Configuring the LDAP Connection Handler

The following command displays the properties of the LDAP connection handler:

$ dsconfig "cn=directory manager" -w password -n get-connection-handler-prop \
  --handler-name "LDAP Connection Handler"

Property : Value(s)
-----------------------:------------
allow-ldap-v2 : true
allow-start-tls : false
allowed-client : -
denied-client : -
enabled : true
keep-stats : true
key-manager-provider : -
listen-address : 0.0.0.0
listen-port : 1389
ssl-cert-nickname : server-cert
ssl-cipher-suite : -
ssl-client-auth-policy : optional
ssl-protocol : -
trust-manager-provider : -
use-ssl : false

To Control Which Clients Have LDAP Access to the Directory Server

You can specify a list of clients that may or may not access the directory server over LDAP. To do this, set the allowed-client or denied-client property of the LDAP connection handler. These properties take an IP address or subnetwork with subnetwork mask as values.

By default, these properties are not set and all clients are allowed access. Changes to these properties take effect immediately but do not interfere with connections that are already established.

This example permits access only to clients in the subnet mask 255.255.255.10.

• Run the dsconfig command as follows:

  $ dsconfig -D "cn=directory manager" -w password -n set-connection-handler-prop \
    --handler-name "LDAP Connection Handler" --set allowed-client:255.255.255.10