JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Oracle Directory Server Enterprise Edition Administration Guide 11g Release 1 (11.1.1.5.0)
search filter icon
search icon

Document Information

Preface

Part I Directory Server Administration

1.  Directory Server Tools

2.  Directory Server Instances and Suffixes

3.  Directory Server Configuration

4.  Directory Server Entries

Managing Entries

Managing Entries Using DSCC

Extending Entries Using DSCC

To Extend Entries Using DSCC

Managing Entries Using ldapmodify and ldapdelete

Adding Entries Using ldapmodify

Modifying Entries Using ldapmodify

Deleting Entries Using ldapdelete

Deleting Entries Using ldapmodify

Searching Entries Using ldapsearch

To Move or Rename an Entry Using ldapmodify

Guidelines and Limitations for Using the Modify DN Operation

General Guidelines for Using the Modify DN Operation

Guidelines for Using the Modify DN Operation With Replication

Grouping Entries for Simplified Management

Compressing Entries

To Compress the Size of Entries in Database

Setting Referrals

Setting the Default Referrals

To Set a Default Referral

Setting Smart Referrals

To Create and Modify a Smart Referral

Checking Valid Attribute Syntax

To Turn On Automatic Syntax Checking

Tracking Modifications to Directory Entries

To Turn Off Entry Modification Tracking

Encrypting Attribute Values

Attribute Encryption and Performance

Attribute Encryption Usage Considerations

To Configure Attribute Encryption

5.  Directory Server Security

6.  Directory Server Access Control

7.  Directory Server Password Policy

8.  Directory Server Backup and Restore

9.  Directory Server Groups, Roles, and CoS

10.  Directory Server Replication

11.  Directory Server Schema

12.  Directory Server Indexing

13.  Directory Server Attribute Value Uniqueness

14.  Directory Server Logging

15.  Directory Server Monitoring

Part II Directory Proxy Server Administration

16.  Directory Proxy Server Tools

17.  Directory Proxy Server Instances

18.  LDAP Data Views

19.  Directory Proxy Server Certificates

20.  Directory Proxy Server Load Balancing and Client Affinity

21.  Directory Proxy Server Distribution

22.  Directory Proxy Server Virtualization

23.  Virtual Data Transformations

24.  Connections Between Directory Proxy Server and Back-End LDAP Servers

25.  Connections Between Clients and Directory Proxy Server

26.  Directory Proxy Server Client Authentication

27.  Directory Proxy Server Logging

28.  Directory Proxy Server Monitoring and Alerts

Part III Directory Service Control Center Administration

29.  Directory Service Control Center Configuration

Index

Managing Entries

The best way to manage entries depends on the context:

Managing Entries Using DSCC

DSCC enables you to view all readable unencrypted attributes of an entry and to edit its writable attributes. It also enables you to add and remove attributes, set multi-valued attributes, and manage the object classes of the entry. For more information about how to use DSCC to manage entries, see the DSCC online help. For more information about DSCC in general, see Directory Service Control Center Interface.

Extending Entries Using DSCC

You can add or edit a directory entry directly through DSCC on the Entry Management tab page for a Directory Server instance. There are buttons that launch wizards for adding and editing entries.

The following procedure explains how to extend entries, adding additional user-defined attributes to existing entries. For example, a new application accessing the directory requires that you store additional information on each entry, and you need to create a few entries for testing purposes.

To Extend Entries Using DSCC

  1. Use the schema wizard to set up a user-defined object class that specifies the attributes that you can add to the entry.

    Click the link to the Directory instance; click the Schema tab; scroll to User-Defined Object Classes, and click the Add button to open the wizard.

    Alternatively, you can update the directory schema over LDAP or by editing configuration files. For more information, see Chapter 11, Directory Server Schema.

    You must create the object class, because adding an object class attribute value to an entry is the LDAP way of extending the list of attributes the entry can have.

  2. From the Entry Management tab, and find the entry to update.
  3. When you edit the entry, use the Text View.

    The form-based editor shows you all the attributes you can edit, but not object classes you can add to extend the entry.

