Sun Java System Directory Server Enterprise Edition 6.0 Migration Guide

Chapter 6 Migrating Directory Proxy Server

There is no automatic migration path to move from a previous version to Directory Proxy Server 6.0. Directory Proxy Server 6.0 provides much more functionality than previous versions. While a one to one mapping of configuration information is therefore not possible in most instances, it is possible to configure Directory Proxy Server 6.0 to behave like a version 5 server for compatibility.

This chapter describes how the configuration properties in Directory Proxy Server 6.0 can be used to simulate a version 5 configuration.

The chapter covers the following topics:

Mapping the Global Configuration

Before you change the Directory Proxy Server 6.0 configuration, back up the configuration by using the dpadm backup command. For more information, see dpadm(1M).

You can configure Directory Proxy Server 6.0 by using the Directory Service Control Center (DSCC) or the dpconf command-line utility. For more information, see dpconf(1M).

Directory Proxy Server 6.0 configuration can be retrieved as a set of properties. For example, information about the port is returned in the listen-port property. This section describes how to map the version 5 global configuration attributes to the corresponding properties in Directory Proxy Server 6.0, where applicable. Not all functionality can be mapped directly.

The global Directory Proxy Server 5 configuration is specified by two object classes:

ids-proxy-sch-LDAPProxy. Contains the name of the Directory Proxy Server server and the DN of the global configuration object.
ids-proxy-sch-GlobalConfiguration. Contains various global configuration attributes.

Because of the way in which Directory Proxy Server 6.0 is configured, Directory Proxy Server 6.0 has no equivalent for the ids-proxy-sch-LDAPProxy object class or its attributes.

In Iplanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Config-Name=name,ou=global,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ids-proxy-con-Config-Name=user-defined-name,ou=system,ou=dar-config,o=netscaperoot.

The functionality of the ids-proxy-sch-GlobalConfiguration is provided as properties of various elements in Directory Proxy Server 6.0. The following table maps the attributes of the ids-proxy-sch-GlobalConfiguration object class to the corresponding properties in Directory Proxy Server 6.0.

Table 6–1 Mapping of Version 5 Global Configuration Attributes to 6.0 Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-Config-Name`	No equivalent
	Directory Proxy Server 6.0 has two listeners, a non-secure listener and a secure listener. The version 5 listen configuration attributes can be mapped to the following four listener properties. To configure listener properties, use the `dpconf` command as follows: `$ dpconf set-ldap-listener-prop PROPERTY` `$ dpconf set-ldaps-listener-prop PROPERTY` For more information, see Configuring Listeners Between Clients and Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.
`ids-proxy-con-listen-port`	`listen-port`
`ids-proxy-con-listen-host`	`listen-address`
`ids-proxy-con-listen-backlog`	`max-connection-queue-size`
`ids-proxy-con-ldaps-port`	`listen-port` (property of the `ldaps-listener`)
`ids-proxy-con-max-conns`	This attribute can be mapped to the `max-client-connections` property of a connection handler resource limit. To configure this property, use the `dpconf` command as follows: `$ dpconf set-resource-limit-policy-prop POLICY-NAME max-client-connections:VALUE` For more information, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.
`ids-proxy-con-userid`	This attribute can be mapped to the user and group names specified when an instance is created by using the following command: `$ dpadm create [-u NAME -g NAME] INSTANCE-PATH` For more information, see Creating and Deleting a Directory Proxy Server Instance in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.
`ids-proxy-con-working-dir`	This attribute can be mapped to the `INSTANCE-PATH` specified when an instance is created by using the following command: `$ dpadm create INSTANCE-PATH` For more information, see Creating and Deleting a Directory Proxy Server Instance in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.
`ids-proxy-con-include-logproperty`	No equivalent. For information on configuring logging in Directory Proxy Server 6.0, see Chapter 27, Directory Proxy Server Logging, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Mapping the Global Security Configuration

In Directory Proxy Server 5, security is configured by using attributes of the global configuration object. In Directory Proxy Server 6.0, you can configure security when you create the server instance by using the dpadm command. For more information, see Chapter 19, Directory Proxy Server Certificates, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

The following table maps the version 5 security attributes to the corresponding properties in Directory Proxy Server 6.

