Setting Referrals and Making a Suffix Read-Only

If you want to limit access to a suffix without disabling the suffix completely, you can modify the access permissions to allow read-only access. In this case you must define a referral to another server for write operations. You can also deny both read and write access, and define a referral for all operations on the suffix.

Referrals can also be used to temporarily point a client application to a different server. For example, while backing up the contents of the suffix, you might add a referral to another suffix.

If your suffix is a consumer in a replicated environment, the replication mechanism determines the value of the referral setting. Although you can manually modify the referral setting, the referral will be overwritten at the next replication update. For information about setting replication referrals, see To Perform Advanced Consumer Configuration.

Referrals are labeled URLs, that is, an LDAP URL optionally followed by a space character and a label. For example:

ldap://phonebook.example.com:389/

Or:

ldap://phonebook.example.com:389/ou=All%20People,dc=example,dc=com

Because space characters are significant, any space characters in the URL part of the referral must be escaped using %20.

To Set Referrals to Make a Suffix Read-Only

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Set the referral URL.

   $ dsconf set-suffix-prop -h host -p port suffix-DN referral-url:LDAP-URL

   where LDAP-URL is a valid URL containing the host name, port number, and DN of the target.

   For example:

   $ dsconf set-suffix-prop -h host1 -p 1389 dc=example,dc=com \
    referral-url:ldap://phonebook.example.com:389/

   You can specify any number of LDAP URLs.

2. Set the referral mode in order to make the suffix read-only.

   $ dsconf set-suffix-prop -h host -p port suffix-DN referral-mode:only-on-write

   To make the suffix unavailable for both read and write operations, and to return referrals for all requests, set the referral-mode to enabled.

3. As soon as the command is successful, the suffix is read-only or inaccessible and ready to return referrals.
4. (Optional) When the suffix becomes available, disable the referrals to make the suffix read-write again.

   $ dsconf set-suffix-prop -h host -p port suffix-DN referral-mode:disabled

   When referrals are disabled, the suffix automatically becomes read-write, unless you have disabled the suffix itself by setting the enabled property of the suffix to off.