Previous      Contents      Index      Next
Sun Java(TM) System Directory Server 5 2004Q2 Administration Reference

Chapter 2
Server Configuration Reference

Directory Server stores configuration information as LDAP entries within the directory itself. Therefore, changes to the server configuration must be implemented using Directory Server rather than by simply editing configuration files. The principal advantage of this method of configuration storage is that it allows a directory administrator to reconfigure the server via LDAP while it is still running, and avoids having to shut it down.

This chapter provides details of how the configuration is organized, how to alter it, and lists configuration attributes for both core server and plug-in configuration. This chapter is divided into the following sections:

Server Configuration Overview
Accessing and Modifying Server Configuration
Core Server Configuration Attributes Reference
Monitoring Attributes
Configuration Quick Reference Tables
Plug-In Overview
Server Plug-In Functionality Reference
Attributes Common to All Plug-Ins
Attributes Allowed by Certain Plug-Ins
Database Plug-In Attributes
Chained Suffix Plug-In Attributes
Frontend Plug-In Attributes
Retro Changelog Plug-In Attributes
Subtree Entry Counter Plug-In Attributes

---

Server Configuration Overview

When you install Directory Server, its default configuration is stored as a series of LDAP entries within the directory, under the subtree cn=config. When the server is started, the contents of the cn=config subtree are read from a file in LDIF format: dse.ldif. This dse.ldif file contains all of the server configuration information. It is worth noting that the latest version of this file is called dse.ldif, the version prior to the last modification is called dse.ldif.bak, and the latest file with which the server successfully started is called dse.ldif.startOK. Many of the features of Directory Server are designed as discrete modules that plug into the core server. The details of the internal configuration for each plug-in are contained in separate entries under cn=plugins,cn=config. For example, the configuration of the Telephone Syntax plug-in is contained in the entry:

cn=Telephone Syntax,cn=plugins,cn=config

Similarly, database-specific configuration is stored under:

cn=ldbm database,cn=plugins,cn=config and cn=chaining
 database,cn=plugins,cn=config

Figure 2-1 shows how the configuration data fits within the cn=config Directory Information Tree.

Figure 2-1  

Configuration Data Under cn=config 

This overview is divided into the following sections:

LDIF Configuration Files - Location
Schema Configuration Files - Location
How the Server Configuration is Organized
Migration of Pre-Directory Server 5.x Configuration Files to LDIF Format

LDIF Configuration Files - Location

Directory Server configuration data is automatically output to files in LDIF format that are located in the following directory by default:

ServerRoot/slapd-serverID/config

In this chapter, all examples use myServer for the server identifier where appropriate.

Schema Configuration Files - Location

Schema configuration is also stored in LDIF format and these files are located in the following directory:

ServerRoot/slapd-serverID/config/schema

For a full list of the LDIF configuration files that are supplied with Directory Server, refer to Table 2-9.

How the Server Configuration is Organized

The dse.ldif file contains all configuration information including directory specific entries created by Directory Server at startup, and directory specific entries related to the database, also created by Directory Server at startup. The file includes the Root DSE (named by "") and the entire contents of cn=config.When the server generates the dse.ldif file, it lists the entries in hierarchical order. It does so in the order that the entries appear in the directory under cn=config.

This section provides an overview of configuration attributes, plug-in functionality configuration, database configuration, and index configuration.

Configuration Attributes

Within a configuration entry, each attribute is represented as an attribute name. The value of the attribute corresponds to the attribute’s configuration.

The following example shows part of the dse.ldif file for a Directory Server and indicates, amongst other things, that schema checking has been turned on. This is represented by the attribute nsslapd-schemacheck, which takes the value on.

Code Example 2-1  Extract of dse.ldif File 

dn: cn=config objectclass: top objectclass: extensibleObject objectclass: nsslapdConfig nsslapd-accesslog-logging-enabled: on nsslapd-enquote-sup-oc: on nsslapd-localhost: myServer.example.com nsslapd-errorlog: ServerRoot/slapd-myServer/logs/errors nsslapd-schemacheck: on nsslapd-port: 389 nsslapd-localuser: nobody ...

Configuration of Plug-in Functionality

The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config. The following example shows the configuration entry for a plug-in, in this case the Telephone Syntax plug-in.

Code Example 2-2  Configuration Entry for Telephone Syntax Plug-in 

dn: cn=Telephone Syntax,cn=plugins,cn=config objectclass: top objectclass: nsSlapdPlugin objectclass: ds-signedPlugin objectclass: extensibleObject cn: Telephone Syntax nsslapd-pluginPath: ServerRoot/lib/syntax-plug-in.so nsslapd-pluginInitfunc: tel_init nsslapd-pluginType: syntax nsslapd-pluginEnabled: on ...

Some of these attributes are common to all plug-ins and some may be particular to a specific plug-in. You can check which attributes are currently being used by a plug-in by performing an ldapsearch on the cn=config subtree.

For a list of plug-ins supported by Sun Java System Directory Server 5.2, general plug-in configuration information, the plug-in configuration attribute reference, and a list of plug-ins requiring the server to be restarted refer to Plug-In Overview and subsequent sections.

Configuration of Databases

The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for the databases containing the o=NetscapeRoot and o=UserRoot suffixes respectively. The cn=NetscapeRoot subtree contains the configuration data used by the Sun Java System Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop). The cn=UserRoot subtree contains all the configuration data for the first user-defined database created during server installation. The cn=UserRoot subtree is called UserRoot by default. However, this is not hard-coded, and, given the fact that there will be multiple database instances, this name will be changed and defined by the user when new databases are added.

Configuration of Indexes

Configuration information for indexing is stored as entries in Directory Server under the three following information tree nodes:

cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config
cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config
cn=default indexes,cn=config,cn=ldbm database,
 cn=plugins,cn=config

For more information regarding indexes in general, refer to the Directory Server Administration Guide. For details regarding the index configuration attributes, refer to Default Index Attributes. The attributes are presented here because this node is the first to appear in the representation of the configuration attributes based on the cn=config information tree.

Migration of Pre-Directory Server 5.x Configuration Files to LDIF Format

Sun Java System Directory Server 5.2 recognizes configuration files that are in LDIF format only, which means that the slapd.conf and slapd.ldbm.conf configuration files from 4.x versions of Directory Server must be converted to LDIF format. Directory Server 4.x configurations can be migrated to the new LDIF format using the migrateInstance5 tool. For information on the attributes that are migrated with this tool, refer to the Directory Server Installation and Migration Guide.

---

Accessing and Modifying Server Configuration

This section discusses access control for configuration entries and describes the various ways in which the server configuration can be viewed and modified. It also covers restrictions on the types of modification that can be made and discusses attributes that require the server to be restarted for changes to take effect. This section has been divided into the following parts:

Access Control for Configuration Entries
Access Control Instruction Format
Changing Configuration Attributes

Access Control for Configuration Entries

When Directory Server is installed, a default set of Access Control Instructions (ACIs) is implemented for all entries under cn=config. Code Example 2-3 shows an example of these default ACIs.

Code Example 2-3  Default ACIs in dse.ldif 

aci: (targetattr = "*")(version 3.0; acl "Configuration Administrators Group";  allow (all)  groupdn = "ldap:///cn=Configuration Administrators,ou=Groups,  ou=TopologyManagement, o=NetscapeRoot";) aci: (targetattr = "*")(version 3.0; acl "Configuration  Administrators";  allow (all) userdn =  "ldap:///uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot";) aci: (targetattr = "*")(version 3.0; acl "Local Directory Administrators Group";  allow (all)  groupdn = "ldap:///ou=Directory Administrators, dc=example,dc=com";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow(all) groupdn =  "ldap:///cn=slapd-myServer, cn=Sun ONE Directory Server, cn=Server Group,  cn=myServer.example.com, dc=example,dc=com, o=NetscapeRoot";)

These default ACIs allow all LDAP operations to be carried out on all configuration attributes by the following users:

Members of the Configuration Administrators Group
The user acting as the Administrator, who has the uid admin that can be configured at installation time
Members of the local Directory Administrators Group
The local Directory Administrator (root DN)
The SIE (Server Instance Entry) Group that is usually assigned using the Set Access Permissions from the main topology view in the main console.

Access Control Instruction Format

An example ACI which allows all users search, read and compare permissions for all attributes would appear as follows:

aci: (targetattr = "*")(version 3.0; acl "my aci"; allow  (search,read,compare) userdn="ldap:///all";)

The permission and bind_rule portions of the ACI are set as a pair, and are also called an Access Control Rule. You can have multiple permission bind_rule pairs for every target. This allows you to efficiently set multiple access controls for any given target. For example:

target (permission bind_rule) (permissions bind_rule)...

For example, you can set a permission that allows anyone binding as Babs Jensen to write to Babs Jensen’s telephone number. The bind rule in this permission is the part that states “if you bind as Babs Jensen.” The target is Babs Jensen’s phone number, and the permission is write access.

Targets

You must decide what entry is targeted by every ACI you create in your directory. If you target a directory entry that is a directory branch point, that branch point, and all of its child entries, are included in the scope of the permission. The advantage of this is that you can place at a high level in the directory tree a general ACI that effectively applies to entries more likely to be located lower in the tree.

For example, at the level of an organizationalUnit entry or a locality entry, you could create an ACI that targets entries that include the inetorgperson object class. You can use this feature to minimize the number of ACIs in the directory tree by placing general rules at high level branch points. To limit the scope of more specific rules, you should place them as close as possible to leaf entries.

If you do not explicitly specify a target entry for the ACI, the ACI is targeted to the directory entry that contains the ACI statement. Also, the default set of attributes targeted by the ACI is any attribute available in the targeted entry’s object class structure.

For every ACI, you can target only one entry or only those entries that match a single LDAP search filter.

Note	ACIs placed in the root DSE entry apply only to that entry.

In addition to targeting entries, you can also target attributes on the entry. This enables you to set a permission that applies to only a subset of attribute values. You can target sets of attributes by explicitly naming the attributes that are targeted, or by explicitly naming the attributes that are not targeted. Use the latter case if you want to set a permission for all but a few attributes allowed by an object class structure. The aci attribute is multi-valued, which means that you can define several ACIs for the same entry or subtree.

Permissions

Permissions can be allowed or denied. In general, you should avoid denying permissions. You can allow or deny the following permissions:

Read

Indicates whether directory data may be read.

Write

Indicates whether directory data may be changed or created. This permission also allows directory data to be deleted, but not the entry itself. To delete an entire entry, the user must have delete permissions.

Search

Indicates whether the directory data can be searched. This differs from the read permission in that read allows directory data to be viewed if it is returned as part of a search operation. For example, if you allow searching for common names and read for a person’s room number, then the room number can be returned as part of the common name search, but the room number cannot, itself, be searched for. This would prevent people from searching your directory to see who occupies a particular room.

Compare

Indicates whether the data may be used in comparison operations. Compare implies the ability to search, but actual directory information is not returned from the search. Instead, a simple Boolean value is returned that indicates whether the compared values match. This is used to match userPassword attribute values during directory authentication.

Selfwrite

Used only for group management. This permission allows users to add or delete themselves from a group. Selfwrite works with proxy authorization: it grants the right to add or remove the proxy DN from a group entry (not the DN of the bound user).

Add

Indicates whether child entries can be created. This permission allows a user to create child entries beneath the targeted entry.

Delete

Indicates whether an entry can be deleted. This permission allows a user to delete the targeted entry.

Proxy

Indicates that the user can use any other DN (except Directory Manager) to access the directory with the rights of this DN.

Bind Rules

The bind rule usually indicates the bind DN subject to the permission. It can also specify bind attributes such as time of day or IP address.

Bind rules enable you to specify that an ACI applies only to a user’s own entry. You can use this to allow users to update their own entries without running the risk of a user updating another user’s entry.

Using bind rules, you can indicate that the ACI is applicable:

Only if the bind operation is arriving from a specific IP address or DNS hostname. This is often used to force all directory updates to occur from a given machine or network domain.
If the person binds anonymously. Setting a permission for anonymous bind means that the permission also applies to anyone who binds to the directory.
For anyone who successfully binds to the directory. This allows general access while preventing anonymous access.
Only if the client has bound as the immediate parent of the entry.
Only if the entry that the person has bound as meets specific LDAP search criteria.

The following keywords are provided to help you express these kinds of access more easily:

Parent

If the bind DN is the immediate parent entry, then the bind rule is true. This allows you to grant specific permissions that, for example, allow a directory branch point to manage its immediate child entries.

Self

If the bind DN is the same as the entry requesting access, then the bind rule is true. For example, you can grant specific permission that allows individuals to update their own entries.

All

The bind rule is true for anyone who has successfully bound to the directory.

Anyone

The bind rule is true for everyone. This keyword is what allows or denies anonymous access.

For more information, refer to Chapter 6, “Managing Access Control” in the Directory Server Administration Guide.

Changing Configuration Attributes

You can view and change server attribute values in one of three ways: by using LDAP through Sun Java System Server Console, by performing ldapsearch and ldapmodify commands, or by manually editing the dse.ldif file.

Note	If you edit the dse.ldif file, you must stop the server beforehand, otherwise your changes will be lost. Editing the dse.ldif file is recommended only for changes to attributes which cannot be altered dynamically. For further information, refer to Configuration Changes Requiring Server Restart.

The following sections describe how to modify entries using LDAP (both via the Sun Java System Server Console and over the command line), the restrictions to modifying entries, the restrictions to modifying attributes, and the configuration changes requiring restart.

Modifying Configuration Entries Using LDAP

The configuration entries in the directory can be searched and modified using LDAP, either via the Sun Java System Server Console or by performing ldapsearch and ldapmodify operations in the same way as other directory entries. The advantage of using LDAP to modify entries is that you can make the changes while the server is running. You must remember to specify the port number when modifying configuration entries as the server is not necessarily running on port 389. For further information refer to Chapter 2, “Creating Directory Entries” in the Directory Server Administration Guide. However, certain changes do require the server to be restarted before they are taken into account. For further information, refer to Configuration Changes Requiring Server Restart.

Note	As with any set of configuration files, care should be taken when changing or deleting nodes in the cn=config subtree, as this risks affecting Directory Server functionality.

The entire configuration, including attributes that always take default values, can be viewed by performing an ldapsearch operation on the cn=config subtree:

ldapsearch -D bindDN -w password -p port -b cn=config objectclass=*

where bindDN is the DN chosen for the Directory Manager when the server was installed and password is the password chosen for Directory Manager. For more information on using ldapsearch refer to the Directory Server Resource Kit Tools Reference.

Previously we saw an example of the configuration entry for the Telephone Syntax plug-in where the plug-in was enabled. If you want to disable this feature you can use the following series of commands to implement this change.

Code Example 2-4  Disabling the Telephone Syntax Plug-in

ldapmodify -D bindDN -w password -p port dn: cn=Telephone Syntax,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off

Restrictions to Modifying Configuration Entries

Certain restrictions apply when modifying server entries:

The dse.ldif cn=monitor entry and its child entries are read-only and cannot be modified.

Restrictions to Modifying Configuration Attributes

Certain restrictions apply when modifying server attributes:

If an attribute is added to cn=config, the server will ignore it.
If an invalid value is entered for an attribute, the server will ignore it.
Since ldapdelete is used for deleting entire entries, you should use ldapmodify if you want to remove an attribute from an entry.

Configuration Changes Requiring Server Restart

Some configuration attributes cannot be altered dynamically while the server is running. In these cases the server needs to be shut down and restarted for the changes to take effect. The modifications should be made either through the Directory Server console or by manually editing the dse.ldif file. Table 2-10 under Configuration Quick Reference Tables contains a list of these attributes.

---

Core Server Configuration Attributes Reference

This section guides you through all the core server functionality configuration attributes. For server functionality implemented via plug-ins, refer to Plug-In Overview and subsequent sections. For implementing your own server functionality, contact Sun Professional Services.

For information on where to find the server configuration and how to change it, refer to Server Configuration Overview and Accessing and Modifying Server Configuration.

The configuration information that is stored in the dse.ldif file is organized as an information tree under the general configuration entry cn=config. This information tree is illustrated in Figure 2-1.

This section describes the configuration tree nodes within this information tree, and is divided into the following subsections:

cn=config
cn=changelog5
cn=encryption
cn=features
cn=mapping tree
cn=Password Policy
cn=replica
cn=ReplicationAgreementName
cn=replication
cn=SNMP
cn=tasks
cn=uniqueid generator

The cn=plugins node is covered in Plug-In Overview and subsequent sections. Attributes are arranged alphabetically and a full description is provided for each, giving the DN of its directory entry, its default value, the valid range of values, and an example of its use.

Caution	Some of the entries and attributes described in this chapter may change in future releases of the product.

cn=config

General configuration entries are stored under the cn=config entry. The cn=config entry is an instance of the nsslapdConfig object class, which in turn inherits from the extensibleObject object class. For attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry. General configuration entries are presented in this section.

nsslapd-accesscontrol (Enable Access Control)

Turns access control on and off. If this attribute has a value off, any valid bind attempt (including an anonymous bind) results in full access to all information stored in Directory Server.

Note	Do not set this attribute to off unless told to do so by technical support personnel.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-accesscontrol: on

nsslapd-accesslog (Access Log)

Specifies the path and filename of the log used to record each database access. The following information is recorded in the log file by default:

IP address of the client machine that accessed the database
operations performed (for example, search, add, modify)
result of the access (for example, the number of entries returned)

For more information on turning access logging off, refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

For access logging to be enabled, this attribute must have a valid path and file name and the nsslapd-accesslog-logging-enabled configuration attribute must be switched to on. Table 2-1 lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Table 2-1  Possible Value Combinations of Access Log Attributes

Attribute Pair	Value Pair	Logging Status
nsslapd-accesslog-logging-enabled nsslapd-accesslog	on empty string	Disabled
nsslapd-accesslog-logging-enabled nsslapd-accesslog	on filename	Enabled
nsslapd-accesslog-logging-enabled nsslapd-accesslog	off empty string	Disabled
nsslapd-accesslog-logging-enabled nsslapd-accesslog	off filename	Disabled

Property	Value
Entry DN	cn=config
Valid Range	Any valid filename.
Default Value	ServerRoot/slapd-serverID/logs/access
Syntax	DirectoryString
Example	nsslapd-accesslog: /usr/ds5/slapd-myserv/logs/access

nsslapd-accesslog-level

Controls what is logged to the access log.

Property	Value
Entry DN	cn=config
Valid Range	0—No access logging 4—Logging for internal access operations 256—Logging for access to an entry 512—Logging for access to an entry and referrals 131072—Precise timing of operation duration. This gives microsecond resolution for the Elapsed Time item in the access log. These values can be added together to provide you with the exact type of logging you require, for example, 516 (4 + 512) to obtain internal access operation, entry access, and referral logging.
Default Value	256
Syntax	Integer
Example	nsslapd-accesslog-level: 256

nsslapd-accesslog-list

This read-only attribute cannot be set. It provides a list of access log files used in access log rotation.

Property	Value
Entry DN	cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString
Example	nsslapd-accesslog-list:accesslog2,accesslog3

nsslapd-accesslog-logbuffering (Log Buffering)

When set to off, the server writes all access log entries directly to disk.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-accesslog-logbuffering: off

nsslapd-accesslog-logexpirationtime (Access Log Expiration Time)

Specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	1
Syntax	Integer
Example	nsslapd-accesslog-logexpirationtime: 2

nsslapd-accesslog-logexpirationtimeunit (Access Log Expiration Time Unit)

Specifies the unit for the nsslapd-accesslog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString
Example	nsslapd-accesslog-logexpirationtimeunit: week

nsslapd-accesslog-logging-enabled (Access Log Enable Logging)

Disables and enables access log logging, but only in conjunction with the nsslapd-accesslog attribute that specifies the path and filename of the log used to record each database access.

For access logging to be enabled, this attribute must be switched to on and the nsslapd-accesslog configuration attribute must have a valid path and filename. Table 2-1 lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of access logging.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-accesslog-logging-enabled: off

nsslapd-accesslog-logmaxdiskspace (Access Log Maximum Disk Space)

Specifies the maximum amount of disk space in megabytes that the access logs are allowed to consume. If this value is exceeded, the oldest access log is deleted.

When setting the maximum disk space, consider the total number of log files that can be created due to log file rotation. Also, remember that there are 3 different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647)
Default Value	500 (A value of -1 means that the disk space allowed to the access log is unlimited in size).
Syntax	Integer
Example	nsslapd-accesslog-logmaxdiskspace: 200

nsslapd-accesslog-logminfreediskspace (Access Log Minimum Free Disk Space)

Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified by this attribute, the oldest access log is deleted until enough disk space is freed to satisfy this attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	5
Syntax	Integer
Example	nsslapd-accesslog-logminfreediskspace: 4

nsslapd-accesslog-logrotationtime (Access Log Rotation Time)

Specifies the time between access log file rotations. The access log will be rotated when this time interval is up, regardless of the current size of the access log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-accesslog-logrotationtimeunit attribute.

For performance reasons, it is not recommended that you specify no log rotation as the log will grow indefinitely. However, there are two ways to specify no log rotation. Either set the nsslapd-accesslog-maxlogsperdir attribute value to 1 or the nsslapd-accesslog-logrotationtime attribute to -1. The server checks the nsslapd-accesslog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-accesslog-logrotationtime attribute. Refer to nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files) for more information.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the time between access log file rotation is unlimited.
Default Value	1
Syntax	Integer
Example	nsslapd-accesslog-logrotationtime: 100

nsslapd-accesslog-logrotationtimeunit (Access Log Rotation Time Unit)

Specifies the units for the nsslapd-accesslog-logrotationtime attribute.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day | hour | minute
Default Value	day
Syntax	DirectoryString
Example	nsslapd-accesslog-logrotationtimeunit: week

nsslapd-accesslog-maxlogsize (Access Log Maximum Log Size)

Specifies the maximum access log size in megabytes. When this value is reached, the access log is rotated. That is, the server starts writing log information to a new log file. If you set the nsslapd-accesslog-maxlogsperdir attribute to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are 3 different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the access log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer
Example	nsslapd-accesslog-maxlogsize: 100

nsslapd-accesslog-maxlogsperdir (Access Log Maximum Number of Log Files)

Specifies the total number of access logs that can be contained in the directory where the access log is stored. If you are using log file rotation, each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. For performance reasons, it is not recommended that you set this value to 1, as the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, then you need to check the nsslapd-accesslog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-accesslog-logrotationtime attribute has a value of -1, there is no log rotation. For more information, refer to nsslapd-accesslog-logrotationtime (Access Log Rotation Time).