  4. In the Text View, add the object class and attributes you want in LDIF format.

    For example, if you extend the schema with example-objectclass that allows the example-attribute attribute to add to the LDIF.

    dn: uid=bjensen,ou=People,dc=example,dc=com
    cn: Babs Jensen
    mail: bjensen@example.com
    objectclass: top
    objectclass: person
    objectclass: organizationalPerson
    objectclass: inetOrgPerson
    objectclass: example-objectclass
    sn: Jensen
    uid: bjensen
    example-attribute: Extended entry

    The Text View editor has a check routine built in, so you can check that your edits are valid with a single click. When everything is the way you want it, apply your changes.

Managing Entries Using ldapmodify and ldapdelete

The ldapmodify and ldapdelete command-line utilities provide full functionality for adding, editing, and deleting your directory contents. You can use these utilities to manage both the configuration entries of the server and the data in the user entries. The utilities can also be used to write scripts to perform bulk management of one or more directories.

The ldapmodify and ldapdelete commands are used in procedures throughout this book. The following sections describe the basic operations that you will need to perform procedures. For more information about the ldapmodify and ldapdelete commands, see Oracle Directory Server Enterprise Edition Reference.

Input to the command-line utilities is always in LDIF, and it can be provided either directly from the command-line or through an input file. The following section provides information about LDIF input, and subsequent sections describe the LDIF input for each type of modification.

For information about formatting LDIF input correctly, see the Guidelines for Providing LDIF Input in Oracle Directory Server Enterprise Edition Reference.

The following sections describe these basic operations:

Adding Entries Using ldapmodify

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.


Note - Ensure that you use the ldapmodify utility provided with the Directory Server Enterprise Edition software.


You can add one or more entries to the directory by using the -a option of ldapmodify. The following example creates a structural entry to contain users and then creates a user entry:

$ ldapmodify -a -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: ou=People,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People
description: Container for user entries

dn: uid=bjensen,ou=People,dc=example,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetorgPerson
uid: bjensen
givenName: Barbara
sn: Jensen
cn: Babs Jensen
telephoneNumber: (408) 555-3922
facsimileTelephoneNumber: (408) 555-4000
mail: bjensen@example.com
userPassword: secret

The -D and -w options give the bind DN and password, respectively, of a user with permissions to create these entries. The -a option indicates that all entries in the LDIF will be added. Then each entry is listed by its DN and its attribute values, with a blank line between each entry. The ldapmodify utility creates each entry after it is entered, and the utility reports any errors.

By convention, the LDIF of an entry lists the following attributes:

  1. The DN of the entry.

  2. The list of object classes.

  3. The naming attribute (or attributes). This is the attribute used in the DN, and it is not necessarily one of the required attributes.

  4. The list of required attributes for all object classes.

  5. Any allowed attributes that you want to include.

When typing a value for the userPassword attribute, provide the clear text version of the password. The server will encrypt this value and store only the encrypted value. Be sure to limit read permissions to protect clear passwords that appear in LDIF files.

You can also use an alternate form of the LDIF that does not require the -a option on the command line. The advantage of this form is that you can combine entry addition statements and entry modification statements, as shown in the following example.

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password: 
dn: ou=People,dc=example,dc=com
changetype: add
objectclass: top
objectclass: organizationalUnit
ou: People
description: Container for user entries

dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: add
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetorgPerson
uid: bjensen
givenName: Barbara
sn: Jensen
cn: Barbara Jensen
telephoneNumber: (408) 555-3922
facsimileTelephoneNumber: (408) 555-4000
mail: bjensen@example.com
userPassword: secret

The changetype: add keyword indicates that the entry with the given DN should be created with all of the subsequent attributes. All other options and LDIF conventions are the same as explained earlier in this section.

In both examples, you can use the -f filename option to read the LDIF from a file instead of from the terminal input. The LDIF file must contain the same format as used for the terminal input, depending upon your use of the -a option.

Modifying Entries Using ldapmodify

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.


Note - Ensure that you use the ldapmodify utility that is provided as a part of the Directory Server Enterprise Edition software.


Use the changetype: modify keyword to add, replace, or remove attributes and their values in an existing entry. When you specify changetype: modify, you must also provide one or more change operations to indicate how the entry is to be modified. The three possible LDIF change operations are shown in the following example:

dn: entryDN
changetype: modify
add: attribute 
attribute: value...
-
replace: attribute 
attribute: newValue...
-
delete: attribute 
[attribute: value]
...