Table 6–2 Mapping of Security Configuration


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-ssl-key`	`ssl-key-pin`
`ids-proxy-con-ssl-cert`	`ssl-certificate-directory` `ssl-server-cert-alias`
`ids-proxy-con-send-cert-as-client` This attribute enables the proxy server to send its certificate to the LDAP server to allow the LDAP server to authenticate the proxy server as an SSL client.	`ssl-client-cert-alias` This property enables the proxy server to send a different certificate to the LDAP server, depending on whether it is acting as an SSL Server or an SSL Client.
`ids-proxy-con-server-ssl-version` `ids-proxy-con-client-ssl-version`	No equivalent
`ids-proxy-con-ssl-cert-required`	This feature can be achieved by setting the following server property: `$ dpconf set-server-prop allow-cert-based-auth:require`
`ids-proxy-con-ssl-cafile`	No equivalent

Managing Certificates

Directory Proxy Server 5, certificates were managed by using the certreq utility, or by using the console. In Directory Proxy Server 6.0, certificates are managed by using the dpadm command, or by using the DSCC.

Certificates must be installed on each individual data source in Directory Proxy Server 6.0.

For information about managing certificates in Directory Proxy Server 6.0, see Chapter 19, Directory Proxy Server Certificates, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Access Control on the Proxy Configuration

In Directory Proxy Server 5, access control on the proxy configuration is managed by ACIs in the configuration directory server. In Directory Proxy Server 6.0, access to the configuration file is restricted to the person who created the proxy instance, or to the proxy manager if the configuration is accessed through Directory Proxy Server. Editing the configuration file directly is not supported.

Mapping the Connection Pool Configuration

Directory Proxy Server 5 can be configured to reuse existing connections to the backend LDAP servers. This can provide a significant performance gain if the backend servers are on a Wide Area Network (WAN). In Directory Proxy Server 6.0, this functionality is provided with connection pools that are configured in the backend server itself. For more information, see Chapter 20, LDAP Data Sources and Data Source Pools, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

The following table provides a mapping between Directory Proxy Server 5 connection configuration attributes and the corresponding Directory Proxy Server 6.0 properties.

Table 6–3 Mapping of Connection Pool Attributes


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-connection-pool`	No equivalent
`ids-proxy-con-connection-pool-interval`	The connection pool grows automatically to a configured maximum. The maximum is configured by setting the following properties of an LDAP data source: `num-bind-init` `num-bin-incr` `num-bind-limit` `num-read-init` `num-read-incr` `num-read-limit` `num-write-init` `num-write-incr` `num-write-limit` For information about setting LDAP data source properties, see To Configure an LDAP Data Source in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.
`ids-proxy-con-connection-pool-timeout`	`backendMaxReadWaitTimeInMilliSec`

Mapping the Groups Configuration

Directory Proxy Server 5 uses groups to define how client connections are identified and what restrictions are placed on the client connections. In Directory Proxy Server 6.0, this functionality is achieved using connection handlers, data views and listeners.

Connection handlers, data views and listeners can be configured by using the Directory Service Control Center or by using the dpconf command. For more information, see Chapter 25, Directory Proxy Server Connection Handlers, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide and Chapter 23, Directory Proxy Server Data Views, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Mapping the Group Object

In Directory Proxy Server 5, a group is defined by setting the attributes of the ids-proxy-sch-Group object class. Certain attributes of this object class can be mapped to Directory Proxy Server 6.0 connection handler properties. For a list of all the connection-handler properties, run the following command:

$ dpconf help-properties | grep connection-handler

In Iplanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=name,ou=groups,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.

The following table maps version 5 group attributes to the corresponding connection handler properties.

