Installation for Oracle Guide for Directory Server Enterprise Edition, 11g Release 1 (11.1.1.7.0)

11g Release 1 (11.1.1.7.0)

E28973-01

Contents

List of Figures

List of Tables

Title and Copyright Information

Preface

- Who Should Use This Book

- Before You Read This Book

- How This Book Is Organized

- Oracle Directory Server Enterprise Edition Documentation Set

- Related Reading

- Redistributable Files

- Default Paths and Command Locations

- Typographic Conventions

- Shell Prompts in Command Examples

- Symbol Conventions

- Documentation, Support, and Training

- Oracle Software Resources

- Documentation Accessibility

1 Before You Install

- 1.1 Quick Scan of Fully Installed and Running Directory Server Enterprise Edition

- 1.1.1 Software Files

- 1.1.2 Data Files

- 1.1.2.1 Server Instances

- 1.1.2.2 Administration Files

- 1.1.3 Background Processes

- 1.2 The Directory Server Enterprise Edition Zip Distribution

- 1.2.1 Contents of the Zip Distribution

- 1.3 File and Process Ownership on Unix Systems

- 1.4 Installation in Solaris Zones

Part I Installing and Uninstalling

2 Installing Directory Server Enterprise Edition

- 2.1 Installing Directory Server Enterprise Edition

- 2.1.1 Complete Pre-Installation Tasks

- 2.1.2 Download and Unzip the ODSEE Zip Distribution File

- 2.1.3 Set Up the Administration (DSCC) Host

- 2.1.4 Set Up a DSCC Agent on the Directory Server or Directory Proxy Server Host

- 2.1.5 Save Useful Information for Your Records

- 2.2 Checking Your Directory Server Enterprise Edition Installation

- 2.2.1 Creating Server Instances From Command Line

- 2.2.1.1 To Create a Directory Server Instance From the Command Line

- 2.2.2 Creating Server Instances Using Directory Service Control Center

- 2.2.2.1 To Create Server Instances with Directory Service Control Center

- 2.3 Setting Environment Variables

3 Uninstalling Directory Server Enterprise Edition

- 3.1 Remove Directory Proxy Server Instances

- 3.1.1 To Delete a Directory Proxy Server Instance Using DSCC

- 3.1.2 To Delete a Directory Proxy Server Instance Using the Command Line

- 3.2 Remove Directory Server Instances

- 3.2.1 To Delete a Directory Server Instance Using DSCC

- 3.2.2 To Delete a Directory Server Instance From the Command Line

- 3.3 Unconfigure and Remove the DSCC Agent from the Directory Server and Directory Proxy Server Hosts

- 3.4 Unconfigure and Remove DSCC from the Administration (DSCC) Host

- 3.5 Remove the ODSEE Software

Part II Appendixes

A Deploying the DSCC WAR File

- A.1 Deploying the DSCC WAR File With a Supported Application Server

- A.2 To Deploy the DSCC WAR File With GlassFish Application Server

- A.3 To Deploy the DSCC WAR File With Tomcat

- A.4 To Deploy the DSCC WAR File With Oracle WebLogic Server

- A.5 To Deploy the DSCC WAR File With Oracle iPlanet Web Server

B Working With Sun Cryptographic Framework on Solaris 10 Systems

- B.1 Using Directory Server With Cryptographic Hardware on a Solaris 10 System

- B.1.1 To Use Directory Server With Cryptographic Hardware on a Solaris 10 System

- B.2 Using Directory Proxy Server With Cryptographic Hardware on a Solaris 10 System

- B.2.1 To Use Directory Proxy Server With Cryptographic Hardware on a Solaris 10 System

Index

List of Figures

- 1-1 Administration Host and Server Host on Different Systems

List of Tables

- 1-1 File and Process Ownership on Unix Systems

Oracle® Fusion Middleware

Installation Guide for Oracle Directory Server Enterprise Edition

11g Release 1 (11.1.1.7.0)

E28973-01

January 2013

Provides detailed instructions for installing and uninstalling the Directory Server Enterprise Edition software. This guide also covers how to pre-configure the software to make the installation operational and how to test if the installation is fully operational.

Installation for Oracle Guide for Directory Server Enterprise Edition, 11g Release 1 (11.1.1.7.0)

E28973-01

Copyright © 2001, 2013, Oracle and/or its affiliates. All rights reserved.

Primary Author:  Gina Cariaga

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Preface

The Installation for Oracle Guide for Directory Server Enterprise Edition provides detailed instructions for installing and uninstalling the Directory Server Enterprise Edition software. This guide also covers how to pre-configure the software to make the installation operational and how to test if the installation is fully operational.

Who Should Use This Book

This Installation Guide is for administrators deploying Directory Server Enterprise Edition, Directory Service Control Center, and Identity Synchronization for Windows software. This document also covers configuration of Identity Synchronization for Windows.

If you are installing Directory Server Enterprise Edition software for evaluation purposes only, put this guide aside for now, and see Evaluation Guide for Oracle Directory Server Enterprise Edition.

Before You Read This Book

Review pertinent information in the Release Notes for Oracle Directory Server Enterprise Edition.

If you are deploying Directory Server Enterprise Edition software in production, also review pertinent information in the Deployment Planning Guide for Oracle Directory Server Enterprise Edition.

Readers installing Identity Synchronization for Windows should be familiar with the following technologies:

- Directory Server

- Microsoft Active Directory or Windows NT authentication

- Lightweight Directory Access Protocol (LDAP)

- Java technology

- Extensible Markup Language (XML)

- Public-key cryptography and Secure Sockets Layer (SSL) protocol

- Intranet, extranet, and Internet security

- Role of digital certificates in an enterprise

How This Book Is Organized

Chapter 1, "Before You Install" covers the information that you must know before installing the product.

Installing and Uninstalling covers the installation of Directory Server Enterprise Edition on supported systems.

Appendixes covers all the additional information that you need to know to use Directory Server Enterprise Edition.

Oracle Directory Server Enterprise Edition Documentation Set

This documentation set explains how to use Oracle Directory Server Enterprise Edition to evaluate, design, deploy, and administer directory services. In addition, it shows how to develop client applications for Directory Server Enterprise Edition. The Oracle Fusion Middleware Directory Server Enterprise Edition Documentation Library is available at http://docs.oracle.com/cd/E29127_01/index.htm.

The following table lists the documents that make up the Directory Server Enterprise Edition documentation set.

Document Title

Contents

Release Notes for
Oracle Directory Server Enterprise Edition

Contains the latest information about Directory Server Enterprise Edition, including known problems.

Evaluation Guide for
Oracle Directory Server Enterprise Edition

Introduces the key features of this release. Demonstrates how these features work and what they offer in the context of a deployment that you can implement on a single system.

Deployment Planning Guide for
Oracle Directory Server Enterprise Edition

Explains how to plan and design highly available, highly scalable directory services based on Directory Server Enterprise Edition. Presents the basic concepts and principles of deployment planning and design. Discusses the solution life cycle, and provides high-level examples and strategies to use when planning solutions based on Directory Server Enterprise Edition.

Installation Guide for
Oracle Directory Server Enterprise Edition

Explains how to install the Directory Server Enterprise Edition software. Shows how to configure the installed software and verify the configured software.

Upgrade and Migration Guide for
Oracle Directory Server Enterprise Edition

Provides instructions for upgrading versions 11.1.1.3, 7.x, and 6 installations, and instructions for migrating version 5.2 installations.

