Oracle® Fusion Middleware Administrator's Guide for Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) Part Number E28972-01 |
|
|
PDF · Mobi · ePub |
An LDAP data view exposes data in an LDAP server to a client request and specifies the data source pool that responds to the request. By defining LDAP data views, you can perform the following tasks:
Expose a whole database in a single view
Provide different views for different subtrees in a database
Provide a unified view of different databases
Creating an LDAP data view includes the following steps:
This section describes how to use the dpconf
command to create and configure LDAP data sources. For reference information about these topics, see LDAP Data Sources in the Reference for Oracle Directory Server Enterprise Edition.
For information about how to create and configure LDAP data sources, see the following procedures.
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
$ dpconf create-ldap-data-source -h host -p port [-s] source-name host:port
In this command, source-name is a name that you assign to the new data source. host and port refer to the host and port on which the LDAP server is running. Note that the data source does not use SSL by default. Use -s
to enable to specify a secure port.
If the host is specified by an IP V6 address, you need to use the IP V6 reference when you create the data source. For example, if Directory Proxy Server will bind to a host with the IP V6 address fe80::209:3dff:fe00:8c93
on port 2389
, use the following command to create the data source:
$ dpconf create-ldap-data-source -h host1 -p 1389 ipv6-host \ [fe80::209:3dff:fe00:8c93]:2389
If you use the console to create the data source, you must specify the actual IP V6 address (without the square brackets).
For information about how to modify the properties of an LDAP data source, see To Configure an LDAP Data Source.
(Optional) View the list of data sources.
$ dpconf list-ldap-data-sources -h host -p port
The following procedure shows how to display the properties of an LDAP data source and how to set the properties that you require to change. The procedure shows the commands using which any of the properties of the LDAP data source can be changed. It also shows how to get the detailed information of a property, which helps you to set that property.
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
View the properties of the data source by using this command syntax:
$ dpconf get-ldap-data-source-prop -h host -p port \ [-M unit] [-Z unit] source-name [property...]
In this command, -M
and -Z
refer to the units in which you want data to be displayed. The M
option specifies the unit of time. The value for -M
can be M
, w
, d
, h
, m
, s
, or ms
, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z
option specifies the data size unit. The value for -Z
can be T
, G
, M
, k
, or b
, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed. The default properties of an LDAP data source are as follows:
bind-dn : - bind-pwd : - client-cred-mode : use-client-identity connect-timeout : 10s description : - down-monitoring-interval : inherited is-enabled : false is-read-only : true ldap-address : host ldap-port : port ldaps-port : ldaps monitoring-bind-timeout : 5s monitoring-entry-dn : "" monitoring-entry-timeout : 5s monitoring-inactivity-timeout : 2m monitoring-interval : 30s monitoring-mode : reactive monitoring-retry-count : 3 monitoring-search-filter : (|(objectClass=*)(objectClass=ldapSubEntry)) num-bind-incr : 10 num-bind-init : 10 num-bind-limit : 1024 num-read-incr : 10 num-read-init : 10 num-read-limit : 1024 num-write-incr : 10 num-write-init : 10 num-write-limit : 1024 proxied-auth-check-timeout : 1.8s proxied-auth-use-v1 : false ssl-policy : never use-read-connections-for-writes : false use-tcp-keep-alive : true use-tcp-no-delay : true
Enable the data source.
$ dpconf set-ldap-data-source-prop -h host -p port source-name is-enabled:true
Configure all the properties that are listed in View the properties of the data source by using this command syntax:, if you want to change the default settings.
$ dpconf set-ldap-data-source-prop -h host -p port source-name property:value
For example, if you want to modify entries on a data source, configure the data source to allow write operations.
$ dpconf set-ldap-data-source-prop -h host -p port source-name is-read-only:false
To use a read connection to process write operation when all the write connections are busy, run the following command. The vice-versa is also true.
dpconf set-ldap-data-source-prop -h host -p port source-name \ use-read-connections-for-writes:true
To find information about a property used in a subcommand, run this command:
$ dpconf help-properties ldap-data-source property
For example, to find information about the is-read-only
property, run this command:
dpconf help-properties ldap-data-source is-read-only
To list the key properties for data sources, use the verbose option -v
with the list-ldap-data-sources
subcommand.