Table 6–4 Mapping Between Version 5 Group Attributes and Version 6 Connection Handler Properties


Directory Proxy Server 5 Group Attribute	Directory Proxy Server 6.0 Connection Handler Property
`ids-proxy-con-Name`	`cn`
`ids-proxy-con-Priority`	`priority`
`ids-proxy-sch-Enable`	`is-enabled`
`ids-proxy-sch-belongs-to`	No equivalent
`ids-proxy-con-permit-auth-none:TRUE` `ids-proxy-con-permit-auth-sasl:TRUE` `ids-proxy-con-permit-auth-simple:TRUE`	`allowed-auth-methods:anonymous allowed-auth-methods:sasl allowed-auth-methods:simple`

Mapping the Network Group Object

Directory Proxy Server 5 groups are configured by setting the attributes of the ids-proxy-sch-NetworkGroup object class. These attributes can be mapped to properties of Directory Proxy Server 6.0 connection handlers, data sources and listeners. For a list of all the properties related to these objects, run the dpconf help-properties command, and search for the object. For example, to locate all the properties of a connection handler, run the following command:

$ dpconf help-properties | grep connection-handler

In Iplanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=group-name,ou=groups,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.

The following table maps Directory Proxy Server 5 network group attributes to the corresponding Directory Proxy Server 6.0 properties and describes how to set these properties by using the command line.

Table 6–5 Mapping Between Version 5 Network Group Attributes and 6.0 Properties


Directory Proxy Server 5 Network Group Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-Client`	`domain-name-filters` and `ip-address-filters` properties of a connection handler
`ids-proxy-con-include-property`	No equivalent
`ids-proxy-con-include-rule`	No equivalent
`ids-proxy-con-ssl-policy:ssl_required`	Set this as a connection handler property by using the following command: `$ dpconf set-connection-handler-prop CONNECTION-HANDLER-NAME is-ssl-mandatory:true`
`ids-proxy-con-ssl-policy:ssl_optional`	Set this as an LDAP data source property by using the following command: `$ dpconf set-ldap-data-source-prop ds1 ssl-policy:client`
`ids-proxy-con-ssl-policy:ssl_unavailable`	Set this as a connection handler property by using the following command: `$ dpconf set-connection-handler-prop CONNECTION-HANDLER-NAME is-ssl-mandatory:false`
`ids-proxy-con-tcp-no-delay`	Set this as a property for a specific listener port by using the following command: `$ dpconf set-ldap-listener-prop use-tcp-no-delay:true`
`ids-proxy-con-allow-multi-ldapv2–bind`	No equivalent
`ids-proxy-con-reverse-dns-lookup`	No equivalent
`ids-proxy-con-timeout`	This functionality exists but with less granularity than in Directory Proxy Server 5. Set this limit as a property for a specific listener port by using the following command: `$ dpconf set-ldap-listener-prop connection-idle-timeout:value`

Mapping Bind Forwarding

Directory Proxy Server 5 bind forwarding is used to determine whether to pass a bind request on to an LDAP server or to reject the bind request and close the client's connection. Directory Proxy Server 6.0 forwards either all bind requests or no bind requests. However, by setting the allowed-auth-methods connection handler property, successful binds can be classified into connection handlers, according to the authentication criteria. Directory Proxy Server 6.0 can be configured to reject all requests from a specific connection handler, providing the same functionality as Directory Proxy Server 5 bind forwarding.

The following table maps the Directory Proxy Server 5 bind forwarding attributes to the corresponding Directory Proxy Server 6 connection handler property settings.

Table 6–6 Mapping of Directory Proxy Server 5 Bind Forwarding Attributes to Directory Proxy Server 6 Connection Handler Property Settings


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-bind-name`	No equivalent
`ids-proxy-con-permit-auth-none`	`allowed-auth-methods:anonymous`
`ids-proxy-con-permit-auth-simple`	`allowed-auth-methods:simple`
`ids-proxy-con-permit-auth-sasl`	`allowed-auth-methods:sasl`

Mapping Operation Forwarding

Operation forwarding determines how Directory Proxy Server 5 handles requests after a successful bind. In Directory Proxy Server 6.0, this functionality is provided by setting the properties of a request filtering policy. For information on configuring a request filtering policy, see Creating and Configuring Request Filtering Policies and Search Data Hiding Rules in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For a list of all the properties of a request filtering policy, run the following command:

$ dpconf help-properties | grep request-filtering-policy

The following table maps the Directory Proxy Server 5 operation forwarding attributes to the corresponding Directory Proxy Server 6 request filtering properties.