Administrator's Guide for
Oracle Directory Server Enterprise Edition

Provides command-line instructions for administering Directory Server Enterprise Edition.

For hints and instructions about using the Directory Service Control Center, DSCC, to administer Directory Server Enterprise Edition, see the online help provided in DSCC.

Reference for
Oracle Directory Server Enterprise Edition

Introduces technical and conceptual foundations of Directory Server Enterprise Edition. Describes its components, architecture, processes, and features.

Man Page Reference for
Oracle Directory Server Enterprise Edition

Describes the command-line tools, schema objects, and other public interfaces that are available through Directory Server Enterprise Edition. Individual sections of this document can be installed as online manual pages.

Developer's Guide for
Oracle Directory Server Enterprise Edition

Shows how to develop directory client applications with the tools and APIs that are provided as part of Directory Server Enterprise Edition.

Troubleshooting for
Oracle Directory Server Enterprise Edition Guide

Provides information for defining the scope of the problem, gathering data, and troubleshooting the problem areas by using various tools.

Release Notes for
Identity Synchronization for Windows 6.0

Provides the latest information for installing, migrating, and upgrading Identity Synchronization for Windows 6.0 SP1.

Deployment Planning Guide for
Identity Synchronization for Windows 6.0

Provides general guidelines and best practices for planning and deploying Identity Synchronization for Windows.

Installation and Configuration Guide for
Identity Synchronization for Windows 6.0

Describes how to install and configure Identity Synchronization for Windows.

For an introduction to Directory Server Enterprise Edition, review the following documents in the order in which they are listed in the following figure.

Description of the illustration docmap.png

Related Reading

The SLAMD Distributed Load Generation Engine is a Java application that is designed to stress test and analyze the performance of network-based applications. This application was originally developed by Sun Microsystems, Inc. to benchmark and analyze the performance of LDAP directory servers. SLAMD is available as an open source application under the Sun Public License, an OSI-approved open source license. To obtain information about SLAMD, go to http://www.slamd.com/. SLAMD is also available as a java.net project. See https://slamd.dev.java.net/.

Java Naming and Directory Interface (JNDI) supports accessing the Directory Server using LDAP and DSML v2 from Java applications. For information about JNDI, see http://www.oracle.com/technetwork/java/jndi/index.html. The JNDI Tutorial contains detailed descriptions and examples of how to use JNDI. This tutorial is at http://download.oracle.com/javase/jndi/tutorial/.

Identity Synchronization for Windows uses Message Queue with a restricted license. Message Queue documentation is available at http://www.oracle.com/technetwork/indexes/documentation/index.html.

Identity Synchronization for Windows works with Microsoft Windows password policies.

- Information about password policies for Windows 2003, is available in the Microsoft documentation (http://technet.microsoft.com/en-us/windowsserver/default.aspx) online.

- Information about the Microsoft Certificate Services Enterprise Root certificate authority, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;247078) online.

- Information about configuring LDAP over SSL on Microsoft systems, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;321051) online.

Redistributable Files

Directory Server Enterprise Edition does not provide any files that you can redistribute.

Default Paths and Command Locations

This section explains the default paths used in documentation, and provides locations of commands on different operating systems and deployment types.

Default Paths

The table in this section describes the default paths that are used in this document. For complete descriptions of the files installed, see Chapter 1, Directory Server Enterprise Edition File Reference, in Reference for Oracle Directory Server Enterprise Edition.

Placeholder

Description

Default Value

install-path

Represents the base installation directory for Directory Server Enterprise Edition software.

When you install from a zip distribution using unzip, the install-path is the current-directory/dsee7.

instance-path

Represents the full path to an instance of Directory Server or Directory Proxy Server.

Documentation uses /local/dsInst/ for Directory Server and /local/dps/ for Directory Proxy Server.

No default path exists. Instance paths must nevertheless always be found on a local file system.

On Solaris systems, the /var directory is recommended:

serverroot

Represents the parent directory of the Identity Synchronization for Windows installation location

Depends on your installation. Note that the concept of a serverroot no longer exists for Directory Server and Directory Proxy Server.

isw-hostname

Represents the Identity Synchronization for Windows instance directory

Depends on your installation

/path/to/cert8.db

Represents the default path and file name of the client's certificate database for Identity Synchronization for Windows

current-working-dir/cert8.db

serverroot/isw-hostname/linebreaklogs/

Represents the default path to the Identity Synchronization for Windows local log files for the System Manager, each connector, and the Central Logger

Depends on your installation

serverroot/isw-hostname/linebreaklogs/central/

Represents the default path to the Identity Synchronization for Windows central log files

Depends on your installation

Command Locations

The table in this section provides locations for commands that are used in Directory Server Enterprise Edition documentation. To learn more about each of the commands, see the relevant man pages. See also "Sofware Layout for Directory Server Enterprise Edition" in the Reference for Oracle Directory Server Enterprise Edition.

Command

Zip Distribution

certutil

install-path/bin/certutil

dpadm

install-path/bin/dpadm

dpconf

install-path/bin/dpconf

dsadm

install-path/bin/dsadm

dsccagent

install-path/bin/agent

dsccmon

install-path/bin/dsccmon

dsccreg

install-path/bin/dsccreg

dsccsetup

install-path/bin/dsccsetup

dsconf

install-path/bin/dsconf

dsmig

install-path/bin/dsmig

dsutil

install-path/bin/dsutil

entrycmp

install-path/bin/entrycmp

fildif

install-path/bin/fildif

idsktune

At the root of the unzipped zip distribution

insync

install-path/bin/insync

ldapmodify

install-path/dsrk/bin/ldapmodify

ldapsearch

install-path/dsrk/bin/ldapsearch

repldisc

install-path/bin/repldisc

Typographic Conventions

The following table describes the typographic conventions that are used in this book.

Typeface

Meaning

Example

AaBbCc123

The names of commands, files, and directories, and onscreen computer output

Edit your .login file.

Use ls a to list all files.

machine_name% you have mail.

AaBbCc123

What you type, contrasted with onscreen computer output

machine_name% su

Password:

aabbcc123

Placeholder: replace with a real name or value

The command to remove a file is rm filename.

AaBbCc123

Book titles, new terms, and terms to be emphasized

Read Chapter 6 in the User's Guide.

A cache is a copy that is stored locally.

Do not save the file.

Note: Some emphasized items appear bold online.

Shell Prompts in Command Examples

The following table shows the default UNIX system prompt and superuser prompt for shells that are included in the Oracle Solaris OS. Note that the default system prompt that is displayed in command examples varies, depending on the Oracle Solaris release.

Shell

Prompt

Bash shell, Korn shell, and Bourne shell

$

Bash shell, Korn shell, and Bourne shell for superuser

#

C shell

machine_name%

C shell for superuser

machine_name#

Symbol Conventions

The following table explains symbols that might be used in this book.

Symbol

Description

Example

Meaning

[ ]

Contains optional arguments and command options.

ls [-l]

The -l option is not required.

{ | }

Contains a set of choices for a required command option.

-d {y|n}

The -d option requires that you use either the y argument or the n argument.

${ }

Indicates a variable reference.

${com.sun.javaRoot}

References the value of the com.sun.javaRoot variable.

-

Joins simultaneous multiple keystrokes.

Control-A

Press the Control key while you press the A key.

+

Joins consecutive multiple keystrokes.

Ctrl+A+N

Press the Control key, release it, and then press the subsequent keys.

>

Indicates menu item selection in a graphical user interface.

File > New > Templates

From the File menu, choose New. From the New submenu, choose Templates.

Documentation, Support, and Training

See the following web sites for additional resources:

- Documentation (http://www.oracle.com/technetwork/indexes/documentation/index.html)

- Support (http://www.oracle.com/us/support/systems/index.html)

- Training (http://education.oracle.com)

Oracle Software Resources

Oracle Technology Network (http://www.oracle.com/technetwork/index.html) offers a range of resources related to Oracle software:

- Discuss technical problems and solutions on the ODSEE Discussion Forum (http://forums.oracle.com/forums/forum.jspa?forumID=877) and the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- See the latest announcements on the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- Download ODSEE 11g Example Files (http://www.oracle.com/technetwork/middleware/id-mgmt/learnmore/odsee11113-examples-350399.zip).

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 Before You Install

Before installing Directory Server Enterprise Edition software in a production environment, obtain the plans for deployment that were created with the help of Deployment Planning Guide for Oracle Directory Server Enterprise Edition. With the plans in hand, read this section to determine how to approach installation for your deployment.

This chapter includes the following sections.

- Quick Scan of Fully Installed and Running Directory Server Enterprise Edition

- The Directory Server Enterprise Edition Zip Distribution

- File and Process Ownership on Unix Systems

- Installation in Solaris Zones

1.1 Quick Scan of Fully Installed and Running Directory Server Enterprise Edition

After Directory Server Enterprise Edition is installed and running, the following elements are found on your system:

- Software Files

- Data Files

- Background Processes

1.1.1 Software Files

The software files include executable files, resource files, and template files. These files are copied on your system from the Directory Server Enterprise Edition distribution.

The software files are organized hierarchically below a single directory, install-path, which is chosen at the time of installation. The hierarchy below the installation path is called the installation layout. User commands are located in install-path/bin and install-path/dsrk/bin directories. For more information about information layout, see Chapter 1, Directory Server Enterprise Edition File Reference, in Reference for Oracle Directory Server Enterprise Edition.

Disk space occupied by install-path is fixed and around 1GB.

1.1.2 Data Files

There are two types of data files, that is, server instances and administration files.

1.1.2.1 Server Instances

- Contain user and configuration data for a single server.

- Multiple server instances can reside on the same host.

- Server instance location can be freely chosen. They can be separate from the install-path.

- Disk space occupied by a server instance is potentially unlimited.

For more information about server instances, see Chapter 2, Directory Server Instances and Suffixes, in Administrator's Guide for Oracle Directory Server Enterprise Edition and Chapter 17, Directory Proxy Server Instances, in Administrator's Guide for Oracle Directory Server Enterprise Edition.

1.1.2.2 Administration Files

- Administration files are located in the install-path/var directory.

- Disk space occupied is limited, that is, a few hundred KB.S

1.1.3 Background Processes

Core Server Daemons (ns-slapd)

There is one daemon running per server instance. This daemon listens to the port that is configured in the server instance (389 by default) and processes the incoming LDAP requests. This daemon reads and writers configuration and user data located in the server instance.

Directory Service Control Center (DSCC) Agent

When you log into DSCC, the DSCC Agent delegates authentication to the DSCC registry.

Application Server Daemon

The application server daemon listens to HTTP on port 8080, by default. The daemon hosts Directory Service Control Center web application and present only on the host where Directory Service Control Center is deployed.

Directory Service Control Center Registry Daemon

This is a directory server instance for Directory Service Control Center's own use. The daemon listens to LDAP port 3998, by default. The daemon responds to requests from Directory Service Control Center and present only on the host where Directory Service Control Center is deployed.

Generally, all the elements listed above are rarely present on the same machine. A typical deployment would be laid out as follows:

- One machine (the administration host) is dedicated to Directory Service Control Center. On this machine, only the Application Server daemon and the Directory Service Control Center registry daemon are running.

- One or more machines are dedicated to server instances. Each machine hosts a single server instance. Only one core server daemon and the common agent container framework daemons are running.

The following figure shows a typical sample deployment.

Figure 1-1 Administration Host and Server Host on Different Systems

Description of "Figure 1-1 Administration Host and Server Host on Different Systems"

For more information, see Directory Server Enterprise Edition Administration Model in Deployment Planning Guide for Oracle Directory Server Enterprise Edition.

1.2 The Directory Server Enterprise Edition Zip Distribution

Directory Server Enterprise Edition is available in zip distribution.

- All the files composing the installation layout are zipped in a single archive.

- Installing means unzipping the archived file using any ZIP tool.

- Any user can perform the unarchiving process.

Each software installation performed from the zip distribution is independent. You can therefore install software from multiple zip distribution versions on the same system. Your system administrator must manually configure the software that you install to restart when the operating system reboots.

Note:

In this release of Directory Server Enterprise Edition, all sample code files have been removed from the delivery. The sample files, and the Developer's Guide for Oracle Directory Server Enterprise Edition are bundled in an example.zip file, that can be downloaded from (http://www.oracle.com/technology/sample_code/products/oid/index.html).

1.2.1 Contents of the Zip Distribution

The zip distribution allows you to create and configure Directory Server and Directory Proxy Server instances as non-root.

Directory Server Enterprise Edition Software Component

Description

Directory Server, Directory Proxy Server, and Directory Service Control Center

Provided. Directory Service Control Center is configurable by deploying the WAR file with the supported application server.

Identity Synchronization for Windows

Provided, but not installed with the zip distribution installation. For information about installing Identity Synchronization for Windows, see Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1.

1.3 File and Process Ownership on Unix Systems

Ownership of installed Directory Server Enterprise Edition elements depends on that software distribution that you have installed. Assuming install-user is the user who runs unzip command and instance-owner is the user who creates a server instance, the ownership assignment table looks like the following:

Table 1-1 File and Process Ownership on Unix Systems

Files

Ownership

Example

Software files

install-user

root

Data files - Administrative files

install-user

root or noaccess

Data files - Server instances

install-user

instance-owner

Processes - ns-slapd daemon

instance-owner

instance-owner

Processes - Common Agent Container daemon

install-user

root

Processes - Application Server daemon

install-user

root or noaccess

Processes - Directory Service Control Center Registry daemon

any

any

For files and processes related to the server instance, ownership can be freely chosen (instance-owner). Each server instance may have a different owner.

For all other files, ownership must be assigned as follows to a single user (install-user).

1.4 Installation in Solaris Zones

This section addresses the key points to consider when installing Directory Server Enterprise Edition in a Solaris zone.

Directory Server Enterprise Edition software treats both global and non-global zones as independent physical systems. When you install the self-contained Directory Server Enterprise Edition software in a non-global zone, you implicitly install the common component services which are part of the software.

Note:

Software running in a non-global zone may not deliver the same level of performance as software running in a global zone.

The following table indicates whether various ODSEE software components are supported or not supported in global, non-global, or sparse zone installations.

Directory Server Enterprise Edition Software Component

Global or Non-Global Zone Installations

Sparse Zone Installations

Directory Server, Directory Proxy Server, and Directory Service Control Center

Supported

Supported

Identity Synchronization for Windows

Not supported

Not supported

Part I

Installing and Uninstalling

This part includes the following chapters:

- Chapter 2, "Installing Directory Server Enterprise Edition" explains how to install the Oracle Directory Server Enterprise Edition software, pre-configure the installation to make it operational, and test the installation.

- Chapter 3, "Uninstalling Directory Server Enterprise Edition" explains how to uninstall the Oracle Directory Server Enterprise Edition software.

2 Installing Directory Server Enterprise Edition

This chapter includes the following topics:

- Installing Directory Server Enterprise Edition

- Checking Your Directory Server Enterprise Edition Installation

- Setting Environment Variables

2.1 Installing Directory Server Enterprise Edition

To install ODSEE, complete the steps described in each of the following sections:

1. Complete Pre-Installation Tasks

2. Download and Unzip the ODSEE Zip Distribution File

3. Set Up the Administration (DSCC) Host

4. Set Up a DSCC Agent on the Directory Server or Directory Proxy Server Host

5. Save Useful Information for Your Records

2.1.1 Complete Pre-Installation Tasks

Review the following notes to determine if you have additional pre-installation tasks to complete:

- Review the Hardware and Operating System Requirements in Release Notes for Oracle Directory Server Enterprise Edition.

- If you are already using Directory Server version 6, 5.2, or a previous version of 11g Release 1, and you want to use the same legacy instances with the 11g Release 1 (11.1.1.7.0) installation, see the Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.

- If your computer does not have Visual C++ 2008 installed, you must install the Microsoft Visual C++ 2008 Redistributable Package (x86).
Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) depends on the Microsoft Visual C++ 2008 Redistributable Package. A version of this package is provided with the Directory Server Enterprise Edition distribution, but it is recommended that you install the latest version from the Microsoft Download Center at http://www.microsoft.com/downloads (http://www.microsoft.com/downloads) (Product family: Developer tools).

- To use AES_256 with Java technology-based applications and utilities, you must download the JCE Unlimited Strength Jurisdiction Policy Files from http://www.oracle.com/technetwork/java/javase/downloads/index.html and install them.

- For information about installing Identity Synchronization for Windows, refer to Installation Guide for Identity Synchronization for Windows 6 and Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1.

2.1.2 Download and Unzip the ODSEE Zip Distribution File

After you download the zip distribution file, the zip file is in your download target directory. The zip file contains the Directory Server Enterprise Edition software, idsktune, the Identity Synchronization for Windows software, and the relevant legal files.

You can install the zip distribution as a non-root user.

1. Download the Directory Server Enterprise Edition zip distribution binaries.
For the latest information on download filenames and locations, see Getting the Software in the Release Notes for Oracle Directory Server Enterprise Edition.

2. Unzip the zip distribution file.
In this example, download-dir is the download target directory, and install-dir is the installation target directory.

# cd /download-dir
# unzip -q ODSEE11_1_1_7_0_xxx.zip
# cd ODSEE_ZIP_Distribution
# unzip -q sun-dsee7.zip -d install-dir
# cd install-dir/dsee7

The install-dir directory is where all the software elements are placed. A minimum of 1 GByte of space is required in this directory.

The install-dir/dsee7 directory contains all of the Directory Server Enterprise Edition components, with the exception of the idsktune utility. The idsktune utility is located in /download-dir/ODSEE_ZIP_Distribution. For the remainder of this guide, /install-dir/dsee7 is referred to as the install-path.

2.1.3 Set Up the Administration (DSCC) Host

The Directory Service Control Center (DSCC) is a web-based interface to manage Directory Server and Directory Proxy Server instances. Set up the DSCC on the computer system that you choose as the administration host.

1. Initialize the DSCC registry.

$ install-path/bin/dsccsetup ads-create
Choose password for Directory Service Manager:directory-service-pwd
Confirm password for Directory Service Manager:directory-service-pwd

Creating DSCC registry...
DSCC Registry has been created successfully

The value that you provide for directory-service-pwd, will be needed to authenticate the DSCC login page and is also used as a DSCC registry password.

DSCC uses its own local instance of Directory Server to store information about your directory service configuration. The instance is referred to as the DSCC Registry.

2. Create the WAR file for DSCC.

$ install-path/bin/dsccsetup war-file-create

Created dscc-war-file-path

Make a note of the dscc-war-file-path, which is the path of the DSCC war file.

3. Note the port and the path assigned to DSCC registry.

# install-path/bin/dsccsetup status
...
Path of DSCC registry is dscc-registry-path
Port of DSCC registry is dscc-registry-port
...

The dscc-registry-port is the port assigned to the DSCC registry by dsccsetup ads-create. The default port that is assigned to the DSCC registry is 3998.

4. To create server instances on the same host on which DSCC is deployed, add the DSCC agent to the DSCC registry.

1. Create a DSCC agent.

$ install-path/bin/dsccagent create
Enter DSCC agent password: ***
Confirm the password: ***
Agent instance install-path/var/dcc/agent has been created successfully
Run the following command to register the agent in the registry: install-path/bin/dsccreg add-agent install-path/var/dcc/agent

2. Add the new DSCC agent to the DSCC registry.
Use the command displayed at the completion of the previous step. For example:

$ install-path/bin/dsccreg add-agent install-path/var/dcc/agent

3. Start the DSCC agent.

$ install-path/bin/dsccagent start
The agent install-path/var/dcc/agent has been started

5. Configure all Directory Server instances you want to monitor through SNMP. For detailed information, see "Chapter 14, Directory Server Monitoring" in the Administrator's Guide for Oracle Directory Server Enterprise Edition."
Run the following command to obtain the DS port number for an instance you want to monitor through SNMP:

# install-path/bin/dsccagent info
Instance Path         :   install-dir/dsee7/var/dcc/agent
Owner                 :   root
JMX port              :   3997
SNMP port             :   3996
DS port               :   3995
State                 :   Stopped
PID                   :   -
DSCC hostname         :   host2
DSCC non-secure port  :   3998
DSCC secure port      :   3999
SNMP v3               :   Disabled
Instance version      :   A-A00

Run the following command using the DS port number obtained in the previous step to set the port number argument:

# install-path/bin/dsconf set-plugin-prop dssnmp argument:on argument:3995

6. Deploy the DSCC WAR file on a supported application server.
See Appendix A, "To Deploy the DSCC WAR File With Oracle iPlanet Web Server" for important information about supported application servers and minimum system and software requirements. Complete the steps in any of the following sections that apply to your application server or servers:

- Section A.2, "To Deploy the DSCC WAR File With GlassFish Application Server"

- Section A.3, "To Deploy the DSCC WAR File With Tomcat"

- Section A.4, "To Deploy the DSCC WAR File With Oracle WebLogic Server"

- Section A.5, "To Deploy the DSCC WAR File With Oracle iPlanet Web Server"

7. Verify that the DSCC setup is working properly.
Type the following command to check the location and other statistics of your WAR file and DSCC registry:

$ install-path/bin/dsccsetup status

2.1.4 Set Up a DSCC Agent on the Directory Server or Directory Proxy Server Host

Create a DSCC agent and add it to the DSCC registry. You must do this for each Directory Server host or Directory Proxy Server host in your topology.

1. Create a DSCC agent.

# install-path/bin/dsccagent create
Enter DSCC agent password: ***
Confirm the password: ***
Agent instance install-path/var/dcc/agent has been created successfully
Run the following command to register the agent in the registry: install-path/bin/dsccreg add-agent install-path/var/dcc/agent

2. Add the new DSCC agent to the DSCC registry.

# install-path/bin/dsccreg add-agent -h dscc-host -p dscc-registry-port install-path/var/dcc/agent

3. Start the DSCC agent.

# install-path/bin/dsccagent start
The agent install-path/var/dcc/agent has been started

4. Create an SNMP agent, and configure Directory Server instances to use the SNMP agent. For detailed information, see "Chapter 14, Directory Server Monitoring" in the Administrator's Guide for Oracle Directory Server Enterprise Edition."

1. Create the SNMP agent.

# install-path/bin/dsccagent enable-snmp

2. Configure all Directory Server instances you want to monitor through SNMP.
Run the following command to obtain the DS port number for an instance you want to monitor through SNMP:

# install-path/bin/dsccagent info
Instance Path         :   install-dir/dsee7/var/dcc/agent
Owner                 :   root
JMX port              :   3997
SNMP port             :   3996
DS port               :   3995
State                 :   Stopped
PID                   :   -
DSCC hostname         :   host2
DSCC non-secure port  :   3998
DSCC secure port      :   3999
SNMP v3               :   Disabled
Instance version      :   A-A00

Run the following command using the DS port number obtained in the previous step to set the port number argument:

# install-patch/bin/set-plugin-prop dssnmp argument:on argument:3995

2.1.5 Save Useful Information for Your Records

You must make a note of the following information that is gathered during the pre-configuration operation.

Information

Description

Comments

install-path

Path under which Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) is installed.

directory-service-pwd

Password assigned to the Directory Service Manager.

dscc-war-file-path

Path of the DSCC WAR file that is to be deployed in your application server.

install-path/var/dscc7.war

dscc-registry-path

Path of the DSCC Registry

install-path/var/dcc/ads

dscc-registry-port

Port of the DSCC Registry

3998 or random. The DSCC Registry port can be retrieved by typing the following command:

install-path/bin/dsccsetup status

dscc-agent-port

Port of the DSCC Agent

3997 or random. The DSCC agent port can be retrieved by typing the following command:

install-path/bin/dsccagent info

2.2 Checking Your Directory Server Enterprise Edition Installation

When you have successfully installed and pre-configured the Directory Server Enterprise Edition software, you can check your installation by creating server instances and working with them.

This section covers the following topics:

- Creating Server Instances From Command Line

- Creating Server Instances Using Directory Service Control Center

2.2.1 Creating Server Instances From Command Line

The following set of commands create a sample server instance, populates it with example data and registers it with DSCC. These commands should execute without any error if software is correctly installed and configured.

2.2.1.1 To Create a Directory Server Instance From the Command Line

Non-root users can create server instances.

Refer to the following procedure to create a Directory Server instance using the command line:

1. Create a new Directory Server instance.
In the following example, default port numbers are specified. But you can specify other port numbers to suit your needs.

$ dsadm create -p 1389 -P 1636 /local/dsInst

Choose the Directory Manager password:xxxxxxxx
Confirm the Directory Manager password:xxxxxxxx
Use 'dsadm start /local/dsInst' to start the instance

The dsInst instance is created under the existing directory, /local/ and xxxxxxxx is assigned as the Directory Manager password.

2. Start the instance.

$ dsadm start /local/dsInst
Server started: pid=2845

3. Prepare an example suffix.

1. Create an empty suffix.

$ dsconf create-suffix -p 1389 -e dc=example,dc=com
Enter "cn=Directory Manager" password:xxxxxxxx

A suffix with root dc=example,dc=com is created.

2. Populate the suffix with LDIF data.

$ dsconf import -p 1389 -e\
install-path/resources/ldif/Example.ldif dc=example,dc=com

Enter "cn=Directory Manager" password:

New data will override existing data of the suffix "dc=example,dc=com".
Initialization will have to be performed on replicated suffixes.

...
...
## Closing files...
## Import complete.  Processed 160 entries in 4 seconds. (40.00 entries/sec)

Task completed (slapd exit code: 0).

The suffix is populated with sample data from Example.ldif.

3. Search for data in the new instance.

$ ldapsearch -p 1389 -b dc=example,dc=com "(uid=ajensen)" mail

version: 1
dn: uid=ajensen, ou=People, dc=example,dc=com
mail: ajensen@example.com

4. Manage your server instance using DSCC.
The following steps assume the following:

- DSCC is installed on dscc-host.

- A DSCC agent is created on the local host and registered in the DSCC registry.

1. Register the server instance with DSCC:

$ dsccreg add-server /local/dsInst/host2

Enter DSCC administrator's password: directory-service-pwd
/local/dsInst2/host2 is an instance of DS

Agent No    Hostname Port Owner    iPath
--------    -------- ---- -------- --------------------------------
0           host2    1636 ajensen  install-path/var/dcc/agent

The registration will use DSCC agent on port: 1389
Enter password of "cn=Directory Manager" for /local/dsInst/host1: xxxxxxxx
This operation will restart /local/dsInst/host1.
Do you want to continue ? (y/n) y
Starting /local/dsInst/host1
Connecting to /local/dsInst/host1 (using ldap://127.0.0.1:1389)
Enabling DSCC access to /local/dsInst/host1
Restarting /local/dsInst/host1
Registering /local/dsInst/host1 in DSCC on dscc-host.

2. List the servers and agents that are currently registered into DSCC.
Description of the illustration listservers.png

5. If you need to use the installation for production and want to clean the system, type the following commands:

# dsccreg remove-server -h dscc-host -p dscc-registry-port /local/dsInst
# dsadm delete /local/dsInst

Next Steps

You can add more suffixes, configure replication with other server instances, tune the instance, and generally proceed with other configuration operations.

See Part I, Directory Server Administration, in Administrator's Guide for Oracle Directory Server Enterprise Edition for instructions on configuring Directory Server with command-line administration tools.

For information about creating Directory Proxy Server instances using the command line, see Chapter 17, Directory Proxy Server Instances, in Administrator's Guide for Oracle Directory Server Enterprise Edition.

2.2.2 Creating Server Instances Using Directory Service Control Center

Before You Begin: The DSCC must already be deployed on a supported application server. See Appendix A, "Deploying the DSCC WAR File."

2.2.2.1 To Create Server Instances with Directory Service Control Center

Non-root users can create server instances.

Refer to the following procedure to create server instances using DSCC.

1. Access DSCC by using http://dscc-host:port/dscc7.
Use http://dscc-host:port/dscc7 or https://dscc-host:port/dscc7 to access DSCC, where dscc-port is determined by your application server configuration.

2. Log in to DSCC as Directory Service Manager.
Directory Service Manager's entry is stored in the DSCC registry. Directory Service Manager also has administrator access to the server instances registered with DSCC.

1. Type the following values:

*  Directory Server Manager: admin
* Password: directory-service-pwd

2. Click the Log In button.

3. Under the Directory Servers tab, click New Server.
The Directory Service Control Center New Directory Server wizard displays.

Description of the illustration dscc.png

4. Follow the instructions in the Directory Service Control Center New Directory Server wizard to create the server instance.
Description of the illustration new-ds-wizard.png

While creating the new server instances, you need to provide the following information. In this example, the LDAP Port 1389 and LDAPS Port 1636 are default values. You can specify other values to suit your needs.

* Host: server-host   # Host where DSCC agent has been configured
* LDAP Port: 1389
* LDAPS Port: 1636
* Instance Path: /local/dsInst
* Directory Manager Password: xxxxxxxx
* Confirm Password: xxxxxxxx
* DSCC Agent Port: dscc-agent-port

Note:

The instance path does not support non-ASCII characters.

5. Complete the create server instance process by following the instructions provided in the graphical user interface.

6. You can choose to delete the server instance by clicking Delete in the More Server Actions drop-down menu.

See Also

Similarly, you can create Directory Proxy Server instances using the Proxy Server tab.

For further configuration and administration of Directory Server and Directory Proxy Server instances, refer to Administrator's Guide for Oracle Directory Server Enterprise Edition.

See the online help for Directory Service Control Center for hints on configuring Directory Server and Directory Proxy Server through the graphical user interface.

2.3 Setting Environment Variables

This section lists environment variables that you can set to facilitate creating server instances and using Directory Server Resource Kit and software development kits.

Environment Variable

Description

Reference

DIR_PROXY_HOST

Hostname of Directory Proxy Server, used when the --hostname option is not specified.

dpconf command

DIR_PROXY_PORT

Port number of Directory Proxy Server, used when the --port and --secure-port options are not specified.

dpconf command

DIRSERV_HOST

Hostname of Directory Server, used when the --hostname option is not specified.

dsconf command

DIRSERV_PORT

Port number of Directory Server, used when the --port and --secure-port options are not specified.

dsconf command

DSCC_HOST

Hostname of the DSCC registry, used when the --hostname option is not specified.

dsccreg, dsccmon commands

DSCC_PORT

Port number of the DSCC registry, used when the --port and --secure-port options are not specified.

dsccreg, dsccmon commands

LDAP_ADMIN_PWF

Path to the file that contains a password, used when the --pwd-file option is not specified.

When server instances are registered with Directory Service Control Center, setting this variable to a file containing the Directory Service Manager password allows to manage all the server instances even if they have different Directory Manager passwords.

dpconf, dsconf, dsccreg, dsccmon commands

LDAP_ADMIN_USER

Directory administrator DN, used when the --user-dn option is not specified.

When server instances are registered with Directory Service Control Center, you may set this variable to cn=admin,cn=Administrators,cn=dscc or any other administrator DN create using DSCC.

dpconf, dsconf, dsccreg, dsccmon commands

MANPATH

install-path/resources/man/:\
$ install-path/resources/man

Online manual pages to browse with the man command

MANSECT

Add any of the following sections that are not listed in your MANSECT environment variable.

1:1m:4:5dsconf:5dpconf:5dssd:5dsat:5dsoc:5

Alternatively, specify the sections to search explicitly when using the man command.

The man command uses the MANSECT environment variable to identify the sections to search by default.

PATH

install-path/bin

Directory Server Enterprise Edition commands

Zip distribution: install-path/dsrk/bin

Directory Server Resource Kit and LDAP client commands

3 Uninstalling Directory Server Enterprise Edition

This chapter provides instructions for uninstalling Directory Server Enterprise Edition. Complete the uninstallation procedures in the order they are presented in the chapter:

1. Remove Directory Proxy Server Instances

2. Remove Directory Server Instances

3. Unconfigure and Remove the DSCC Agent from the Directory Server and Directory Proxy Server Hosts

4. Unconfigure and Remove DSCC from the Administration (DSCC) Host

5. Remove the ODSEE Software

3.1 Remove Directory Proxy Server Instances

Use one of the following methods to remove a Directory Proxy Instance:

- To Delete a Directory Proxy Server Instance Using DSCC

- To Delete a Directory Proxy Server Instance Using the Command Line

See Also

After you have removed all server instances on the system, go to Section 3.5, "Remove the ODSEE Software.".

3.1.1 To Delete a Directory Proxy Server Instance Using DSCC

1. Access Directory Service Control Center.
Use http://dscc-host:port/dscc7 or https://dscc-host:port/dscc7 to access DSCC, where port depends on your application server configuration.

2. Under the Proxy Servers tab, select the server to delete and click Delete in the More Server Actions drop-down list.

3. Delete the server instance. Choose the Delete command in the Action drop-down list.

3.1.2 To Delete a Directory Proxy Server Instance Using the Command Line

1. If you have used DSCC to manage the server instance, remove registration for the server.

$ dsccreg remove-server -h dscc-host -p dscc-registry-port /local/dps

Enter DSCC administrator's password: directory-service-pwd
/local/dps is an instance of DPS
Enter password of "cn=Proxy Manager" for /local/dps:
Unregistering /local/dps from DSCC on hostname.
Connecting to /local/dps
Disabling DSCC access to /local/dps

For details, see the dsccreg man page.

2. Delete the server instance.

$ dpadm delete /local/dps
Directory Proxy Server instance '/local/dps' stopped
Directory Proxy Server instance '/local/dps' removed.

3.2 Remove Directory Server Instances

Use one of the following methods to remove a Directory Server instance:

- To Delete a Directory Server Instance Using DSCC

- To Delete a Directory Server Instance From the Command Line

See Also

After you have removed all server instances on the system, go to Section 3.5, "Remove the ODSEE Software.".

3.2.1 To Delete a Directory Server Instance Using DSCC

Caution:

Deleting a Directory Server instance completely removes all the instance files, including all LDAP entries managed by the instance. Before you delete an instance, back up your data as described in Chapter 8, Directory Server Backup and Restore, in Administrator's Guide for Oracle Directory Server Enterprise Edition.

1. Access Directory Service Control Center.
Use http://dscc-host:port/dscc7 or https://dscc-host:port/dscc7 to access DSCC, where port depends on your application server configuration.

2. Under the Directory Servers tab, select the server to delete and click Delete in the More Server Actions drop-down list.

3. Delete the server instance with the Delete command in the action drop-down list.

3.2.2 To Delete a Directory Server Instance From the Command Line

Deleting a Directory Server instance completely removes all the files under the instance-path directory. If the databases and logs are saved in another directory, they are not removed when you delete the Directory Server instance.

Before you delete a server instance, back up your data as described in Chapter 8, Directory Server Backup and Restore, in Administrator's Guide for Oracle Directory Server Enterprise Edition.

1. If you have used DSCC to manage the server instance, remove registration for the server.

$ dsccreg remove-server -h dscc-host -p dscc-registry-port /local/dsInst

Enter DSCC administrator's password: directory-service-pwd
/local/dsInst is an instance of DS
Enter password of "cn=Directory Manager" for /local/dsInst:
This operation will restart /local/dsInst.
Do you want to continue ? (y/n) y
Unregistering /local/dsInst from DSCC on hostname.
Connecting to /local/dsInst
Disabling DSCC access to /local/dsInst
Restarting /local/dsInst

For details, see dsccreg

2. Delete the server instance.

$ dsadm delete /local/dsInst
Server stopped
/local/dsInst deleted

3.3 Unconfigure and Remove the DSCC Agent from the Directory Server and Directory Proxy Server Hosts

To remove the DSCC agent, run the following commands:

$ dsccagent stop
$ dsccreg remove-agent -h dscc-host -p dscc-registry-port
$ dsccagent delete

3.4 Unconfigure and Remove DSCC from the Administration (DSCC) Host

1. Remove the DSCC agent.

$ dsccagent stop
$ dsccreg remove-agent -h dscc-host -p dscc-registry-port
$ dsccagent delete

2. Delete the WAR file.

$ dsccsetup war-file-delete

3. Delete the DSCC registry.

$ dsccsetup ads-delete
***
Deleting DSCC Registry...
All server registrations will be definitively erased.
Existing server instances will not be modified.
Do you really want to delete the DSCC Registry ? [y/n]y
Directory Server instance 'install-path/dsee7/var/dcc/ads' stopped
DSCC Registry has been deleted successfully
***
Deleted install-path/dsee7/var/dscc7.war
***

3.5 Remove the ODSEE Software

Remove Directory Server Enterprise Edition with a system command.

$ rm -r install-path

Part II

Appendixes

This part contains the following appendixes:

- Appendix A, "Deploying the DSCC WAR File"

- Appendix B, "Working With Sun Cryptographic Framework on Solaris 10 Systems"

A Deploying the DSCC WAR File

To access and manage server instances using a web-based interface, you must deploy the DSCC WAR file, supplied with the Directory Server Enterprise Edition software, with one of the supported application servers.

This appendix describes the minimum requirements that must be met by the application server and provides basic instructions on how to deploy the DSCC WAR file with the application server. These procedures do not intend to cover all possible methods to deploy the WAR file for a specific application server. For more information pertaining to a specific application server, refer to the respective application server documentation.

This Appendix contains the following topics:

- Deploying the DSCC WAR File With a Supported Application Server

- To Deploy the DSCC WAR File With GlassFish Application Server

- To Deploy the DSCC WAR File With Tomcat

- To Deploy the DSCC WAR File With Oracle WebLogic Server

- To Deploy the DSCC WAR File With Oracle iPlanet Web Server

A.1 Deploying the DSCC WAR File With a Supported Application Server

For information about supported hardware and sofware, see the "ODSEE CertificationMatrix " (http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html).

In addition, your application server must comply with the following requirements:

- All Java permissions must be granted to the DSCC application.
By default, all the supported application servers grant these permissions to the DSCC application..

- The tag pooling feature of your application server must be disabled.
Tag pooling is disabled by default in all the supported application servers except Tomcat.

The following procedures describe the deployment instructions for each application server.

- To Deploy the DSCC WAR File With GlassFish Application Server

- To Deploy the DSCC WAR File With Tomcat

- To Deploy the DSCC WAR File With Oracle WebLogic Server

- To Deploy the DSCC WAR File With Oracle iPlanet Web Server

Note:

The http port numbers, used to connect to the console, mentioned in the following sections are the default port numbers for each application server. The port numbers may differ if the default port numbers are already in use.

A.2 To Deploy the DSCC WAR File With GlassFish Application Server

1. Create an application server instance. Run the following commands:

$ mkdir glassfish-domain-path
$ cd app-server-install-path/bin
$ asadmin --user admin create-domain --domaindir glassfish-domain-path --adminport 3737 dscc7

2. Deploy the WAR file in your application server instance.

$ asadmin --user admin start-domain --domaindir glassfish-domain-path dscc7
$ cp install-path/var/dscc7.war glassfish-domain-path/dscc7/autodeploy

For more information about creating and configuring application server instances and deploying the WAR file, refer to the GlassFish Online Help.

3. In the GlassFish JVM options settings, verify the following property is set to true:

-Djava.awt.headless=true

4. Open DSCC.
Use http://hostname:8080/dscc7 or https://hostname:8181/dscc7 based on the configuration of your application server.

The Directory Service Manager Login page is displayed.

A.3 To Deploy the DSCC WAR File With Tomcat

The following example shows how to install DSCC in Tomcat on a Solaris 10 system.

1. Install Tomcat.
For installing Tomcat and creating instances, refer to the Tomcat documentation.

2. Disable tag pooling.
Tag pooling must be disabled for DSCC to work properly. To disable tag pooling, in the $CATALINA_HOME/conf/web.xml configuration file, set the enablePooling parameter to false. For example:

...
<servlet>
<servlet-name>jsp</servlet-name>
<servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
<init-param>
<param-name>fork</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>xpoweredBy</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>enablePooling</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>3</load-on-startup>
</servlet>
...

3. Enable replication topology rendering.

$ export CATALINA_OPTS="-Djava.awt.headless=true"

4. In the ${CATALINA_HOME}/conf/tomcat-users.xml file, add a user that has a Tomcat administrator role. For example :

<role rolename="manager"/>
<user username="admin" password="admin" roles="manager"/>

5. Restart Tomcat.

1. Verify that you have the appropriate permissions to run the startup script (startup.sh on Solaris, tomcat5.exe or tomcat6.exe on Windows).

2. Type the following commands:

$ ${CATALINA_HOME}/bin/shutdown.sh
$ ${CATALINA_HOME}/bin/startup.sh

6. Use a browser to open the Tomcat administration page.
Access the following URL: http://hostname:8080

Click Tomcat Manager > Administration tab. Then log in as the administrative user you defined in the step 4 above.

7. Deploy the DSCC WAR file.

1. Copy the DSCC WAR file to an accessible file system.

2. In the Tomcat Administration tab, click the Deploy tab.
Browse your file system to find and select the DSCC WAR as the "WAR File to Deploy," and then click Deploy.

8. In the list of the Tomcat deployed applications to connect to, choose /dscc7.
The Directory Service Manager Login page is displayed.

A.4 To Deploy the DSCC WAR File With Oracle WebLogic Server

The following example shows how to install DSCC in Oracle WebLogic Server on a Solaris 10 system.

Note:

This example assumes a basic knowledge of Oracle WebLogic Server administration and does not replace the Oracle WebLogic Server documentation. For conceptual information about domains, administration servers and managed servers, see "Key Concepts" in the Oracle Fusion Middleware Concepts Guide.

1. Browse the WebLogic console using http://localhost:7001/console.

2. Navigate to base_domain/Deployments in the Domain Structure panel.

3. Click Lock and Edit.

4. Click Install.

5. Click Upload your file(s).

6. In Deployment Archive, select install-path/var/dscc7.war and click Next.

7. Select dscc7.war and click Next.

8. Select Install this deployment as an application and click Next.

9. Provide a Name for the deployment, accept the default Optional Settings and click Finish.

10. Click Activate Changes in the top left corner.
The dscc7 deployment must be in the active state.

11. Use http://hostname:port/dscc7 to connect to DSCC.
The default port number for Oracle WebLogic Server is 7001.

The Oracle Directory Service Control Center authentication page is displayed.

A.5 To Deploy the DSCC WAR File With Oracle iPlanet Web Server

The following example shows how to install DSCC in Oracle iPlanet Web Server on a Solaris 10 system. The same procedure can be used for Sun Java System Web Server 7.0+.

Caution:

If you install Oracle iPlanet Web Server as root, web server daemons run as a webservd user. In that case, the easiest way to make your deployment work successfully is to install Directory Server Enterprise Edition and pre-configure DSCC as a webservd user.

1. Browse the Oracle iPlanet Web Server console using https://hostname:8989.

2. Under the Common Tasks tab, click Add Web Application in the Virtual Server Tasks section.

3. In the Add Web Application form, provide the following values and click OK.
Web Application Location: install-path/var/dscc7.war

URI: /dscc7

4. Enable server-side HTML.

1. Click the Content Handling tab of the virtual server.

2. In the Parsed HTML/SSI section, click New and then OK.

3. In the main window, click Deployment Pending link located in the top right corner and complete deployment by following the wizard.

4. Edit the magnus.conf file of the virtual server:

# vi install-path/https-virtual-server/config/magnus.conf

Add the following line:

type=magnus-internal/parsed-html exts=shtml

5. Under the Configurations tab, click the Refresh button.

6. Click Instance Configuration Modified in the top right corner and click Pull and deploy configuration from virtual-server and click OK.

For the detailed information about enabling server-side HTML, see Enabling Server-Side HTML in Oracle iPlanet Web Server 7.0.9 Developer's Guide.

5. Under the Configurations tab, select the configuration that you have created and click Start.

6. In the Oracle iPlanet Web Server JVM options settings, verify the following property is set to true:

-Djava.awt.headless=true

7. Use http://hostname:8080/dscc7 to connect to DSCC.
The Directory Service Manager Login page displays.

B Working With Sun Cryptographic Framework on Solaris 10 Systems

This appendix briefly explains how to use the Sun Crypto Accelerator cards through the Sun cryptographic framework on Solaris 10 systems with Directory Server and Directory Proxy Server. For more information about the framework, see the respective documentation.

- Using Directory Server With Cryptographic Hardware on a Solaris 10 System

- Using Directory Proxy Server With Cryptographic Hardware on a Solaris 10 System

B.1 Using Directory Server With Cryptographic Hardware on a Solaris 10 System

This procedure is designed for use with Sun Crypto Accelerator hardware. Perform the following procedure as the same user who runs the Directory Server instance.

B.1.1 To Use Directory Server With Cryptographic Hardware on a Solaris 10 System

1. Set the PIN used to access the cryptographic framework by typing the pktool setpin command.
Set the PIN as the same user as the one running Directory Server.

2. Export the current Directory Server certificate to a PKCS#12 file.
The following command shows how to perform this step if the Directory Server instance is located under /local/ds/.

$ dsadm export-cert -o cert-file /local/ds defaultCert

3. Configure Directory Server to use the appropriate token when accessing the key material.
Typically, the token is Sun Metaslot.

$ dsconf set-server-prop 'ssl-rsa-security-device:Sun Metaslot'

4. Stop Directory Server.

$ dsadm stop /local/ds

5. If you have no other certificates in the existing certificate database for the Directory Server instance, remove the certificate database.

$ rm -f /local/ds/alias/*.db

This optional step ensures that no certificates are stored in the software database.

6. Create a new certificate database backed by the Solaris cryptographic framework.
If you have not removed the certificate database, you do not need to run the modutil -create line in this example.

$ /usr/sfw/bin/64/modutil -create -dbdir /local/ds/alias -dbprefix slapd-
$ /usr/sfw/bin/64/modutil -add "Solaris Kernel Crypto Driver" -libfile \
/usr/lib/64/libpkcs11.so -dbdir /local/ds/alias -dbprefix slapd-
$ /usr/sfw/bin/64/modutil -enable "Solaris Kernel Crypto Driver" \
-dbdir /local/ds/alias -dbprefix slapd-

7. Import the PKCS#12 certificate that you exported.

$ /usr/sfw/bin/64/pk12util -i cert-file \
-d /local/ds/alias -P slapd- -h "Sun Metaslot"
$ /usr/sfw/bin/64/certutil -M -n "Sun Metaslot:defaultCert" -t CTu \
-d /local/ds/alias -P slapd-

If your accelerator board has a FIPS 140-2 keystore, for added security, make sure that the private key is stored on the device. Sun Crypto Accelerator 4000 and 6000 boards have FIPS 140-2 keystores, for example. The exact process depends on the board.

Note:

Make sure that the cryptographic hardware supports the cipher suites that you want to use. Not all hardware supports all the cipher suites. As a workaround, you can use dsconf ssl-cipher-family to set specific suites.

8. Create a password file that contains the PIN needed to access the cryptographic framework.
This file is required only when the password is changed in step 1.

$ echo "Sun Metaslot:password"> /local/dsInst/alias/slapd-pin.txt

If the password has been changed in step 1, password is the new password, otherwise it is the one currently in use.

9. Start Directory Server.

$ dsadm start /local/ds

B.2 Using Directory Proxy Server With Cryptographic Hardware on a Solaris 10 System

This procedure is designed for use with Sun Crypto Accelerator hardware. Perform the following procedure as the same user who runs the Directory Proxy Server instance.

B.2.1 To Use Directory Proxy Server With Cryptographic Hardware on a Solaris 10 System

1. Stop Directory Proxy Server.

$ dpadm stop /local/dps

2. Turn off the certificate database password storage.

$ dpadm set-flags /local/dps cert-pwd-prompt=on
Choose the certificate database password:
Confirm the certificate database password:

3. Set the PIN used to access the cryptographic framework by typing the pktool setpin command.
Use the same password that you typed when turning off the certificate database password storage.

4. Generate a key pair by using the cryptographic framework as the key store.

$ keytool -genkeypair -alias defaultDPScert
-dname "ou=dps server,dc=example,dc=com" -keyalg RSA -sigalg MD5withRSA
-validity 3652 -storetype PKCS11 -keystore NONE -storepass pin-password

pin-password is the password that you set as the PIN with the pktool setpin command.

5. Edit the Directory Proxy Server configuration file, adding the following attributes to the base entry, cn=config.

serverCertificateNickName: defaultDPScert
certificateKeyStore: NONE
certificateKeyStoreType: PKCS11

6. Start Directory Proxy Server.

$ dpadm start /local/dps

Index

C  D  E  I  J  L  M  P  R  S  U  W  Z

C

central log directories, Preface

certificate database

default path, Preface

check

install, 2.2

command line

Directory Server, 2.2.1.1

server instance, 2.2.1

D

default locations, Preface

DIR_PROXY_HOST, 2.3

DIR_PROXY_PORT, 2.3

DIRSERV_HOST, 2.3

DIRSERV_PORT, 2.3

DSCC

registry, 2.1.3

server instance, 2.2.2.1

DSCC_HOST, 2.3 DSCC_PORT, 2.3 DSEE

uninstall, 3

E

environment variables, 2.3

DIR_PROXY_HOST , 2.3

DIR_PROXY_PORT , 2.3

DIRSERV_HOST , 2.3

DIRSERV_PORT , 2.3

DSCC_HOST , 2.3

DSCC_PORT , 2.3

LDAP_ADMIN_PWF , 2.3

LDAP_ADMIN_USER , 2.3

MANPATH , 2.3

MANSECT , 2.3

PATH, 2.3

I

Install

zip distribution, 2.1

install

check, 2.2

install-path, Preface instance

Directory server, 2.2.1.1

instance-path, Preface isw- hostname directory, Preface

J

Java Naming and Directory Interface, Preface

L

LDAP_ADMIN_PWF, 2.3

LDAP_ADMIN_USER, 2.3

local log directory, Preface

M

MANPATH, 2.3

MANSECT, 2.3

Message Queue, Preface

P

PATH, 2.3

R

removing server instance

Directory Proxy Server, 3.1.1

Directory Server, 3.1.2, 3.2.1

command line, 3.2.2

DSCC, 3.2.1

S

server instance

command line, 2.2.1

DSCC, 2.2.2.1

serverroot directory, Preface SLAMD Distributed Load Generation Engine, Preface

U

uninstall

DSEE, 3

W

war

create, 2.1.3

Z

Zip distribution

install, 2.1

Copyright © 2001, 2013, Oracle and/or its affiliates. All rights reserved.