$ dpconf list-ldap-data-sources -v Name is-enabled ldap-address ldap-port ldaps-port description ----------- ---------- ------------ --------- ---------- ----------- datasource0 true myHost myPort ldaps - datasource1 true myHost myPort ldaps -
If necessary, restart the instance of Directory Proxy Server for the changes to take effect.
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server. For a list of configuration changes that require a server restart, see Configuration Changes Requiring Server Restart.
This section describes how to use the dpconf
command to create and configure LDAP data source pools. For reference information about these topics, see LDAP Data Sources in the Reference for Oracle Directory Server Enterprise Edition.
For information about how to create and configure data source pools, see the following procedures:
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Create one or more data source pools.
$ dpconf create-ldap-data-source-pool -h host -p port pool-name
Additional data source pools can be specified after the first pool-name. For information about how to modify the properties of a data source pool, see To Configure an LDAP Data Source Pool.
(Optional) View the list of data source pools.
$ dpconf list-ldap-data-source-pools -h host -p port
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
View the properties of the data source pool by using this command syntax:
$ dpconf get-ldap-data-source-pool-prop -h host -p port \ [-M unit] [-Z unit] pool-name [property...]
In this command, -M
and -Z
refer to the units in which you want data to be displayed. The M
option specifies the unit of time. The value for -M
can be M
, w
, d
, h
, m
, s
, or ms
, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z
option specifies the data size unit. The value for -Z
can be T
, G
, M
, k
, or b
, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed. The default properties of an LDAP data source pool are as follows:
client-affinity-bind-dn-filters : connection client-affinity-criteria : connection client-affinity-ip-address-filters : any client-affinity-policy : write-affinity-after-write client-affinity-timeout : 20s description : Example data source pool enable-client-affinity : false load-balancing-algorithm : proportional minimum-total-weight : 100 proportion : 100 sample-size : 100
Configure the properties that are listed in View the properties of the data source pool by using this command syntax:.
$ dpconf set-ldap-data-source-pool-prop -h host -p port pool-name \ property:value
For information about how to configure the properties of a data source pool for load balancing and client affinity, see Chapter 18, "Directory Proxy Server Load Balancing and Client Affinity".
A data source that is attached to a data source pool is called an attached data source. The properties of an attached data source determine the load balancing configuration of the data source pool. When you configure the weights of an attached data source, consider the weights of all of the attached data sources in a data source pool. Ensure that the weights work together as required. For information about how to configure weights for load balancing, see To Configure Weights for Load Balancing.
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Attach one or more data sources to a data source pool.
$ dpconf attach-ldap-data-source -h host -p port pool-name \ source-name [source-name ...]
(Optional) View the list of attached data sources for a given data source pool.
$ dpconf list-attached-ldap-data-sources -h host -p port -E pool-name
In this command, -E
is optional, and modifies the display output to show one property value per line.
(Optional) View the key properties of the attached data sources for a given data source pool.
$ dpconf list-attached-ldap-data-sources -h host -p port -v pool-name
In this command, -v
specifies verbose output. For example, view the properties of an example data source pool.
$ dpconf list-attached-ldap-data-sources -h host1 -p 1389 -v My-pool SRC_NAME add-weight bind-weight compare-weight ----------- ---------- ----------- -------------- datasource0 disabled disabled disabled datasource1 disabled disabled disabled delete-weight modify-dn-weight modify-weight search-weight ------------- ---------------- ------------- ------------- disabled disabled disabled disabled disabled disabled disabled disabled
(Optional) View the properties of an attached data source by using the following command syntax:
$ dpconf get-attached-ldap-data-source-prop -h host -p port [-M unit] [-Z unit] \ pool-name source-name [property...]
In this command, -M
and -Z
refer to the units in which you want data to be displayed. The M
option specifies the unit of time. The value for -M
can be M
, w
, d
, h
, m
, s
, or ms
, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z
option specifies the data size unit. The value for -Z
can be T
, G
, M
, k
, or b
, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed.
The properties of an attached data source define the weight for each type of operation in load balancing. The default weights of an attached data source are as follows:
add-weight : disabled bind-weight : disabled compare-weight : disabled delete-weight : disabled modify-dn-weight : disabled modify-weight : disabled search-weight : disabled
The default weights of an attached data source are 0 and disabled. You must set the weights of an attached data source for Directory Proxy Server to work as intended.