Table 6–7 Mapping of Directory Proxy Server 5 Operation Forwarding Attributes to Directory Proxy Server 6 Request Filtering Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-permit-op-search`	`allow-search-operations`
`ids-proxy-con-permit-op-compare`	`allow-compare-operations`
`ids-proxy-con-permit-op-add`	`allow-add-operations`
`ids-proxy-con-permit-op-delete`	`allow-delete-operations`
`ids-proxy-con-permit-op-modify`	`allow-modify-operations`
`ids-proxy-con-permit-op-modrdn`	`allow-rename-operations`
`ids-proxy-con-permit-op-extended`	`allow-extended-operations`

Mapping Subtree Hiding

Directory Proxy Server 5 uses the ids-proxy-con-forbidden-subtree attribute to specify a subtree of entries to be excluded in any client request. Directory Proxy Server 6.0 provides this functionality with the allowed-subtrees and prohibited-subtrees properties of a request filtering policy. For information on hiding subtrees in this way, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

If your subtrees are distributed across different backend servers, you can use the excluded-subtrees property of a data view to hide subtrees. For more information on hiding subtrees in this way, see Excluding a Subtree From a Data View in Sun Java System Directory Server Enterprise Edition 6.0 Reference and To Configure Data Views With Hierarchy and a Distribution Algorithm in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Mapping Search Request Controls

In Directory Proxy Server 5, search request controls are used to prevent certain kinds of requests from reaching the LDAP server. In Directory Proxy Server 6.0, this functionality is provided by setting properties of a request filtering policy and a resource limits policy.

For information on configuring a request filtering policy, see Creating and Configuring Request Filtering Policies and Search Data Hiding Rules in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For information on configuring a resource limits policy, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For a list of all the properties associated with a request filtering policy, or a resource limits policy, run the dpadm help-properties command and search for the object. For example, to locate all properties associated with a resource limits policy, run the following command:

$ dpconf help-properties | grep resource-limits-policy

The following table maps the Directory Proxy Server 5 search request control attributes to the corresponding Directory Proxy Server 6.0 properties.

Table 6–8 Mapping Directory Proxy Server 5 Search Request Control Attributes to Directory Proxy Server 6.0 Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-filter-inequality`	`allow-inequality-search-operations` property of the request filtering policy
`ids-proxy-con-min-substring-size`	`minimum-search-filter-substring-length` property of the resource limits policy

Mapping Compare Request Controls

In Directory Proxy Server 5, compare request controls are used to prevent certain kinds of search and compare operations from reaching the LDAP server. In Directory Proxy Server 6.0, this functionality is provided by setting properties of a request filtering policy.

The following table maps the Directory Proxy Server 5 compare request control attributes to the corresponding Directory Proxy Server 6 properties.

Table 6–9 Mapping of Directory Proxy Server 5 Compare Request Control Attributes to Directory Proxy Server 6 Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-forbidden-compare`	`prohibited-comparable-attrs`
`ids-proxy-con-permitted-compare`	`allowed-comparable-attrs`

Mapping Attributes Modifying Search Requests

In Directory Proxy Server 5, these attributes are used to modify the search request before it is forwarded to the server. In Directory Proxy Server 6, this functionality is provided by setting properties of a request filtering policy and a resource limits policy.

The following table maps the Directory Proxy Server 5 search request modifying attributes to the corresponding Directory Proxy Server 6 properties.

Table 6–10 Mapping of Directory Proxy Server 5 Search Request Modifying Attributes to Directory Proxy Server 6 Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-minimum-base`	`allowed-subtrees` property of the request filtering policy
`ids-proxy-con-max-scope`	`allowed-search-scopes` property of the request filtering policy
`ids-proxy-con-max-timelimit`	`search-time-limit` property of the resource limits policy

Mapping Attributes Restricting Search Responses

In Directory Proxy Server 5, these attributes describe restrictions that are applied to search results being returned by the server, before they are forwarded to the client. In Directory Proxy Server 6, this functionality is provided by setting the properties of a resource limits policy and by configuring search data hiding rules.

For information about configuring a resource limits policy, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For information about creating search data hiding rules, see To Create Search Data Hiding Rules in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For a list of properties associated with a search data hiding rule, run the following command:

$ dpconf help-properties | grep search-data-hiding-rule

The following table maps the Directory Proxy Server 5 search response restriction attributes to the corresponding Directory Proxy Server 6.0 properties.

Table 6–11 Mapping of Directory Proxy Server 5 Search Response Restriction Attributes to Directory Proxy Server 6.0 Properties


Directory Proxy Server 5 Attributes	Directory Proxy Server 6.0 Properties
`ids-proxy-con-max-result-size`	`search-size-limit` property of the resource limits policy
`ids-proxy-con-forbidden-return`	To hide a subset of attributes: `rule-action:hide-attributes` `attributes:attribute-name` To hide an entire entry: `rule-action:hide-entry`
`ids-proxy-con-permitted-return`	`rule-action:show-attributes` `attributes:attribute-name`
`ids-proxy-con-search-reference`	No direct equivalent. Search continuation references are governed by the `referral-policy` property of the resource limits policy

Mapping the Referral Configuration Attributes

In Directory Proxy Server 5, these attributes determine what Directory Proxy Server should do with referrals. In Directory Proxy Server 6.0, this functionality is provided by setting properties of a resource limits policy.

For information on configuring a resource limits policy, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

The following table maps the Directory Proxy Server 5 referral configuration attributes to the corresponding Directory Proxy Server 6 resource limits properties.

Table 6–12 Mapping of Directory Proxy Server 5 Referral Configuration Attributes to Directory Proxy Server 6 resource limits Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-reference`	`referral-policy`
`ids-proxy-con-referral-ssl-policy`	`referral-policy`
`ids-proxy-con-referral-bind-policy`	`referral-bind-policy`
`ids-proxy-con-max-refcount`	`referral-hop-limit`

Mapping the Server Load Configuration

In Directory Proxy Server 5, these attributes are used to control the number of simultaneous operations and total number of operations a client can request on one connection. In Directory Proxy Server 6, this functionality is provided by setting properties of a resource limits policy.

For information on configuring a resource limits policy, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

The following table maps the Directory Proxy Server 5 server load configuration attributes to the corresponding Directory Proxy Server 6.0 resource limits properties.

Table 6–13 Mapping of Directory Proxy Server 5 Server Load Configuration Attributes to Directory Proxy Server 6.0 Resource Limits Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-max-simultaneous-operations-per-connection`	`max-simultaneous-operations-per-connection`
`ids-proxy-con-operations-per-connection`	`max-total-operations-per-connection`
`ids-proxy-con-max-conns`	`max-connections`
`ids-proxy-con-max-simultaneous-conns-from-ip`	`max-client-connections`

Mapping the Properties Configuration

The Directory Proxy Server 5 property objects enable you to specify specialized restrictions that LDAP clients must follow. Most of the functionality of property objects is available in Directory Proxy Server 6, although it is supplied by various elements of the new architecture. The following sections describe how to map the Directory Proxy Server 5 property objects to the corresponding 6.0 functionality.

Attribute Renaming Property

In Directory Proxy Server 5, attribute renaming is defined by the ids-proxy-sch-RenameAttribute object class. This object uses the ids-proxy-con-server-attr-name and ids-proxy-con-client-attr-name attributes to specify which attributes must be renamed by Directory Proxy Server.

The attribute renaming functionality is replaced in Directory Proxy Server 6 by the attr-name-mappings property of an LDAP data source. This property is multi-valued, and takes values of the form client-attribute-name#server-attribute-name. In a client request, Directory Proxy Server renames the client-attribute-name to the server-attribute-name. In a response, Directory Proxy Server renames the server-attribute-name to the client-attribute-name.

To configure this property, use the following command:

$ dpconf set-ldap-data-source-prop data-source-name \
 attr-name-mappings:client-attribute-name#server-attribute-name

Forbidden Entry Property

In Directory Proxy Server 5, the ids-proxy-sch-ForbiddenEntryProperty object is used to specify a list of entries or attributes that are hidden from client applications. In Directory Proxy Server 6.0 this functionality is achieved by creating a search-data-hiding-rule for a request filtering policy.

The following table maps the attributes of the ids-proxy-sch-ForbiddenEntryProperty object to the corresponding properties of a search data hiding rule in Directory Proxy Server 6.0. For information about creating search data hiding rules, see To Create Search Data Hiding Rules in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Table 6–14 Mapping of Directory Proxy Server 5 Server Load Configuration Attributes to Directory Proxy Server 6 Resource Limits Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6 Property
`ids-proxy-con-dn-exact`	`target-dns`
`ids-proxy-con-dn-regexp`	`target-dn-regular-expressions`
`ids-proxy-con-ava`	`target-attr-value-assertions`
`ids-proxy-con-forbidden-return`	To hide a subset of attributes: `rule-action:hide-attributes` `attrs:attribute-name` To hide an entire entry: `rule-action:hide-entry`
`ids-proxy-con-permitted-return`	`rule-action:show-attributes` `attrs:attribute-name`

LDAP Server Property

In Directory Proxy Server 5, the ids-proxy-sch-LDAPServer property is used to define the backend LDAP servers to which Directory Proxy Server sends requests. In Directory Proxy Server 6.0, this functionality is achieved by using LDAP data sources. You can set properties for LDAP data sources by using the Directory Service Control Center or by using the command line. For more information, see Creating and Configuring LDAP Data Sources in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

In Iplanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=server-name,ou=properties,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ou=groups,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.

The following table maps the attributes of the ids-proxy-sch-LDAPServer object class to the corresponding data source properties in Directory Proxy Server 6.0. Data sources provide additional functionality that was not provided in Directory Proxy Server 5. Not all data source properties are listed here. For a list of all the properties that can be configured for a data source, run the following command:

$ dpconf help-properties | grep ldap-data-source

Table 6–15 Mapping of ids-proxy-sch-LDAPServer Attributes to Data Source Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-host`	`ldap-address`
`ids-proxy-con-port`	`ldap-port`
`ids-proxy-con-sport`	`ldaps-port`
`ids-proxy-con-supported-version`	No equivalent Directory Proxy Server 6.0 supports LDAP v3 backends for both version 2 and version 3 clients. Directory Proxy Server 6.0 supports the proxy authorization control version 1 and version 2.
`ids-proxy-con-use-version`	No equivalent Directory Proxy Server 6.0 supports LDAP v3 backends for both v2 and v3 clients. Directory Proxy Server 6.0 supports the proxy authorization control version 1 and version 2.
`ids-proxy-con-tcp-no-delay`	`use-tcp-no-delay`
`ids-proxy-con-link-security-policy`	`ssl-policy`
`ids-proxy-con-x509cert-subject`	No equivalent. Directory Proxy Server 6.0 does not check the subject of the certificate provided by the backend server.
`ids-proxy-con-keepalive-interval`	This functionality is achieved by setting the following properties of the LDAP data source: `monitoring-bind-timeout` `monitoring-entry-timeout` `monitoring-inactivity-timeout` `monitoring-interval` For information about setting LDAP data source properties, see To Configure an LDAP Data Source in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Load Balancing Property

In Directory Proxy Server 5, the ids-proxy-sch-LoadBalanceProperty is used to configure load balancing across multiple LDAP servers. Directory Proxy Server 5 supports proportional load balancing only, that is, each LDAP server is allotted a certain percentage of the total load. The ids-proxy-sch-LoadBalanceProperty object class has one attribute, ids-proxy-con-Server, whose value has the following syntax:

server-name[#percentage]

In Iplanet Directory Access Router 5.0 (IDAR) these configuration attributes are stored under ids-proxy-con-Name=load-balance,ou=properties,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, these configuration attributes are stored under ids-proxy-con-name=load-balancing-1,ou=properties,cn=user-defined-name,ou=dar-config,o=NetscapeRoot.

In Directory Proxy Server 6.0, load balancing is configured as a property of a data source pool. A data source pool is essentially a collection of LDAP servers to which Directory Proxy Server can route requests. For information about setting up a data source pool, see Creating and Configuring LDAP Data Source Pools in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide. For a list of properties associated with a data source pool, run the following command:

$ dpconf help-properties | grep ldap-data-source-pool

Directory Proxy Server 6.0 supports proportional load balancing but also supports additional load balancing algorithms. To configure proportional load balancing, set the property of the data source pool as follows:

$ dpconf set-ldap-data-source-pool-prop data-source-pool-name load-balancing-algorithm:proportional

The percentage of load allotted to each server is configured by setting various properties of an attached data source. An attached data source is a data source that has been attached to a specific data source pool. To configure proportional load, set the weight properties of the attached data source for each operation type as follows:

$ dpconf set-attached-ldap-data-source-prop data-source-pool-name attached-data-source-name
 add-weight:value
 bind-weight:value
 compare-weight:value
 delete-weight:value
 modify-dn-weight:value
 modify-weight:value
 search-weight:value

For more information, see Configuring Load Balancing in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Monitoring Backend Servers

To monitor the state of its backend LDAP servers, Directory Proxy Server 5 performs an anonymous search operation on the RootDSE of each server every ten seconds. Directory Proxy Server 6.0 has a number of properties that can be configured to monitor its backend servers. For more information, see Retrieving Monitored Data About Data Sources in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Search Size Limit Property

Directory Proxy Server 5 uses the ids-proxy-sch-SizeLimitProperty to apply size limits based on the base and scope of search operations. In Directory Proxy Server 6.0, the search size limit can be configured by setting a property of the resource limits policy. A resource limits policy defines the maximum resource that Directory Proxy Server can process for a given connection handler. Use the dpconfcommand to set the search size limit for a resource policy, as follows:

$ dpconf set-resource-limits-policy-prop policy-name search-size-limit:number-of-entries

Resource limits policies control much more than just search size limit. For information on configuring resource limits policies, see Creating and Configuring a Resource Limits Policy in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

The following table maps the attributes of a version 5 size limit property to the corresponding properties in Directory Proxy Server 6.0.

Table 6–16 Mapping of Version 5 Search Size Limit Attributes to 6.0 Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-con-Size-Limit`	`search-size-limit`
`ids-proxy-con-Dn-One`	`one-level-search-base-dn`
`ids-proxy-con-Dn-Sub`	No equivalent

Log Property

The logging functionality available in Directory Proxy Server 5 is differs substantially from the functionality available in Directory Proxy Server 6.0.

In Directory Proxy Server 5, the following logs were maintained:

System log. Includes log records of system events and errors.
Audit log. Includes audit trails for all events and errors.

Directory Proxy Server 6.0 maintains an errors log file, an access log file, and administrative alerts.

The errors log and administrative alerts are equivalent to the version 5 system log. Administrative alerts are events raised by Directory Proxy Server. These events can be sent to the syslog daemon or to an administrator through email.

The Directory Proxy Server 6.0 access log is equivalent to the version 5 audit log.

Logs in version 5 were configured by using the ids-proxy-sch-LogProperty object class. Logs in Directory Proxy Server 6.0 are configured by setting properties for the access and error log, using the dpconf command. For example, to set properties for the access log, use the following command:

$ dpconf set-access-log-prop PROPERTY:VALUE

Directory Proxy Server 6.0 provides new log features, such as log file rotation, and enables log configuration to be fine tuned. For example, one log level can be set per message category.

In Iplanet Directory Access Router 5.0 (IDAR) log configuration attributes are stored under ids-proxy-con-Config-Name=name,ou=global,ou=pd2,ou=iDAR,o=services. In Directory Proxy Server 5.2, log configuration attributes are stored under ids-proxy-con-Config-Name=user-defined-name,ou=system,ou=dar-config,o=netscaperoot.

It is not really possible to map the log configuration between Directory Proxy Server 5 and Directory Proxy Server 6.0 because the logging models between these two versions are very different. The Directory Proxy Server 5 log model combines what is logged with where it is logged. In Directory Proxy Server 6.0, the model is cleaner. One set of properties describes what is logged, and a separate set of properties describes where log messages are sent.

The following table lists the attributes of the ids-proxy-sch-LogProperty object class and describes at a high level how the corresponding functionality is achieved in Directory Proxy Server 6.0.

Table 6–17 Version 5 and Version 6 Log Functionality


Directory Proxy Server 5 Attribute	Purpose	Directory Proxy Server 6.0 Equivalent
`ids-proxy-con-log-level`	Level of logging	Global log level
`ids-proxy-con-stat-level`	Kinds of statistics logged	Monitoring data
`ids-proxy-con-log-syslog`	Syslog facility code	`syslog` output for administrative alerts No equivalent for error messages
`ids-proxy-con-log-file`	Path to log file	`log-file-name` of the `error-log` object
`ids-proxy-con-audit-syslog`	Syslog facility code for audit log	No equivalent
`ids-proxy-con-audit-file`	Path to audit log file	`log-file-name` of the `access-log` object

Because a one to one mapping of log configuration is not possible between the two versions, you need to understand the new logging model and then configure your new logs accordingly, rather than migrating your old log configuration. For more information, see Chapter 27, Directory Proxy Server Logging, in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Mapping the Events Configuration

Directory Proxy Server 5 event objects are used to specify conditions that Directory Proxy Server should evaluate at predetermined states.

Two types of event objects are supported:

OnBindSuccess. Evaluated when a client successfully completes a bind operation.
OnSSLEstablished. Evaluated when a client successfully established an SSL session.

In Directory Proxy Server 6.0, events are implemented as properties of a connection handler. Use the dpconf command to set these properties. For example, run the following command to set the authentication methods for the connection handler:

$ dpconf set-connection-handler-prop connection-handler-name \ 
 allowed-auth-methods:anonymous allowed-auth-methods:sasl allowed-auth-methods:simple

The following table maps the version 5 event configuration attributes to the corresponding properties in Directory Proxy Server 6.0.

Table 6–18 Mapping Between Version 5 Event Attributes and Version 6 Connection Handler Properties


Directory Proxy Server 5 Attribute	Directory Proxy Server 6.0 Property
`ids-proxy-sch-OnBindSuccessRule`	`bind-dn-filters`
`ids-proxy-con-ssl-required`	`is-ssl-mandatory`
`ids-proxy-con-bind-anonymous`	`allowed-auth-methods:anonymous`
`ids-proxy-con-bind-simple`	`allowed-auth-methods:simple`
`ids-proxy-con-bind-sasl`	`allowed-auth-methods:sasl`

Mapping the Actions Configuration

Directory Proxy Server 5 supports only one action, specified by the ids-proxy-sch-ChangeGroupAction object class. This action enables you to configure Directory Proxy Server to change a client from one access group to another based on the evaluation of a rule. The action uses the multi-valued ids-proxy-con-to-group attribute to specify the groups to which the client can change.

Directory Proxy Server 6.0 connection handlers provide this functionality. After being classified into a connection handler, a connection can be automatically reclassified into another connection handler. For example, if a client connects anonymously, the connection is allocated to the connection handler configured for anonymous connections. If the client later provides a bind DN on the same connection, the connection can be reallocated to another connection handler.

For information on how to configure this functionality in Directory Proxy Server 6.0, see Creating, Configuring, and Deleting Connection Handlers in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide.

Configuring Directory Proxy Server 6.0 as a Simple Connection-Based Router

It is possible to configure an instance of Directory Proxy Server 6.0 to behave as a simple connection-based router, with the same functionality as Directory Proxy Server 5.2. To do this, map the configuration attributes described previously and follow the procedure describe in Configuring Directory Proxy Server as a Connection Based Router in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide