Glossary

access control instruction. See ACI.

ACI. Access Control Instruction. An instruction that grants or denies permissions to entries in the directory.

access control list. See ACL.

ACL. Access control list. The mechanism for controlling access to your directory.

access rights. In the context of access control, specify the level of access granted or denied. Access rights are related to the type of operation that can be performed on the directory. The following rights can be granted or denied: read, write, add, delete, search, compare, selfwrite, proxy and all.

account inactivation. Disables a user account, group of accounts, or an entire domain so that all authentication attempts are automatically rejected.

All IDs Threshold. A size limit which is globally applied to every index key managed by the server. When the size of an individual ID list reaches this limit, the server replaces that ID list with an All IDs token.

All IDs token. A mechanism which causes the server to assume that all directory entries match the index key. In effect, the All IDs token causes the server to behave as if no index was available for the search request.

anonymous access. When granted, allows anyone to access directory information without providing credentials, and regardless of the conditions of the bind.

approximate index. Allows for efficient approximate or "sounds-like" searches.

attribute. Holds descriptive information about an entry. Attributes have a label and a value. Each attribute also follows a standard syntax for the type of information that can be stored as the attribute value.

attribute list. A list of required and optional attributes for a given entry type or object class.

authenticating directory server. In pass-through authentication (PTA), the authenticating directory server is the directory server that contains the authentication credentials of the requesting client. The PTA-enabled host sends PTA requests it receives from clients to the host.

authentication. (1) Process of proving the identity of the client user to the Directory Server. Users must provide a bind DN and either the corresponding password or certificate in order to be granted access to the directory. Directory Server allows the user to perform functions or access files and directories based on the permissions granted to that user by the directory administrator.

(2) Allows a client to make sure they are connected to a secure server, preventing another computer from impersonating the server or attempting to appear secure when it is not.

authentication certificate. Digital file that is not transferable and not forgeable and is issued by a third party. Authentication certificates are sent from server to client or client to server in order to verify and authenticate the other party.

base DN. Base distinguished name. A search operation is performed on the base DN, the DN of the entry and all entries below it in the directory tree.

base distinguished name. See base DN.

bind DN. Distinguished name used to authenticate to Directory Server when performing an operation.

bind distinguished name. See bind DN.

bind rule. In the context of access control, the bind rule specifies the credentials and conditions that a particular user or client must satisfy in order to get access to directory information.

branch entry. An entry that represents the top of a subtree in the directory.

browser. Software, such as Netscape Navigator, used to request and view World Wide Web material stored as HTML files. The browser uses the HTTP protocol to communicate with the host server.

browsing index. Otherwise known as the virtual view index, speeds up the display of entries in the Directory Server Console. Browsing indexes can be created on any branchpoint in the directory tree to improve display performance.

CA. See Certificate Authority.

cascading replication. In a cascading replication scenario, one server, often called the hub supplier acts both as a consumer and a supplier for a particular replica. It holds a read-only replica and maintains a change log. It receives updates from the supplier server that holds the master copy of the data, and in turn supplies those updates to the consumer.

certificate. A collection of data that associates the public keys of a network user with their DN in the directory. The certificate is stored in within the directory as user object attributes.

Certificate Authority. Company or organization that sells and issues authentication certificates. You may purchase an authentication certificate from a Certification Authority that you trust. Also known as a CA.

chaining. A method for relaying requests to another server. Results for the request are collected, compiled and then returned to the client.

change log. A change log is record that describes the modifications that have occurred on a replica. The supplier server then replays these modifications on the replicas stored on consumer servers, or on other masters, in the case of multi-master replication.

character type. Distinguishes alphabetic characters from numeric or other characters and the mapping of upper-case to lower-case letters.

ciphertext. Encrypted information that cannot be read by anyone without the proper key to decrypt the information.