In the following example, all the properties are set to one. You can change the values of these properties as per your requirements. For information about how to configure weights of an attached data source for load balancing, see To Configure Weights for Load Balancing.
$ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name add-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name bind-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name compare-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name delete-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name modify-dn-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name modify-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name search-weight:1
For information about how to create and configure LDAP data views, see the following procedures:
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Create an LDAP data view.
$ dpconf create-ldap-data-view -h host -p port view-name pool-name suffix-DN
For information about how to modify the properties of an LDAP data view, see To Configure an LDAP Data View.
View the list of LDAP data views.
$ dpconf list-ldap-data-views -h host -p port
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
View the properties of an LDAP data view.
$ dpconf get-ldap-data-view-prop -h host -p port view-name
If you create a data view without configuring any of the properties, your data view has the following configuration:
alternate-search-base-dn : "" attr-name-mappings : none base-dn : suffix-DN contains-shared-entries : false custom-distribution-algorithm-class : none description : - distribution-algorithm : none dn-join-rule : none dn-mapping-attrs : none dn-mapping-source-base-dn : none excluded-subtrees : - filter-join-rule : none is-enabled : true is-read-only : false is-routable : true ldap-data-source-pool : pool-name lexicographic-attrs : all lexicographic-lower-bound : none lexicographic-upper-bound : none non-viewable-attr : none non-writable-attr : none numeric-attrs : all numeric-default-data-view : false numeric-lower-bound : none numeric-upper-bound : none pattern-matching-base-object-search-filter : all pattern-matching-base-dn-regular-expression : all pattern-matching-dn-regular-expression : all pattern-matching-one-level-search-filter : all pattern-matching-subtree-search-filter : all process-bind : - replication-role : master viewable-attr : all except non-viewable-attr writable-attr : all except non-writable-attr
Change one or more of the properties that are listed in View the properties of an LDAP data view..
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ property:value [property:value ... ]
For example, to access the dc=example,dc=com
subtree on a data source, specify dn-mapping-source-base-dn
in the data view.
$ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ dn-mapping-source-base-dn:dc=example,dc=com
To add a value to a multi-valued property, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name property+:value
To remove a value from a multi-valued property, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name property-:value
If necessary, restart the instance of Directory Proxy Server for the changes to take effect.
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.
The configuration entries for Directory Proxy Server are in cn=config
. When you use Directory Proxy Server to access configuration entries, by default, you access the configuration entries of Directory Proxy Server.
To access the configuration entries of a directory server, it is better to connect directly to Directory Server, not to Directory Proxy Server. For information about how to configure Directory Server, see Chapter 2, "Directory Server Configuration".
Caution:
If you reconfigure Directory Proxy Server to access the configuration entries of a directory server, you are likely to break the administration framework of Directory Proxy Server.
If you really need to access the configuration entries of a directory server through Directory Proxy Server, take special steps to ensure that you do not break the administration framework of Directory Proxy Server. This section describes how to access the configuration entries of a directory server by using Directory Proxy Server.
Create a data source as described in Creating and Configuring LDAP Data Sources.
Create an LDAP data source pool as described in Creating and Configuring LDAP Data Source Pools.
To expose the configuration entries of one specific data source, attach only one LDAP data source to the LDAP data source pool as described in Attaching LDAP Data Sources to a Data Source Pool.
$ dpconf attach-ldap-data-source -h host -p port pool-name data-source-name
After performing this step, a client can access the configuration entries of the data source that is connected to Directory Proxy Server.
If you attach more than one LDAP data source to the LDAP data source pool, you can access the configuration entries of one of the data sources connected to Directory Proxy Server. However, you cannot know which data source the configuration entries belong to.
You must set the weights of an attached data source for Directory Proxy Server to work as intended. For more information, see Attaching LDAP Data Sources to a Data Source Pool.
Create an LDAP data view to expose cn=config
.
$ dpconf create-ldap-data-view -h host -p port view-name pool-name cn=config
Each entry in a directory is identified by a DN and a set of attributes and their values. Often, the DNs and the attributes defined on the client side do not map to the DNs and the attributes defined on the server side. Data views can be defined to rename DNs and attributes. When a client makes a request, the DNs and attributes are renamed to match the server side. When the result is returned to a client, the DNs and attributes are changed back to match the client side.