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	10
Syntax	Integer
Example	nsslapd-accesslog-maxlogsperdir: 10

nsslapd-attribute-name-exceptions

Allows non-standard characters in attribute names to be used for backward compatibility with older servers.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-attribute-name-exceptions: on

nsslapd-auditlog (Audit Log)

Specifies the path name and filename of the log used to record changes made to each database.

Property	Value
Entry DN	cn=config
Valid Range	Any valid filename
Default Value	ServerRoot/slapd-serverID/logs/audit
Syntax	DirectoryString
Example	nsslapd-auditlog: /ServerRoot/slapd-serverID/logs/audit

For audit logging to be enabled, this attribute must have a valid path and file name and the nsslapd-auditlog-logging-enabled configuration attribute must be switched to on. Table 2-2 lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

Table 2-2  Possible Value Combinations of Audit Log Attributes

Attribute Pair	Value Pair	Logging Status
nsslapd-auditlog-logging-enabled nsslapd-auditlog	on empty string	Disabled
nsslapd-auditlog-logging-enabled nsslapd-auditlog	on filename	Enabled
nsslapd-auditlog-logging-enabled nsslapd-auditlog	off empty string	Disabled
nsslapd-auditlog-logging-enabled nsslapd-auditlog	off filename	Disabled

nsslapd-auditlog-list

Provides a list of audit log files.

Property	Value
Entry DN	cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString
Example	nsslapd-auditlog-list: auditlog2,auditlog3

nsslapd-auditlog-logexpirationtime (Audit Log Expiration Time)

Specifies the maximum age that a log file can be before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logexpirationtimeunit attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	1
Syntax	Integer
Example	nsslapd-auditlog-logexpirationtime: 1

nsslapd-auditlog-logexpirationtimeunit (Audit Log Expiration Time Unit)

Specifies the units for the nsslapd-auditlog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString
Example	nsslapd-auditlog-logexpirationtimeunit: day

nsslapd-auditlog-logging-enabled (Audit Log Enable Logging)

Turns audit logging on and off.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-auditlog-logging-enabled: off

For audit logging to be enabled this attribute must be switched to on and the nsslapd-auditlog configuration attribute must have a valid path and file name. Table 2-2 lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of audit logging.

nsslapd-auditlog-logmaxdiskspace (Audit Log Maximum Disk Space)

Specifies the maximum amount of disk space in megabytes that the audit logs are allowed to consume. If this value is exceeded, the oldest audit log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations with the total amount of disk space that you want to be used by the audit log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the disk space allowed for the audit log is unlimited in size.
Default Value	100
Syntax	Integer
Example	nsslapd-auditlog-logmaxdiskspace: 500

nsslapd-auditlog-logminfreediskspace (Audit Log Minimum Free Disk Space)

Specifies the minimum permissible free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest audit log is deleted until enough disk space is freed to satisfy this attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	5
Syntax	Integer
Example	nsslapd-auditlog-logminfreediskspace: 3

nsslapd-auditlog-logrotationtime (Audit Log Rotation Time)

Specifies the time between audit log file rotations. The audit log is rotated when this time interval is up, regardless of the current size of the audit log, but only if an update operation, such as an add, delete, modify or modify RDN, has caused Directory Server to write information to the audit file. If nothing has been written to the audit log, the log is not rotated.

This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-auditlog-logrotationtimeunit attribute. If you set the nsslapd-auditlog-maxlogsperdir attribute to 1, the server ignores this attribute.

For performance reasons, it is not recommended that you specify no log rotation, as the log will grow indefinitely. However, there are two ways to specify no log rotation. Either set the nsslapd-auditlog-maxlogsperdir attribute value to 1 or the nsslapd-auditlog-logrotationtime attribute to -1. The server checks the nsslapd-auditlog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server checks the nsslapd-auditlog-logrotationtime attribute. Refer to nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files) for more information.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the time between audit log file rotations is unlimited.
Default Value	1
Syntax	Integer
Example	nsslapd-auditlog-logrotationtime: 100

nsslapd-auditlog-logrotationtimeunit (Audit Log Rotation Time Unit)

Specifies the units for the nsslapd-auditlog-logrotationtime attribute.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day | hour | minute
Default Value	week
Syntax	DirectoryString
Example	nsslapd-auditlog-logrotationtimeunit: day

nsslapd-auditlog-maxlogsize (Audit Log Maximum Log Size)

Specifies the maximum audit log size in megabytes. When this value is reached, the audit log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-auditlog-maxlogsperdir to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also remember that there are 3 different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the audit log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647) where a value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer
Example	nsslapd-auditlog-maxlogsize: 50

nsslapd-auditlog-maxlogsperdir (Audit Log Maximum Number of Log Files)

Specifies the total number of audit logs that can be contained in the directory where the audit log is stored. If you are using log file rotation, then each time the audit log is rotated, a new log file is created. When the number of files contained in the audit log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. The default is 1 log. If you accept this default, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, you need to check the nsslapd-auditlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-auditlog-logrotationtime attribute has a value of -1, then there is no log rotation. Refer to nsslapd-auditlog-logrotationtime (Audit Log Rotation Time) for more information.

Property	Value
Entry DN	cn=config
Valid range	1 to the maximum 32 bit integer value (2147483647)
Default value	1
Syntax	Integer
Example	nsslapd-auditlog-maxlogsperdir: 10

nsslapd-certmap-basedn (Certificate Map Search Base)

This attribute can be used when client authentication is performed using SSL certificates in order to avoid limitation of the security subsystem certificate mapping, configured in certmap.conf. Depending on the certmap.conf configuration, the certificate mapping may be done using a directory subtree search based at the root DN. Note that if the search is based at the root DN, then the nsslapd-certmap-basedn attribute may force the search to be based at some entry other than the root. For further information, refer to Chapter 11, “Implementing Security” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=config
Valid Range	The DN of an entry in the directory
Default Value	N/A
Syntax	DN
Example	nsslapd-certmap-basedn: ou=people,dc=example,dc=com

nsslapd-config

This read-only attribute is the config DN.

Property	Value
Entry DN	cn=config
Valid Range	Any valid config DN.
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-config:cn=config

nsslapd-ds4-compatible-schema

Makes the schema in cn=schema compatible with 4.x versions of Directory Server.

Note	When this attribute is set to on, Directory Server can read schema from 4.x configuration files, which use syntax for attribute types and object classes that differs from the standard syntax defined by RFC 2252 and used in Directory Server 5. As a result, when this attribute is set to on, schema cannot be modified through the console, but must instead be modified manually.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-ds4-compatible-schema: off

nsslapd-enquote-sup-oc (Enable Superior Object Class Enquoting)

Controls whether the quoting in the objectclasses attributes contained in the cn=schema entry conforms to the quoting specified by internet draft RFC 2252. By default, Directory Server does not place single quotes around the superior object class identified on the objectclasses attributes contained in cn=schema. RFC 2252 indicates that this value should not be quoted.

That is, Directory Server publishes objectclasses attributes in the cn=schema entry as follows:

objectclasses: ( 2.5.6.6 NAME ’person’ DESC ’Standard ObjectClass’ SUP ’top’ MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

However, RFC 2252 indicates that this attribute should be published as follows:

objectclasses: ( 2.5.6.6 NAME ’person’ DESC ’Standard ObjectClass’ SUP top MUST ( objectclass $ sn $ cn ) MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

Notice the absence of single quotes around the word top.

Turning this attribute on means that the Directory Server Resource Kit LDAP Clients will no longer function, as they require the schema as defined in RFC 2252.

Turning this attribute off causes Directory Server to conform to RFC 2252, but doing so may interfere with some earlier LDAP clients. Specifically, any client written using the Sun Java System Directory SDK for Java 4.x will no longer be able to correctly read and modify schema. This includes the 4.x version of the Sun Java System Server Console. Note that turning this attribute on or off does not affect the 5.x Sun Java System Server Console.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-enquote-sup-oc: off

nsslapd-errorlog (Error Log)

Specifies the path name and filename of the log used to record error messages generated by Directory Server. These messages can describe error conditions, but more often they contain informative conditions such as:

Server startup and shutdown times
Port number the server uses

This log contains varying amounts of information depending on the current setting of the Log Level attribute. Refer to nsslapd-errorlog-level (Error Log Level) for more information.

Property	Value
Entry DN	cn=config
Valid Range	Any valid filename
Default Value	ServerRoot/slapd-serverID/logs/error
Syntax	DirectoryString
Example	nsslapd-errorlog: /ServerRoot/slapd-serverID/logs/error

For error logging to be enabled, this attribute must have a valid path and file name and the nsslapd-errorlog-logging-enabled configuration attribute must be switched to on. Table 2-3 lists the four possible combinations of values for these two configuration attributes and their outcome in terms of disabling or enabling of error logging.

Table 2-3  Possible Value Combinations of Error Log Attributes

Attribute Pair	Value Pair	Logging Status
nsslapd-errorlog-logging-enabled nsslapd-errorlog	on empty string	Disabled
nsslapd-errorlog-logging-enabled nsslapd-errorlog	on filename	Enabled
nsslapd-errorlog-logging-enabled nsslapd-errorlog	off empty string	Disabled
nsslapd-errorlog-logging-enabled nsslapd-errorlog	off filename	Disabled

nsslapd-errorlog-level (Error Log Level)

Specifies the level of logging to be used by Directory Server.

Note	This attribute has been deprecated in Directory Server 5.2. It is still supported for backward compatibility but has been replaced by the nsslapd-infolog-area (Information Log Area) and nsslapd-infolog-level (Information Log Level) attributes.

nsslapd-errorlog-list (Error Log List)

This read-only attribute provides a list of error log files.

Property	Value
Entry DN	cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString
Example	nsslapd-errorlog-list:errorlog2,errorlog3

nsslapd-errorlog-logexpirationtime (Error Log Expiration Time)

Specifies the maximum age that a log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logexpirationtimeunit attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	1
Syntax	Integer
Example	nsslapd-errorlog-logexpirationtime: 1

nsslapd-errorlog-logexpirationtimeunit (Error Log Expiration Time Unit)

Specifies the units for the nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString
Example	nsslapd-errorlog-logexpirationtimeunit: week

nsslapd-errorlog-logging-enabled (Enable Error Logging)

Turns error logging on and off.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-errorlog-logging-enabled: on

nsslapd-errorlog-logmaxdiskspace (Error Log Maximum Disk Space)

Specifies the maximum amount of disk space in megabytes that the error logs are allowed to consume. If this value is exceeded, the oldest error log is deleted.

When setting a maximum disk space, consider the total number of log files that can be created due to log file rotation. Also, remember that there are 3 different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the disk space allowed to the error log is unlimited in size.
Default Value	100
Syntax	Integer
Example	nsslapd-errorlog-logmaxdiskspace: 500

nsslapd-errorlog-logminfreediskspace (Error Log Minimum Free Disk Space)

Specifies the minimum allowed free disk space in megabytes. When the amount of free disk space falls below the value specified on this attribute, the oldest error log is deleted until enough disk space is freed to satisfy this attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	5
Syntax	Integer
Example	nsslapd-errorlog-logminfreediskspace: 5

nsslapd-errorlog-logrotationtime (Error Log Rotation Time)

Specifies the time between error log file rotations. The error log will be rotated when this time interval is up, regardless of the current size of the error log. This attribute supplies only the number of units. The units (day, week, month, and so forth) are given by the nsslapd-errorlog-logrotationtimeunit attribute.

For performance reasons, it is not recommended that you specify no log rotation as the log will grow indefinitely. However, there are two ways to specify no log rotation. Either set the nsslapd-errorlog-maxlogsperdir attribute value to 1 or the nsslapd-errorlog-logrotationtime attribute to -1. The server checks the nsslapd-errorlog-maxlogsperdir attribute first and if this attribute value is larger than 1, the server then checks the nsslapd-errorlog-logrotationtime attribute. Refer to nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log Files) for more information.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means that the time between error log file rotation is unlimited).
Default Value	1
Syntax	Integer
Example	nsslapd-errorlog-logrotationtime: 100

nsslapd-errorlog-logrotationtimeunit (Error Log Rotation Time Unit)

Specifies the units for nsslapd-errorlog-logrotationtime (Error Log Rotation Time). If the unit is unknown by the server, the log will never expire.

Property	Value
Entry DN	cn=config
Valid Range	month | week | day | hour | minute
Default Value	week
Syntax	DirectoryString
Example	nsslapd-errorlog-logrotationtimeunit: day

nsslapd-errorlog-maxlogsize (Maximum Error Log Size)

Specifies the maximum error log size in megabytes. When this value is reached, the error log is rotated. That is, the server starts writing log information to a new log file. If you set nsslapd-errorlog-maxlogsperdir to 1, the server ignores this attribute.

When setting a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are 3 different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the error log.

Property	Value
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32 bit integer value (2147483647), where a value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer
Example	nsslapd-errorlog-maxlogsize: 100

nsslapd-errorlog-maxlogsperdir (Maximum Number of Error Log Files)

Specifies the total number of error logs that can be contained in the directory where the error log is stored. If you are using log file rotation, then each time the error log is rotated, a new log file is created. When the number of files contained in the error log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. If this attribute is set to 1, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, then you need to check the nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified. If the nsslapd-errorlog-logrotationtime attribute has a value of -1 then there is no log rotation. Refer to nsslapd-errorlog-logrotationtime (Error Log Rotation Time) for more information.

Property	Value
Entry DN	cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647)
Default Value	2
Syntax	Integer
Example	nsslapd-errorlog-maxlogsperdir: 10

nsslapd-groupevalnestlevel

Specifies the number of levels of nesting that the access control system will perform for group evaluation.

Property	Value
Entry DN	cn=config
Valid Range	0 to the maximum 64-bit integer value
Default Value	0
Syntax	Integer
Example	nsslapd-groupevalnestlevel:5

nsslapd-idletimeout (Idle Timeout)

Specifies the amount of time in seconds after which an idle LDAP client connection is closed by the server. A value of 0 indicates that the server will never close idle connections.

Property	Value
Entry DN	cn=config
Valid Range	0 to the maximum 32 bit integer value (2147483647)
Default Value	0
Syntax	Integer
Example	nsslapd-IdleTimeout: 0

nsslapd-infolog-area (Information Log Area)

Specifies the component for which logging information should be provided. Each component is identified as an area, whose value is a decimal translation of the hex values in slapi-plugin.h.

The log area is additive; for example, to enable logging on Search filter processing (32) and Config file processing (64), you would set this attribute to 96 (32+64).

If you are writing plug-ins for Directory Server, refer to the Directory Server Plug-In Developer’s Guide for more information on using this attribute.

Property	Value
Entry DN	cn=config
Valid Range	1 = Trace function calls. Logs a message when the server enters and exits a function. 2 = Debug packet handling 4 = Heavy trace output debugging 8 = Connection management 16 = Print out packets sent/received 32 = Search filter processing 64 = Config file processing 128 = Access control list processing 2048 = Log entry parsing debugging 4096 = Housekeeping thread debugging 8192 = Replication debugging 16384 = Default logging area, used for critical errors and other messages that are always written to the error log, for example server startup messages. Messages at this level are always included in the error log regardless of the nsslapd-infolog-level setting. 32768 = Database cache debugging. 65536 = Server plug-in debugging. An entry is written to the log file when a server plug-in calls slapi_log_info_ex().
Default Value	0
Syntax	Integer
Example	nsslapd-infolog-area: 0

nsslapd-infolog-level (Information Log Level)

Specifies the level of logging information that should be returned for the server component defined by the nsslapd-infolog-area attribute. A value of 0 means that only default logging information is returned for the selected area. Setting this attribute to 1 enables additional logging information to be returned for the selected area.

Property	Value
Entry DN	cn=config
Valid Range	0 | 1
Default Value	0
Syntax	Integer
Example	nsslapd-infolog-level: 0

nsslapd-instancedir (Instance Directory)

Specifies the full path to the directory where this server instance is installed. The hostname is the default serverID given at installation time. Do not change this value after installation.

Property	Value
Entry DN	cn=config
Valid Range	Any valid file path.
Default Value	ServerRoot/slapd-serverID
Syntax	DirectoryString
Example	nsslapd-instancedir: /usr/ds5/slapd-myServer

nsslapd-ioblocktimeout (IO Block Time Out)

Specifies the amount of time in milliseconds after which the connection to a stalled LDAP client is closed. An LDAP client is considered to be stalled when it has not made any I/O progress for read or write operations.

Property	Value
Entry DN	cn=config
Valid Range	0 to the maximum 32 bit integer value (2147483647)
Default Value	1800000
Syntax	Integer
Example	nsslapd-ioblocktimeout: 1800000

nsslapd-lastmod (Track Modification Time)

Specifies whether Directory Server maintains the modification attributes for Directory Server entries. These attributes include:

modifiersname—The distinguished name of the person who last modified the entry.
modifytimestamp—The timestamp, in GMT format, for when the entry was last modified.
creatorsname—The distinguished name of the person who initially created the entry.
createtimestamp—The timestamp for when the entry was created in GMT format.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-lastmod: off

nsslapd-listenhost (Listen to IP Address)

Allows multiple Directory Server instances to run on a multihomed machine, and makes it possible to limit listening to one or more interfaces of a multihomed machine. Provide the hostname or hostnames corresponding to the IP interface(s) you want to specify as values for this attribute. Directory Server responds only to requests sent to the interface(s) corresponding to the hostname(s) specified. This prevents other programs from using the same port as Directory Server on the specified interfaces.

Property	Value
Entry DN	cn=config
Valid Range	Any hostname or hostnames
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-listenhost: host_name

nsslapd-localhost (Local Host)

This read-only attribute specifies the host machine on which Directory Server runs.

Property	Value
Entry DN	cn=config
Valid Range	Any fully qualified hostname.
Default Value	Hostname of installed machine.
Syntax	DirectoryString
Example	nsslapd-localhost:myServer.example.com

nsslapd-localuser (Local User)

Specifies the user under which Directory Server runs. The group under which the user runs is derived from this attribute, by examining the groups that the user is a member of. Should the user change, all the files in the installation directory must be owned by this user.

Property	Value
Entry DN	cn=config
Valid Range	Any valid user on the local system.
Default Value	To run as the same user who started Directory Server.
Syntax	DirectoryString
Example	nsslapd-localuser: nobody

nsslapd-maxbersize (Maximum Message Size)

Defines the maximum size in bytes allowed for an incoming message. This limits the size of LDAP requests that can be handled by Directory Server. Limiting the size of requests prevents some kinds of denial of service attacks.

The limit applies to the total size of the LDAP request. For example, if the request is to add an entry, and the entry in the request is larger than two megabytes, then the add request is denied. Care should be taken when changing this attribute and we recommend contacting Sun Professional Services before doing so.

Property	Value
Entry DN	cn=config
Valid Range	0 - 2GB (2,147,483,647 bytes) where a value of 0 indicates that the default value should be used.
Default Value	2097152
Syntax	Integer
Example	nsslapd-maxbersize: 2097152

nsslapd-maxconnections (Maximum Number of Connections)

This attribute limits the number of simultaneous connections the server can manage. The value of this attribute is not set by default. If it is not set manually, its implicit value is the maximum number of file descriptors a process can open on the system.

You can use this attribute to limit the amount of memory used by Directory Server. Directory Server allocates n*512 bytes of data, where n is equal to the value of nsslapd-maxconnections, if set, or to the maximum number of file descriptors a process can open on the system.

For example, on Solaris 9 systems, the maximum number of file descriptors is 64000. If nsslapd-maxconnections is not set, Directory Server allocates 35 MB of data, which may cause problems for some deployments. Setting nsslapd-maxconnections to a suitable value can help to alleviate this problem.

Property	Value
Entry DN	cn=config
Valid Range	nsslapd-reservedescriptors +1 to maxdescriptors. If the maxdescriptors attribute is not set, the maximum value of nsslapd-maxconnections is the maximum number of file descriptors a process can open on the system.
Default Value	N/A
Syntax	Integer
Example	nsslapd-maxconnections: 4096

nsslapd-maxdescriptors (Maximum File Descriptors)

This attribute sets the maximum, platform-dependent number of file descriptors that Directory Server will try to use. A file descriptor is used whenever a client connects to the server. It is also used for some server activities such as index maintenance. The number of available file descriptors for TCP/IP connections is the total for the nsslapd-maxdescriptors attribute minus the number of file descriptors used by the server for non-client connections, such as index management and managing replication, as specified in the nsslapd-reservedescriptors attribute. For details, refer to nsslapd-reservedescriptors (Reserved File Descriptors).

The number that you specify here should not be greater than the total number of file descriptors that your operating system allows the ns-slapd process to use. This number will differ depending on your operating system. Some operating systems allow you to configure the number of file descriptors available to a process. Refer to your operating system documentation for details on file descriptor limits and configuration. It is worth noting that the included idsktune program can be used to suggest changes to the system kernel or TCP/IP tuning attributes, including increasing the number of file descriptors if necessary. You should consider increasing the value on this attribute if Directory Server is refusing connections because it is out of file descriptors. When this occurs, the following message is written to the Directory Server errors log file:

Not listening for new connections -- too many fds open

Note	UNIX shells usually have configurable limits on the number of file descriptors. Refer to your operating system documentation for further information regarding limit and ulimit as these limits can often cause problems.

Property	Value
Entry DN	cn=config
Valid Range	1 to 65535
Default Value	Maximum number of file descriptors allowed for a process
Syntax	Integer
Example	nsslapd-maxdescriptors: 8192

nsslapd-maxpsearch (Maximum Persistent Searches)

Defines the maximum number of persistent searches that can be performed on Directory Server. The persistent search mechanism provides an active channel through which entries that change (and information about the changes that occur) can be communicated. Because each persistent search operation uses one thread, limiting the number of simultaneous persistent searches prevents certain kinds of denial of service attacks.

