Sun Java System Directory Server Enterprise Edition 6.2 Release Notes

Chapter 4 Directory Proxy Server Bugs Fixed and Known Problems

This chapter contains important, product-specific information available at the time of release of Directory Proxy Server.

This chapter includes the following sections:

Bugs Fixed in Directory Proxy Server 6.2

This section lists the bugs fixed since the last release of Directory Proxy Server.


When a join data view is configured using filter-join-rule, addition of the entries to join data view is not possible even after you set the transformation rule on the secondary data view.


Directory Proxy Server loops infinitely after aborting a search on a join data view.


Directory Proxy Server should never return a result code as 32 when search on a JDBC data view does not return any entry satisfying the search criteria.

Known Problems and Limitations in Directory Proxy Server

This section lists known problems and limitations at the time of release.

Directory Proxy Server Limitations

This section lists product limitations.

Do not change file permissions by hand.

Changes to file permissions for installed Directory Server Enterprise Edition product files can in some cases prevent the software from operating properly. Only change file permissions when following instructions in the product documentation, or following instructions from Sun support.

To workaround this limitation, install products and create server instances as a user having appropriate user and group permissions.

Self-signed server certificates cannot be renewed.

When creating a self-signed server certificate, make sure you specify a validity long enough that you do not have to renew the certificate.

Known Directory Proxy Server Issues in 6.2

This section lists the known issues that are found at the time of Directory Proxy Server 6.2 release.


The modify DN operation is not supported for LDIF, JDBC, join and access control data views.


When local proxy ACIs are defined, operations using the get effective rights control may not return the correct information.


Directory Proxy Server has been seen to reject ACIs that specify subtypes to the target attribute, such as (targetattr = "locality;lang-fr-ca").


The dpconf command does not reject new line and line feed characters in property values. Avoid using new line and line feed characters when setting property values.


When ACIs are configured, Directory Proxy Server has been seen not to return the same results as a search directly on the LDAP data source.


Directory Proxy Server cannot resume the JDBC data source connection that is restored after the data source connection failure. Directory Proxy Server can resume the connection only after restarting the Directory Proxy Server instance.


Directory Proxy Server has been seen to return an operations error, stating that the server is unable to read the bind response, after a Directory Server data source is restarted.


Directory Proxy Server must be restarted when the authentication mode configuration is changed.


After a CA-Signed Certificate request is generated for Directory Proxy Server, you can refresh Directory Service Control Center. Directory Service Control Center then labels the certificate as self-signed.


You can configure to use SSL connections when the client application connects using SSL. If the SSL port used by Directory Proxy Server is incorrect, Directory Proxy Server has been seen to close all connections after a secure search.


Directory Proxy Server fails to count the number of referral hops properly when configured to use authentication based on the client application credentials rather than proxy authorization.


Directory Proxy Server allows you to set the base-dn property of a data view to the root DN, "", only when initially creating the data view.


Directory Service Control Center sorts values as strings. As a result, when you sort numbers in Directory Service Control Center, the numbers are sorted as if they were strings.

An ascending sort of 0, 20, and 100 results in the list 0, 100, 20. A descending sort of 0, 20, and 100 results in the list 20, 100, 0.


Directory Proxy Server instance with multi-byte characters in its path may fail to be created in DSCC, to start or perform other regular tasks.

Some of these issues can be resolved by using the charset that was used to create the instance. Set the charset using the following commands:

# cacaoadm list-params | grep java-flags
  java-flags=-Xms4M -Xmx64M

# cacaoadm stop
# cacaoadm set-param java-flags="-Xms4M -Xmx64M -Dfile.encoding=utf-8"
# cacaoadm start

Use only the ASCII characters in the instance path to avoid these issues.


Do not use the dollar sign, $, when defining attribute rules.


After configuring alerts, you must restart Directory Proxy Server for the change to take effect.


In Directory Proxy Server, referral hop limit does not work.


Directory Proxy Server has been seen to fail to rename an entry moving to another data view when numeric or lexicographic data distribution is configured.


When working with join data views, Directory Proxy Server does not take data distribution algorithms in the views that make up the join.

To work around this issue, configure data distribution at the level of the join data view when using joins and data distribution together.


The dpadm autostart command does not work when you install software from native packages, and you relocate the native packages at installation time.


On Windows, the output of dsadm and dpadm commands, and help messages are not localized in Simplified and Traditional Chinese languages.


After configuring a JDBC data source, you must restart Directory Proxy Server for the change to take effect.


The modify RDN operation is not supported for entries in JDBC data views.


Directory Proxy Server does not allow you to manage schema over LDAP.


Directory Proxy Server should ignore the filter-join-rule property when it is used in a primary table.


After installation and after server instance creation on Windows systems, the file permissions to the installation and server instance folder allow access to all users.

To work around this issue, change the permissions on the installations and server instance folders.


On Windows, DSCC initialization can only be performed by Administrator user


Access Manager, when accessing Directory Server through Directory Proxy Server, has been seen to encounter caching problems related to persistent searches after Directory Server is restarted.

To work around this issue, restart either Access Manager or Directory Proxy Server after restarting Directory Server.

For further fine tuning, you can increase the number of and delay between Access Manager attempts to reestablish persistent search connections. You can increase these parameters by changing the following properties in the file.

  • Increase, which represents the number of attempts. The default is 3 attempts.

  • Increase, which represents the number of milliseconds delay between attempts. The default is 3000 milliseconds.


If you run a search using JDBC data view configured with DB2 database and there are large number of entries to be returned in the search result, an error might occur after returning 1344 entries.

To overcome this limitation, increase the number of large packages by setting the value of the CLI/ODBC configuration keyword CLIPkg to a value up to 30. Even then the search result is limited to maximum of 11712 Entries.

For more information, see DB2 documentation.


When creating a self-signed certificate using Directory Service Control Center, do not use multi-byte characters for the certificate names.


The default LDAP controls allowed through Directory Proxy Server are not displayed by Directory Service Control Center.


After configuring JDBC syntax, you must restart Directory Proxy Server for the change to take effect.


Directory Service Control Center removes commas when changing the DN for an existing excluded subtree, or alternate search base.


After enabling or disabling non secure LDAP access for the first time, you must restart Directory Proxy Server for the change to take effect.


Virtual directory macros using split do not work properly.


Time limit and size limit settings work only with LDAP data sources.


After using the command dpadm set-flags cert-pwd-store=off, Directory Proxy Server cannot be restarted using Directory Service Control Center.


When using the jvm-args flag of the dpadm command and restarting the server, you cannot successfully allocate more than 2 GB memory for the Java virtual machine.

To work around this issue, use dpadm stop and dpadm start instead of dpadm restart.


The dpadm start command has been seen to fail when used with a server instance name combining both ASCII and multi-byte characters.


When setting the data-view-routing-custom-list property on an existing connection handler, an error occurs with data view names containing characters that must be escaped, such as commas.

To work around this issue, do not give data views names that contain characters that must be escaped. For example, do not use data view names containing DNs.


Unlike previous versions, as stated in the manual page allowed-ldap-controls(5dpconf), Directory Proxy Server does not allow the server side sort control by default.

You can enable Directory Proxy Server support for the server side sort control by adding server-side-sorting to the list of allowed LDAP controls specified by the allowed-ldap-controls property.

$ dpconf set-server-prop \
 allowed-ldap-controls:auth-request \
 allowed-ldap-controls:chaining-loop-detection \
 allowed-ldap-controls:manage-dsa \
 allowed-ldap-controls:persistent-search \
 allowed-ldap-controls:proxy-auth-v1 \
 allowed-ldap-controls:proxy-auth-v2 \
 allowed-ldap-controls:real-attributes-only \

Notice that you must repeat the existing settings. Otherwise, only the server side sort control is allowed.