For information about attribute renaming and DN renaming, see Attribute Renaming and DN Renaming in the Reference for Oracle Directory Server Enterprise Edition. For information about how to rename attributes and DNs, see the following procedures:
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Set one or more attr-name-mappings
properties on the data view for which you want to configure attribute mapping.
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings:client-side-attribute-name#server-side-attribute-name[#qualifier]\ [attr-name-mappings:client-side-attribute-name#server-side-attribute-name#qualifier...]
For example, rename surname
on the client side to sn
on the server side.
$ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ attr-name-mappings:surname#sn
To add an attribute mapping to an existing list of mappings, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings+:client-side-attribute-name#server-side-attribute-name[#qualifier]
To remove an attribute mapping from an existing list of mappings, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings-:client-side-attribute-name#server-side-attribute-name[#qualifier]
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
View the base-dn
property and the DN mapping properties of the data view for which you want to rename DNs.
$ dpconf get-ldap-data-view-prop -h host -p port view-name base-dn \ dn-mapping-source-base-dn dn-mapping-attrs
The properties have the following meanings:
base-dn
is the DN of the subtree on the client side, which is equivalent to the base DN of the data view.
dn-mapping-source-base-dn
is the DN of the subtree on the server side.
dn-mapping-attrs
defines a list of attributes that contain DNs of entries.
For example, the data view for the dc=example,dc=com
database on the client side has the following values when DN renaming is not defined:
$ dpconf get-ldap-data-view-prop myDataView base-dn \ dn-mapping-source-base-dn dn-mapping-attrs base-dn : dc=example,dc=com dn-mapping-attrs : none dn-mapping-source-base-dn : none
Map a DN on the client side to a DN on the server side.
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ dn-mapping-source-base-dn:server-side-dn
For example, map the dc=example,dc=com
database on the client side to dc=example,dc=org
on the server side.
$ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ dn-mapping-source-base-dn:dc=example,dc=org
Rename attributes in the portion of the DIT that is affected by Map a DN on the client side to a DN on the server side., if those attributes contain DNs.
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ dn-mapping-attrs:attribute-name [dn-mapping-attrs:attribute-name ...]
For example, if the group
attribute contains DNs in the namespace affected by the rename operation in Map a DN on the client side to a DN on the server side., rename the attribute as follows:
$ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView dn-mapping-attrs:group
To add a DN mapping to an existing list of mappings, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port \ view-name dn-mapping-attrs+:attribute-name
To remove a DN mapping from an existing list of mappings, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port \ view-name dn-mapping-attrs-:attribute-name
View the base-dn
property and the DN mapping properties of the data view for which you have renamed DNs.
$ dpconf get-ldap-data-view-prop -h host -p port view-name base-dn \ dn-mapping-source-base-dn dn-mapping-attrs
For example, the data view for the dc=example,dc=com
database on the client side has the following values after DN renaming:
$ dpconf get-ldap-data-view-prop -h host1 -p 1389 myDataView base-dn \ dn-mapping-source-base-dn dn-mapping-attrs base-dn : dc=example,dc=com dn-mapping-attrs : group dn-mapping-source-base-dn : dc=example,dc=org
When a subordinate data view is created, Directory Proxy Server automatically excludes the subordinate data view from the superior data view. When a request targets the subordinate data view, the request is sent to the subordinate data view, not to the superior data view.
When an alternate search base is specified in a subordinate data view, search operations targeted at the superior data view are also performed in the subordinate data view.
By default, Directory Proxy Server automatically configures the excluded-subtrees
and alternate-search-base-dn
properties. The following procedure describes how to configure these properties manually.
excluded-subtrees
and alternate-search-base-dn
PropertiesYou can use the web interface Directory Service Control Center (DSCC) to perform this task.
Configure Directory Proxy Server to manually route requests.
$ dpconf set-server-prop -h host -p port data-view-automatic-routing-mode:manual
When data-view-automatic-routing-mode
is manual
, Directory Proxy Server does not generate the excluded-subtrees
and alternate-search-base-dn
properties. You must set the values of these properties manually. The values that you set here are not checked by Directory Proxy Server. Be aware that setting these values incorrectly can break the administration path.
