The Directory Proxy Server 5 property objects enable you to specify specialized restrictions that LDAP clients must follow. Most of the functionality of property objects is available in Directory Proxy Server 6, although it is supplied by various elements of the new architecture. The following sections describe how to map the Directory Proxy Server 5 property objects to the corresponding 6.0 functionality.
In Directory Proxy Server 5, attribute renaming is defined by the ids-proxy-sch-RenameAttribute object class. This object uses the ids-proxy-con-server-attr-name and ids-proxy-con-client-attr-name attributes to specify which attributes must be renamed by Directory Proxy Server.
The attribute renaming functionality is replaced in Directory Proxy Server 6 by the attr-name-mappings property of an LDAP data source. This property is multi-valued, and takes values of the form client-attribute-name#server-attribute-name. In a client request, Directory Proxy Server renames the client-attribute-name to the server-attribute-name. In a response, Directory Proxy Server renames the server-attribute-name to the client-attribute-name.
To configure this property, use the following command:
$ dpconf set-ldap-data-source-prop data-source-name \ attr-name-mappings:client-attribute-name#server-attribute-name
In Directory Proxy Server 5, the ids-proxy-sch-ForbiddenEntryProperty object is used to specify a list of entries or attributes that are hidden from client applications. In Directory Proxy Server 6.2 this functionality is achieved by creating a search-data-hiding-rule for a request filtering policy.
In iPlanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=group-name,ou=groups,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.
The following table maps the attributes of the ids-proxy-sch-ForbiddenEntryProperty object to the corresponding properties of a search data hiding rule in Directory Proxy Server 6.2. For information about creating search data hiding rules, see To Create Search Data Hiding Rules in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.
Table 6–14 Mapping of Directory Proxy Server 5 Server Load Configuration Attributes to Directory Proxy Server 6 Resource Limits Properties
Directory Proxy Server 5 Attribute |
Directory Proxy Server 6 Property |
---|---|
ids-proxy-con-dn-exact |
target-dns |
ids-proxy-con-dn-regexp |
target-dn-regular-expressions |
ids-proxy-con-ava |
target-attr-value-assertions |
ids-proxy-con-forbidden-return |
To hide a subset of attributes: rule-action:hide-attributes attrs:attribute-name To hide an entire entry: rule-action:hide-entry |
ids-proxy-con-permitted-return |
rule-action:show-attributes attrs:attribute-name |
In Directory Proxy Server 5, the ids-proxy-sch-LDAPServer property is used to define the backend LDAP servers to which Directory Proxy Server sends requests. In Directory Proxy Server 6.2, this functionality is achieved by using LDAP data sources. You can set properties for LDAP data sources by using the Directory Service Control Center or by using the command line. For more information, see Creating and Configuring LDAP Data Sources in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.
In iPlanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=server-name,ou=properties,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.
The following table maps the attributes of the ids-proxy-sch-LDAPServer object class to the corresponding data source properties in Directory Proxy Server 6.2. Data sources provide additional functionality that was not provided in Directory Proxy Server 5. Not all data source properties are listed here. For a list of all the properties that can be configured for a data source, run the following command:
$ dpconf help-properties | grep ldap-data-sourceTable 6–15 Mapping of ids-proxy-sch-LDAPServer Attributes to Data Source Properties
Directory Proxy Server 5 Attribute |
Directory Proxy Server 6.2 Property |
---|---|
ids-proxy-con-host |
ldap-address |
ids-proxy-con-port |
ldap-port |
ids-proxy-con-sport |
ldaps-port |
ids-proxy-con-supported-version |
No equivalent Directory Proxy Server 6.2 supports LDAP v3 backends for both version 2 and version 3 clients. Directory Proxy Server 6.2 supports the proxy authorization control version 1 and version 2. |
ids-proxy-con-use-version |
No equivalent Directory Proxy Server 6.2 supports LDAP v3 backends for both v2 and v3 clients. Directory Proxy Server 6.2 supports the proxy authorization control version 1 and version 2. |
ids-proxy-con-tcp-no-delay |
use-tcp-no-delay |
ids-proxy-con-link-security-policy |
ssl-policy |
ids-proxy-con-x509cert-subject |
No equivalent. Directory Proxy Server 6.2 does not check the subject of the certificate provided by the backend server. |
ids-proxy-con-keepalive-interval |
This functionality is achieved by setting the following properties of the LDAP data source: monitoring-bind-timeout monitoring-entry-timeout monitoring-inactivity-timeout monitoring-interval For information about setting LDAP data source properties, see To Configure an LDAP Data Source in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide. |
In Directory Proxy Server 5, the ids-proxy-sch-LoadBalanceProperty is used to configure load balancing across multiple LDAP servers. Directory Proxy Server 5 supports proportional load balancing only, that is, each LDAP server is allotted a certain percentage of the total load. The ids-proxy-sch-LoadBalanceProperty object class has one attribute, ids-proxy-con-Server, whose value has the following syntax:
server-name[#percentage]
In iPlanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=load-balance,ou=properties,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ids-proxy-con-name=load-balancing-1,ou=properties,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.