Property	Value
Entry DN	cn=config
Valid Range	1 to maximum thread number
Default Value	30
Syntax	Integer
Example	nsslapd-maxpsearch: 30

nsslapd-maxthreadsperconn (Maximum Threads Per Connection)

Defines the maximum number of threads that a connection should use. For normal operations where a client binds and performs only one or two operations before unbinding, you should use the default value. For situations where a client binds and simultaneously issues many requests, you should increase this value to allow each connection enough resources to perform all the operations.

Property	Value
Entry DN	cn=config
Valid Range	1 to maximum threadnumber
Default Value	5
Syntax	Integer
Example	nsslapd-maxthreadsperconn: 5

nsslapd-nagle

When the value of this attribute is off, the TCP_NODELAY option is set so that LDAP responses (such as entries or result messages) are sent back to a client immediately. When the attribute is turned on, default TCP behavior applies. That is, the sending of data is delayed, in the hope that this will enable additional data to be grouped into one packet of the underlying network MTU size (typically 1500 bytes for Ethernet).

Property	Value
Entry DN	cn=config
Valid range	on | off
Default value	off
Syntax	DirectoryString
Example	nsslapd-nagle: off

nsslapd-plugin

This multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server.

nsslapd-port (Port Number)

TCP/IP port number used for LDAP communications. If you want to run SSL/TLS over this port, you can do so through the Start TLS extended operation. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user.

Note	Be aware when changing this port number of other applications whose configurations you may have to modify to reflect the change. When changing the port number through the command line, you must also update nsServerPort on cn=slapd-serverID, cn=Sun Java(TM) System Directory Server, cn=Server Group, cn=hostname, ou=domainname, o=NetscapeRoot in the configuration directory. In addition, when you change the port number of a configuration directory server you must close the console, stop all Administration Servers using the configuration directory, and modify the LDAP URL for the configuration directory in each Administration Server’s ServerRoot/shared/config/dbswitch.conf before restarting the Administration Server.

You must restart the server for the port number change to be taken into account.

Property	Value
Entry DN	cn=config
Valid Range	1 to 65535
Default Value	389
Syntax	Integer
Example	nsslapd-port: 389

nsslapd-privatenamespaces

Contains the list of the private naming contexts cn=config, cn=schema,and cn=monitor.

Property	Value
Entry DN	cn=config
Valid Range	cn=config, cn=schema ,and cn=monitor
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-privatenamespaces: cn=config

nsslapd-readonly (Read Only)

Specifies whether the whole server is in read-only mode, meaning that neither data in the database(s) nor configuration information can be modified. Any attempt to modify a database in read-only mode returns an error indicating that the server is unwilling to perform the operation.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-readonly: off

nsslapd-referral (Referral)

This multi-valued attribute specifies the LDAP URL(s) to be returned by the suffix, when the server receives a request for an entry not belonging to the local tree, that is, an entry whose suffix does not match the value specified on any of the suffix attributes. For example, suppose the database contains only the entries:

ou=People, dc=example,dc=com

but the request is for:

ou=Groups, dc=example,dc=com

In this case, the referral is returned so the client may contact the corresponding directory for the requested entry. Although only one referral is allowed per Directory Server instance, this referral can have multiple values.

Note	If you want to use SSL and TLS communications, the Referral attribute should be in the following form: ldaps://serverHost Start TLS does not support referrals.

For more information on managing referrals, refer to “Setting Referrals” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=config
Valid Range	Valid LDAP URL in the following format: ldap://serverHost
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-referral: ldap://alternate.example.com

nsslapd-referralmode (Referral Mode)

When set, this attribute will send back the referral for any request on any suffix.

Property	Value
Entry DN	cn=config
Valid Range	Valid LDAP URL in the following format: ldap://serverHost
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-referralmode: ldap://backup.example.com

nsslapd-reservedescriptors (Reserved File Descriptors)

This read-only attribute specifies the number of file descriptors that Directory Server reserves for managing non-client connections, such as index management and managing replication. The number of file descriptors that the server reserves for this purpose subtracts from the total number of file descriptors available for servicing LDAP client connections. For details, refer to nsslapd-maxdescriptors (Maximum File Descriptors).

Most installations of Directory Server should never need to change this attribute. However, consider increasing the value on this attribute if all of the following are true:

The server is replicating to a large number of consumer servers (more than 10) and/or the server is maintaining a large number of index files (more than 30).
The server is servicing a large number of LDAP connections.
You get error messages reporting that the server is unable to open file descriptors (the actual error message will differ depending on the operation that the server is attempting to perform), but these error messages are NOT related to managing client LDAP connections.

Increasing the value on this attribute may result in more LDAP clients being unable to access your directory. Therefore, when you increase the value on this attribute, increase the value on the nsslapd-maxdescriptors attribute also. Note that you may not be able to increase the nsslapd-maxdescriptors value if your server is already using the maximum number of file descriptors that your operating system allows a process to use. Refer to your operating system documentation for details. If this is the case, then reduce the load on your server by causing LDAP clients to search alternative directory replicas.

To assist you in computing the number of file descriptors you set for this attribute, we suggest you use the following formula:

nsslapd-reservedescriptor =
  20 + (NumBackends * 4) + NumGlobalIndexes + ReplicationDescriptors +
  ChainingBackendDescriptors + PTADescriptors + SSLDescriptors

where the terms are given in the following table:

Table 2-4  Terms for Computing the Value of nsslapd-reservedescriptor 

Term	Definition
NumldbmBackends	Number of ldbm databases.
NumGlobalIndexes	Total number of configured indexes for all databases including system indexes. By default, there are 8 system indexes and 17 additional indexes per database.
ReplicationDescriptors	NumSupplierReplicas + 8 Where NumSupplierReplicas is number of replicas in the server that can act as a supplier (hub or master).
ChainingBackendDescriptors	NumChainingBackends * nsOperationConnectionsLimit Where nsOperationConnectionsLimit is defined in the chained suffix configuration and 10 by default.
PTADescriptors	3 if PTA is configured, 0 if PTA is not configured.
SSLDescriptors	5 (4 files + 1 listen socket) if SSL is configured, 0 if SSL is not configured.

Property	Value
Entry DN	cn=config
Valid Range	1 to 65535
Default Value	64
Syntax	Integer
Example	nsslapd-reservedescriptors: 64

nsslapd-return-exact-case (Return Exact Case)

Returns the exact case of attribute names, as defined in the schema.

Attribute names are case-insensitive by default. However, when an attribute is returned by Directory Server (as the result of a search operation) some client applications require attribute names to match the case of the attribute as it is listed in the schema. Other client applications require attribute names to be returned in lower case (the default behavior in Directory Server 4.x).

nsslapd-return-exact-case is enabled by default. You should disable this attribute if you have legacy clients that expect attribute names to be returned in lower case (for backward compatibility with Directory Server 4.x). You must stop and restart the server for changes to this attribute to be taken into account.

Note that if the attribute name is specified in the search, it is returned in the case in which it is specified, regardless of the value of nsslapd-return-exact-case.

For example, the following search command

ldapsearch -b "cn=config" -s base objectclass=* "PassWordMinAGe"

returns the attribute as "PassWordMinAGe=0", whether nsslapd-return-exact-case is set to on or off.

If nsslapd-return-exact-case is set to on, the following search command

ldapsearch -b "cn=config" -s base objectclass=*

returns the attribute as "passwordMinAge=0", which is how this attribute is defined in the schema.

If nsslapd-return-exact-case is set to off, the same search command

ldapsearch -b "cn=config" -s base objectclass=*

returns the attribute as "passwordminage=0" (in lower case).

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-return-exact-case: on

nsslapd-rootdn (Manager DN)

Specifies the distinguished name of an entry that is not subject to access control restrictions, administrative limit restrictions for operations on the directory or resource limits in general. The attributes nsslapd-sizelimit, nsslapd-timelimit, and nsslapd-schemacheck do not apply to this DN either. nsslapd-idletimeout does however apply to connections opened by this DN.

For information on changing the Root DN, refer to “Creating Directory Entries” in the Directory Server Administration Guide.

.

Property	Value
Entry DN	cn=config
Valid Range	Any valid distinguished name
Default Value	N/A
Syntax	DN
Example	nsslapd-rootdn: cn=Directory Manager

nsslapd-rootpw (Root Password)

Allows you to specify the password associated with the "Manager DN". When you provide the root password, it will be encrypted according to the encryption method you selected for nsslapd-rootpwstoragescheme (Root Password Storage Scheme). When viewed from the server console, this attribute shows the value:***** When viewed from the dse.ldif file, this attribute shows the encryption method followed by the encrypted string of the password. Please note that the example below is what you view, not what you type.

Caution	If you configure a root DN at server installation time, you must also provide a root password. However, it is possible for the root password to be deleted from dse.ldif by direct editing of the file. In this situation, the root DN can only obtain the same access to your directory as you allow for anonymous access. Always make sure that a root password is defined in dse.ldif when a root DN is configured for your database.

Property	Value
Entry DN	cn=config
Valid Range	Any valid password encrypted by any one of the encryption methods that are described in passwordStorageScheme (Password Storage Scheme).
Default Value	N/A
Syntax	DirectoryString: {encryption_method} encrypted_password
Example	nsslapd-rootpw: {SSHA}9Eko69APCJfF

nsslapd-rootpwstoragescheme (Root Password Storage Scheme)

Available only from the server console. This attribute indicates the encryption method used for the root password.

Property	Value
Entry DN	cn=config
Valid Range	Any encryption method as described in passwordStorageScheme (Password Storage Scheme).
Default Value	SSHA
Syntax	DirectoryString
Example	nsslapd-rootpwstoragescheme: SSHA

nsslapd-schema-repl-useronly

This attribute allows you to have greater control over the schema that is replicated. The attribute is off by default, implying that the entire schema is replicated. If the attribute is set to on, only schema with an X-ORIGIN of user-defined is replicated. This setting greatly improves the performance of schema replication.

If you are replicating from a 5.2 Directory Server to a 5.1 server, you must set this attribute to on. Otherwise the 5.2 schema will be pushed to the 5.1 server and the 5.1 server will be unable to restart, due to duplicate objects.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-schema-repl-useronly: off

nsslapd-schemacheck (Schema Checking)

Specifies whether the database schema will be enforced during entry insertion or modification. When this attribute has a value of on, Directory Server will not check the schema of existing entries until they are modified. The database schema defines the type of information allowed in the database. You can extend the default schema using the objectclasses and attribute types. For information on how to extend your schema using Directory Server console, refer to Chapter 9, “Extending the Directory Schema” in the Directory Server Administration Guide.

Note	Schema checking works by default when database modifications are made using an LDAP client, such as ldapmodify, the Directory Server console, or when importing a database from LDIF using directoryserver ldif2db. If you turn schema checking off, you will have to verify manually that your entries conform to the schema. If schema checking is turned on, the server sends an error message to inform you of the entries that do not match the schema. Make sure that the attributes and object classes you create in your LDIF statements are both spelled correctly and identified in dse.ldif. You will need to create a file in LDIF format in the schema directory or add the elements to 99user.ldif.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-schemacheck: on

nsslapd-securelistenhost

Allows multiple Directory Server instances to run on a multihomed machine, using secure SSL/TLS connections, and makes it possible to limit listening to one or more interfaces of a multihomed machine. Provide the hostname or hostnames corresponding to the IP interface(s) you want to specify as the values for this attribute. Directory Server responds only to requests sent to the interface(s) corresponding to the hostname(s) specified. This prevents other programs from using the same port as Directory Server on the interfaces specified.

Property	Value
Entry DN	cn=config
Valid Range	Any secure hostname or hostnames
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-securelistenhost:secure_host_name

nsslapd-securePort (Encrypted Port Number)

TCP/IP port number used for SSL/TLS communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires that Directory Server runs as super user.

Note	Be aware when changing this port number of other applications whose configurations you may have to modify to reflect the change. When changing the port number through the command line, you must also update nsSecureServerPort on cn=slapd-serverID, cn=Sun Java(TM) System Directory Server, cn=Server Group, cn=hostname, ou=domainname, o=NetscapeRoot in the configuration directory. In addition, when you change the port number of a configuration directory server you must close the console, stop all Administration Servers using the configuration directory, and modify the LDAP URL for the configuration directory in each Administration Server’s ServerRoot/shared/config/dbswitch.conf before restarting the Administration Server.

The default value 636 is only used if the server has been configured with a private key and a certificate; otherwise it does not listen on this port.

You must restart the server for the port number change to be taken into account.

Property	Value
Entry DN	cn=config
Valid Range	1 to 65535
Default Value	636
Syntax	Integer
Example	nsslapd-securePort: 636

nsslapd-security (Security)

Enables the use of security features (SSL/TLS and attribute encryption) in Directory Server. If you require secure connections, or the use of the attribute encryption feature, this attribute should be set to on.

Property	Value
Entry DN	cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-security: off

nsslapd-sizelimit (Size Limit)

Specifies the maximum number of entries to return from a search operation. If this limit is reached, ns-slapd returns any entries it has located that match the search request, as well as an exceeded size limit error.

When no limit is set, ns-slapd will return every matching entry to the client regardless of the number found. To set a no limit value whereby Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file.

This limit applies to everyone regardless of their organization.

Property	Value
Entry DN	cn=config
Valid Range	-1 to the maximum 32 bit integer value (2147483647)
Default Value	2000
Syntax	Integer
Example	nsslapd-sizelimit: 2000

nsslapd-threadnumber (Thread Number)

Defines the number of operation threads that Directory Server will create during startup. The nsslapd-threadnumber value should be increased if you have many directory clients performing time-consuming operations such as add or modify. This ensures that there are other threads available for servicing short-lived operations such as simple searches.

Property	Value
Entry DN	cn=config
Valid Range	1 to the number of threads supported by your system
Default Value	30
Syntax	Integer
Example	nsslapd-threadnumber: 60

nsslapd-timelimit (Time Limit)

Specifies the maximum number of seconds allocated for a search request. If this limit is reached, Directory Server returns any entries it has located that match the search request, as well as an exceeded time limit error.

When no limit is set, ns-slapd will return every matching entry to the client regardless of the time it takes. To set a no limit value whereby Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file. A value of zero (0) causes no time to be allowed for searches. The smallest time limit is 1 second.

Property	Value
Entry DN	cn=config
Valid range	-1 to the maximum 32 bit integer value (2147483647) in seconds
Default value	3600
Syntax	Integer
Example	nsslapd-timelimit: 3600

nsslapd-versionstring (Version String)

Specifies the server version number.

Property	Value
Entry DN	cn=config
Valid range	Any valid server version number.
Default value	N/A
Syntax	DirectoryString
Example	nsslapd-versionstring:SunONE-Directory/5.2

cn=changelog5

Multi-master replication changelog configuration entries are stored under the cn=changelog5 entry. The replication changelog behaves much like a database. The cn=changelog5,cn=config entry is an instance of the extensibleObject object class. For attributes to be taken into account by the server, this object class (and the top object class) must be present in the entry.

It is worth noting that two different types of change logs are maintained by Sun Java System Directory Server 5.2. The first type, which is stored here and referred to as changelog, is used by multi-master replication; the second change log, which is actually a plug-in and referred to as retro changelog, is intended for use by Sun Java System Meta Directory. Refer to Retro Changelog Plug-In Attributes for further information regarding the Retro Changelog Plug-in. Multi-master replication changelog attributes are presented in this section.

nsslapd-cachesize (Cache Size)

Specifies the replication changelog cache size, in terms of the number of entries it can hold. Note that it is simpler to limit the cache by memory size only (using the nsslapd-cachememsize attribute). If you attempt to set a value that is not an integer or is too big for a 64-bit unsigned integer (32-bit unsigned integer for 32-bit installations), you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=changelog5,cn=config
Valid Range	1 to 2,147,483,647 (or -1 which means unlimited) entries
Default Value	-1
Syntax	Integer
Example	nsslapd-cachesize: -1

nsslapd-cachememsize (Cache Memory Size)

Specifies the changelog cache size, in terms of the available memory space. Limiting cachesize in terms of memory occupied is the simplest method. If automatic cache resizing is activated, this attribute is overridden. If you attempt to set a value that is not an integer or is too big for a 64-bit unsigned integer (32-bit unsigned integer for 32-bit installations), you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=changelog5,cn=config
Valid Range	200KB to 264-1 Bytes (200KB to 232-1 Bytes for 32-bit installations)
Default Value	10 485 760 (10Mb)
Syntax	Integer
Example	nsslapd-cachememsize:10

nsslapd-changelogdir (Changelog Directory)

This required attribute specifies the name of the directory in which the change log database will be created. Whenever a change log configuration entry is created it must contain a valid directory or the operation will be rejected. The GUI proposes by default that this database be stored under:

ServerRoot/slapd-serverID/changelogdb

Note	For performance reasons, it is recommended that you store this database on a different physical disk. If you change this value after enabling replication, the old changelog is deleted and a new changelog is created. Therefore, you should not change the value of this attribute after replication has been enabled and consumers intialized.

Property	Value
Entry DN	cn=changelog5,cn=config
Valid Range	Any valid path to the directory storing the change log
Default Value	None
Syntax	DirectoryString
Example	nsslapd-changelogdir:  /usr/myhome/slapd-local/changelogdb

nsslapd-changelogmaxage (Max Changelog Age)

Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records. For information on the change log, refer to nsslapd-changelogdir (Changelog Directory).

Property	Value
Entry DN	cn=changelog5,cn=config
Valid Range	0 (meaning that entries are not removed according to their age) to maximum integer (2147483647)
Default Value	0
Syntax	DirectoryString IntegerAgeID where AgeID is “s” for seconds, “m” for minutes, “h” for hours, “d” for days, or “w” for weeks.
Example	nsslapd-changelogmaxage: 30d

nsslapd-changelogmaxentries (Max Changelog Records)

Specifies the maximum number of records the change log may contain. If this attribute is absent, there is no maximum number of records the change log can contain. For information on the change log, refer to nsslapd-changelogdir (Changelog Directory).

Property	Value
Entry DN	cn=changelog5,cn=config
Valid Range	0 (meaning that the only maximum limit is the disk size) to maximum integer (2147483647)
Default Value	0
Syntax	Integer
Example	nsslapd-changelogmaxentries: 5000

cn=encryption

Encryption related attributes are stored under the cn=encryption,cn=config entry. This entry is an instance of the nsEncryptionConfig object class. For encryption related attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. Encryption configuration attributes are presented in this section.

nsSSLSessionTimeout

Specifies the lifetime duration of an SSL session for both SSLv2 and SSLv3. The minimum timeout value is 5 seconds and if you enter a value below this, it is automatically replaced by 5 seconds. Values outside the valid ranges are replaced by the default value of 100 seconds (SSLv2).

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	(SSLv2) 5 seconds to 100 seconds (SSLv3) 5 seconds to 24 hours
Default Value	0 (which translates to 100 seconds if you are running SSLv2 and 24 hours if you are running SSLv3).
Syntax	Integer
Example	nsSSLSessionTimeout: 5

nsSSLClientAuth

In an SSL connection, this attribute specifies whether a client certificate is allowed, required, or should not be sent (off) to the SSL server.

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	off | allowed | required
Default Value	allowed
Syntax	DirectoryString
Example	nsSSLClientAuth: allowed

nsSSLServerAuth

Specifies the action that the SSL client should take on the server certificate sent by the SSL server in an SSL connection.

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	weak - make no attempt to verify whether the server certificate is from a trusted certificate authority cert - verify whether the server certificate is from a trusted certificate authority cncheck - verify whether the server certificate is from a trusted certificate authority and verify the DN contained in the server certificate (to avoid man-in-the middle attacks on the server)
Default Value	cert
Syntax	DirectoryString
Example	nsSSLServerAuth: cert

nsSSL2 (SSL 2)

Supports SSL version 2.

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsSSL2: on

nsSSL3 (SSL 3)

Supports SSL version 3.

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsSSL3: on

nsSSL3ciphers

This multi-valued attribute specifies the set of encryption ciphers Directory Server will use during SSL communications. For more information on the ciphers supported by Directory Server, refer to Chapter 11, “Managing SSL”, in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=encryption,cn=config
Valid Range	For domestic versions, any combination of the following: For SSLv3 rsa_null_md5 rsa_rc4_128_md5 rsa_rc4_40_md5 rsa_rc2_40_md5 rsa_des_sha rsa_fips_des_sha rsa_3des_sha rsa_fips_3des_sha For TLS tls_rsa_export1024_with_rc4_56_sha tls_rsa_export1024_with_des_cbc_sha
Default Value	N/A
Syntax	DirectoryString + symbol to enable or - symbol to disable followed by the cipher(s). It is important to note that blank spaces are not allowed in the list of ciphers. To enable all ciphers (except rsa_null_md5 which must be specifically called) you can specify +all.
Example	nsslapd-SSL3ciphers:  +RSA_NULL_MD5,+RC4_56_SHA,-RC4_56_SHA

If you are using the Directory Server console to set the cipher preferences, the values on the SSL 3.0 tab of the Cipher Preference dialog box correspond to the following:

Table 2-5  SSLv3 Ciphers

Cipher in Console	Corresponding SSLv3 Cipher
None	rsa_null_md5
RC4	rsa_rc4_128_md5
RC4 (Export)	rsa_rc4_40_md5
RC2(Export)	rsa_rc2_40_md5
DES	rsa_des_sha
DES (FIPS)	rsa_fips_des_sha
Triple-DES	rsa_3des_sha
Triple-DES (FIPS)	rsa_fips_3des_sha

If you are using the Directory Server console to set the cipher preferences, the values on the TLS tab of the Cipher Preference dialog box correspond to the following:

Table 2-6  TLS Ciphers

Cipher in Console	Corresponding TLS Cipher
RC4 (Export)	tls_rsa_export1024_with_rc4_56_sha
DES (Export)	tls_rsa_export1024_with_des_cbc_sha

cn=features

The cn=features,cn=config entry is an instance of the nsContainer object class. It offers access controls for features such as VLV, persistent search, getEffectiveRights, and online import, configuration for internationalized (refer to Table 5-1 for more information) matching and searching, and configuration attributes for the filtering service (used by the partial replication feature), under the cn=filtering service,cn=features,cn=config entry.