Alternatively, configure Directory Proxy Server to partially route requests manually.
$ dpconf set-server-prop -h host -p port data-view-automatic-routing-mode:limited
When data-view-automatic-routing-mode
is limited
, Directory Proxy Server does not generate the excluded-subtrees
and alternate-search-base-dn
properties. However, Directory Proxy Server does check that the values set here do not conflict with the administration path.
Configure the view exclusion base.
$ dpconf set-ldap-data-view-prop -h host -p port view-name excluded-subtrees:suffix-DN
The view exclusion base determines branches of the DIT whose entries are not exposed by the data view.
Configure the alternate search base.
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ alternate-search-base-dn:search-base-DN
The alternate search base determines other branches of the DIT in which entries belonging to this data view may be located. The base DN is defined by default as an alternate search base in all data views.
This section contains the following information about data views and how to create and configure them:
The examples in this section assume that the connection handler allows all client connections to be processed by Directory Proxy Server.
If you create a data view without configuring any of the properties, your data view has the following configuration:
alternate-search-base-dn : "" alternate-search-base-dn : base-DN attr-name-mappings : none base-dn : suffix-DN contains-shared-entries : - description : - distribution-algorithm : - dn-join-rule : - dn-mapping-attrs : none dn-mapping-source-base-dn : none excluded-subtrees : - filter-join-rule : - is-enabled : true is-read-only : false is-routable : true ldap-data-source-pool : pool-name lexicographic-attrs : all lexicographic-lower-bound : none lexicographic-upper-bound : none non-viewable-attr : - non-writable-attr : - numeric-attrs : all numeric-default-data-view : false numeric-lower-bound : none numeric-upper-bound : none pattern-matching-base-object-search-filter : all pattern-matching-dn-regular-expression : all pattern-matching-one-level-search-filter : all pattern-matching-subtree-search-filter : all process-bind : - replication-role : master viewable-attr : all except non-viewable-attr writable-attr : all except non-writable-attr
This section shows the configuration of a data view that routes all the requests that do not match their targets mentioned in their target DNs, to a data source pool. This data view is called the root data view. The root data view is created by default when an instance of Directory Proxy Server is created. For information about the root data view, see Data Views to Route All Requests, Irrespective of the Target DN of the Request in the Reference for Oracle Directory Server Enterprise Edition.
The root data view has the following configuration:
alternate-search-base-dn : - attr-name-mappings : none base-dn : "" contains-shared-entries : - description : Automatically-generated data view able to route client operations independently of the operation base dn distribution-algorithm : - dn-join-rule : - dn-mapping-attrs : none dn-mapping-source-base-dn : none excluded-subtrees : "" excluded-subtrees : cn=config excluded-subtrees : cn=monitor excluded-subtrees : cn=proxy manager excluded-subtrees : cn=virtual access controls excluded-subtrees : dc=example,dc=com filter-join-rule : - is-enabled : true is-read-only : false is-routable : true ldap-data-source-pool : defaultDataSourcePool lexicographic-attrs : all lexicographic-lower-bound : none lexicographic-upper-bound : none non-viewable-attr : - non-writable-attr : - numeric-attrs : all numeric-default-data-view : false numeric-lower-bound : none numeric-upper-bound : none pattern-matching-base-object-search-filter : all pattern-matching-dn-regular-expression : all pattern-matching-one-level-search-filter : all pattern-matching-subtree-search-filter : all process-bind : - replication-role : master viewable-attr : all except non-viewable-attr writable-attr : all except non-writable-attr
This section describes how to configure a data view that routes requests targeted at a list of subtrees to a set of data-equivalent data sources. For information about this type of deployment, see Data Views to Route Requests When a List of Subtrees Are Stored on Multiple, Data-Equivalent Data Sources in the Reference for Oracle Directory Server Enterprise Edition.
The example in this section has multiple data sources that contain the same set of subtrees. The data sources are data-equivalent and are pooled into one data source pool for load balancing. A data view is configured for each subtree to expose that subtree to client requests. The following figure shows the sample deployment.
Figure 17-1 Sample Deployment That Routes Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.
Create a data source pool as described in Creating and Configuring LDAP Data Source Pools.
Attach the data sources to the data source pool as described in Attaching LDAP Data Sources to a Data Source Pool.