In Directory Proxy Server 6.2, load balancing is configured as a property of a data source pool. A data source pool is essentially a collection of LDAP servers to which Directory Proxy Server can route requests. For information about setting up a data source pool, see Creating and Configuring LDAP Data Source Pools in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide. For a list of properties associated with a data source pool, run the following command:
$ dpconf help-properties | grep ldap-data-source-pool |
Directory Proxy Server 6.2 supports proportional load balancing but also supports additional load balancing algorithms. To configure proportional load balancing, set the property of the data source pool as follows:
$ dpconf set-ldap-data-source-pool-prop data-source-pool-name load-balancing-algorithm:proportional
The percentage of load allotted to each server is configured by setting various properties of an attached data source. An attached data source is a data source that has been attached to a specific data source pool. To configure proportional load, set the weight properties of the attached data source for each operation type as follows:
$ dpconf set-attached-ldap-data-source-prop data-source-pool-name attached-data-source-name add-weight:value bind-weight:value compare-weight:value delete-weight:value modify-dn-weight:value modify-weight:value search-weight:value
For more information, see Configuring Load Balancing in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.
To monitor the state of its backend LDAP servers, Directory Proxy Server 5 performs an anonymous search operation on the RootDSE of each server every ten seconds. Directory Proxy Server 6.2 has a number of properties that can be configured to monitor its backend servers. For more information, see Retrieving Monitored Data About Data Sources in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.
Directory Proxy Server 5 uses the ids-proxy-sch-SizeLimitProperty to apply size limits based on the base and scope of search operations. In Directory Proxy Server 6.2, the search size limit can be configured by setting a property of the resource limits policy. A resource limits policy defines the maximum resource that Directory Proxy Server can process for a given connection handler. Use the dpconfcommand to set the search size limit for a resource policy, as follows:
$ dpconf set-resource-limits-policy-prop policy-name search-size-limit:number-of-entries |
Resource limits policies control much more than just search size limit. For information on configuring resource limits policies, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.
In iPlanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=group-name,ou=groups,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.
The following table maps the attributes of a version 5 size limit property to the corresponding properties in Directory Proxy Server 6.2.
Table 6–16 Mapping of Version 5 Search Size Limit Attributes to 6.0 Properties
Directory Proxy Server 5 Attribute |
Directory Proxy Server 6.2 Property |
---|---|
ids-proxy-con-Size-Limit |
search-size-limit |
ids-proxy-con-Dn-One |
one-level-search-base-dn |
ids-proxy-con-Dn-Sub |
No equivalent |
The logging functionality available in Directory Proxy Server 5 is differs substantially from the functionality available in Directory Proxy Server 6.2.
In Directory Proxy Server 5, the following logs were maintained:
System log. Includes log records of system events and errors.
Audit log. Includes audit trails for all events and errors.
Directory Proxy Server 6.2 maintains an errors log file, an access log file, and administrative alerts.
The errors log and administrative alerts are equivalent to the version 5 system log. Administrative alerts are events raised by Directory Proxy Server. These events can be sent to the syslog daemon or to an administrator through email.
The Directory Proxy Server 6.2 access log is equivalent to the version 5 audit log.
Logs in version 5 were configured by using the ids-proxy-sch-LogProperty object class. Logs in Directory Proxy Server 6.2 are configured by setting properties for the access and error log, using the dpconf command. For example, to set properties for the access log, use the following command:
$ dpconf set-access-log-prop PROPERTY:VALUE
Directory Proxy Server 6.2 provides new log features, such as log file rotation, and enables log configuration to be fine tuned. For example, one log level can be set per message category.
In iPlanet Directory Access Router 5.0 (IDAR) log configuration attributes are stored under ids-proxy-con-Config-Name=name,ou=global,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, log configuration attributes are stored under ids-proxy-con-Config-Name=user-defined-name,ou=system,ou=dar-config,o=netscaperoot.
It is not really possible to map the log configuration between Directory Proxy Server 5 and Directory Proxy Server 6.2 because the logging models between these two versions are very different. The Directory Proxy Server 5 log model combines what is logged with where it is logged. In Directory Proxy Server 6.2, the model is cleaner. One set of properties describes what is logged, and a separate set of properties describes where log messages are sent.
The following table lists the attributes of the ids-proxy-sch-LogProperty object class and describes at a high level how the corresponding functionality is achieved in Directory Proxy Server 6.2.
Table 6–17 Version 5 and Version 6 Log Functionality
Directory Proxy Server 5 Attribute |
Purpose |
Directory Proxy Server 6.2 Equivalent |
---|---|---|
ids-proxy-con-log-level |
Level of logging |
Global log level |
ids-proxy-con-stat-level |
Kinds of statistics logged |
Monitoring data |
ids-proxy-con-log-syslog |
Syslog facility code |
syslog output for administrative alerts No equivalent for error messages |
ids-proxy-con-log-file |
Path to log file |
log-file-name of the error-log object |
ids-proxy-con-audit-syslog |
Syslog facility code for audit log |
No equivalent |
ids-proxy-con-audit-file |
Path to audit log file |
log-file-name of the access-log object |
Because a one to one mapping of log configuration is not possible between the two versions, you need to understand the new logging model and then configure your new logs accordingly, rather than migrating your old log configuration. For more information, see Chapter 27, Directory Proxy Server Logging, in Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide.