test

Sun Java System Directory Server Enterprise Edition 6.1 Release Notes

Known Directory Server Issues in 6.0

This section lists the issues that are found at the time of Directory Server 6.0 release.

2113177

Directory Server has been seen to crash when the server is stopped while performing online export, backup, restore, or index creation.

2133169

When entries are imported from LDIF, Directory Server does not generate createTimeStamp and modifyTimeStamp attributes.

LDIF import is optimized for speed. The import process does not generate these attributes. To work around this limitation, add rather than import the entries. Alternatively, preprocess the LDIF to add the attributes before import.

4979319

Some Directory Server error messages refer to the Database Errors Guide, which does not exist. If you cannot understand the meaning of a critical error message that is not documented, contact Sun support.

6358392

When removing software, the dsee_deploy uninstall command does not stop or delete existing server instances.

To work around this limitation, follow the instructions in the Sun Java System Directory Server Enterprise Edition 6.1 Installation Guide.

6366948

Directory Server has been seen to retain pwdFailureTime values on a consumer replica, even after the attribute values have been cleared on the supplier replica. The values remain after the modification of userPassword has been replicated.

6395603

When installing software from the zip distribution, do not use the -N (--no-cacao) option if you intend subsequently to manage servers with Directory Service Control Center. The Common Agent Container cannot be installed separately later.

6401484

The dsconf accord-repl-agmt command cannot align authentication properties of the replication agreement when SSL client authentication is used on the destination suffix.

    To work around this issue, store the supplier certificate in the configuration on the consumer, following these steps. The examples command shown are based on two instances on the same host.

  1. Export the certificate to a file.

    The following example shows how to perform the export for servers in /local/supplier and /local/consumer.


    $ dsadm show-cert -F der -o /tmp/supplier-cert.txt /local/supplier defaultCert
$ dsadm show-cert -F der -o /tmp/consumer-cert.txt /local/consumer defaultCert

  2. Exchange the client and supplier certificates.

    The following example shows how to perform the exchange for servers in /local/supplier and /local/consumer.


    $ dsadm add-cert --ca /local/consumer supplierCert /tmp/supplier-cert.txt
$ dsadm add-cert --ca /local/supplier consumerCert /tmp/consumer-cert.txt

  3. Add the SSL client entry on the consumer, including the supplierCert certificate on a usercertificate;binary attribute, with the proper subjectDN.

  4. Add the replication manager DN on the consumer.


    $ dsconf set-suffix-prop suffix-dn repl-manager-bind-dn:entryDN

  5. Update the rules in /local/consumer/alias/certmap.conf.

  6. Restart both servers with the dsadm start command.

6410741

Directory Service Control Center sorts values as strings. As a result, when you sort numbers in Directory Service Control Center, the numbers are sorted as if they were strings.

An ascending sort of 0, 20, and 100 results in the list 0, 100, 20. A descending sort of 0, 20, and 100 results in the list 20, 100, 0.

6415184

Directory Server instances with multi-byte names can not be registered in Directory Service Control Center.

To work around this issue, configure the Common Agent Container as follows.


# cacaoadm stop
# cacaoadm set-param java-flags="-Xms4M -Xmx64M -Dfile.encoding=utf-8"
# cacaoadm start
6416407

Directory Server does not correctly parse ACI target DNs containing escaped quotes or a single escaped comma. The following example modifications cause syntax errors.

dn:o=mary\"red\"doe,o=example.com
changetype:modify
add:aci
aci:(target="ldap:///o=mary\"red\"doe,o=example.com")
 (targetattr="*")(version 3.0; acl "testQuotes";
 allow (all) userdn ="ldap:///self";)
dn:o=Example Company\, Inc.,dc=example,dc=com
changetype:modify
add:aci
aci:(target="ldap:///o=Example Company\, Inc.,dc=example,dc=com")
 (targetattr="*")(version 3.0; acl "testComma";
 allow (all) userdn ="ldap:///self";)

Examples with more than one comma that has been escaped have been observed to parse correctly, however.

6428448

The dpconf command has been seen to display the Enter "cn=Directory Manager" password: prompt twice when used in interactive mode.

6435416

When running server management commands in the French locale, some messages displayed by the commands are missing apostrophes.

6443229

Directory Service Control Center does not allow you to manage PKCS#11 external security devices or tokens.

6446318

SASL authentication has been seen to fail on Windows systems when SASL encryption is used.

As a workaround to this issue, reset SASL to the following.


dn: cn=SASL, cn=security, cn=config
  dssaslminssf: 0
  dssaslmaxssf: 0
6448572

Directory Service Control Center fails to generate a self-signed certificate when you specify the country.

6449828

Directory Service Control Center does not properly display userCertificate binary values.

6468074

The configuration attribute name, passwordRootdnMayBypassModsCheck, does not reflect that the server now allows any administrator to bypass password syntax checking when modifying another user's password when the attribute is set.

6468096

Do not set LD_LIBRARY_PATH before installing from the zip distribution or using the dsadm command.

6469296

The Directory Service Control Center feature that allows you to copy the configuration of an existing server does not allow you to copy the plug-in configuration.