When using the DN renaming feature of Directory Proxy Server, notice that repeating DN components are renamed to only one replacement component.

Consider for example that you want to rename DNs that end in to end in dc=com. For entries whose DN repeats the original component, such as uid=userid,ou=people,,, the resulting renamed DN is uid=userid,ou=people,dc=com, and not uid=userid,ou=people,,dc=com.


The JDBC connection configuration to access Oracle 9 through Directory Proxy Server might not be as straightforward as shown in the documentation.

Consider the following configuration. You have an Oracle 9 server listening on host myhost, port 1537 with the instance having system identifier (SID) MYINST. The instance has a database MYNAME.MYTABLE.

Typically, to configure access through to MYTABLE, you would set the following properties.

  • On the JDBC data source, set db-name:MYINST.

  • On the JDBC data source, set db-url:jdbc:oracle:thin:myhost:1537:.

  • On the JDBC table, set sql-table:MYNAME.MYTABLE.

If these settings do not work for you, try configuring access through to MYTABLE with the following settings.

  • On the JDBC data source, set db-name:(CONNECT_DATA=(SERVICE_NAME=MYINST))).

  • On the JDBC data source, set db-url:jdbc:oracle:thin:@(DESCRIPTION= (ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myhost)(PORT=1537))).

  • On the JDBC table, set sql-table:MYNAME.MYTABLE.


Directory Proxy Server cannot write JDBC attributes implying many-to-many (N:N) relationship between tables in the JDBC database.


Search doesn't work on a join view if using attributes from secondary view in the search filter.


Directory Proxy Server instances with multi-byte DN and created using DSCC, fail to start on Linux.


When you use Service Management Facility (SMF) in Solaris 10 to enable a server instance, the instance might not start when you reboot your system.

As a workaround, add the following lines which are marked with + to /opt/SUNWdsee/ds6/install/tmpl_smf.manifest.

restart_on="none" type="service"> 
<service_fmri value="svc:/network/initial:default"/> 
+ <dependency name="nameservice" grouping="require_all" \
+ restart_on="none" type="service"> 
+ <service_fmri value="svc:/milestone/name-services"/> 
+ </dependency> 
<exec_method type="method" name="start" 
exec="%%%INSTALL_PATH%%%/bin/dsadm start --exec %{sunds/path}"...

Console does not retrieve the backend status of the Directory Proxy Server instance if a machine has multiple host names.


On Linux, the localized server messages shown in the DSCC progress window might display the international characters garbled in the Japanese locale.


If duplicate entries are present in RDBMS table matching a DN pattern found in JDBC object class, then duplicate subtree (non-leaf) nodes would be returned by Directory Proxy Server when search is performed against the JDBC data view. For example, if there is a DN pattern ou in a JDBC object class and there are duplicate entries (say, sales) present in the RDBMS column mapped to JDBC attribute ou, then there would be duplicate nodes like ou=sales present in the search result.

To resolve this issue, do the following:

  1. Create an RDBMS view by taking the values from the table that contains the column mapped to ou JDBC attribute in such a way that there are no duplicated entries.

  2. Replace the RDBMS table name with the RDBMS view name in the JDBC object class with the DN pattern ou. The limitation of this approach is that since RDBMS views are read-only, no values for the JDBC attribute ou could be added through Directory Proxy Server.


The idsktune command does not support SuSE Enterprise Linux.


In the More View Options of an instance, the date shown under the Access Logs, Error Logs, and Audit Logs tabs is not localized.


The string err= is not translated in some of the Korean and Simplified Chinese messages.


In DSCC configured using Tomcat server, the title of the Help and Version pop-up windows displays the multi-byte strings garbled.


On Solaris 9 x86, the string owner in the output of the dpadm show-cert dps-instance-path command is not translated in Simplified Chinese and Traditional Chinese.


The pop-up windows prompting the confirmation for stopping or unregistering servers display the doubled apostrophes in the French locale.