CIR. See consumer-initiated replication.

class definition. Specifies the information needed to create an instance of a particular object and determines how the object works in relation to other objects in the directory.

class of service. See CoS.

classic CoS. A classic CoS identifies the template entry by both its DN and the value of one of the target entry's attributes.

client. See LDAP client.

code page. An internal table used by a locale in the context of the internationalization plug-in that the operating system uses to relate keyboard keys to character font screen displays.

collation order. Provides language and cultural-specific information about how the characters of a given language are to be sorted. This information might include the sequence of letters in the alphabet or how to compare letters with accents to letters without accents.

consumer. Server containing replicated directory trees or subtrees from a supplier server.

consumer replica. A replica that refers all add and modify operations to master replicas. A server can hold any number of consumer replicas.

consumer-initiated replication. Replication configuration where consumer servers pull directory data from supplier servers.

consumer server. In the context of replication, a server that holds a replica that is copied from a different server is called a consumer for that replica.

CoS. A method for sharing attributes between entries in a way that is invisible to applications.

CoS definition entry. Identifies the type of CoS you are using. It is stored as an LDAP subentry below the branch it affects.

CoS template entry. Contains a list of the shared attribute values.

daemon. A background process on a Unix machine that is responsible for a particular system task. Daemon processes do not need human intervention to continue functioning.

DAP   . Directory Access Protocol. The ISO X.500 standard protocol that provides client access to the directory.

data master. The server that is the master source of a particular piece of data.

database link. An implementation of chaining. The database link behaves like a database but has no persistent storage. Instead, it points to data stored remotely.

default index. One of a set of default indexes created per database instance. Default indexes can be modified, although care should be taken before removing them, as certain plug-ins may depend on them.

definition entry. See CoS definition entry.

Directory Access Protocol. See DAP.

directory tree. The logical representation of the information stored in the directory. It mirrors the tree model used by most file systems, with the tree's root point appearing at the top of the hierarchy. Also known as DIT.

Directory Manager. The privileged database administrator, comparable to the root user in UNIX. Access control does not apply to the directory manager.

Directory Server Console. An LDAP client application that provides a graphic user interface to browse, configure, and manage the contents of your directory. It is a component of the iPlanet Directory Server product.

directory service. A database application designed to manage descriptive, attribute-based information about people and resources within an organization.

distinguished name. String representation of an entry's name and location in an LDAP directory.

DIT. See directory tree.

DN. see distinguished name.

DM. See Directory Manager.

DNS. Domain Name System. The system used by machines on a network to associate standard IP addresses (such as 198.93.93.10) with hostnames (such as www.iPlanet.com). Machines normally get the IP address for a hostname from a DNS server, or they look it up in tables maintained on their systems.

DNS alias. A DNS alias is a hostname that the DNS server knows points to a different host—specifically a DNS CNAME record. Machines always have one real name, but they can have one or more aliases. For example, an alias such as www.[yourdomain].[domain] might point to a real machine called realthing.[yourdomain].[domain] where the server currently exists.

entry. A group of lines in the LDIF file that contains information about an object.

entry distribution. Method of distributing directory entries across more than one server in order to scale to support large numbers of entries.

entry ID list. Each index that the directory uses is composed of a table of index keys and matching entry ID lists. The entry ID list is used by the directory to build a list of candidate entries that may match the client application's search request.

equality index. Allows you to search efficiently for entries containing a specific attribute value.

file extension. The section of a filename after the period or dot (.) that typically defines the type of file (for example, .GIF and .HTML). In the filename index.html the file extension is html.

file type. The format of a given file. For example, graphics files are often saved in GIF format, while a text file is usually saved as ASCII text format. File types are usually identified by the file extension (for example, .GIF or .HTML).

filter. A constraint applied to a directory query that restricts the information returned.

filtered role. Allows you to assign entries to the role depending upon the attribute contained by each entry. You do this by specifying an LDAP filter. Entries that match the filter are said to possess the role.

general access. When granted, indicates that all authenticated users can access directory information.

hostname. A name for a machine in the form machine.domain.dom, which is translated into an IP address. For example, www.iPlanet.com is the machine www in the subdomain iPlanet and com domain.

HTML. Hypertext Markup Language. The formatting language used for documents on the World Wide Web. HTML files are plain text files with formatting codes that tell browsers such as the Netscape Navigator how to display text, position graphics and form items, and display links to other pages.