Configure load balancing.
For information, see Configuring Load Balancing.
Create a data view with a base DN at dc=example1,dc=com
that refers to the data source pool.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-1 \ data-source-pool-1 dc=example1,dc=com
Create another data view with a base DN at dc=example2,dc=com
that refers to the data source pool.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-2 \ data-source-pool-1 dc=example2,dc=com
The other properties of the data views are the same as the default data view in Default Data View.
If necessary, restart the instance of Directory Proxy Server for the changes to take effect.
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.
This section describes how to configure a data view that provides a single point of access to different subtrees stored in multiple data sources. For information about this type of deployment, see Data Views to Provide a Single Point of Access When Different Subtrees Are Stored on Different Data Sources in the Reference for Oracle Directory Server Enterprise Edition.
The example in this section contains a data view for each subtree. A data source pool is configured for each set of data-equivalent data sources. The following figure shows the example deployment.
Figure 17-2 Sample Deployment That Provides a Single Point of Access When Different Subtrees Are Stored on Different Data Sources
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.
Create two data source pools as described in Creating and Configuring LDAP Data Source Pools.
Attach the data sources that contain dc=example1,dc=com
to data-source-pool-1
, and the data sources that contain dc=example2,dc=com
to data-source-pool-2
, as described in Attaching LDAP Data Sources to a Data Source Pool.
Configure load balancing.
For information, see Configuring Load Balancing.
Create a data view with a base DN at dc=example1,dc=com
that refers to data-source-pool-1
.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-1 \ data-source-pool-1 dc=example1,dc=com
Create another data view with a base DN at dc=example2,dc=com
that refers to data-source-pool-2
.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-2 \ data-source-pool-1 dc=example2,dc=com
The other properties of the data views are the same as the default data view in Default Data View.
If necessary, restart the instance of Directory Proxy Server for the changes to take effect.
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.
This section describes how to configure a data view for a single point of access when a superior branch of a subtree is stored in a different data source to a subordinate branch. For information about this type of deployment, see Data Views to Route Requests When Superior and Subordinate Subtrees Are Stored in Different Data Sources in the Reference for Oracle Directory Server Enterprise Edition.
The example in this section contains three data views. The base DN of data view 1 is superior to the base DN of data view 2 and the base DN of data view 3. Or, in other words, data source 2 and data source 3 contain subtrees that are subordinate to the subtree on data source 1. The following figure shows the example deployment.
Figure 17-3 Sample Deployment to Routes Requests When Superior and Subordinate Subtrees Are Stored in Different Data Sources
Directory Proxy Server automatically excludes a subordinate branch of a subtree from a data view when the subordinate branch is configured as the base DN of a separate data view.
You can use the web interface Directory Service Control Center (DSCC) to perform this task.
Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.
Create three data source pools as described in Creating and Configuring LDAP Data Source Pools.
Attach the data sources to the data source pools by following the instructions in Attaching LDAP Data Sources to a Data Source Pool.
Attach the data sources that contain dc=example,dc=com
to data-source-pool-1
.
Attach the data sources that contain ou=computer,dc=example,dc=com
to data-source-pool-2
.
Attach the data sources that contain ou=people,dc=example,dc=com
to data-source-pool-3
.
Configure load balancing.
For information, see Configuring Load Balancing.
Create a data view with a base DN at dc=example,dc=com
and a data source pool data-source-pool-1
.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-1 \ data-source-pool-1 dc=example,dc=com
Create a data view with a base DN at ou=computer,dc=example,dc=com
and a data source pool data-source-pool-2
.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-2 \ data-source-pool-2 ou=computer,dc=example,dc=com
Create a data view with a base DN at ou=people,dc=example,dc=com
and a data source pool data-source-pool-3
.
$ dpconf create-ldap-data-view -h host1 -p 1389 dataview-3 \ data-source-pool-3 ou=people,dc=example,dc=com
Verify that the subtrees ou=computer,dc=example, dc=com
and ou=people,dc=example, dc=com
have been excluded from dataview-1
by looking at the excluded-subtrees
parameter.
$ dpconf get-ldap-data-view-prop -h host1 -p 1389 dataview-1 excluded-subtrees
The list of excluded subtrees is returned.
If necessary, restart the instance of Directory Proxy Server for the changes to take effect.
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.