Creating a Network Group Quality of Service Policy

Creating a quality of service policy is optional and associated to a network group. There are four types of quality of service policy available:

• request filtering policy

• resource limits

• affinity

• referral

To create a network group quality of service policy, use the dsconfig create-network-group-qos-policy command. You must specify the name of the network group to which the quality of service policy applies, as well as the type of quality of service policy.

Creating a Request Filtering Policy

When you create a network group request filtering policy, you can set the following properties:

• allowed-attributes: list of attributes that can be specified in the filter of a search request

• allowed-operations: type of operation accepted by the network group. For example, you can set a network group to accept only read requests.

• allowed-search-scopes: scope of a search accepted, for example one-level only.

• allowed-subtrees: list of specific sub-trees that can be specified as base DN in a search request

• prohibited-attributes: list of attributes which, if specified in the filter of a search request, will be rejected

• prohibited-subtrees: list of specific sub-tress that will not manage a request

To create a network group quality of service request filtering policy, use the dsconfig create-network-group-qos-policy command. You must state the network group to which the quality of service policy applies.

For example, if you want to ensure that users can only search and not modify data, use the following command:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  create-network-group-qos-policy \
  --group-name network-group1 \
  --type request-filtering \
  --set allowed-operations:search 

Creating a Network Group Resource Limit

When you create a network group resource limit, you can set the following properties:

• maximum number of simultaneous operations per connection (max-concurrent-ops-per-connection). If you want your Sun OpenDS Standard Edition proxy to run in synchronous mode, set the maximum to 1.

• maximum number of operations per connection (max-ops-per-connection)

• maximum number of connections (max-connections). If you do not set a maximum number of connections, the server limit is used.

• maximum number of connections from the same IP (max-connections-from-same-ip). Set this parameter if you want to avoid Denial of Service attacks. However, this parameter should not be set if you know that the requests typically come from the same client.

• minimum search string length (min-substring-length). The shorter the search string, the more results that need to be found and displayed. Therefore, it may be useful to set a minimum search string length in the substring search filter to limit the resources used.

• size limit (size-limit) limits the number of results of a query. It is recommended to use the default value.

• time limit (time-limit) of a connection. It is recommended to use the default value.

To create a network group quality of service resource limit policy, use the dsconfig create-network-group-qos-policy command. You must state the network group to which the quality of service policy applies.

For example, if you want to ensure that a user enters a search string of at least 5 characters, to limit the number of return values, use the following command:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  create-network-group-qos-policy \
  --group-name network-group1 \
  --type resource-limits \
  --set min-substring-length:5 

Creating an Affinity Quality of Service Policy

Affinity is used only in a deployment with load balancing. When you create a network group quality of service, you can set the following affinity properties:

• indicate that a certain routing policy be used, regardless of the regular routing process (affinity-policy). For example, you can set all requests be routed to a LDAP server after a write has been completed on that server. That way, read requests would return results which are consistent with the previous write request.

• set a timeout (affinity-timeout) to define the duration during which the affinity applies.

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  create-network-group-qos-policy \
  --group-name network-group1 \
  --type affinity \
  --set affinity-timeout:60 s 

The possible affinity policy values are:

• all-requests-after-first-request

• all-requests-after-first-write-request

• all-write-requests-after-first-write-request

• first-read-request-after-write-request

Creating a Referral Quality of Service Policy

You can configure the behavior of the Sun OpenDS Standard Edition proxy when a referral is received from the remote LDAP server.

Note - Referrals must be defined on OpenDS server or DSEE server; see the appropriate documentation for more information.

When you create a network group quality of service, you can set the following referral properties:

• the maximum number of hops supported (referral-hop-limit) when the referral policy is set to follow. The default is set to 5.

• define the type of referral policy (referral-policy), such as discard, forward, or follow. This defines how a referral will be treated by the network group.

For example, the referral-policy is set by default to forward. You can change it to discard or to follow, as follows:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  create-network-group-qos-policy \
  --group-name network-group1 \
  --type referral \
  --set referral-policy:follow