The filtering service subtree contains two nodes: cn=sets and cn=elements.

cn=elements contains all defined filtering units. A filtering unit is the minimum filtering concept that the filtering service can understand in a particular subtree.

cn=sets contains combinations and unions of the filtering units under cn=elements to extend the filtering definition.

For more information on the filtering service, refer to the Directory Server Administration Guide.

cn=elements,cn=filtering service,cn=features,
 cn=config

Objects in this subtree are of type dsFilterSPFractionElement.

dsFilterSPType

Specifies the type of partial replication.

Property	Value
Entry DN	cn="elementName",cn=elements,cn=filtering service,  cn=features,cn=config
Valid Range	fractional_include | fractional_exclude
Default Value	N/A
Example	filterSPType: fractional_include

dsFilterSPFractionAttr

If the dsFilterSPType attribute is set to fractional_include, this attribute contains the list of attributes to be included for replication.

If the dsFilterSPType attribute is set to fractional_exclude, this attribute contains the list of attributes to be excluded for replication.

Property	Value
Entry DN	cn="elementName",cn=elements,cn=filtering service,  cn=features,cn=config
Valid Range	Any attribute name defined in the schema.
Default Value	N/A
Example	dsFilterSPFractionAttr: cn

cn=sets,cn=filtering service,cn=features,
 cn=config

Objects in this subtree are of type dsFilterSPConfigSet.

dsFilterSPConfigDefinition

This single-valued attribute may contain any AND or OR combination of any number of Configuration Elements entries located in the configuration directory. The value of this attribute must conform to the following syntax:

dsFilterSPConfigDefinition: SUBSET(1) || SUBSET(2) ||...|| SUBSET(N)

Here SUBSET(x) is written as (subtree_configuration && sparse_configuration && fractional_configuration). For Directory Server 5.2, subtree_configuration and sparse_configuration must be any. fractional_configuration is an RDN value part referring to the entry that specifies the attribute types to include or exclude.

Property	Value
Entry DN	cn="setName",cn=sets,cn=filtering service,  cn=features,cn=config
Valid Range	Any string.
Default Value	N/A
Syntax	DirectoryString
Example	dsFilterSPConfigDefinition:  (any && any && include_cn_sn)

cn=mapping tree

Configuration attributes for suffixes and replication are stored under cn=mapping tree,cn=config. Configuration attributes related to suffixes are found under the suffix subentry

cn="suffixName",cn=mapping tree,cn=config.

Replication configuration attributes are stored under

cn=replica,cn="suffixName",cn=mapping tree,cn=config.

Replication agreement attributes are stored under

cn=replicationAgreementName,cn=replica,cn="suffixName",cn=mapping tree, cn=config.

Suffix Configuration Attributes Under cn="suffixName"

Suffix configuration attributes are stored under the cn="suffixName" entry, for example cn="dc=example,dc=com". This entry is an instance of the nsMappingTree object class, which inherits from the extensibleObject object class. For suffix configuration attributes to be taken into account by the server, these object classes (in addition to the top object class) must be present in the entry. Suffix configuration attributes are presented in this section.

nsslapd-backend

Gives the name of the suffix or chained suffix used to process requests. This attribute can be multi-valued if you are using a custom distribution plug-in, with one suffix name per value. In this case, you must also specify the nsslapd-distribution-plugin and nsslapd-distribution-funct attributes.

This attribute is required when the value of the nsslapd-state attribute is set to backend or referral on update.

Property	Value
Entry DN	cn="suffixName",cn=mapping tree,cn=config
Valid Range	Any valid partition name.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-backend: NetscapeRoot

nsslapd-distribution-plugin

Specifies the full path and filename of the shared library for the custom distribution plugin. This attribute is required along with nsslapd-distribution-funct when you have specified more than one suffix in the nsslapd-backend attribute.

Contact Sun Professional Services for information on how to create distribution logic for Directory Server.

Property	Value
Entry DN	cn="suffixName",cn=mapping tree,cn=config
Valid Range	The full path and filename of the plug-in library.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-distribution-plugin: ServerRoot/plugins/custom/myDistrib.so

Note	Once you have distributed entries, you cannot redistribute them. The following restrictions apply: You cannot change your distribution function once you have deployed entry distribution. You cannot use the LDAP modrDN or ldapmodify commands to change an entry if that would cause them to be distributed into a different database. You cannot replicate databases that are distributed over multiple databases. Violating these restrictions prevents Sun Java System Directory Server from correctly locating and returning entries.

nsslapd-distribution-funct

Specifies the name of your distribution function within the library named by nsslapd-distribution-plugin. This attribute is required along with nsslapd-distribution-plugin when you have specified more than one database in the nsslapd-backend attribute.

Contact Sun Professional Services for information on how to create distribution logic for your Directory Server.

Property	Value
Entry DN	cn="suffixName",cn=mapping tree,cn=config
Valid Range	The name of the distribution function.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-distribution-funct: alphabeticalDistrib

nsslapd-referral

Lists the servers to which updates are referred. This attribute can be multi-valued, with one server per value. This attribute is required when the value of the nsslapd-state attribute is set to referral.

Property	Value
Entry DN	cn="suffixName",cn=mapping tree,cn=config
Valid Range	Any valid LDAP URL.
Default Value	Defined by the Replication Agreement.
Syntax	DirectoryString
Example	nsslapd-referral: ldap://myServer.example.com:389

nsslapd-state

Determines how the suffix handles operations.

Property	Value
Entry DN	cn="suffixName",cn=mapping tree,cn=config
Valid Range	Backend = the backend (database) is used to process all operations. Disabled = the database is not available for processing operations. The server returns a “No such search object” error in response to requests made by client applications. Referral = a referral is returned for requests made to this suffix. Referral on update = the database is used for all operations except update requests, which receive a referral.
Default Value	backend
Syntax	DirectoryString
Example	nsslapd-state: backend

Replication Attributes Under cn=replica, cn="suffixName",cn=mapping tree,cn=config

Replication configuration attributes are stored under

cn=replica,cn="suffixName",cn=mapping tree,cn=config.

The cn=replica entry is an instance of the nsDS5Replica object class. For replication configuration attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. Replication configuration attributes are presented in this section. For further information regarding replication, refer to Chapter 8, “Managing Replication” in the Directory Server Administration Guide.

cn

This attribute is used to name the replica. Once it has been set, it cannot be modified.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	Any valid suffix name.
Default Value	cn=replica
Syntax	DirectoryString
Example	cn: "cn=replica"

ds5BeginReplicaAcceptUpdates

Enables you to specify that the replica should accept client updates instead of referring them.

Property	Value
Entry DN	cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	stop | start
Default Value	N/A
Syntax	DirectoryString
Example	ds5BeginReplicaAcceptUpdates: start

ds5ReferralDelayAfterInit

Enables you to specify the delay after which a recently initialized replica will start accepting client updates instead of referring them.

Property	Value
Entry DN	cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 to any 64-bit integer (seconds)
Default Value	0 (infinite)
Syntax	DirectoryString
Example	ds5ReferralDelayAfterInit: 100

nsDS5Flags

This attribute enables you to specify replica properties you have previously defined in flags. At present only two flags exist. One enables you to specify whether changes are logged. The second enables you to overwrite automatic referrals.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	0 = no changes are logged and automatic referrals are not overwritten   1 = changes are logged and automatic referrals are not overwritten   4 = no changes are logged and automatic referrals are overwritten   5 = changes are logged and automatic referrals are overwritten
Default Value	0 (no changes are logged and automatic referrals are not overwritten)
Syntax	Integer
Example	nsDS5Flags: 0

nsDS5ReplicaBindDN

This multi-valued attribute specifies the DN to use when binding. The value can either be the DN of the local entry on the consumer server or, in the case of an SSL connection, the certificate identity associated with the same DN.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	Any valid DN.
Default Value	cn=replication manager, cn=replication,cn=config
Syntax	DirectoryString
Example	nsDS5ReplicaBindDN: cn=replication manager, cn=replication,cn=config

nsDS5ReplicaChangeCount (Replica Change Count)

This read-only attribute informs you of the total number of entries in the change log (whether they still remain to be replicated or not). The change log is purged according to settings for attributes described in nsslapd-changelogmaxage (Max Changelog Age) and nsslapd-changelogmaxentries (Max Changelog Records).

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	-1 to maximum 32-bit integer (2147483647)
Default Value	N/A
Syntax	Integer
Example	nsDS5ReplicaChangeCount: 675

nsDS5ReplicaId (Replica ID)

Specifies the unique ID for masters in a given replication environment. Consumer services always have the same replica id : 65535.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	1 to 65534
Default Value	N/A
Syntax	Integer
Example	nsDS5ReplicaId: 1

nsDS5ReplicaLegacyConsumer

If this attribute is absent or has a value of false, then the replica is not a legacy consumer.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	true | false
Default Value	false
Syntax	DirectoryString
Example	nsDS5ReplicaLegacyConsumer: false

nsDS5ReplicaName

This read-only attribute specifies the name of the replica with a unique identifier for internal operations. This unique identifier is allocated by the server when the replica is created. This attribute is for internal use only.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString (a UID identifies the replica)
Example	nsDS5ReplicaName: 66a2b699-1dd211b2-807fa9c3-a58714648

nsDS5ReplicaPurgeDelay

Specifies the maximum time period for keeping tombstone entries—entries that have been marked for deletion but not yet removed—and replication state information. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy, to avoid incurring conflict resolution problems and server divergence.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	0 (keep forever) to maximum integer (2147483647)
Default Value	604800 (1 week : 60x60x24x7)
Syntax	Integer
Example	nsDS5ReplicaPurgeDelay: 604800

nsDS5ReplicaReferral

This multi-valued attribute specifies the user-defined referrals. This should be defined on a consumer only. User referrals are only returned when a client attempts to modify data on a read-only consumer.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	Any valid LDAP URL.
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaReferral: ldap://ldap.aceindustry.com

nsDS5ReplicaRoot

Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated. It cannot be modified.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	Suffix of the database being replicated.
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaRoot: "dc=example,dc=com"

nsDS5ReplicaTombstonePurgeInterval

Specifies the time interval in seconds between purge operation cycles. When setting this attribute, bear in mind that the purge operation is time consuming.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	0 to maximum integer (2147483647) in seconds
Default Value	3600 (1 hour)
Syntax	Integer
Example	nsDS5ReplicaTombstonePurgeInterval: 3600

nsDS5ReplicaType

Defines the type of replication relationship that exists between this replica and the others.

Property	Value
Entry DN	cn=replica,cn="suffixName",cn=mapping tree,cn=config
Valid Range	0 = unknown (do not use) 1 = primary (not yet used) 2 = consumer (read-only) 3 = consumer/supplier (updateable)
Default Value	N/A
Syntax	Integer
Example	nsDS5ReplicaType: 2

Replication Attributes Under cn=ReplicationAgreementName,cn=replica, cn="suffixName", cn=mapping tree,cn=config

The replication attributes that concern the replication agreement are stored under

cn=ReplicationAgreementName,cn=replica,cn="suffixName",cn=mapping tree,cn=config.

The cn=ReplicationAgreementName entry is an instance of the nsDS5ReplicationAgreement object class. For replication agreement configuration attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. Replication agreements are configured only on supplier replicas. The replication agreement configuration attributes are presented in this section.

cn

This attribute defines the replication agreement name. Once this attribute has been set it cannot be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any valid suffix name.
Default Value	cn=replica
Syntax	DirectoryString
Example	cn: "cn=ReplicationAgreement1"

description

Free form text description of the replication agreement. This attribute can be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any string.
Default Value	N/A
Syntax	DirectoryString
Example	description: Replication Agreement between Server A and Server B.

ds5AgreementEnable

Specifies whether a replication agreement is enabled or disabled.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	ds5agreementEnable: on

ds5ReplicaChangesSentDuringLastUpdate

This read-only attribute specifies the number of entries that were replicated in the last update session.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	Integer
Example	ds5ReplicaChangesSentDuringLastUpdate: 0

ds5ReplicaPendingChanges

This multi-valued, read-only attribute identifies the operations (ADD, DEL, MOD) not yet sent to the specified consumer, the DN of the entry affected, and the change sequence number (CSN).

The attribute must be specifically requested in an ldapsearch operation. If the ds5agreementEnable attribute is set to off, the value of this attribute has no meaning.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A.
Default Value	N/A
Syntax	DirectoryString
Example	ds5ReplicaPendingChanges: DEL DNOfEntryToDelete CSN ds5ReplicaPendingChanges: ADD DNOfEntryToAdd CSN

ds5ReplicaPendingChangesCount

This read-only attribute provides the number of changes not yet sent to the specified consumer. The attribute must be specifically requested in an ldapsearch operation. If the ds5agreementEnable attribute is set to off, the value of this attribute has no meaning.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	Integer
Example	ds5ReplicaPendingChangesCount: 2

ds5ReplicaTransportCompressionLevel

This attribute specifies the level of compression used in transporting updates to a consumer.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0-3 0 = No compression 1 = Default Zlib compression (Zlib numeric value = -1) 2 = Best speed (Zlib numeric value = 1) 3 = Best compression (Zlib numeric value = 9)
Default Value	0
Syntax	Integer
Example	ds5ReplicaTransportCompressionLevel: 0

ds5ReplicaTransportGroupSize

The number of updates (for an incremental update) or entries (for a total update) that the supplier will group together before sending the changes to the consumer.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 to 100
Default Value	1
Syntax	Integer
Example	ds5ReplicaTransportGroupSize: 1

ds5ReplicaTransportWindowSize

The number of updates (for an incremental update) or entries (for a total update) that the supplier will send before waiting for a reply from the consumer.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	1 to 1000
Default Value	10
Syntax	Integer
Example	ds5ReplicaTransportWindowSize: 10

dsFilterSPConfigchecksum

The checksum for partial replication configuration.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName",  cn=mapping tree,cn=config (on supplier replica) cn=replica,cn="suffixName",cn=mapping tree,cn=config (on consumer replica)
Valid Range	This attribute is for internal use and must not be modified.
Default Value	N/A
Syntax	DirectoryString

nsDS5BeginReplicaRefresh

Allows you to initialize a replica. This attribute is absent by default. However, if you add this attribute with a value of start, the server reinitializes the replica and removes the attribute value.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	stop | start
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5BeginReplicaRefresh: start

nsDS5ReplicaBindDN

Specifies the DN to use when binding. The value of this attribute must be the same as the one in cn=replica on the consumer replica. A default DN of "cn=replication manager" is created when you set up a replication agreement. This can be modified. This attribute may be empty if certificate-based authentication is used.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any valid DN.
Default Value	cn=replication manager,cn=replication,cn=config
Syntax	DirectoryString
Example	nsDS5ReplicaBindDN: cn=replication manager, cn=replication,cn=config

nsDS5ReplicaBindMethod

Specifies the method to use for binding. This attribute can be modified. SIMPLE binds, for example, require a DN and password.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	SIMPLE or SSLCLIENTAUTH
Default Value	SIMPLE
Syntax	DirectoryString
Example	nsDS5ReplicaBindMethod: SIMPLE

nsDS5ReplicaChangesSentSinceStartup

This read-only attribute provides you with the number of changes sent to this replica since the server started.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 to maximum 32-bit integer (2147483647)
Default Value	N/A
Syntax	Integer
Example	nsDS5ReplicaChangesSentSinceStartup: 647

nsDS5ReplicaCredentials

Specifies the credentials for the bind DN (specified in the nsDS5ReplicaBindDN attribute) on the remote server containing the consumer replica. The value for this attribute can be modified. When certificate-based authentication is used, this attribute may not have a value. The example below shows the encrypted password you can view as the result of a search, given the appropriate access to the entry.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any valid password that will be encrypted using the DES reversible password encryption schema.
Default Value	N/A
Syntax	DirectoryString {DES} encrypted_password
Example	nsDS5ReplicaCredentials: {DES} 9Eko69APCJfFReplica

nsDS5ReplicaHost

Specifies the hostname for the remote server containing the consumer replica. Once this attribute has been set it cannot be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any valid host server name.
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaHost: MyServer

nsDS5ReplicaLastInitEnd

This optional, read-only attribute states when the initialization of the consumer replica ended.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	GeneralizedTime
Example	nsDS5ReplicaLastInitEnd: YYYYMMDDhhmmssZ (19711223113229)

nsDS5ReplicaLastInitStart

This optional, read-only attribute states when the initialization of the consumer replica started.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	GeneralizedTime
Example	nsDS5ReplicaLastInitStart: YYYYMMDDhhmmssZ (20000902160000)

nsDS5ReplicaLastInitStatus

This optional, read-only attribute provides status for the initialization of the consumer.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 (Consumer Initialization Succeeded) followed by any other status message.
Default Value	N/A
Syntax	String
Example	nsDS5ReplicaLastUpdateStatus: 0 Consumer Initialization Succeeded

nsDS5ReplicaLastUpdateEnd

This read-only attribute states when the most recent replication schedule update ended.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 (Consumer Initialization succeeded.)
Default Value	N/A
Syntax	GeneralizedTime
Example	nsDS5ReplicaLastUpdateEnd: YYYYMMDDhhmmssZ (20000902160000)

nsDS5ReplicaLastUpdateStart

This read-only attribute states when the most recent replication schedule update started.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	GeneralizedTime
Example	nsDS5ReplicaLastUpdateStart: YYYYMMDDhhmmssZ (20000902160000)

nsDS5ReplicaLastUpdateStatus

This read-only attribute provides the status for the most recent replication schedule updates.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 (no replication sessions started) followed by any other error or status message.
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaLastUpdateStatus: 0 replica acquired successfully

nsDS5ReplicaPort

Specifies the port number for the remote server containing the replica. Once this attribute has been set, it cannot be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Port number for the remote server containing the replica.
Default Value	N/A
Syntax	Integer
Example	nsDS5ReplicaPort: 389

nsDS5ReplicaRoot

Specifies the DN at the root of a replicated area. This attribute must have the same value as the suffix of the database being replicated. It cannot be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Suffix of the database being replicated.
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaRoot: "dc=example,dc=com"

nsDS5ReplicaTimeout

This allowed attribute specifies the number of seconds outbound LDAP operations will wait for a response from the remote replica before timing out and failing. If you see "Warning: timed out waiting" messages in the error log file, then you should increase the value of this attribute.

You can find out the amount of time the operation actually lasted by examining the access log on the remote machine. You can then set the nsDS5ReplicaTimout attribute accordingly to optimize performance.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	0 to maximum integer value (2147483647) in seconds
Default Value	600
Syntax	Integer
Example	nsDS5ReplicaTimeout: 600

nsDS5ReplicaTransportInfo

Specifies the type of transport used for transporting data to and from the replica. The attribute values can either be SSL, which means that the connection is established over SSL, or LDAP, which means that regular LDAP connections are used. If this attribute is absent, regular LDAP connections are used. This attribute cannot be modified once set.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	SSL | LDAP
Default Value	LDAP
Syntax	DirectoryString
Example	nsDS5ReplicaTransportInfo: LDAP

nsDS5ReplicaUpdateInProgress

This read-only attribute states whether or not a replication schedule update is in progress.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	true | false
Default Value	N/A
Syntax	DirectoryString
Example	nsDS5ReplicaUpdateInProgress:true

nsDS5ReplicaUpdateSchedule

This multi-valued attribute specifies the replication schedule. It can be modified.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Time schedule presented as XXXX-YYYY 0123456 where XXXX is the starting hour, YYYY is the finishing hour and the numbers 0123456 are the days of the week, starting with Sunday. If you want to configure a time that runs through midnight, you must configure replication to stop at 2359, then start at 0000 the next day.
Default Value	0000-2359 0123456 (all the time)
Syntax	Integer
Example	nsDS5ReplicaUpdateSchedule: 0000-2359 0123456

nsDS50ruv

This attribute is responsible for managing the internal state of the replica via the replication update vector. It is always present and must not be changed.

ds5PartialReplConfiguration

Specifies the partial replication configuration entry point for the Replication Agreement. The value of this attribute is the value part of the RDN of the entry, which stores the filtering information required by the partial replication module. Such entries are under the cn=sets, cn=filtering service,cn=features,cn=config entry.

Property	Value
Entry DN	cn=ReplicationAgreementName,cn=replica,cn="suffixName", cn=mapping tree,cn=config
Valid Range	Any string
Default Value	None
Syntax	DirectoryString
Example	ds5PartialReplConfiguration: include_people_cn

Note	The example provided references an entry with DN cn=include_people_cn,cn=sets, cn=filtering service,cn=features,cn=config, and having attributes such as dsFilterSPConfigDefinition, dsFilterSPFractionAttr, dsFilterSPType.

cn=Password Policy

Configurable password policy attributes are stored under cn=Password Policy,cn=config. For a description of the operational or state attributes related to password policy, refer to Chapter 11, "Operational Attributes."

Configurable password attributes fall into one of the following categories:

attributes that determine the password policy itself
attributes that determine the account lockout policy

Note	In previous versions of Directory Server, configurable password policy attributes were stored directly under cn=config.

Password Policy Attributes

The following attributes determine the password policy.

passwordChange (Password Change)

Indicates whether users may change their passwords. If this attribute is not present, a value of on is assumed (users can change their passwords).

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	passwordChange: on

passwordCheckSyntax (Check Password Syntax)

Indicates whether the password syntax will be checked before the password is saved. The password syntax checking mechanism checks that the password meets the password minimum length requirement and that the string does not contain any “trivial” words, such as the user’s name or user ID or any attribute value stored in the uid, cn, sn, givenName, ou, or mail attributes of the user’s directory entry.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordCheckSyntax: off

passwordExp (Password Expiration)

Indicates whether user passwords will expire after a given number of seconds. By default, user passwords do not expire. If password expiration is enabled, you can set the number of seconds after which the password will expire using the passwordMaxAge attribute.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordExp: on

passwordExpireWithoutWarning (Password Expire Without Warning)

Indicates whether a password can expire regardless of whether the user was warned about the expiration date.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordExpireWithoutWarning: on

passwordInHistory (Number of Passwords to Remember)

Indicates the number of passwords Directory Server stores in history. Passwords that are stored in history cannot be reused by users. The password history feature is disabled by default (the passwordInHistory attribute has a value of 0). This implies that Directory Server does not store any old passwords and users can reuse passwords.