Use a hyphen (-) on a line to separate operations on the same entry, and use a blank line to separate groups of operations on different entries. You can also give several attribute: value pairs for each operation.

Adding an Attribute Value

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

The following example shows how you can use the same add LDIF syntax to add values to existing multi-valued attribute and to attributes that do not yet exist:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
add: cn
cn: Babs Jensen
-
add: mobile
mobile: (408) 555-7844

This operation might fail and the server will return an error if any of the following are true:

Using the Binary Attribute Subtype

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

The attribute;binary subtype indicates that attribute values must be transported over LDAP as binary data, regardless of their actual syntax. This subtype is designed for complex syntax that does not have LDAP string representations, such as userCertificate. The binary subtype should not be used outside of this purpose.

When used with the ldapmodify command, appropriate subtypes can be added to attribute names in any of the LDIF statements.

To enter a binary value, you may type it directly in the LDIF text or read it from another file. The LDIF syntax for reading it from a file is shown in the following example:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
version: 1
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
add: userCertificate;binary
userCertificate;binary:< file:///local/cert-file

To use the :< syntax to specify a file name, you must begin the LDIF statement with the line version: 1. When ldapmodify processes this statement, it will set the attribute to the value that is read from the entire contents of the given file.

By default, the search returns the binary attributes when used with the ;binary option. Set the compat-flag to norfc4522 to disable rfc4522 compliance.

Adding an Attribute With a Language Subtype

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

Language and pronunciation subtypes of attributes designate localized values. When you specify a language subtype for an attribute, the subtype is added to the attribute name as follows:

attribute;lang-CC

where attribute is an existing attribute type, and cc is the two-letter country code to designate the language. You may optionally add a pronunciation subtype to a language subtype to designate a phonetic equivalent for the localized value. In this case the attribute name is as follows:

attribute;lang-CC;phonetic

To perform an operation on an attribute with a subtype, you must explicitly match its subtype. For example, if you want to modify an attribute value that has the lang-fr language subtype, you must include lang-fr in the modify operation as follows:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
add: homePostalAddress;lang-fr
homePostalAddress;lang-fr: 34, rue de la Paix

Note - If the attribute value contains non-ASCII characters, they must be UTF-8 encoded.


Modifying Attribute Values

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

The following example shows how to change the value of an attribute by using the replace syntax in LDIF:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
replace: sn
sn: Morris
-
replace: cn
cn: Barbara Morris
cn: Babs Morris

All current values of the specified attributes are removed, and all given values are added.

After changing an attribute value, you can use the ldapsearch command to verify the change.

Trailing Spaces in Attribute Values

When you modify an attribute value, do not unintentionally include trailing spaces at the end of the value. The trailing spaces are stored in the server as part of the attribute's value, and leads to unexpected values being stored

When you verify the change using DSCC or the ldapsearch command, the value you see might be plain text or some other unexpected value. This depends on which Directory Server client you use.

Deleting an Attribute Value

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

The following example shows how to delete an attribute entirely and to delete only one value of a multi valued attribute:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
delete: facsimileTelephoneNumber
-
delete: cn
cn: Babs Morris

When using the delete syntax without specifying an attribute: value pair, all values of the attribute are removed. If you specify an attribute: value pair, only that value is removed.

Modifying One Value of a Multi Valued Attribute

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

To modify one value of a multi valued attribute with the ldapmodify command, you must perform two operations as shown in the following example:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
delete: mobile
mobile: (408) 555-7845
-
add: mobile
mobile: (408) 555-5487

Deleting Entries Using ldapdelete

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.


Note - Ensure that you use the ldapdelete utility that is provided as a part of the Directory Server Enterprise Edition software.


Use the ldapdelete command-line utility to delete entries from the directory. This utility binds to the directory server and deletes one or more entries based on their DN. You must provide a bind DN that has permission to delete the specified entries.

You cannot delete an entry that has children. The LDAP protocol forbids the situation where child entries would no longer have a parent. For example, you cannot delete an organizational unit entry unless you have first deleted all entries that belong to the organizational unit.

The following example shows only one entry in the organizational unit. This entry and then its parent entry can be deleted.

$ ldapdelete -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
Enter bind password:
uid=bjensen,ou=People,dc=example,dc=com
ou=People,dc=example,dc=com

Deleting Entries Using ldapmodify

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.