6469688

On Windows systems, the dsconf command has been seen to fail to import LDIF with double-byte characters in the LDIF file name.

To work around this issue, change the LDIF file name so that it does not contain double-byte characters.

6475244

When using a browser running in Chinese, Japanese, or Korean locales, logs generated by Directory Service Control Center when creating a server instance contain garbage.

To work around this issue perform the following commands on the Common Agent Container where the new server instance is to be created.


cocaoadm stop
cacaoadm set-param java-flags="-Xms4M -Xmx64M -Dfile.encoding=utf-8"
cacaoadm start
6478568

The dsadm enable-service command does not work correctly with Sun Cluster.

6478586

When using a browser running in the French locale, duplicate apostrophes appear in Directory Service Control Center.

6480753

The dsee_deploy command has been seen to hang while registering the Monitoring Framework component into the Common Agent Container.

6482378

The supportedSSLCiphers attribute on the root DSE lists NULL encryption ciphers not actually supported by the server.

6482888

Unless you start Directory Server at least once, the dsadm enable-service fails to restart Directory Server upon system reboot.

6483290

Neither Directory Service Control Center nor the dsconf command allows you to configure how Directory Server handles invalid plug-in signatures. Default behavior is to verify the plug-in signatures, but not to require that they are valid. Directory Server logs a warning for invalid signatures.

To change the server behavior, adjust the ds-require-valid-plugin-signature and ds-verify-valid-plugin-signature attributes on cn=config. Both attributes take either on or off.

6485560

Directory Service Control Center does not allow you to browse a suffix that is configured to return a referral to another suffix.

6488197

After installation and after server instance creation on Windows systems, the file permissions to the installation and server instance folder allow access to all users.

To work around this issue, change the permissions on the installations and server instance folders.

6488262

The dsadm autostart command fails when multiple instances are specified, and the command fails for one of the instances.

6488263

The dsadm autostart command does not support white space in the instance file name.

6488303

The dsmig command has been seen not to migrate values for some configuration attributes that are not identified in the upgrade and migration documentation.

The following configuration attributes are concerned:

  • nsslapd-db-durable-transaction

  • nsslapd-db-replication-batch-val

  • nsslapd-disk-low-threshold

  • nsslapd-disk-full-threshold

6489776

After a total update on master replica bearing significant write load, in some cases the generation ID for the master having undergone total update is not set properly. As a result, replication fails.

6490653

When enabling referral mode for Directory Server by using Directory Service Control Center through Internet Explorer 6, the text in the confirm referral mode window is truncated.

To work around this issue, use a different browser such as Mozilla web browser.

6490762

After creating or adding a new certificate, Directory Server must be restarted for the change to take effect.

6491849

After upgrading replica, and moving servers to new systems, you must recreate replication agreements to use new host names. Directory Service Control Center lets you delete the existing replication agreements, but does not allow you to create new agreements.

6492894

On Red Hat systems, the dsadm autostart command does not always ensure that the server instances start at boot time.

6492939

Directory Server does not properly handle Chinese multi-byte character in strings for database names, file names, and path names.

To work around this issue when creating a Directory Server suffix having Chinese multi-byte characters, specify a database name that has no multi-byte characters. When creating a suffix on the command line, for example, explicitly set the --db-name option of the dsconf create-suffix command.


$ dsconf create-suffix --db-name asciiDBName multibyteSuffixDN

Do not use the default database name for the suffix.

6493957
6493977

On Windows systems when Directory Server is enabled as a service, do not use the dsadm cert-pwd-prompt=on command.

6494027

The following replication error messages have been seen to persist on agreements with a consumer even after a total update is performed on the consumer.

Error sending replication updates. Error Message: Replication error
updating replica: Unable to start a replication session : transient
error - Failed to get supported proto. Error code 907.

Operational Status Error sending updates to server host:port. Error:
Replication error updating replica: Incremental update session abored :
fatal error - Send extended op failed. Error code: 824.

To eliminate the messages, disable the replication agreement, and then enable the replication agreement.

6494448

When stopping multiple master replica under heavy load in a multi master replication configuration, the servers may take several minutes to stop.

6494984

After an import operation is performed on a master where read-write-mode is set to read-only, Directory Server fails to restart.

6494997

The dsconf command does not prompt for the appropriate dsSearchBaseDN setting when configuring DSML.

6495004

On Windows systems, Directory Server has been seen to fail to start when the base name of the instance is ds.

6495459

You must configure DSML before you can monitor DSML with Java ES Monitoring Framework.

6496916
6539849
6555637

The More on Server Groups, More on read/write mode, and More on this table links in Directory Service Control Center point to English online help on all the locales.

6497053

When installing from the zip distribution, the dsee_deploy command does not provide an option to configure SNMP and stream adaptor ports.

To workaround this issue,

  1. Enabled Monitoring Plugin using the web console or dpconf.

  2. Using cacaoadm set-param, change snmp-adaptor-port, snmp-adaptor-trap-port and commandstream-adaptor-port.

6497894

The dsconf help-properties command is set to work properly only after instance creation. In addition, the correct list of values for the dsml-client-auth-mode command should be client-cert-first | http-basic-only | client-cert-only.