To prevent users from rapidly cycling through a number of passwords, use the passwordMinAge attribute.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	0 to 24 passwords
Default Value	0
Syntax	Integer
Example	passwordInHistory: 6

passwordMaxAge (Password Maximum Age)

Indicates the number of seconds after which user passwords will expire. To use this attribute, you must enable password expiration using the passwordExp attribute.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value	8640000 (100 days)
Syntax	Integer
Example	passwordMaxAge: 100

passwordMinAge (Password Minimum Age)

Specifies the number of seconds that must elapse between password modifications. Use this attribute in conjunction with the passwordInHistory attribute to prevent users from quickly cycling through passwords so that they can use their old password again. A value of zero (0) indicates that the user can change the password immediately.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	0 to 2147472000 seconds (24,855 days)
Default Value	0
Syntax	Integer
Example	passwordMinAge: 86400

passwordMinLength (Password Minimum Length)

Specifies the minimum number of characters that must be used in a password. Syntax checking is performed against this attribute, if the passwordCheckSyntax attribute is set to on.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	2 to 512 characters
Default Value	6
Syntax	Integer
Example	passwordMinLength: 6

passwordMustChange (Password Must Change)

Indicates whether users must change their passwords when they first bind to Directory Server, or when the password has been reset by the administrator. If this attribute is set to on, users are required to change their passwords.

For users to be able to change their passwords, the passwordChange attribute must also be set to on.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordMustChange: off

passwordRootDNMayBypassModsChecks

Allows the root DN to modify passwords, even if the modification violates the password policy.

When this attribute is set to on, the Directory Manager can make modifications to passwords that violate the password policy. This allows exceptions to the password policy, and can be used, for example, in the case of applications that reset passwords to the same default value. If the Directory Manager changes a password and the server detects that the new password violates the minimum length or the password history, a warning is logged, but the modification proceeds.

This attribute is set to off by default, which means that the server rejects password modifications by the Directory Manager if they violate the password policy.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordRootdnMayBypassModsChecks: off

passwordStorageScheme (Password Storage Scheme)

Specifies the algorithm used to encrypt Directory Server passwords. The default password storage scheme is the Salted Secure Hash Algorithm (SSHA).

The following encryption types are supported by Directory Server 5.2:

SSHA (Salted Secure Hash Algorithm) is the recommended method as it is the most secure.
SHA (Secure Hash Algorithm). This is the method supported by 4.x Directory Servers.
CRYPT is the UNIX crypt algorithm. It is provided for compatibility with UNIX passwords.

If this attribute is set to CLEAR, passwords are not encrypted and appear in plain text.

You can modify how Directory Server stores password attributes by writing your own password storage scheme plug-in. For more information refer to Chapter 11, "Writing Password Storage Scheme Plug-Ins" in the Directory Server Plug-In Developer’s Guide.

Note	You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present but only for backward compatibility.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid range	Any of the following password storage schema: SSHA|SHA|CRYPT|CLEAR
Default value	SSHA
Syntax	DirectoryString
Example	passwordStorageScheme: SSHA

passwordWarning (Send Warning)

Specifies the number of seconds before a user’s password expires, that a warning is returned in response to a client bind request. The client receives a password expiration warning on attempting to authenticate to the directory. Depending on the LDAP client, the user may also be prompted to change their password at the time the warning is returned.

Note	Directory Server does not send the warning to the end user, but instead returns a warning to the client application performing the bind. In other words, end users do not automatically receive email or other notification as a result of passwordWarning being set to on in the directory. As the end user probably needs to take action when a warning is received, make sure the warning received by the client application is appropriately delivered to the end user.

If this attribute is not present, or if the value of the attribute is 0, no warning messages are sent. For password expiration to be enabled, the passwordExp attribute must be set to on.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value	86400 (1 day)
Syntax	Integer
Example	passwordWarning: 86400

Account Lockout Attributes

The following attributes determine the account lockout policy.

passwordLockout (Account Lockout)

Enables the account lockout mechanism. If this attribute is set to on, users will be locked out of the directory (for the length of time specified in the passwordLockoutDuration attribute) once the maximum number of consecutive failed bind attempts has been reached. The maximum number of consecutive bind attempts is specified by the passwordMaxFailure attribute.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	passwordLockout: off

passwordLockoutDuration (Lockout Duration)

If the account lockout feature is enabled (passwordLockout is set to on), this attribute specifies the length of time (in seconds) during which users will be locked out of the directory. The account is locked when the maximum number of consecutive failed bind attempts (specified by passwordMaxFailure) has been reached.

If this attribute is not present, or if it is set to 0, the account will remain locked until it is reset by the administrator.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value	3600
Syntax	Integer
Example	passwordLockoutDuration: 3600

passwordMaxFailure (Maximum Password Failures)

If the account lockout feature is enabled (passwordLockout is set to on), this attribute specifies the number of consecutive failed bind attempts after which a user will be locked out of the directory. Each time an invalid password is sent from the user’s account, the password failure counter is incremented. The value of this counter is stored in the operational attribute, passwordRetryCount.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	1 to 32767
Default Value	3
Syntax	Integer
Example	passwordMaxFailure: 3

passwordResetFailureCount (Reset Password Failure Counter)

Each time an invalid password is sent from the user’s account, the password failure counter is incremented. The value of this counter is stored in the operational attribute, passwordRetryCount. This attribute specifies the length of time (in seconds) after which passwordRetryCount is reset to 0 (even if no successful authentication occurs).

If passwordResetFailureCount is set to 0, the failure counter is reset only when a successful bind occurs.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	1 to the maximum 32 bit integer value (2147483647) in seconds
Default Value	600
Syntax	Integer
Example	passwordResetFailureCount: 600

passwordUnlock (Unlock Account)

If the account lockout mechanism is enabled, (passwordLockout is set to on), this attribute specifies whether user accounts will be unlocked after a period of time. The period of time is specified in the passwordLockoutDuration attribute.

If passwordUnlock is set to on and the value of the passwordMaxFailure attribute has been reached, the account will be unlocked after the number of seconds specified in the passwordLockoutDuration attribute. However, if passwordUnlock is set to off, and the value of the passwordMaxFailure attribute has been reached, the account will remain locked until the administrator resets it.

For more information on password policies, refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=Password Policy,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	passwordUnlock: off

cn=replication

A default replication bind DN (cn=replication manager) is created when you set up a replication agreement. This can be modified.

When configuring legacy replication, configuration attributes are stored under this cn=replication,cn=config node, which serves as a placeholder.

cn=SNMP

SNMP configuration attributes are stored under cn=SNMP,cn=config. The cn=SNMP entry is an instance of the nsSNMP object class. For SNMP configuration attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. SNMP configuration attributes are presented in this section.

nssnmpenabled

Specifies whether SNMP is enabled or not.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nssnmpenabled: off

nssnmporganization

Specifies the organization to which Directory Server belongs.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Organization name
Default Value	N/A
Syntax	DirectoryString
Example	nssnmporganization: Sun Java System

nssnmplocation

Specifies the location within the company or organization where Directory Server resides.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Location
Default Value	N/A
Syntax	DirectoryString
Example	nssnmplocation: B14

nssnmpcontact

Specifies the E-mail address of the person responsible for maintaining Directory Server.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Contact E-mail address
Default Value	N/A
Syntax	DirectoryString
Example	nssnmpcontact: ITdept@example.com

nssnmpdescription

Provides a unique description of the Directory Server instance.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Description
Default Value	N/A
Syntax	DirectoryString
Example	nssnmpdescription: Employee directory instance

nssnmpmasterhost

This required attribute specifies the hostname of the machine on which the master agent is installed.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Machine hostname or local host.
Default Value	localhost
Syntax	DirectoryString
Example	nssnmpmasterhost: localhost

nssnmpmasterport

Specifies the port number used to communicate with the master agent.

Property	Value
Entry DN	cn=SNMP,cn=config
Valid Range	Operating System dependent port number. Refer to your Operating System documentation for further information.
Default Value	199
Syntax	Integer
Example	nssnmpmasterport: 199

cn=tasks

No specific configuration attributes.

cn=uniqueid generator

The uniqueid generator configuration attributes are stored under cn=uniqueid generator,cn=config. The cn=uniqueid generator entry is an instance of the extensibleObject object class. For uniqueid generator configuration attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. Uniqueid generator configuration attributes are presented in this section.

nsState

This attribute stores information on the state of the clock. It is intended for internal use only, to ensure that the server cannot generate a change sequence number (CSN) inferior to existing ones required for detecting backward clock errors. Do not edit this attribute.

Property	Value
Entry DN	cn=uniqueid generator,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString
Example	nsstate:AbId0c3oMIDUntiLCyYNGgAAAAAAAAAA

---

Monitoring Attributes

Read-only monitoring information is stored under the cn=monitor entry.

cn=monitor

The cn=monitor entry is an instance of the extensibleObject object class. For cn=monitor configuration attributes to be taken into account by the server, this object class (in addition to the top object class) must be present in the entry. The cn=monitor read-only attributes are presented in this section.

backendMonitorDN

DN for each Directory Server backend.

For further database monitoring information, refer to Database Monitoring Attributes, Database Performance Attributes, Database Monitoring Attributes Under cn=NetscapeRoot, and Chained Suffix Monitoring Attributes.

bytesSent

Number of bytes sent by Directory Server.

cache-avail-bytes

The number of bytes available for caching.

connection

List of open connections given in the following format:

connection=31:20010201164808Z:45:45::cn=directory manager:LDAP

where 31 is the connection number, 20010201164808Z is the date the connection was opened, 45 is the number of operations received, 45 is the number of completed operations, and cn=directory manager is the bind DN.

connectionPeak

Maximum number of simultaneous connections since server startup.

currentConnections

Number of current Directory Server connections.

currentTime

Current time usually given in Greenwich Mean Time (indicated by GeneralizedTime syntax Z notation, for example 20010202131102Z).

dTableSize

Size of the Directory Server descriptor table.

entriesSent

Number of entries sent by Directory Server.

nbackEnds

Number of Directory Server backends.

opsCompleted

Number of Directory Server operations completed.

opsInitiated

Number of Directory Server operations initiated.

request-que-backlog

The number of requests waiting to be processed by a thread. Each request received by the server is accepted, then placed in a queue until a thread is available to process it. The queue backlog should always be small, (0 or close to 0). If the queue backlog is large, use the nsslapd-threadnumber attribute to increase the number of threads available in the server.

readWaiters

Number of connections where some requests are pending and not currently being serviced by a thread in Directory Server.

startTime

Directory Server start time.

threads

Number of operation threads Directory Server creates during startup. This attribute can be set using the nsslapd-threadnumber (Thread Number) attribute under cn=config. The nsslapd-threadnumber attribute is not present in the dse.ldif file by default, but can be added.

totalConnections

Total number of Directory Server connections.

version

Directory Server version and build number.

cn=disk,cn=monitor

The cn=disk entry enables you to monitor disk conditions over LDAP. This entry is an instance of the extensibleObject object class. A cn=disknumber,cn=disk,cn=monitor entry exists for each disk. The following disk monitoring attributes appear under each of these individual disk entries.

disk-dir

Specifies the pathname of a directory used by the server on disk. Where several database instances reside on the same disk or an instance refers to several directories on the same disk, the short pathname is displayed. The disk numbering is arbitrary.

disk-free

Indicates the amount of free disk space available to the server, in MB.

Note	The disk space available to the server process may be less than the total free disk space. For example, on some platforms a process that is not running as superuser may not have all the free disk space available to it.

disk-state

Indicates the state of the disk, based on the available free space and on the thresholds set for disk low and disk full (with the configuration parameters nsslapd-disk-low-threshold and nsslapd-disk-full-threshold). Possible values are normal, low, and full.

cn=counters,cn=monitor

This entry holds counter information for the various subtree entry counter plug-ins, if they are enabled. For more information on these plug-ins, refer to Subtree Entry Counter Plug-Ins.

cn=monitor,cn=Class of Service,cn=plugins,
 cn=config

This entry holds counters related to the Class of Service plug-in. This entry is an instance of the extensibleObject object class.

Refer to Class of Service Plug-In for details on configuration of that plug-in itself.

classicHashAvgClashListLength

When the CoS plug-in uses the hash table for fast lookup, if more than one classic CoS template corresponds to the hash key used, the plug-in next checks for matches in what is called the clash list, a list of templates sharing an identical hash key. The value of this attribute provides the average length across all hash tables of classic CoS template clash lists, giving some indication of how much linear searching the plug-in must perform after using the hash table during fast lookup.

classicHashAvgClashPercentagePerHash

The average number of clashes per hash table. That is, the average percentage per hash of classic CoS templates sharing an identical hash key.

classicHashMemUsage

The memory overhead in bytes to hold hash tables for fast classic CoS template lookups.

classicHashValuesMemUsage

The memory in bytes used to hold hash values for fast classic CoS template lookups.

numClassicDefinitions

The number of classic CoS definition entries in use.

numClassicHashTables

The number of hash tables created for fast lookup where more than 10 classic CoS templates apply for a single CoS definition. Hash tables are not created for smaller lists of templates.

numClassicTemplates

The number of classic CoS template entries in use.

numCoSAttributeTypes

The number of distinct attributes with values calculated through CoS.

numIndirectDefinitions

The number of indirect CoS definition entries in use.

numPointerDefinitions

The number of pointer CoS definition entries in use.

numPointerTemplates

The number of pointer CoS template entries in use.

cn=snmp,cn=monitor

The cn=snmp entry enables you to monitor Directory Server access, operations, and errors. This entry is an instance of the extensibleObject object class.

addentryops

The number of add operations serviced by this directory since server startup.

anonymousbinds

The number of anonymous binds to the directory since server startup.

bindsecurityerrors

The number of bind requests that have been rejected by the directory due to authentication failures or invalid credentials since server startup.

bytesrecv

The number of bytes received by this directory since server startup.

bytessent

The number of bytes sent to clients by this directory since server startup.

cacheentries

The number of entries cached in the directory. This number remains 0 when the Directory Server instance is handling multiple backends.

cachehits

The number of operations serviced from the locally held cache since application startup. This number remains 0 when the Directory Server instance is handling multiple backends.

chainings

The number of chaining operations returned by this directory in response to client requests since server startup.

compareops

The number of compare operations serviced by this directory since server startup.

connections

The number of current open connections.

connectionseq

The number of connections handled by the directory since server startup.

copyentries

The number of directory entries for which this directory contains a consumer copy. The value of this object will always be 0 (as no updates are currently performed).

entriesreturned

The number of entries returned by this directory in response to client requests since server startup.

errors

The number of requests that could not be serviced due to errors (other than security or referral errors). Errors include name errors, update errors, attribute errors, and service errors. Partially serviced requests are not counted as errors.

inops

The number of operations forwarded to this directory from another directory since server startup.

listops

The number of list operations serviced by this directory since server startup. The value of this object will always be 0 because LDAP implements list operations indirectly via the search operation.

masterentries

The number of directory entries for which this directory contains the master entry. The value of this object will always be 0 (as no updates are currently performed).

modifyentryops

The number of modify operations serviced by this directory since server startup.

modifyrdnops

The number of modify RDN operations serviced by this directory since server startup.

onelevelsearchops

The number of one-level search operations serviced by this directory since server startup.

readops

The number of read operations serviced by this directory since application start. The value of this object will always be 0 because LDAP implements read operations indirectly via the search operation.

referrals

The number of referrals returned by this directory in response to client requests since server startup.

referralsreturned

The number of referrals returned by this directory in response to client requests since server startup.

removeentryops

The number of delete operations serviced by this directory since server startup.

searchops

The total number of search operations serviced by this directory since server startup.

securityerrors

The number of operations forwarded to this directory that did not meet security requirements.

simpleauthbinds

The number of binds to the directory that were established using a simple authentication method (such as password protection) since server startup.

slavehits

The number of operations that were serviced from locally held replications (shadow entries). The value of this object will always be 0.

strongauthbinds

The number of binds to the directory that were established using a strong authentication method (such as SSL or an SASL mechanism like Kerberos) since server startup.

unauthbinds

The number of unauthenticated binds to the directory since server startup.

wholesubtreesearchops

The number of whole subtree search operations serviced by this directory since server startup.

SNMP Monitoring Objects and Interactions

In addition to the attributes on cn=snmp,cn=monitor, Directory Server supports managed objects related to the interactions between the monitored server and its peer servers. Table 2-7 covers these.

Table 2-7  Interactions Table of Supported SNMP Managed Objects 

Managed Object	Description
dsTimeOfCreation	The value of system “up” time when the entry containing interaction details of (attempted) interaction between the Directory Server and a peer Directory Server was created. If the entry was created before the management network subsystem was initialized, this object will contain a value of zero.
dsTimeOfLastAttempt	The value of system “up” time when the last attempt was made to contact this Directory Server. If the last attempt was made before the network management subsystem was initialized, this object will contain a value of zero.
dsTimeOfLastSuccess	The value of system “up” time when the last attempt made to contact this Directory Server was successful. If none of the attempts have been successful, this object will have a value of zero. If the last successful attempt was made before the network management subsystem was initialized, this object will contain a value of zero.
dsFailuresSinceLastSuccess	The number of failures since the last successful attempt to contact this Directory Server. If there have been no successful attempts, this object will contain the number of failures since this entry was created.
dsFailures	Cumulative failures to contact the peer Directory Server since the creation of this entry.
dsSuccesses	Cumulative successes since the creation of this entry.
dsURL	URL of the peer Directory Server.

Directory Server also supports entity related managed objects, containing information about the current server installation. These managed objects are listed in Table 2-8.

Table 2-8  Entity Table of SNMP Supported Managed Objects 

Managed Object	Description
dsEntityDescr	A general textual description of the installed Directory Server.
dsEntityVers	Directory Server version.
dsEntityOrg	Organization responsible for this installation of Directory Server.
dsEntityLocation	Physical location of this Directory Server. For example: hostname, building, number, laboratory number, etc.
dsEntityContact	Contact person responsible for the installed Directory Server and their contact details.
dsEntityName	Name assigned to the installation of Directory Server by the installation site.

---

Configuration Quick Reference Tables

This section provides quick reference tables for LDIF configuration files supplied with Directory Server, object classes and schema used in server configuration, and attributes requiring server restart.

LDIF Configuration Files

Table 2-9 lists all the configuration files that are supplied with Directory Server, including those for the schema of other Sun Java System and legacy servers. Each file is preceded by a number that indicates the order in which they should be loaded (in ascending numerical and then alphabetical order). refer to LDIF Files for information on where these files are stored.

Table 2-9  Directory Server Configuration LDIF Files 

Configuration Filename	Purpose
dse.ldif	Contains front-end Directory Specific Entries created by the directory at server startup. These include the Root DSE (""), and the contents of cn=config and cn=monitor.
00core.ldif	Contains LDAPv3 standard operational schema, such as “subschemaSubentry,” the LDAPv3 standard user and organization schema defined in RFC 2256 (based on X.520/X.521), inetOrgPerson and other widely-used attributes, and the operational attributes used by Sun Java System Directory Server 5.2 configuration. Modifying this file will cause interoperability problems. User defined attributes should be added using Sun Java System Server Console.
05rfc2247.ldif	Schema from RFC 2247 and related pilot schema: “Using Domains in LDAP/X500 Distinguished Names.”
05rfc2927.ldif	Schema from RFC 2927: “MIME Directory Profile for LDAP Schema.” Contains the ldapSchemas operational attribute required for the attribute to show up in the subschema subentry.
11rfc2307.ldif	Schema from RFC 2307: “An Approach for Using LDAP as a Network Information Service.”
20subscriber.ldif	Contains new schema elements and the Nortel subscriber interoperability specification. Also contains the adminRole and memberOf attributes and inetAdmin object class previously stored in 50ns-delegated-admin.ldif file.
25java-object.ldif	Schema from RFC 2713: “Schema for Representing Java(tm) Objects in an LDAP Directory.”
28pilot.ldif	Contains pilot directory schema from FRC 1274 that is no longer recommended for new deployments. Please note that future RFCs that succeed RFC 1274 may deprecate some or all of 28pilot.ldif attribute types and classes.
30ns-common.ldif	Schema that contains objects classes and attributes common to the Sun Java System Server Console framework.
50ns-admin.ldif	Schema used by Sun Java System Administration Services.
50ns-calendar.ldif	Schema used by Sun Java System Calendar Server.
50ns-certificate.ldif	Schema for Sun Java System Certificate Management System.
50ns-compass.ldif	Schema used by Netscape Compass Server to define personal interest profiles.
50ns-delegated-admin.ldif	Schema used by Delegated Administrator 4.5.
50ns-directory.ldif	Contains additional configuration schema used by Directory Server 4.12 and earlier versions of the directory, which is no longer applicable to Sun Java System Directory Server 5.2. This schema is required for replicating between Directory Server 4.12 and Sun Java System Directory Server 5.2.
50ns-legacy.ldif	Legacy schema used by Sun Java System Administration Server for legacy servers.
50ns-mail.ldif	Schema used by Sun Java System Messaging Server to define mail users and mail groups.
50ns-mcd-browser.ldif	Schema used by Mission Control Desktop to hold browser client preferences.
50ns-mcd-config.ldif	Schema used by Mission Control Desktop to set MCD "config()" preferences.
50ns-mcd-li.ldif	Schema used by Mission Control Desktop to define location independence.
50ns-mcd-mail.ldif	Schema used by Mission Control Desktop to hold mail client and messenger security preferences.
50ns-media.ldif	Schema used for Media Server.
50ns-mlm.ldif	Schema used by Messaging Server 4.0 for mailing list management.
50ns-msg.ldif	Schema used for Web Mail.
50ns-netshare.ldif	Schema used for Netshare.
50ns-news.ldif	Schema used for Collabra Server to hold news group preferences.
50ns-proxy.ldif	Schema used for Sun Java System Proxy Server.
50ns-value.ldif	Schema for Sun Java System servers’ value item schema.
50ns-wcal.ldif	Schema for Sun Java System Web Calendaring.
50ns-web.ldif	Schema for Sun Java System Web Server.
99user.ldif	User-defined schema maintained by Directory Server replication consumers that contains the attributes and object classes from the suppliers.

Configuration Changes Requiring Server Restart

Table 2-10 lists the configuration attributes that cannot take effect dynamically, while the server is still running. After modifying these parameters through the console or the ldapmodify command, the server must be stopped and restarted for them to take effect. The table lists the configuration attributes concerned, with their full DNs, and provides a brief description of their functions.

Table 2-10  Configuration Changes Requiring Server Restart  

Configuration Attribute	Action Requiring Restart
cn=changelog5,cn=config:nsslapd-changelogsuffix	Modifying the change log suffix.
cn=changelog5,cn=config:nsslapd-db*	Modifying any of the changelog database parameters.
cn=Class of Service,cn=plugins,cn=config:  nsslapd-pluginarg0	Modifying the mechanism for handling attribute values calculated using classic CoS.
cn=config,cn=ldbm database,cn=plugins,cn=config: nsslapd-dbcachesize	Modifying the dbcachesize attribute.
cn=config,cn=ldbm database,cn=plugins,cn=config: nsslapd-dbncache	Modifying the database cache.
cn=config:nsslapd-port	Changing the port number.
cn=config:nsslapd-secureport	Changing the secure port number.
cn=encryption,cn=config:nsssl2	Enabling or disabling SSL Version 2 for Directory Server.
cn=encryption,cn=config:nsssl3	Enabling or disabling SSL Version 3 for Directory Server.
cn=encryption,cn=config:nssslclientauth	Enabling or disabling client authentication.
cn=encryption,cn=config:nssslsessiontimeout	Changing the lifetime of an SSL session.
cn=suffixName,cn=ldbm database,cn=plugins,cn=config: nsslapd-cachesize	Modifying the cachesize attribute.

---

Plug-In Overview

The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config. A second look at Code Example 2-2 (configuration entry for the Telephone Syntax plug-in) described in Chapter 2, "Server Configuration Reference," shows some of the plug-in configuration attributes:

dn: cn=Telephone Syntax,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsSlapdPlugin cn: Telephone Syntax nsslapd-pluginPath: ServerRoot/lib/syntax-plugin.so nsslapd-pluginInitfunc: tel_init nsslapd-pluginType: syntax nsslapd-pluginEnabled: on

Some of these attributes are common to all plug-ins while others may be particular to a specific plug-in. You can check which attributes are currently being used by a given plug-in by performing an ldapsearch on the cn=config subtree.

Object Classes for Plug-In Configuration

All plug-ins are instances of the nsSlapdPlugin object class, which in turn inherits from the extensibleObject object class. For plug-in configuration attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry as shown in the following example:

dn:cn=ACL Plugin,cn=plugins,cn=config objectclass:top objectclass:extensibleObject objectclass:nsSlapdPlugin

---

Server Plug-In Functionality Reference

The following tables provide an overview of the plug-ins provided with Sun Java System Directory Server 5.2, along with their configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading. These tables will enable you to compare plug-in performance gains and costs and choose the optimal settings for your deployment. A reference to additional information on the plug-ins is provided where this is available.

7-Bit Check Plug-In

Plug-In Name	7-Bit Check (NS7bitAttr)
DN of Config Entry	cn=7-bit check,cn=plugins,cn=config
Description	Checks certain attributes are 7-bit clean.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	List of attributes (uid mail userpassword) followed by , (a comma) and then suffix(es) on which the check is to occur.
Dependencies	None
Performance Related Information	None
Further Information	If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in. When adding or modifying an attribute value checked by this plug-in, and the new value violates the 7-Bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as: Value of attribute attr contains extended (8-bit) characters: value

ACL Plug-In

Plug-In Name	ACL Plugin
DN of Config Entry	cn=ACL Plugin,cn=plugins,cn=config
Description	ACL access check plug-in
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 6, “Managing Access Control” in the Directory Server Administration Guide.

ACL Preoperation Plug-In

Plug-In Name	ACL preoperation
DN of Config Entry	cn=ACL preoperation,cn=plugins,cn=config
Description	ACL access check plug-in.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	Database
Performance Related Information	It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 6, “Managing Access Control” in the Directory Server Administration Guide.

Binary Syntax Plug-In

Plug-In Name	Binary Syntax
DN of Config Entry	cn=Binary Syntax,cn=plugins,cn=config
Description	Syntax for handling binary data.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Boolean Syntax Plug-In

Plug-In Name	Boolean Syntax
DN of Config Entry	cn=Boolean Syntax,cn=plugins,cn=config
Description	Syntax for handling booleans.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Case Exact String Syntax Plug-In

Plug-In Name	Case Exact String Syntax
DN of Config Entry	cn=Case Exact String Syntax,cn=plugins,cn=config
Description	Syntax for handling case-sensitive strings.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Case Ignore String Syntax Plug-In

Plug-In Name	Case Ignore String Syntax
DN of Config Entry	cn=Case Ignore String Syntax,cn=plugins,cn=config
Description	Syntax for handling case-insensitive strings.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Chaining Database Plug-In

Plug-In Name	Chaining Database
DN of Config Entry	cn=Chaining database,cn=plugins,cn=config
Description	Syntax for handling DNs.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	“Creating Chained Suffixes” in Chapter 3 of the Directory Server Administration Guide.

Class of Service Plug-In

Plug-In Name	Class of Service
DN of Config Entry	cn=Class of Service,cn=plugins,cn=config
Description	Allows for sharing of attributes between entries.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	Set the nsslapd-pluginarg0 attribute to: 0 (default) to enable fast lookup of classic CoS templates 1 to disable fast lookup for classic CoS template selection 2 to disable checks for ambiguous pointer and classic CoS definitions Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages. 3 to disable both Restart Directory Server for modifications to take effect.
Dependencies	None
Performance Related Information	It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 5, “Advanced Entry Management” in the Directory Server Administration Guide. For monitoring information, refer to cn=monitor,cn=Class of Service,cn=plugins,  cn=config.

Country String Syntax Plug-In

Plug-In Name	Country String Syntax
DN of Config Entry	cn=Country String Syntax,cn=plugins,cn=config
Description	Syntax for handling countries.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Distinguished Name Syntax Plug-In

Plug-In Name	Distinguished Name Syntax
DN of Config Entry	cn=Distinguished Name Syntax,cn=plugins,cn=config
Description	Syntax for handling DNs.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

DSML Frontend Syntax Plug-In

Plug-In Name	Frontends
DN of Config Entry	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Description	Enables you to access the directory using DSMLv2 over SOAP/HTTP.
Configurable Options	on | off
Default Setting	off
Configurable Arguments	ds-hdsml-soapschemalocation ds-hdsml-dsmlschemalocation
Dependencies	None
Performance Related Information	None

Generalized Time Syntax Plug-In

Plug-In Name	Generalized Time Syntax
DN of Config Entry	cn=Generalized Time Syntax,cn=plugins,cn=config
Description	Syntax for dealing with dates, times, and time zones.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

Integer Syntax Plug-In

Plug-In Name	Integer Syntax
DN of Config Entry	cn=Integer Syntax,cn=plugins,cn=config
Description	Syntax for handling integers.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

Internationalization Plug-In

Plug-In Name	Internationalization Plugin
DN of Config Entry	cn=Internationalization Plugin,cn=plugins,cn=config
Description	Syntax for handling DNs.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the dse.ldif file.
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	Refer to Chapter 5, "Directory Internationalization Reference."

ldbm Database Plug-In

Plug-In Name	ldbm database plug-in
DN of Config Entry	cn=ldbm database plug-in,cn=plugins,cn=config
Description	Implements local databases.
Configurable Options	N/A
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Refer to Database Plug-In Attributes for further information on database configuration. It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 2, “Creating Your Directory Tree” in the Directory Server Administration Guide.

Legacy Replication Plug-In

Plug-In Name	Legacy Replication plug-in
DN of Config Entry	cn=Legacy Replication plug-in,cn=plugins,  cn=config
Description	Enables Sun Java System Directory Server 5.2 to be a consumer of a 4.x supplier.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None.
Dependencies	database
Performance Related Information	None
Further Information	This plug-in can be disabled if the server is not (and never will be) a consumer of a 4.x server. Refer to Chapter 8, “Managing Replication” in the Directory Server Administration Guide for more information.

Multimaster Replication Plug-In

Plug-In Name	Multimaster Replication Plugin
DN of Config Entry	cn=Multimaster Replication plugin,cn=plugins,  cn=config
Description	Enables replication between two 5.x Directory Servers.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	database
Performance Related Information	N/A
Further Information	You can turn this plug-in off if you have only one server, which will never replicate. Refer to Chapter 8, “Managing Replication” in the Directory Server Administration Guide for more information.

Octet String Syntax Plug-In

Plug-In Name	Octet String Syntax
DN of Config Entry	cn=Octet String Syntax,cn=plugins,cn=config
Description	Syntax for handling octet strings.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

CLEAR Password Storage Plug-In

Plug-In Name	CLEAR
DN of Config Entry	cn=CLEAR,cn=Password Storage Schemes,cn=plugins,  cn=config
Description	CLEAR password storage scheme used for password encryption.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 7, “User Account Management” in the Directory Server Administration Guide.

CRYPT Password Storage Plug-In

Plug-In Name	CRYPT
DN of Config Entry	cn=CRYPT,cn=Password Storage Schemes,cn=plugins,  cn=config
Description	CRYPT password storage scheme used for password encryption.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 7, “User Account Management” in the Directory Server Administration Guide.

NS-MTA-MD5 Password Storage Scheme Plug-In

Plug-In Name	NS-MTA-MD5
DN of Config Entry	cn=NS-MTA-MD5,cn=Password Storage Schemes,  cn=plugins,cn=config
Description	NS-MTA-MD5 password storage scheme for password encryption.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only (the data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.) Refer to Chapter 7, “User Account Management” in the Directory Server Administration Guide.

SHA Password Storage Scheme Plug-In

Plug-In Name	SHA
DN of Config Entry	cn=SHA,cn=Password Storage Schemes,cn=plugins,  cn=config
Description	SHA password storage scheme for password encryption.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, we recommend that you choose SSHA instead, as SSHA is a far more secure option.
Further Information	Chapter 7, “User Account Management” in the Directory Server Administration Guide.

SSHA Password Storage Scheme Plug-In

Plug-In Name	SSHA
DN of Config Entry	cn=SSHA,cn=Password Storage Schemes,cn=plugins,  cn=config
Description	SSHA password storage scheme for password encryption.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 7, “User Account Management” in the Directory Server Administration Guide.

Postal Address String Syntax Plug-In

Plug-In Name	Postal Address Syntax
DN of Config Entry	cn=Postal Address Syntax,cn=plugins,cn=config
Description	Syntax used for handling postal addresses.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

PTA Plug-In

Plug-In Name	Pass Through Authentication
DN of Config Entry	cn=Pass Through Authentication,cn=plugins,  cn=config
Description	Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.
Configurable Options	on | off
Default Setting	off
Configurable Arguments	The LDAP URL to the configuration directory. nsslapd-pluginarg0: ldap://config.example.com/o=NetscapeRoot
Dependencies	None
Further Information	Chapter 14, “Using the Pass-Through Authentication Plug-in” in the Directory Server Administration Guide. Note that the PTA plug-in is not listed in Directory Server console or in the dse.ldif file if you use the same server instance for your user directory and your configuration directory.

Referential Integrity Postoperation Plug-In

Plug-In Name	Referential Integrity Postoperation
DN of Config Entry	cn=Referential Integrity Postoperation,  cn=plugins,cn=config
Description	Enables the server to ensure referential integrity.
Configurable Options	All configuration and on | off
Default Setting	off
Configurable Arguments	When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember1, owner and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes. The following arguments are configurable: 1.  (nsslapd-pluginarg0) Check for referential integrity -1 = no check for referential integrity  0 = check for referential integrity is performed immediately positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified. 2.  (nsslapd-pluginarg1) Log file for storing the change, for example ServerRoot/slapd-serverID/logs/referint 3.  (nsslapd-pluginarg2) Reserved for future use. 4.  (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.
Dependencies	database type
Limitations	Observe the following limitations when you use the referential integrity plug-in in a multi-master replication environment: Enable the referential integrity plug-in on all servers containing master replicas Enable the referential integrity plug-in with the same configuration on every master
Further Information	Refer to “Maintaining Referential Integrity” in Chapter 2 of the Directory Server Administration Guide.
Example Configuration Entry	The following example configures the plug-in to check for referential integrity immeditately, store logs in ServerRoot/slapd-serverID/logs/referint, and cover attribute types member, uniqueMember, owner, seeAlso, and nsroledn. dn: cn=referential integrity postoperation,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: ds-signedPlugin objectClass: extensibleObject cn: referential integrity postoperation nsslapd-pluginPath: ServerRoot/lib/referint-plugin.so nsslapd-pluginInitfunc: referint_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-pluginarg0: 0 nsslapd-pluginarg1: ServerRoot/slapd-serverID/logs/referint nsslapd-pluginarg2: 0 nsslapd-pluginarg3: member nsslapd-pluginarg4: uniquemember nsslapd-pluginarg5: owner nsslapd-pluginarg6: seeAlso nsslapd-pluginarg7: nsroledn nsslapd-plugin-depends-on-type: database ds-pluginDigest:: base64EncodedDigest ds-pluginSignature:: base64EncodedSignature nsslapd-pluginId: referint nsslapd-pluginVersion: 5.2_Patch_2 nsslapd-pluginVendor: Sun Microsystems, Inc. nsslapd-pluginDescription: referential integrity plugin

1If uniqueMember values contain optional hashes (#) followed by unique identifiers, this attribute cannot be used with the referential integrity plug-in.

Retro Changelog Plug-In

Plug-In Name	Retro Changelog Plugin
DN of Config Entry	cn=Retro Changelog Plugin,cn=plugins,cn=config
Description	Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions. Maintains a log of all changes occurring in Directory Server. The Retro Changelog offers the same functionality as the changelog in the 4.x versions of Directory Server.
Configurable Options	on | off
Default Setting	off
Configurable Arguments	Refer to Retro Changelog Plug-In Attributes for further information on the two configuration attributes for this plug-in.
Dependencies	None
Performance Related Information	May slow down Directory Server performance.
Further Information	Chapter 8, “Managing Replication” in the Directory Server Administration Guide.

Roles Plug-In

Plug-In Name	Roles Plugin
DN of Config Entry	cn=Roles Plugin,cn=plugins,cn=config
Description	Enables the use of roles in Directory Server.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	State Change Plugin
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.
Further Information	Chapter 5, “Advanced Entry Management” in the Directory Server Administration Guide.

State Change Plug-In

Plug-In Name	State Change Plugin
DN of Config Entry	cn=State Change Plugin,cn=plugins,cn=config
Description	State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen. ‘This plug-in is used internally by the roles plug-in.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None

Subtree Entry Counter Plug-Ins

Plug-In Name	Subtree Entry Counter For ObjectClass
DN of Config Entry	cn=Subtree Entry Counter for ObjectClass,cn=plugins,  cn=config
Description	Maintain a count of entries with a particular object class. The following plug-ins are provided:   - Subtree entry counter for departments in domains   - Subtree entry counter for domains within a domain   - Subtree entry counter for mail lists   - Subtree entry counter for nested departments   - Subtree entry counter for total domains   - Subtree entry counter for users
Configurable Options	on | off
Default Setting	off
Configurable Arguments	None
Dependencies	None
Performance Related Information	These plug-ins are provided for use with Messaging Server only, and are disabled by default. It is recommended that you leave these plug-ins disabled unless your Messaging Server requires them.

Telephone Syntax Plug-In

Plug-In Name	Telephone Syntax
DN of Config Entry	cn=Telephone Syntax,cn=plugins,cn=config
Description	Syntax for handling telephone numbers.
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

UID Uniqueness Plug-In

Plug-In Name	UID Uniqueness
DN of Config Entry	cn=UID Uniqueness,cn=plugins,cn=config
Description	Checks that the values of specified attributes are unique each time a modification occurs on an entry.
Configurable Options	on | off
Default Setting	off
Configurable Arguments	You may configure this plug-in in either of two different ways. 1.  You specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com, configure the arguments in the configuration entry as follows: nsslapd-pluginarg0: employeeNumber nsslapd-pluginarg1: uid nsslapd-pluginarg2: o=org1,dc=example,dc=com nsslapd-pluginarg3: o=org2,dc=example,dc=com 2.  You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique across in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson objectclass, configure the arguments in the configuration entry as follows: nsslapd-pluginarg0: employeeNumber nsslapd-pluginarg1: uid nsslapd-pluginarg2: MarkerObjectClass="organization"  RequiredObjectClass="inetOrgPerson"
Dependencies	database type
Performance Related Information	Sun Java System Directory Server 5.2 provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes. The UID Uniqueness plug-in may slow down Directory Server performance.
Further Information	Chapter 15, “Using the UID Uniqueness Plug-in” in the Directory Server Administration Guide.

URI Plug-In

Plug-In Name	URI Syntax
DN of Config Entry	cn=URI Syntax,cn=plugins,cn=config
Description	Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)
Configurable Options	on | off
Default Setting	on
Configurable Arguments	None
Dependencies	None
Performance Related Information	Do not modify the configuration of this plug-in. It is recommended that you leave this plug-in running at all times.

---

Attributes Common to All Plug-Ins

This list provides a brief attribute description, the Entry DN, valid range, default value, syntax, and an example for each attribute.

nsslapd-pluginPath

Specifies the full path to the plug-in.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any valid path
Default Value	None
Syntax	DirectoryString
Example	nsslapd-pluginPath: /usr/ds5/lib/uid-plugin.so

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any valid plug-in function.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginType

Specifies the plug-in type. Refer to nsslapd-plugin-depends-on-type for further information.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any valid plug-in type.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-pluginType: preoperation

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any valid plug-in ID.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-pluginId: chaining database

nsslapd-pluginVersion

Specifies the plug-in version.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any valid plug-in version.
Default Value	Product version
Syntax	DirectoryString
Example	nsslapd-pluginVersion: 5.0b1

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	Any approved plug-in vendor.
Default Value	Sun Microsystems, Inc.
Syntax	DirectoryString
Example	nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginDescription

Provides a description of the plug-in.

Property	Value
Entry DN	cn=plug-inName,cn=plugins,cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString
Example	nsslapd-pluginDescription: acl access check plug-in

---

Attributes Allowed by Certain Plug-Ins

nsslapd-plugin-depends-on-type

Multi-valued attribute, used to ensure that plug-ins are called by the server in the correct order. Takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType. For details, refer to nsslapd-pluginType. All plug-ins whose type value matches one of the values in the following valid range will be started by the server prior to this plug-in. The following example shows that the database plug-in will be started prior to the postoperation Referential Integrity plug-in.

Property	Value
Entry DN	cn=referential integrity postoperation,cn=plugins,  cn=config
Valid Range	Database
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-plugin-depends-on-type: database

nsslapd-plugin-depends-on-named

Multi-valued attribute, used to ensure that plug-ins are called by the server in the correct order. Takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it will be started by the server prior to this plug-in. If the plug-in does not exist, the server will fail to start. The following example shows that the Class of Service plug-in will be started prior to the postoperation Referential Integrity plug-in. If the Class of Service plug-in does not exist, the server will fail to start.

Property	Value
Entry DN	cn=referential integrity postoperation,cn=plugins,cn=config
Valid Range	Class of Service
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-plugin-depends-on-named: Class of Service

---

Database Plug-In Attributes

The database plug-in is also organized in an information tree as shown in the following diagram:

All plug-in technology used by the database instances is stored in the cn=ldbm database plug-in node. This section presents the additional attribute information for each of the nodes in bold in the cn=ldbm database,cn=plugins,cn=config information tree.

Database Configuration Attributes

Global configuration attributes common to all database instances are stored in the cn=config,cn=ldbm database,cn=plugins,cn=config tree node.

nsLookthroughLimit

This performance-related attribute specifies the maximum number of entries that Directory Server will check when examining candidate entries in response to a search request. If you bind as the directory manager DN, unlimited is set by default and overrides any other settings you may specify here.

Binder based resource limits work for this limit, which means that if a value for the operational attribute nsLookThroughlimit is present in the entry used to bind, the default limit is overridden. If you attempt to set a value that is not a number or is too big for a 64-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	-1 to the maximum number of entries (where -1 is unlimited)
Default Value	5000
Syntax	Integer
Example	nsLookthroughLimit: 5000

nsslapd-allidsthreshold

This performance-related attribute is present by default. It specifies the number of entry IDs that can be maintained for an index key, before the server sets the All IDs token and stops maintaining a list of IDs for that specific key. If you attempt to set a value that is not a number or is too big for a 64-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

However, as tuning this attribute is a complex task and can severely degrade performance, it is advisable to keep the default value. For a more detailed explanation of the All IDs Threshold refer to Chapter 10,“Managing Indexes” in the Directory Server Administration Guide, and to information on indexing in the Directory Server Performance Tuning Guide.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	100 to the maximum 64-bit integer value entry IDs
Default Value	4000
Syntax	Integer
Example	nsslapd-allidsthreshold: 4000

nsslapd-cache-autosize

This performance tuning related attribute is turned off by default. It specifies the percentage of free memory to use for all the combined caches. For example, if the value is set to 80, then 80 percent of the remaining free memory is claimed for the cache. If you plan to run other servers on the machine, then the value will be lower. Setting the value to 0 turns off the cache autosizing and uses the normal nsslapd-cachememsize and nsslapd-dbcachesize attributes.

When possible, use nsslapd-cachememsize and nsslapd-dbcachesize instead.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 (turns cache autosizing off) to 100
Default Value	0
Syntax	Integer
Example	nsslapd-cache-autosize: 80

nsslapd-cache-autosize-split

This performance-related attribute specifies the percentage of cache space to allocate to the database cache. For example, setting this to “60” would give the database cache 60 percent of the cache space and divide the remaining 40 percent between the backend entry caches. That is, if there were 2 databases, each of them would receive 20 percent. This attribute applies only when the nsslapd-cache-autosize attribute has a non-zero value.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 - 100
Default Value	66 (This will not necessarily optimize your operations.)
Syntax	Integer
Example	nsslapd-cache-autosize-split: 66

nsslapd-dbcachesize

This performance tuning related attribute specifies database cache size. Note that this is neither the index cache nor the entry cache. If you activate automatic cache resizing, you override this attribute, by replacing these values with its own guessed values at a later stage of the server startup.

If you attempt to set a value that is not a number or is too big for a 32-bit or 64-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	500KB to 4GB for 32-bit platforms and 500KB to 2^64-1 for 64-bit platforms
Default Value	10 MB
Syntax	Integer
Example	nsslapd-dbcachesize: 10 MB

Note	On Solaris platforms, the actual cache used may be significantly higher than what is specified in the nsslapd-cachememsize and and nsslapd-dbcachesize attributes. It is therefore recommended that you do not specify a total cache size of more than 2 GB for 32-bit servers.

nsslapd-db-checkpoint-interval

The amount of time in seconds after which Directory Server sends a checkpoint record to the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. A checkpoint record indicates which database operations have been physically written to the directory database. The checkpoint records are used to determine where in the database transaction log to begin recovery after a system failure. The nsslapd-db-checkpoint-interval attribute is absent from dse.ldif. To change the checkpoint interval, you add the attribute to dse.ldif. This attribute can be dynamically modified using ldapmodify. For further information on modifying this attribute, refer to the section on “Transaction Logging” in the Directory Server Performance Tuning Guide.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Sun engineering staff and Sun Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause Directory Server to be unstable.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	10 to 300 seconds
Default Value	60
Syntax	Integer
Example	nsslapd-db-checkpoint-interval: 120

nsslapd-db-circular-logging

Specifies circular logging for the transaction log files. If this attribute is switched off, old transaction log files are not removed, and are kept renamed as old log transaction files. Turning circular logging off can severely degrade server performance. It should therefore only be modified with the guidance of Sun engineering staff and Sun Professional Services.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	on or off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-db-circular-logging: on

nsslapd-db-durable-transactions

Indicates whether database transaction log entries are immediately written to the disk. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only.

With durable transactions enabled, every directory change is physically recorded in the log file and is therefore able to be recovered in the event of a system failure. However, the durable transactions feature may also slow down the performance of Directory Server. With durable transactions disabled, all transactions are logically written to the database transaction log but may not be physically written to disk immediately. If there is a system failure before a directory change is physically written to disk, that change is not recoverable.

Note	In previous versions of Directory Server, this attribute could not be modified dynamically. In Directory Server 5.2, this attribute can be modified dynamically using ldapmodify, without stopping the server.

For more information on database transaction logging, refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsslapd-db-durable-transactions: on

nsslapd-db-home-directory

Used to fix a situation where the operating system endlessly flushes pages. This flushing can be so excessive that performance of the entire system is severely degraded.

This situation will occur only for certain combinations of the database cache size, the size of physical memory, and kernel tuning attributes. In particular, this situation should not occur if the database cache size is less than 100 MB.

For example, if your Solaris host seems excessively slow and your database cache size is around 100 MB or more, then you can use the iostat utility to diagnose the problem. Use iostat to monitor the activity of the disk where the Directory Server’s database files are stored. If all of the following conditions are true:

The disk is heavily used (more than 1 MB per second of data transfer)
There is a long service time (more than 100 ms)
There is mostly write activity

then you should use the nsslapd-db-home-directory attribute to specify a subdirectory of a tempfs type file system.

Note	The directory referenced by the nsslapd-db-home-directory attribute must be a subdirectory of a file system of type tempfs (such as /tmp). If you have multiple Directory Servers on the same machine, their nsslapd-db-home-directory attributes must be configured with different directories. Failure to do so will result in the databases for both directories becoming corrupted. Finally, use of this attribute causes internal Directory Server database files to be moved to the directory referenced by the attribute. It is possible, but unlikely, that the server will no longer start after the files have been moved because not enough memory can be committed. This is a symptom of an overly large database cache size being configured for your server. If this happens, reduce the size of your database cache size to a value where the server will start again.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Any valid directory name in a tempfs file system, such as /tmp.
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-db-home-directory: /tmp/slapd-dirserv

nsslapd-db-idl-divisor

Specifies the index block size in terms of the number of blocks per database page. The block size is calculated by dividing the database page size by the value of this attribute. A value of 1 makes the block size exactly equal to the page size. The default value of 0 sets the block size to the page size minus an estimated allowance for internal database overhead. Before modifying the value of this attribute export all databases using the db2ldif script. Once the modification has been made, reload the databases using the ldif2db script.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 8
Default Value	0
Syntax	Integer
Example	nsslapd-db-idl-divisor: 2

nsslapd-db-locks

Specifies the number of locks that can be used by the database. Increase the value of this attribute if you observe the following error:

libdb: Lock table is out of available locks

The current number of locks being used, the number of locks configured, and the maximum number of locks reached during the life of the process can be checked using the attributes nsslapd-db-current-locks, nsslapd-db-configured-locks, and nsslapd-db-max-locks respectively, under the entry cn=database,cn=monitor,cn=ldbm dababase,cn=plugins,cn=config.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	1 to maximum integer
Default Value	20000
Syntax	Integer
Example	nsslapd-db-locks: 20000

nsslapd-db-logbuf-size

Specifies the log information buffer size. Log information is stored in memory until the buffer fills up or the transaction commit forces the buffer to be written to disk. Larger buffer sizes can significantly increase throughput in the presence of highly concurrent applications, or transactions producing large amounts of data. The nsslapd-db-logbuf-size attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

Note	You must be prepared to export all databases to LDIF, remove existing databases, and reimport all databases from LDIF when modifying this attribute. Refer to the Directory Server Performance Tuning Guide for instructions.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0, 32768 to 2097152 bytes (limited by the transaction log file size, which is 10 MB by default) 0 is equivalent to 32768 bytes
Default Value	524288 for new instances
Syntax	Integer
Example	nsslapd-db-logbuf-size: 524288

nsslapd-db-logdirectory

The path to the directory containing the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. By default, the database transaction log is stored in the same directory as the directory entries themselves:

ServerRoot/slapd-serverID/db

For fault-tolerance and performance reasons, you may want to move this log file to another physical disk. The nsslapd-db-logdirectory attribute is absent from dse.ldif. To change the location of the database transaction log, add the attribute to dse.ldif.

Note	You must be prepared to export all databases to LDIF, remove existing databases, and reimport all databases from LDIF when modifying this attribute.

For more information on database transaction logging, refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Any valid path and directory name.
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-db-logdirectory: /logs/txnlog

nsslapd-db-logfile-size

Specifies the maximum size of a single file in the log in bytes. By default, or if the value is set to 0, a maximum size of 10 MB is used. The maximum size is an unsigned 4-byte value. The value of this attribute can have significant impact on performance, as it can be tuned to avoid extensive log switching in the event of heavy entries.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to unsigned 4-byte integer
Default Value	10 (MB)
Syntax	Integer
Example	nsslapd-db-logfile-size: 10

nsslapd-db-page-size

Specifies the size of the pages used to hold items in the database in bytes. The minimum size is 512 bytes and the maximum size is 64K bytes. If the page size is not explicitly set, Directory Server defaults to a page size of 8K bytes. Changing this default value can have significant performance impact. If the page size is too small, it results in extensive page splitting and copying, whereas if the page size is too large, it can waste disk space.

Note	You must be prepared to export all databases to LDIF, remove existing databases, and reimport all databases from LDIF when modifying this attribute.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	512 bytes to 64 KB
Default Value	8 (KB)
Syntax	Integer
Example	nsslapd-db-page-size: 8

nsslapd-db-transaction-batch-val

Specifies how many transactions will be batched before being committed. You can use this attribute to improve update performance when full transaction durability is not required. This attribute can be dynamically modified using ldapmodify.

If you do not define this attribute or set it to a value of 0, transaction batching will be turned off and it will be impossible to make remote modifications to this attribute via LDAP. However, setting this attribute to a value greater than 0 causes the server to delay committing transactions until the number of queued transactions is equal to the attribute value. A value greater than 0 also allows you to modify this attribute remotely via LDAP. A value of 1 for this attribute allows you to modify the attribute setting remotely via LDAP, but results in no batching behavior. A value of 1 at server startup is therefore useful for maintaining normal durability, while also allowing transaction batching to be turned on and off remotely when desired. Bear in mind that the value you choose for this attribute may require you to modify the nsslapd-db-logbuf-size attribute to ensure sufficient log buffer size for accommodating your batched transactions.

Note	The nsslapd-db-transaction-batch-val attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

For more information on database transaction logging, refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to 30
Default Value	0 (or turned off)
Syntax	Integer
Example	nsslapd-db-transaction-batch-val: 5

nsslapd-db-tx-max

Specifies the maximum number of concurrent transactions that can be handled by the database. Increase the value of this attribute if you observe the following error:

Serious Error---Failed in dblayer_txn_begin, err=12 (Not enough space)

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	1 to maximum integer
Default Value	200
Syntax	Integer
Example	nsslapd-db-tx-max: 200

nsslapd-dbncache

This attribute allows you to split the ldbm cache into equally sized separate pieces of memory. It is possible to specify caches that are large enough so that they cannot be allocated contiguously on some architectures. For example, some releases of Solaris limit the amount of memory that may be allocated contiguously by a process. If nsslapd-dbncache is 0 or 1, the cache will be allocated contiguously in memory. If it is greater than 1, the cache will be broken up into ncache equally sized separate pieces of memory.

This attribute is provided only for system modification/diagnostics and should be changed only with the guidance of Sun engineering staff and Sun Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause Directory Server to be unstable.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Positive integer or 0
Default Value	0
Syntax	Integer
Example	nsslapd-dbncache: 0

nsslapd-import-cachesize

This performance tuning related attribute determines the size of the database cache used in the bulk import process. By setting this attribute value so that the maximum available system physical memory is used for the database cache during bulk importing, you can optimize bulk import speed. If you attempt to set a value that is not a number or is too big for a 32-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Note	A cache is created for each load that occurs. For example, if the user sets the nsslapd-import-cachesize attribute to 1 GB, then 1 GB is used when loading one database, 2 GB is used when loading 2 databases, and so forth. Ensure that you have sufficient physical memory to prevent swapping from occurring, as this results in performance degradation.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	20 MB to 4 GB for 32-bit platforms and 20 MB to 2^64-1 for 64-bit platforms
Default Value	20971520 (20 MB)
Syntax	Integer
Example	nsslapd-import-cachesize: 20971520

nsslapd-mode

Specifies the permissions used for newly created index files.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Any four-digit octal number. However, mode 0600 is recommended. This allows read and write access for the owner of the index files (which is the user that ns-slapd runs as), and no access for other users.
Default Value	0600
Syntax	Integer
Example	nsslapd-mode: 0600

nsslapd-exclude-from-export

Specifies a list of attributes that will be excluded when the database is exported.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	N/A
Default Value	entrydn entryid dncomp parentid numSubordinates
Syntax	DirectoryString
Example	nsslapd-exclude-from-export: entrydn entryid

nsslapd-disk-low-threshold

Specifies the “low” free space on the disk (in MB). When the available free space on any one of the disks used by a database instance falls below the value specified by this attribute, protocol updates on that instance are permitted only by the directory manager.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to unsigned 4-byte integer
Default Value	100
Syntax	Integer
Example	nsslapd-disk-low-threshold: 100

nsslapd-disk-full-threshold

When the minimum free space on the disk (in MB). When the available free space on any one of the disks used by a database instance falls below the value specified by this attribute, no updates are permitted and the server returns an LDAP_UNWILLING_TO_PERFORM error. Updates are allowed again as soon as free space rises above the threshold.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	0 to unsigned 4-byte integer
Default Value	10
Syntax	Integer
Example	nsslapd-disk-full-threshold: 10

Database Monitoring Attributes

Table 2-11 lists the global read-only attributes containing database statistics for monitoring activity on databases. These attributes are stored under cn=monitor,cn=ldbm database,cn=plugins,cn=config. For more information on these monitoring read-only entries refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

Table 2-11  Database Monitoring Attributes 

Attribute	Description
dbcachehits	Requested pages found in the database.
dbcachetries	Total requested pages found in the database cache.
dbcachehitratio	Percentage of requested pages found in the database cache (hits/tries).
dbcachepagein	Pages read into the database cache.
dbcachepageout	Pages written from the database cache to the backing file.
dbcacheroevict	Clean pages forced from the cache.
dbcacherwevict	Dirty pages forced from the cache.

Database Configuration Attributes Under cn=NetscapeRoot and cn=UserRoot

The cn=NetscapeRoot and cn=UserRoot subtrees contain configuration data for the databases containing the o=NetscapeRoot and o="suffixname" suffixes, respectively. The cn=NetscapeRoot subtree contains the configuration data used by the Sun Java System Administration Server for authentication and all actions that cannot be performed through LDAP (such as start/stop). The cn=UserRoot subtree contains all the configuration data for the user-defined database. The cn=UserRoot subtree is called UserRoot by default. However, this is not hard-coded, and, given the fact that there will be multiple database instances, this name will be changed and defined by the user when new databases are added.

The following attributes are common to both the cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config and cn=UserRoot,cn=ldbm database,cn=plugins,cn=config subtrees.

nsslapd-cachesize

This performance tuning related attribute specifies the cache size in terms of the entries it can hold. However, it is worth noting that it is simpler to limit by memory size only (using the nsslapd-cachememsize attribute). If you attempt to set a value that is not a number or is too big for a 32-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=suffixName,cn=ldbm database,cn=plugins,cn=config
Valid Range	1 to 2,147,483,647 (or -1 which means limitless) entries
Default Value	-1
Syntax	Integer
Example	nsslapd-cachesize: -1

nsslapd-cachememsize

This performance tuning related attribute specifies the cache size in terms of available memory space. Limiting cachesize in terms of memory occupied is the simplest method. By activating automatic cache resizing, you override this attribute, replacing these values with its own guessed values at a later stage of the server startup. If you attempt to set a value that is not a number or is too big for a 64-bit (32-bit for 32-bit installations) signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Property	Value
Entry DN	cn=suffixName,cn=ldbm database,cn=plugins,cn=config
Valid Range	200KB to 264-1 (232-1 for 32-bit installations)
Default Value	10 485 760 (10Mb)
Syntax	Integer
Example	nsslapd-cachememsize:10

nsslapd-directory

Specifies the absolute path to the database instance. If the database instance is created manually, this attribute must be included. It is set by default in the Sun Java System Server Console and can be modified. Once the database instance has been created, do not modify this path as any changes risk preventing the server from accessing data.

Property	Value
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Any valid absolute path to the database instance.
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-directory: /ServerRoot/slapd-serverID/db

nsslapd-readonly

Specifies read only permission. When this attribute is set to on, directory entries can be viewed but cannot be modified. This is useful, for example, when you are performing a backup of the directory.

Property	Value
Entry DN	cn=suffixName,cn=ldbm database,cn=plugins,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-readonly: off

nsslapd-require-index

When switched to on, this attribute allows you to refuse non-indexed or allids searches. This performance related attribute avoids saturating the server with erroneous searches.

Property	Value
Entry DN	cn=suffixName,cn=ldbm database,cn=plugins,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsslapd-require-index: off

nsslapd-suffix

Specifies the chained suffix. This is a single-valued attribute as each database instance can have only one suffix. Previously, it was possible to have more than one suffix on a single database instance but this is no longer the case. Any changes made to this attribute after the entry has been created take effect only after you restart the server containing the chained suffix.

Property	Value
Entry DN	cn=suffixName,cn=ldbm database,cn=plugins,cn=config
Valid Range	Any valid DN
Default Value	N/A
Syntax	DirectoryString
Example	nsslapd-suffix: o=Netscaperoot

Database Performance Attributes

Table 2-12 lists the read-only database performance attributes. These attributes are stored under cn=database,cn=monitor,cn=ldbm database, cn=plugins,cn=config. All of the values for these attributes are 32-bit integers.

Table 2-12  Database Performance Attributes 

Attribute	Description
nsslapd-db-abort-rate	Number of transactions that have been aborted.
nsslapd-db-active-txns	Number of transactions that are currently active (used by the database.)
nsslapd-db-cache-hit	Requested pages found in the cache.
nsslapd-db-cache-region-wait-rate	Number of times that a thread of control was forced to wait before obtaining the region lock.
nsslapd-db-cache-size-bytes	Total cache size in bytes.
nsslapd-db-cache-try	Total cache lookups.
nsslapd-db-clean-pages	Clean pages currently in the cache.
nsslapd-db-commit-rate	Number of transactions that have been committed.
nsslapd-db-configured-locks	Configured number of locks.
nsslapd-db-configured-txns	Configured number of transactions.
nsslapd-db-current-locks	Number of locks currently used by the database.
nsslapd-db-deadlock-rate	Number of deadlocks detected.
nsslapd-db-dirty-pages	Dirty pages currently in the cache.
nsslapd-db-hash-buckets	Number of hash buckets in buffer hash table.
nsslapd-db-hash-elements-examine-rate	Total number of hash elements traversed during hash table lookups.
nsslapd-db-hash-search-rate	Total number of buffer hash table lookups.
nsslapd-db-lock-conflicts	Total number of locks not immediately available due to conflicts.
nsslapd-db-lockers	Number of current lockers.
nsslapd-db-lock-region-wait-rate	Number of times that a thread of control was forced to wait before obtaining the region lock.
nsslapd-db-lock-request-rate	Total number of locks requested.
nsslapd-db-log-bytes-since-checkpoint	Number of bytes written to this log since the last checkpoint.
nsslapd-db-log-flush-commit	The number of log flushes that contained a transaction commit record.
nsslapd-db-log-flush-count	The number of times the log has been flushed to disk.
nsslapd-db-log-max-commit-per-flush	The maximum number of commits contained in a single log flush.
nsslapd-db-log-min-commit-per-flush	The minimum number of commits contained in a single log flush that contained a commit.
nsslapd-db-log-region-wait-rate	Number of times that a thread of control was forced to wait before obtaining the region lock.
nsslapd-db-log-write-count	The number of times the log has been written to disk.
nsslapd-db-log-write-count-fill	The number of times the log has been written to disk because the in-memory log record cache filled up.
nsslapd-db-log-write-rate	Number of bytes written to the log since the last checkpoint.
nsslapd-db-longest-chain-length	Longest chain ever encountered in buffer hash table lookups.
nsslapd-db-max-locks	Maximum number of locks used by the database since the last startup.
nsslapd-db-max-txns	Maximum number of transactions used since the last startup.
nsslapd-db-page-create-rate	Pages created in the cache.
nsslapd-db-page-read-rate	Pages read into the cache.
nsslapd-db-page-ro-evict-rate	Clean pages forced from the cache.
nsslapd-db-page-rw-evict-rate	Dirty pages forced from the cache.
nsslapd-db-pages-in-use	All pages, clean or dirty, currently in use.
nsslapd-db-page-trickle-rate	Dirty pages written using the memp_trickle interface.
nsslapd-db-page-write-rate	Pages read into the cache.
nsslapd-db-txn-region-wait-rate	Number of times that a thread of control was force to wait before obtaining the region lock.

Default Index Attributes

The set of default indexes is stored under cn=default indexes,cn=config, cn=ldbm database,cn=plugins,cn=config. Default indexes are configured per backend in order to optimize Directory Server functionality for the majority of deployments.

All indexes, except system-essential ones, can be removed, but care should be taken not to cause unnecessary disruptions. This section presents four required indexing attributes and one optional indexing attribute. For further information on indexes refer to Chapter 10, “Managing Indexes” in the Directory Server Administration Guide.

nsSystemIndex

This mandatory attribute specifies whether the index is a system index, that is, an index that is vital for Directory Server operations. If this attribute has a value of true, it is system essential. System indexes must not be removed as this will seriously disrupt server functionality.

Property	Value
Entry DN	cn=default indexes,cn=config,cn=ldbm database,  cn=plugins,cn=config
Valid Range	true | false
Default Value	N/A
Syntax	DirectoryString
Example	nssystemindex: true

nsIndexType

This optional, multi-valued attribute specifies the types of index used in Directory Server operations and the values of the attributes to be indexed. Each index type must be entered on a separate line.

Property	Value
Entry DN	cn=default indexes,cn=config,cn=ldbm database,  cn=plugins,cn=config
Valid Range	pres = presence index eq = equality index approx = approximate index sub = substring index matching rule= international index index browse = browsing index
Default Value	N/A
Syntax	DirectoryString
Example	nsindextype: eq

nsMatchingRule

This optional, multi-valued attribute specifies the collation order object identifier (OID) required for Directory Server to operate international indexing.

Property	Value
Entry DN	cn=default indexes,cn=monitor,cn=ldbm database,  cn=plugins,cn=config
Valid Range	Any valid collation order object identifier (OID)
Default Value	None
Syntax	DirectoryString
Example	nsMatchingRule: 1.3.6.1.4.1.42.2.27.9.4.23.1 (For Bulgarian)

cn

Provides the name of the attribute to be indexed.

Property	Value
Entry DN	cn=default indexes,cn=monitor,cn=ldbm database,  cn=plugins,cn=config
Valid Range	Any valid index cn.
Default Value	None
Syntax	DirectoryString
Example	cn: aci

description

This optional attribute provides a free-hand text description of what the index actually performs.

Property	Value
Entry DN	cn=default indexes,cn=monitor,cn=ldbm database,  cn=plugins,cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString
Example	description: substring index

Database Monitoring Attributes Under cn=NetscapeRoot

Table 2-13 lists the global, read-only entries for monitoring activity on the NetscapeRoot database, stored under cn=monitor,cn=Netscaperoot,cn=ldbm database, cn=plugins,cn=config. These attributes contain database statistics and are provided for each file that makes up your database. For further information refer to Chapter 12, “Managing Log Files” in the Directory Server Administration Guide.

Table 2-13  Database Monitoring Attributes Under cn=NetscapeRoot 

Attribute	Description
dbfilename-number	This attribute indicates the name of the file and provides a sequential integer identifier (starting at 0) for the file. All associated statistics for the file are given the same numerical identifier.
dbfilecachehit	Number of times that a search requiring data from this file was performed and data successfully obtained from the cache.
dbfilecachemiss	Number of times that a search requiring data from this file was performed and that the data could not be obtained from the cache.
dbfilepagein	Number of pages brought to the cache from this file.
dbfilepageout	Number of pages for this file written from cache to disk.

Database Index Attributes Under cn=NetscapeRoot and cn=UserRoot

In addition to the set of default indexes that are stored under cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=config, custom indexes can be created for o=Netscaperoot, o=UserRoot, and manually created databases. These custom indexes are stored under the cn=index,cn=NetscapeRoot,cn=ldbm database,cn=plugins,cn=config and cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=config entries, respectively. Each indexed attribute represents a subentry under the above cn=config information tree nodes, as shown in the following figure:

For example, the index file for the aci attribute under o=UserRoot will appear in Directory Server as follows:

dn:cn=aci,cn=index,cn=UserRoot,cn=ldbm database,cn=plugins,cn=confi objectclass:top objectclass:nsIndex cn=aci nssystemindex:true nsindextype:pres

Note that the aci attribute is an operational attribute and is not returned in a search unless you explicitly request it.

For details on the five possible indexing attributes, refer to the section Default Index Attributes. For further information about indexes refer to Chapter 10, “Managing Indexes” in the Directory Server Administration Guide.

VLV Index Object Classes

A VLV (virtual list view) index provides fast searches against a known result set and sort ordering. To do this, the object class vlvSearch is needed to define the VLV search, and the object class vlvIndex is needed to order the search. VLV index object classes are stored under cn=MCCsuffixName, cn=userRoot, cn=ldbm database,cn=plugins,cn=config.

vlvIndex

Used to define the sort criteria of a Virtual List View index. Each VLV index specification defines the sort order to be imposed on the result set defined in the VLV search entry. A set of VLV index entries may appear below the VLV search entry. The cn (commonName) attribute is used as the naming component for the entry.

Property	Value
Entry DN	cn=MCCsuffixName, cn=userRoot, cn=ldbm database,  cn=plugins, cn=config
Superior Class	top
OID	2.16.840.1.113730.3.2.42
Required Attributes	cn, objectClass, vlvSort
Allowed Attributes	vlvEnabled, vlvUses

vlvSearch

Used to define a VLV search. Specifies the entry result set to be VLV indexed.

Property	Value
Entry DN	cn=MCCsuffixName, cn=userRoot, cn=ldbm database,  cn=plugins, cn=config
Superior Class	top
OID	2.16.840.1.113730.3.2.38
Required Attributes	cn, objectClass, vlvBase, vlvFilter, vlvScope
Allowed Attributes	multiLineDescription

VLV Index Attributes

VLV Index Attributes are stored under cn=MCCsuffixName,cn=userRoot,
cn=ldbm database,cn=plugins,cn=config.

vlvBase

Defines the base DN of a VLV search.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DN
Example	vlvBase:o=example.com

vlvEnabled

Used by the server to signal whether the index is available or unavailable. When VLV indexes are created offline, new vlvSearch entries are enabled when the indexes are rebuilt. VLV indexes can also be created while the server is running in read-only mode. This attribute is read-only and single-valued.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range	0
Default Value	N/A
Syntax	Integer
Example	vlvEnabled:0

vlvFilter

Defines the filter for a VLV search.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range
Default Value	N/A
Syntax	IA5String
Example	vlvFilter:(uid>=r)

vlvScope

Defines the scope of a VLV search.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range	0=base search 1=one level search 2=subtree search
Default Value	N/A
Syntax	Integer
Example	vlvScope:1

vlvSort

Defines the sort specification for a VLV search. Consists of a list of comma-delimited attribute names. A minus sign is used to denote a reverse sort. The example below will result in a sort by uid, then by reverse common name.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString
Example	vlvSort:uid, -cn

vlvUses

This read-only attribute displays the number of times the VLV index was used. This number resets after a restart of the server.

Property	Value
Entry DN	cn=userRoot, cn=ldbm database, cn=plugins, cn=config
Valid Range	1-x
Default Value	N/A
Syntax	Integer
Example	vlvUses:7

---

Chained Suffix Plug-In Attributes

The chained suffix plug-in is organized in an information tree as shown below:

All plug-in technology used by the chained suffix instances is stored in the cn=chaining database plug-in node. This section presents the additional attribute information for the three nodes marked in bold in the cn=chaining database,cn=plugins,cn=config information tree. For more information on the chaining backend, refer to “Creating Chained Suffixes” in Chapter 3 of the Directory Server Administration Guide.

Chained Suffix Attributes

Global chained suffix configuration attributes common to all instances are stored under cn=config,cn=chaining database,cn=plugins,cn=config.

nsActiveChainingComponents

Lists the components using chaining. A component is any functional unit in the server. The value of this attribute overrides the value in the global configuration attribute. To disable chaining on a particular database instance, use the value None.

This attribute also allows you to alter the components used to chain. By default, no components are allowed to chain. For this reason, this attribute does not appear in a list of cn=config,cn=chaining database,cn=config attributes, as LDAP considers empty attributes to be non-existent.

Property	Value
Entry DN	cn=config,cn=chaining database,cn=plugins,cn=config
Valid Range	Any valid component entry.
Default Value	None
Syntax	DirectoryString
Example	nsActiveChainingComponents: cn=uid uniqueness,cn=plugins,cn=config

nsMaxResponseDelay

This error detection, performance related attribute specifies the maximum period of time it can take a remote server to respond to an LDAP operation request made by a chained suffix before an error is suspected. Once this delay period has been met, the chained suffix tests the connection with the remote server.

Property	Value
Entry DN	cn=config,cn=chaining database,cn=plugins,cn=config
Valid Range	Any valid delay period in seconds.
Default Value	60 seconds
Syntax	Integer
Example	nsMaxResponseDelay: 60

nsMaxTestResponseDelay

This error detection, performance related attribute specifies the duration of the test issued by the chained suffix to check whether the remote server is responding. If a response from the remote server is not returned within this period, the chained suffix assumes the remote server is down and the connection is not used for subsequent operations.

Property	Value
Entry DN	cn=config,cn=chaining database,cn=plugins,cn=config
Valid Range	Any valid delay period in seconds.
Default Value	15 seconds
Syntax	Integer
Example	nsMaxTestResponseDelay: 15

nsTransmittedControls

This attribute, which can be both a global (and thus dynamic) configuration or an instance (cn=chained suffix instance,cn=chaining database, cn=plugins,cn=config) configuration attribute, allows you to alter the controls that the chained suffix forwards. The following controls are forwarded by default:

Managed DSA, object identifier: 2.16.840.1.113730.3.4.2.
Virtual list view (VLV), object identifier: 2.16.840.1.113730.3.4.9
Server side sorting, object identifier: 1.2.840.113556.1.4.473

Property	Value
Entry DN	cn=config,cn=chaining database,cn=plugins,cn=config
Valid Range	Any valid OID or the above listed controls forwarded by the chained suffix.
Default Value	None
Syntax	Integer
Example	nsTransmittedControls: 1.2.840.113556.1.4.473

Default Instance Chained Suffix Attributes

Default instance chained suffix attributes are stored under cn=default instance config,cn=chaining database,cn=plugins,cn=config.

nsAbandonedSearchCheckInterval

The number of seconds that pass before the server checks for abandoned operations.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	0 to 2147483647 seconds
Default Value	2
Syntax	Integer
Example	nsabandonedsearchcheckinterval: 10

nsBindConnectionsLimit

Maximum number of TCP connections the chained suffix establishes with the remote server.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	1 to 50 connections
Default Value	3
Syntax	Integer
Example	nsbindconnectionslimit: 3

nsBindRetryLimit

Number of times a chained suffix attempts to bind with the remote server if the initial bind attempt is unsuccessful. A value of 0 here indicates that the chained suffix will only attempt to bind once only.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	0 to 5
Default Value	3
Syntax	Integer
Example	nsbindretrylimit: 3

nsBindTimeout

Period of time before the bind attempt times out. There is no real Valid Range for this attribute, except reasonable patience limits.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	0 to 60 seconds
Default Value	15
Syntax	Integer
Example	nsbindtimeout:15

nsCheckLocalACI

Reserved for advanced use only. Controls whether ACIs are evaluated on the chained suffix as well as the remote data server. Changes to this attribute only take effect once the server has been restarted.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nschecklocalaci: on

nsConcurrentBindLimit

The maximum number of concurrent bind operations per TCP connection.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	1 to 25 binds
Default Value	10
Syntax	Integer
Example	nsconcurrentbindlimit:10

nsConcurrentOperationsLimit

The maximum number of concurrent operations allowed.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	1 to 50 operations
Default Value	50
Syntax	Integer
Example	nsconcurrentoperationslimit: 50

nsConnectionLife

Specifies the connection lifetime. You can keep connections between the chained suffix and the remote server open for an unspecified time, or you can close them after a specific period of time. Keeping the connections open is faster, but uses more resources. When the value is 0 and a list of failover servers is provided in the nsFarmServerURL attribute, the “main” server is never contacted after failover to the alternate server.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	0 to limitless seconds (where 0 means forever)
Default Value	0
Syntax	Integer
Example	nsconnectionlife: 0

nsOperationConnectionsLimit

Maximum number of LDAP connections the chained suffix establishes with the remote server.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	1 to 20 connections
Default Value	10
Syntax	Integer
Example	nsoperationconnectionslimit:10

nsProxiedAuthorization

Reserved for advanced use only, this attribute permits you to disable proxied authorization. A value of off means that proxied authorization is disabled, and that all binds for chained operations are executed as the user specified in nsMultiplexorBindDN.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString
Example	nsproxiedauthorization: on

nsReferralOnScopedSearch

Controls whether referrals are returned for searches with scope of one level or subtree. When nsReferralOnScopedSearch is set to on, Directory Server returning referrals for such searches, instead of chaining the searches, allowing clients that can handle referrals to access the appropriate directory directly.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	on | off
Default Value	off
Syntax	DirectoryString
Example	nsreferralonscopedsearch: off

nsslapd-sizelimit

Specifies the size limit of an entry for the chained suffix, in entries.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	-1 (no limit) to 2147483647 entries
Default Value	2000
Syntax	Integer
Example	nsslapd-sizelimit: 2000

nsslapd-timelimit

Specifies the default search time limit for the chained suffix.

Property	Value
Entry DN	cn=default instance config,cn=chaining database,  cn=plugins,cn=config
Valid Range	-1 to 2147483647 seconds
Default Value	3600
Syntax	Integer
Example	nsslapd-timelimit: 3600

Instance-Specific Chained Suffix Attributes

Instance-specific chained suffix attributes are stored under cn=chained suffix instance name,cn=chaining database,cn=plugins,cn=config.

nsFarmServerURL

The LDAP URL of the remote server. A farm server is contains data in one or more databases. This attribute can contain optional servers for failover, separated by spaces. For cascading chaining, this URL can point to another chained suffix.

Refer to the Directory Server Administration Guide for details on configuring cascading chaining.

Property	Value
Entry DN	cn=chained suffix instance name,cn=chaining database,  cn=plugins,cn=config
Valid Range	Any valid remote server LDAP URL.
Default Value	N/A
Syntax	DirectoryString
Example	nsFarmServerURL: ldap://epdiote.example.com:alternate_server:3333

nsMultiplexorBindDN

DN of the administrative entry used to communicate with the remote server. The multiplexor is the server that contains the chained suffix and communicates with the farm server. This bind DN cannot be the Directory Manager. If this attribute is not specified, the chained suffix binds as anonymous.

Property	Value
Entry DN	cn=chained suffix instance name,cn=chaining database,  cn=plugins,cn=config
Valid Range	N/A
Default Value	DN of the multiplexor.
Syntax	DirectoryString
Example	nsMultiplexorBindDN: cn=proxy manager

nsMultiplexorCredentials

Password for the administrative user, in plain text. If no password is provided, users can bind as anonymous. The password is encrypted in the configuration file. Please note that the example below is what you view, not what you type.

Property	Value
Entry DN	cn=chained suffix instance name,cn=chaining database,c  n=plugins,cn=config
Valid Range	Any valid password (that is encrypted using the DES reversible password encryption schema.)
Default Value	N/A
Syntax	DirectoryString
Example	nsMultiplexorCredentials: {DES} 9Eko69APCJfF

nshoplimit

Specifies the maximum number of times a suffix is allowed to chain, that is, the number of times a request can be forwarded from one chained suffix to another.

Property	Value
Entry DN	cn=chained suffix instance name,cn=chaining database,  cn=plugins,cn=config
Valid Range	1 to an appropriate upper limit for your deployment.
Default Value	10
Syntax	Integer
Example	nsHopLimit: 3

Chained Suffix Monitoring Attributes

Table 2-14 lists the chained suffix attributes used for monitoring activity on instances. These attributes are stored under cn=monitor,cn=database instance name, cn=chaining database,cn=plugins,cn=config.

Table 2-14  Chained Suffix Monitoring Attributes 

Attribute	Description
nsAddCount	Number of add operations received.
nsDeleteCount	Number of delete operations received.
nsModifyCount	Number of modify operations received.
nsRenameCount	Number of rename operations received.
nsSearchBaseCount	Number of base level searches received.
nsSearchOneLevelCount	Number of one-level searches received.
nsSearchSubtreeCount	Number of subtree searches received.
nsAbandonCount	Number of abandon operations received.
nsBindCount	Number of bind requests received.
nsUnbindCount	Number of unbinds received.
nsCompareCount	Number of compare operations received.
nsOperationConnectionCount	Number of open connections for normal operations.
nsBindConnectionCount	Number of open connections for bind operations.

---

Frontend Plug-In Attributes

The frontend plug-in enables you to access directory data by methods other than LDAP. Sun Java System Directory Server 5.2 provides a DSML frontend plug-in that enables access using DSMLv2 over HTTP/SOAP. Attributes for the DSML frontend plug-in are stored under cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,cn=config.

ds-hdsml-clientauthmethod

Defines how the server will identify a client on a secure (SSL) connection.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	clientCertOnly: the server uses the credentials from the client certificate to identify the client. httpBasicOnly: the server uses the credentials from the HTTP authorization header to identify the client. clientCertFirst: the server attempts to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.
Default Value	clientCertFirst
Syntax	DirectoryString
Example	ds-hdsml-clientauthmethod: clientCertFirst

ds-hdsml-dsmlschemalocation

The path to the DSMLv2 schema. This is generated automatically and should not be changed.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	Any valid path to the directory storing the DSML schema.
Default Value	ServerRoot/lib/DSMLv2.xsd
Syntax	DirectoryString
Example	ds-hdsml-dsmlschemalocation:  /var/ds5/slapd-myServer/lib/DSMLv2.xsd

ds-hdsml-iobuffersize

The size of the buffer in which the DSML request is stored. If Directory Server receives many large DSML requests, such as large modify requests, then increasing this value may allow fewer buffers to be passed from the HTTP front end to the DSML parsers.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (231-1). The value must be a multiple of 256.
Default Value	8192
Syntax	Integer
Example	ds-hdsml-buffersize: 8192

ds-hdsml-poolmaxsize

The maximum number of DSML parsers kept ready to handle DSML requests. If you expect sustained traffic of many concurrent DSML requests, you may choose to increase the value of this attribute.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins  cn=config
Valid Range	1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (231-1).
Default Value	10
Syntax	Integer
Example	ds-hdsml-poolmaxsize: 10

ds-hdsml-poolsize

The minimum, default number of DSML parsers kept ready to handle DSML requests. If you expect sustained traffic of many concurrent DSML requests, you may choose to increase the value of this attribute.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (231-1).
Default Value	5
Syntax	Integer
Example	ds-hdsml-poolsize: 5

ds-hdsml-port

The HTTP port used for DSML communications. The selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user.

Note that you must restart the server for a port number change to be taken into account.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1-65535
Default Value	80
Syntax	Integer
Example	ds-hdsml-port: 8080

ds-hdsml-requestmaxsize

The maximum size of a DSML request. If the request is larger than this value, the server responds with the error message REQUEST_ENTITY_TOO_LARGE and closes the connection to prevent the client from continuing the request.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1-2147483647 (231-1)
Default Value	32768
Syntax	Integer
Example	ds-hdsml-requestmaxsize: 32768

ds-hdsml-responsemsgsize

The maximum size of a server response to a DSML request (or a fraction of the maximum response size in the case of intermediate search responses). If the response is larger than the size specified here

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1-2147483647 (231-1)
Default Value	65536
Syntax	Integer
Example	ds-hdsml-responsemsgsize: 65536

ds-hdsml-rooturl

The root URL used in the HTTP POST request to indicate the request is DSML. On the client side, this corresponds to the first line of the post, such as:

POST /dsml HTTP/1.1

Client applications must post to the value of this attribute.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	Any valid URL.
Default Value	/dsml
Syntax	DirectoryString
Example	ds-hdsml-rooturl: /dsml

ds-hdsml-secureport

The port number used for secure DSML communications (over SSL). The selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user. Note that you must restart the server for a port number change to be taken into account.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	1-65535
Default Value	None
Syntax	Integer
Example	ds-hdsml-secureport: 1443

ds-hdsml-soapschemalocation

The path to the SOAP schema. This is generated automatically and should not be changed.

Property	Value
Entry DN	cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins,  cn=config
Valid Range	Any valid path to the directory storing the SOAP schema.
Default Value	ServerRoot/lib/soap-env.xsd
Syntax	DirectoryString
Example	ds-hdsml-soapschemalocation:  /var/ds5/slapd-myServer/lib/soap-eng.xsd

Implementation of the DSMLv2 Standard

The complete DSMLv2 specification and supporting documentation can be found at the following locations:

http://www.oasis-open.org/committees/dsml/docs/DSMLv2.xsd

http://www.oasis-open.org/committees/dsml/docs/DSMLv2.doc

The Sun Java System Directory Server implementation of this specification is complete, with the following restrictions:

Bindings

DSMLv2 defines two normative bindings: a SOAP request/response binding and a file binding that serves as the DSMLv2 analog of LDIF. Sun Java System Directory Server supports the SOAP request/response binding.

Modify DN

Sun Java System Directory Server supports the DSML modDNRequest and modDNResponse operations. Changing of a DN is supported; however, moving an entry to a different part of the directory tree is not supported.

Abandon Request

Sun Java System Directory Server does not support the abandonRequest operation, since this operation is of no use over HTTP.

Search Operations

Some DSML clients incorrectly send an equality match with value * when a presence match is intended. Directory Server will return zero results from these misformatted queries. You can detect these incorrect clients by searching for the characters =\2a in the access log.

Content of the HTTP Header

Sun Java System Directory Server supports only the HTTP POST operation. The following example shows the minimum fields required to send a DSML request to the server over HTTP:

POST /dsml HTTP/1.1
content-length: 450
HOST: hostMachine
SOAPAction: ""
Content-Type: text/xml
Connection: close

The Connection field is optional. In HTTP 1.0, the default value of this field is close. In HTTP 1.1, however, the default value is keep-alive. It is therefore recommended that you include this field with a value of close in your last request if you are using HTTP 1.1, to accelerate the dialog.

Additional fields may be included in the HTTP header. If they are supported by Directory Server, their values will override the defaults. If the fields are not supported, the request will not be rejected by the server but the fields will be ignored.

---

Retro Changelog Plug-In Attributes

Two different types of changelogs are maintained by Sun Java System Directory Server 5.2. The first type, referred to as changelog, is used by multi-master replication and the second changelog, which is in fact a plug-in referred to as retro changelog, is intended for use by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

This Retro Changelog plug-in is used to record modifications made to a supplier server. When the supplier server’s directory is modified, an entry is written to the Retro Changelog that contains:

A number that uniquely identifies the modification. This number is sequential with respect to other entries in the change log.
The modification action; that is, exactly how the directory was modified.

It is through the Retro Changelog plug-in that you access the changes performed to Directory Server using searches to “cn=changelog,cn=config” file.

nsslapd-changelogdir

This attribute specifies the name of the directory in which the changelog database is created the first time the plug-in is run. By default the database is stored with all the other databases under:

ServerRoot/slapd-serverID/db/changelog

Note	For performance reasons you will probably want to store this database on a different physical disk.

Property	Value
Entry DN	cn=Retro Changelog Plugin,cn=plugins,cn=config
Valid Range	Any valid path to the directory.
Default Value	None
Syntax	DirectoryString
Example	nsslapd-changelogdir: /var/slapd-serverID/changelog

nsslapd-changelogmaxage (Max Changelog Age)

Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records, which is the default behavior as this attribute is not present by default.

Property	Value
Entry DN	cn=Retro Changelog Plugin,cn=plugins,cn=config
Valid Range	0 (meaning that entries are not removed according to their age) to the maximum 32 bit integer value (2147483647).
Default Value	0
Syntax	DirectoryString IntegerAgeID where AgeID is “s” for seconds, “m” for minutes, “h” for hours, “d” for days, or “w” for weeks.
Example	nsslapd-changelogmaxage: 30d

nsslapd-changelogmaxentries (Max Changelog Entries)

Specifies the maximum number of entries in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers.

Property	Value
Entry DN	cn=Retro Changelog Plugin,cn=plugins,cn=config
Valid Range	0 (no limit to the number of entries) to the maximum 32 bit integer value (2147483647).
Default Value	0
Syntax	Integer
Example	nsslapd-changelogmaxentries: 0

---

Subtree Entry Counter Plug-In Attributes

The subtree entry counter plug-ins maintain a count of entries with a particular object class. The counter attributes are listed in Table 2-15.

Table 2-15  Subtree Entry Counter Plug-In Attributes

Attribute	Definition
nsNumDepts	Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.
nsNumDomains	Either the number of total domains, or the number of domains within a domain (nested domains), depending on the DN of the entry.
nsNumMailLists	Number of mail lists.

Previous      Contents      Index      Next

---

Copyright 2004 Sun Microsystems, Inc. All rights reserved.