HTTP. Hypertext Transfer Protocol. The method for exchanging information between HTTP servers and clients.

HTTPD. An abbreviation for the HTTP daemon or service, a program that serves information using the HTTP protocol. The daemon or service is often called an httpd.

HTTP-NG. The next generation of Hypertext Transfer Protocol.

HTTPS. A secure version of HTTP, implemented using the Secure Sockets Layer, SSL.

hub supplier. In the context of replication, a server that holds a replica that is copied from a different server, and in turn replicates it to a third server. See also cascading replication.

index key. Each index that the directory uses is composed of a table of index keys and matching entry ID lists.

indirect CoS. An indirect CoS identifies the template entry using the value of one of the target entry's attributes.

international index. Speeds up searches for information in international directories.

International Standards Organization. See ISO.

IP address. Internet Protocol address. A set of numbers, separated by dots, that specifies the actual location of a machine on the Internet (for example, 198.93.93.10).

ISO. International Standards Organization

knowledge reference. Pointers to directory information stored in different databases.

LDAP. Lightweight Directory Access Protocol. Directory service protocol designed to run over TCP/IP and across multiple platforms.

LDAPv3. Version 3 of the LDAP protocol, upon which Directory Server bases its schema format

LDAP client. Software used to request and view LDAP entries from an LDAP Directory Server. See also browser.

LDAP Data Interchange Format. See LDAP Data Interchange Format.

LDAP URL. Provides the means of locating directory servers using DNS and then completing the query via LDAP. A sample LDAP URL is ldap://ldap.iplanet.com

LDBM database. A high-performance, disk-based database consisting of a set of large files that contain all of the data assigned to it. The primary data store in Directory Server.

LDIF. LDAP Data Interchange Format. Format used to represent Directory Server entries in text form.

leaf entry. An entry under which there are no other entries. A leaf entry cannot be a branch point in a directory tree.

Lightweight Directory Access Protocol. See LDAP.

locale. Identifies the collation order, character type, monetary format and time / date format used to present data for users of a specific region, culture, and/or custom. This includes information on how data of a given language is interpreted, stored, or collated. The locale also indicates which code page should be used to represent a given language.

managed object. A standard value which the SNMP agent can access and send to the NMS. Each managed object is identified with an official name and a numeric identifier expressed in dot-notation.

managed role. Allow you to create an explicit enumerated list of members.

management information base. See MIB.

mapping tree. A data structure that associates the names of suffixes (subtrees) with databases.

master agent. See SNMP master agent.

matching rule. Provides guidelines for how the server compares strings during a search operation. In an international search, the matching rule tells the server what collation order and operator to use.

MD5. A message digest algorithm by RSA Data Security, Inc., which can be used to produce a short digest of data, that is unique with high probability, and is mathematically extremely hard to produce a piece of data that will produce the same message digest.

MD5 signature. A message digest produced by the MD5 algorithm.

MIB. Management Information Base. All data, or any portion thereof, associated with the SNMP network. We can think of the MIB as a database which contains the definitions of all SNMP managed objects. The MIB has a tree like hierarchy, where the top level contains the most general information about the network and lower levels deal with specific, separate network areas.

MIB namespace. Management Information namespace. The means for directory data to be named and referenced. Also called the directory tree.

monetary format. Specifies the monetary symbol used by specific region, whether the symbol goes before or after its value, and how monetary units are represented.

multi-master replication. An advanced replication scenario in which two servers each hold a copy of the same read-write replica. Each server maintains a change log for the replica. Modifications made on one server are automatically replicated to the other server. In case of conflict, a time stamp is used to determine which server holds the most recent version.

multiplexor. The server containing the database link that communicates with the remote server.

n + 1 directory problem. The problem of managing multiple instances of the same information in different directories, resulting in increased hardware and personnel costs.

name collisions. Multiple entries with the same distinguished name.

nested role. Allow you to create roles that contain other roles.

network management application. Network Management Station component that graphically displays information about SNMP managed devices (which device is up or down, which and how many error messages were received, etc.).

network management station. See NMS.

NIS. Network Information Service. A system of programs and data files that Unix machines use to collect, collate, and share specific information about machines, users, file systems, and network parameters throughout a network of computers.

NMS. Network Management Station. Powerful workstation with one or more network management applications installed.

ns-slapd. iPlanet's LDAP Directory Server daemon or service that is responsible for all actions of the Directory Server. See also slapd.

object class. Defines an entry type in the directory by defining which attributes are contained in the entry.

object identifier. A string, usually of decimal numbers, that uniquely identifies a schema element, such as an object class or an attribute, in an object-oriented system. Object identifiers are assigned by ANSI, IETF or similar organizations.

OID. See object identifier.

operational attribute. An operational attribute contains information used internally by the directory to keep track of modifications and subtree properties. Operational attributes are not returned in response to a search unless explicitly requested.

parent access. When granted, indicates that users have access to entries below their own in the directory tree, that is, if the bind DN is the parent of the targeted entry.

pass-through authentication. See PTA.

pass-through subtree. In pass-through authentication, the PTA directory server will pass through bind requests to the authenticating directory server from all clients whose DN is contained in this subtree.

password file. A file on Unix machines that stores Unix user login names, passwords, and user ID numbers. It is also known as /etc/passwd, because of where it is kept.

password policy. A set of rules that govern how passwords are used in a given directory.

permission. In the context of access control, the permission states whether access to the directory information is granted or denied, and the level of access that is granted or denied. See access rights.

PDU. Protocol Data Unit. Encoded messages which form the basis of data exchanges between SNMP devices.

pointer CoS. A pointer CoS identifies the template entry using the template DN only.

presence index. Allows you to search for entries that contain a specific indexed attribute.

protocol. A set of rules that describes how devices on a network exchange information.

protocol data unit. See PDU.

proxy authorization. A special form of authentication where a user binds to the directory with its own identity but is granted the access rights of another user. This other user is referred to as the proxy user, and its DN the proxy DN.

proxy DN. Used with proxied authentication. The proxy DN is the DN of an entry that has access permissions to the target on which the client application is attempting to perform an operation.

PTA. Pass-through authentication. Mechanism by which one directory server consults another to check bind credentials.

PTA directory server. In pass-through authentication (PTA), the PTA directory server is the server that sends (passes through) bind requests it receives to the authenticating directory server.

PTA LDAP URL. In pass-through authentication, the URL that defines the authenticating directory server, pass-through subtree(s) and optional parameters.

RAM. Random access memory. The physical semiconductor-based memory in a computer. Information stored in RAM is lost when the computer is shut down.

rc.local. A file on Unix machines that describes programs that are run when the machine starts. It is also called /etc/rc.local because of its location.

RDN. Relative distinguished name. The name of the actual entry itself, before the entry's ancestors have been appended to the string to form the full distinguished name.

referential integrity. Mechanism that ensures that relationships between related entries are maintained within the directory.

referral. (1) When a server receives a search or update request from an LDAP client that it cannot process, it usually sends back to the client a pointer to the LDAP sever that can process the request.

(2) In the context of replication, when a consumer replica receives an update request, it forwards it to the server that holds the corresponding master replica. This forwarding process is called a referral.

replica. A database that participates in replication. See also consumer replica and supplier replica.

relative distinguished name. See RDN.

replication. Act of copying directory trees or subtrees from supplier servers to consumer servers.

replication agreement. Set of configuration parameters that are stored on the supplier server and identify the databases to replicate, the consumer servers to which the data is pushed, the times during which replication can occur, the DN and credentials used by the supplier to bind to the consumer, and how the connection is secured.

RFC. Request For Comments. Procedures or standards documents submitted to the Internet community. People can send comments on the technologies before they become accepted standards.

role. An entry grouping mechanism. Each role has members, which are the entries that possess the role.

role-based attributes. Attributes that appear on an entry because it possesses a particular role within an associated CoS template.

root. The most privileged user available on Unix machines. The root user has complete access privileges to all files on the machine.

root suffix. The parent of one or more sub suffixes. A directory tree can contain more than one root suffix.

schema. Definitions describing what types of information can be stored as entries in the directory. When information that does not match the schema is stored in the directory, clients attempting to access the directory may be unable to display the proper results.

schema checking. Ensures that entries added or modified in the directory conform to the defined schema. Schema checking is on by default and users will receive an error if they try to save an entry that does not conform to the schema.

Secure Sockets Layer. See SSL.

self access. When granted, indicates that users have access to their own entries, that is, if the bind DN matches the targeted entry.

server daemon. The server daemon is a process that, once running, listens for and accepts requests from clients.

server service. The server service is a process on Windows NT that, once running, listens for and accepts requests from clients. It is the SMB server on Windows NT.

server root. A directory on the server machine dedicated to holding the server program and configuration, maintenance, and information files.

Server Selector. Interface that allows you select and configure servers using a browser.

service. A background process on a Windows NT machine that is responsible for a particular system task. Service processes do not need human intervention to continue functioning.

SIE. Server Instance Entry.

Simple Network Management Protocol. See SNMP.

single-master replication. The most basic replication scenario in which two servers each hold a copy of the same read-write replicas to consumer servers. In a single-master replication scenario, the supplier server maintains a change log.

SIR. See supplier-initiated replication.

slapd. LDAP Directory Server daemon or service that is responsible for most functions of a directory except replication. See also ns-slapd.

SNMP. Simple Network Management Protocol. Used to monitor and manage application processes running on the servers, by exchanging data about network activity.

SNMP master agent. Software that exchanges information between the various subagents and the NMS.

SNMP subagent. Software that gathers information about the managed device and passes the information to the master agent.

SSL. Secure Sockets Layer. A software library establishing a secure connection between two parties (client and server) used to implement HTTPS, the secure version of HTTP.

standard index. Indexes that are maintained by default.

sub suffix. A branch underneath a root suffix.

subagent. See SNMP subagent.

substring index. Allows for efficient searching against substrings within entries. Substring indexes are limited to a minimum of two characters for each entry.

suffix. The name of the entry at the top of the directory tree, below which data is stored. Multiple suffixes are possible within the same directory. Each database only has one suffix.

superuser. The most privileged user available on Unix machines (also called root). The superuser has complete access privileges to all files on the machine.

supplier. Server containing the master copy of directory trees or subtrees that are replicated to consumer servers.

supplier-initiated replication. Replication configuration where supplier servers replicate directory data to consumer servers.

supplier replica . A replica that contains a master copy of directory information and can be updated. A server can hold any number of master replicas.

supplier server. In the context of replication, a server that holds a replica that is copied to a different server is called a supplier for that replica.

symmetric encryption. Encryption that uses the same key for both encrypting and decrypting. DES is an example of a symmetric encryption algorithm.

system index. Cannot be deleted or modified as it is essential to Directory Server operations.

target. In the context of access control, the target identifies the directory information to which a particular ACI applies.

target entry. The entries within the scope of a CoS.

TCP/IP. Transmission Control Protocol/Internet Protocol. The main network protocol for the Internet and for enterprise (company) networks.

template entry. See CoS template entry.

time / date format. Indicates the customary formatting for times and dates in a specific region.

TLS. Transport Layer Security. The new standard for secure socket layers, a public key based protocol.

topology. The way a directory tree is divided among physical servers and how these servers link with one another.

Transport Layer Security. See TLS.

uid. A unique number associated with each user on a Unix system.

URL. Uniform Resource Locator. The addressing system used by the server and the client to request documents. It is often called a location. The format of a URL is [protocol]://[machine:port]/[document]. The port number is necessary only on selected servers, and it is often assigned by the server, freeing the user of having to place it in the URL.

virtual list view index . Otherwise known as a browsing index, speeds up the display of entries in the Directory Server Console. Virtual list view indexes can be created on any branchpoint in the directory tree to improve display performance.

X.500 standard. The set of ISO/ITU-T documents outlining the recommended information model, object classes and attributes used by directory server implementation.