Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide

Creating and Configuring LDAP Data Sources

For information about how to create and configure LDAP data sources, see the following procedures.

ProcedureTo Create an LDAP Data Source

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

  1. Create the data source.

    $ dpconf create-ldap-data-source -h host -p port source-name host:port

    In this command, source-name is a name that you assign to the new data source. host and port refer to the host and port on which the LDAP server is running. Note that the data source does not use SSL by default.

    If the host is specified by an IP V6 address, you need to use the IP V6 reference when you create the data source. For example, if Directory Proxy Server will bind to a host with the IP V6 address fe80::209:3dff:fe00:8c93 on port 2389, use the following command to create the data source:

    $ dpconf create-ldap-data-source -h host1 -p 1389 ipv6-host \

    If you use the console to create the data source, you must specify the actual IP V6 address (without the square brackets).

    For information about how to modify the properties of an LDAP data source, see To Configure an LDAP Data Source.

  2. (Optional) View the list of data sources.

    $ dpconf list-ldap-data-sources -h host -p port

ProcedureTo Configure an LDAP Data Source

This procedure configures authorization between Directory Proxy Server and an LDAP data source. The procedure also configures how Directory Proxy Server monitors an LDAP data source.

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

  1. View the properties of the data source by using this command syntax:

    dpconf get-ldap-data-source-prop -h host -p port [-M unit] [-Z unit] source-name [property...]

    In this command, -M and -Z refer to the units in which you want data to be displayed. The M option specifies the unit of time. The value for -M can be M, w, d, h, m, s, or ms, to represent months, weeks, days, hours, minutes, seconds, or miliseconds. The -Z option specifies the data size unit. The value for -Z can be T, G, M, k, or b, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.

    If you do not specify a property, all properties are displayed. The default properties of an LDAP data source are as follows:

    bind-dn                        :  -
    bind-pwd                       :  -
    client-cred-mode               :  use-client-identity
    connect-timeout                :  10s
    description                    :  -
    is-enabled                     :  false
    is-read-only                   :  true
    ldap-address                   :  host
    ldap-port                      :  port
    ldaps-port                     :  ldaps
    monitoring-bind-timeout        :  5s
    monitoring-entry-dn            :  ""
    monitoring-entry-timeout       :  5s
    monitoring-inactivity-timeout  :  2m
    monitoring-interval            :  30s
    monitoring-mode                :  proactive
    monitoring-search-filter       :  (|(objectClass=*)(objectClass=ldapSubEntry))
    num-bind-incr                  :  10
    num-bind-init                  :  10
    num-bind-limit                 :  1024
    num-read-incr                  :  10
    num-read-init                  :  10
    num-read-limit                 :  1024
    num-write-incr                 :  10
    num-write-init                 :  10
    num-write-limit                :  1024
    proxied-auth-check-timeout     :  1.8s
    proxied-auth-use-v1            :  false
    ssl-policy                     :  never
    use-tcp-no-delay               :  true
  2. Enable the data source.

    $ dpconf set-ldap-data-source-prop -h host -p port source-name is-enabled:true
  3. Configure all the properties that are listed in Step 1, if you want to change the default settings.

    $ dpconf set-ldap-data-source-prop -h host -p port source-name property:value

    For example, if you want to modify entries on a data source, configure the data source to allow write operations.

    $ dpconf set-ldap-data-source-prop -h host -p port source-name is-read-only:false

    To find information about a property used in a subcommand, run this command:

    $ dpconf help-properties ldap-data-source property

    To list the key properties for data sources, use the verbose option -v with the list subcommand.

    $ dpconf list-ldap-data-sources -v
    Name         is-enabled  ldap-address  ldap-port  ldaps-port  description
    -----------  ----------  ------------  ---------  ----------  -----------
    datasource0  true        myHost        myPort     ldaps       -
    datasource1  true        myHost        myPort     ldaps       -
  4. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

    For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server. For a list of configuration changes that require a server restart, see Configuration Changes Requiring Server Restart.