6498537

In order to use Directory Service Control Center on Windows XP systems, the guest account must be disabled. Additionally, the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ForceGuest must be set to 0 in order for authentication to succeed.

6500297
6500301

After installing from the zip distribution on Solaris and Red Hat systems, Directory Server does not appear through SNMP after the Common Agent Container, cacao, is restarted.

To work around this issue on Solaris systems, apply all recommended patches listed in Directory Server, Directory Proxy Server, and Directory Server Resource Kit Operating System Requirements.

6501900
6501902
6501904

Some output displayed by the dsccmon, dsccreg, dsccsetup, and dsccreg commands is not localized.

6503595

After accessing Directory Service Control Center for the first time and registering a Directory Server instance, a warning and an exception are written to the Sun Java Web Console logs.

You can ignore safely ignore the warning, failed to retreive "server-pid" from command ouptut, and the exception. The exception output appears as follows.

StandardWrapperValve[wizardWindowServlet]: Servlet.service() for servlet
 wizardWindowServlet threw exception
java.lang.IllegalStateException: Cannot forward after response has been
 committed
6503558

When setting up Directory Service Control Center in a locale other than English, log messages concerning creation of the Directory Service Control Center Registry are not fully localized. Some log messages are shown in the locale used when setting up Directory Service Control Center.

6506020

After manual reboot following installation on a Windows system with the Java ES installer, Directory Server is not running. However, Directory Server can appear to be running in the Task Manager. When this occurs, Directory Server cannot be restarted from the Task Manager.

To work around this issue, remove the process ID file from the logs folder.

6506043

The dsmig migrate-data -R -N command has been seen to fail when upgrading from Directory Server 5 2005Q1.

To work around failures in automatic data migration, migrate the data manually as described in Chapter 3, Migrating Directory Server Manually, in Sun Java System Directory Server Enterprise Edition 6.1 Migration Guide.

6507312

On HP-UX systems, applications using NSPR libraries crash and dump core after investigation with gdb. The problem occurs when you attach gdb to a running Directory Server instance, then use the gdb quit command.

6507803

When accessing Directory Service Control Center through Internet Explorer 6, saving index configuration changes for a suffix causes a null error to appear. The progress window for the operation appears to freeze.

To work around this issue, access Directory Service Control Center through a different browser, such as a Mozilla-based browser.

6507817

When you edit a directory entry through Directory Service Control Center, if the entry is simultaneously changed by some other method, refreshing the display does not show the changes.

6508042

Directory Service Control Center has been seen to show incorrect status for the User-Changeable field of Global Password Policy, pwd-user-change-enabled.

To work around this issue, use the dsconf(1M) command to read the pwd-user-change-enabled server property.


$ dsconf get-server-prop -w /tmp/ds.pwd pwd-user-change-enabled
pwd-user-change-enabled  :  off
6510594

When upgrading from Directory Server 5.2, if you have a certificate database that contains no trusted certificates, the dsmig migrate-config command fails. This problem can occur when you have created a certificate database, but never used the database, nor set up SSL.

    To work around this issue, follow these steps.

  1. Remove the new, empty Directory Server 6 instance.

  2. Rename the ServerRoot/alias/slapd-serverID-cert8.db and ServerRoot/alias/slapd-serverID-key3.db files that the Directory Server 5.2 instance uses.


    $ cd ServerRoot/alias
$ mv slapd-serverID-cert8.db slapd-serverID-cert8.db.old
$ mv slapd-serverID-key3.db slapd-serverID-key3.db.old

  3. Perform the upgrade and migration process again.

6513644

On HP-UX systems, Directory Service Control Center has been seen to show a null pointer exception error message when starting and stopping a Directory Server instance. The error affects Directory Service Control Center, not the Directory Server instance.

6519263

When migrating a Directory Server configuration, the dsmig migrate-config command fails if the -R option is used but not all suffixes in the existing configuration are replicated.

    To work around this issue, perform the following steps.

  1. Stop the old server.

  2. In the old server instance, dse.ldif configuration file entry with DN cn=changelog5,cn=config comment out the following attributes using hash marks, #.

    #nsslapd-changelogmaxage: ...
#nsslapd-changelogmaxentries: ...

  3. Make a note of the values for these attributes.

  4. Migrate the server configuration using the dsmig migrate-config command.

  5. On the new server instance, for every suffix that has a configuration entry with DN of the form cn=replica,cn=suffix-dn,cn=mapping tree,cn=config, run the following commands.


    $ dsconf set-suffix-prop -p port suffix-dn repl-cl-max-age:old-value

    Here old-value means the value of nsslapd-changelogmaxage in the old server instance.


    $ dsconf set-suffix-prop -p port suffix-dn repl-cl-max-entry-count:old-value/nbr-suffixes

    Here old-value means the value of nsslapd-changelogmaxentries in the old server instance. nbr-suffixes is the total number of replicated suffixes.