Note - Ensure that you use the ldapmodify utility that is provided as a part of the Directory Server Enterprise Edition software.


When using the ldapmodify utility, you can also use the changetype: delete keywords to delete entries. All of the same limitations apply as when using ldapdelete, as described in the previous section. The advantage of using LDIF syntax for deleting entries is that you can perform a mix of operations in a single LDIF file.

The following example performs the same delete operations as the previous example:

$ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: delete

dn: ou=People,dc=example,dc=com
changetype: delete

Searching Entries Using ldapsearch

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.


Note - Ensure that you use the ldapsearch utility that is provided as a part of the Directory Server Enterprise Edition software.


You can use the ldapsearch command-line utility to locate and retrieve directory entries.

For more information about using ldapsearch, common ldapsearch options, accepted formats, and examples, refer to Oracle Directory Server Enterprise Edition Reference.

To Move or Rename an Entry Using ldapmodify

This procedure uses the modify DN operation. Before starting this operation, ensure that you are familiar with the section Guidelines and Limitations for Using the Modify DN Operation.

For parts of this procedure, you can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help. Other parts of the procedure can only be done using the command line.


Note - When modifying the DNs of entries that are a uniquemember of a group, you must have the referential integrity plug-in enabled. Referential integrity ensures that the group members get adjusted when the entry is moved. For information about how to enable and configure the referential integrity plug-in, see To Configure the Referential Integrity Plug-In.


  1. If you are moving an entry from one parent to another, extend ACI rights on the parent entries.
    • On the current parent entry of the entry to be moved, ensure that the ACI allows the export operations by using the syntax allow (export ...)

    • On the future parent entry of the entry to be moved, ensure that the ACI allows the import operations. by using the syntax allow (import ...)

    For information about using ACIs, see Chapter 6, Directory Server Access Control.

  2. Ensure that the modify DN operation is enabled globally, or at least for the suffix or suffixes that will be affected by the move operation.

    To ensure compatibility with previous releases of Directory Server, the modify DN operation is not enabled by default.

    If you have already enabled the modify DN operation previously, go to the next step.

    To enable the modify DN operation globally for a server, use this command:

    $ dsconf set-server-prop -h host -p port moddn-enabled:on
  3. Run the ldapmodify command.

    This step uses the modify DN operation. Do one of the following:

    • Move the entry.

      For example, the following command moves the entry uid=bjensen from the subtree for contractors, ou=Contractors,dc=example,dc=com to the subtree for employees, ou=People,dc=example,dc=com:

      $ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
      Enter bind password:
      dn: uid=bjensen,ou=Contractors,dc=example,dc=com
      changetype: modrdn
      newrdn: uid=bjensen
      deleteoldrdn: 0
      newsuperior: ou=People,dc=example,dc=com
    • Rename the entry.

      For example, the following command renames the entry uid=bbjensen to uid=bjensen:

      $ ldapmodify -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
      Enter bind password:
      dn: uid=bbjensen,ou=People,dc=example,dc=com
      changetype: modrdn
      newrdn: uid=bjensen
      deleteoldrdn: 1

    Pay attention to the following attributes when writing the LDIF statement:

    • dn - Specifies the entry to rename or move.

    • changetype: modrdn - Specifies that a modify DN operation is to be used.

    • newrdn - Gives the new naming attribute.

    • deleteoldrdn - Indicates whether the previous naming attribute should be removed from the entry (1 is yes, 0 is no).

      Note that you cannot remove a naming attribute from the entry if that attribute is obligatory in the entry definition.

    • newsuperior - Specifies the new superior attribute of the entry.

    For information about the ldapmodify command and its options, see the ldapmodify(1) man page.

  4. If you encounter resource limit errors when moving or renaming subtrees that contain a large number of entries, increase the number of locks that can be used by the database.
    $ dsconf set-server-prop -h host -p port db-lock-count:value

    If you modify this property, you must restart the server for the change to take effect.

Guidelines and Limitations for Using the Modify DN Operation

When you use the modify DN operation, as described in the previous section, use the guidelines described in the following sections.

General Guidelines for Using the Modify DN Operation

Guidelines for Using the Modify DN Operation With Replication


Caution

Caution - Using the modify DN operation without complying with the following requirements can break replication and bring down your directory service.