Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Who Should Use This Book
• Before You Read This Book
• How This Book Is Organized
• Examples Used in This Guide
• Oracle Directory Server Enterprise Edition Documentation Set
• Related Reading
• Redistributable Files
• Default Paths and Command Locations
• Typographic Conventions
• Shell Prompts in Command Examples
• Symbol Conventions
• Documentation, Support, and Training
• Oracle Software Resources
• Documentation Accessibility

Part I Directory Server Administration

1 Directory Server Tools

• 1.1 Directory Server Administration Overview
• 1.2 Deciding When to Use DSCC and When to Use the Command Line
  • 1.2.1 Determining Whether a Procedure Can Be Done Using DSCC
  • 1.2.2 Cases Where Using DSCC Is Better
    • 1.2.2.1 Viewing Servers and Suffix Replication Status
    • 1.2.2.2 Managing Groups of Servers
    • 1.2.2.3 Copying Configuration Settings
    • 1.2.2.4 Configuring Replication
• 1.3 Directory Server Command-Line Tools
  • 1.3.1 Location of Directory Server Commands
  • 1.3.2 Setting Environment Variables for dsconf
  • 1.3.3 Comparison of dsadm and dsconf
  • 1.3.4 Obtaining Help for Using dsadm, dsconf, and dsutil
  • 1.3.5 Modifying Configuration Properties by Using dsconf
  • 1.3.6 Setting Multi-Valued Properties With dsconf
  • 1.3.7 Working With the dsutil Command
  • 1.3.8 Man Pages

2 Directory Server Configuration

• 2.1 Displaying the Configuration of Directory Server Instance
• 2.2 Modifying the Configuration Using DSCC
• 2.3 Modifying the Configuration From the Command Line
• 2.4 Modifying the dse.ldif File
• 2.5 Configuring Administration Users
  • 2.5.1 To Create an Administration User with Root Access
  • 2.5.2 To Configure the Directory Manager
• 2.6 Protecting Configuration Information
• 2.7 Changing Directory Server Port Numbers
  • 2.7.1 To Modify a Port Number, Enable a Port, and Disable a Port
• 2.8 Configuring DSML
  • 2.8.1 To Enable the DSML-over-HTTP Service
  • 2.8.2 To Disable the DSML-over-HTTP Service
  • 2.8.3 To Configure DSML Security
  • 2.8.4 DSML Identity Mapping
    • 2.8.4.1 To Define a New Identity Mapping for HTTP Headers
• 2.9 Setting the Server as Read-Only
  • 2.9.1 To Enable or Disable the Server Read-Only Mode
• 2.10 Configuring Memory
  • 2.10.1 Preloading Caches
    • 2.10.1.1 To Enable Entry Cache Preloading
    • 2.10.1.2 To Preload the Database Cache
  • 2.10.2 To Modify Database Cache
  • 2.10.3 To Monitor Database Cache
  • 2.10.4 To Monitor Entry Cache
  • 2.10.5 To Modify Entry Cache Size
    • 2.10.5.1 To Manually Modify the Entry Cache
    • 2.10.5.2 To Configure Automatic Entry Cache Size Management
  • 2.10.6 To Configure Heap Memory Threshold
• 2.11 Setting Resource Limits For Each Client Account
  • 2.11.1 To Configure Search Limit

3 Directory Server Entries

• 3.1 Managing Entries
  • 3.1.1 Managing Entries Using DSCC
  • 3.1.2 Extending Entries Using DSCC
    • 3.1.2.1 To Extend Entries Using DSCC
  • 3.1.3 Managing Entries Using ldapmodify and ldapdelete
    • 3.1.3.1 Adding Entries Using ldapmodify
    • 3.1.3.2 Modifying Entries Using ldapmodify
    • 3.1.3.3 Deleting Entries Using ldapdelete
    • 3.1.3.4 Deleting Entries Using ldapmodify
    • 3.1.3.5 Searching Entries Using ldapsearch
  • 3.1.4 To Move or Rename an Entry Using ldapmodify
  • 3.1.5 Guidelines and Limitations for Using the Modify DN Operation
    • 3.1.5.1 General Guidelines for Using the Modify DN Operation
    • 3.1.5.2 Guidelines for Using the Modify DN Operation With Replication
• 3.2 Grouping Entries for Simplified Management
• 3.3 Compressing Entries
  • 3.3.1 To Compress the Size of Entries in Database
• 3.4 Setting Referrals
  • 3.4.1 Setting the Default Referrals
    • 3.4.1.1 To Set a Default Referral
  • 3.4.2 Setting Smart Referrals
    • 3.4.2.1 To Create and Modify a Smart Referral
• 3.5 Checking Valid Attribute Syntax
  • 3.5.1 To Turn On Automatic Syntax Checking
• 3.6 Tracking Modifications to Directory Entries
  • 3.6.1 To Turn Off Entry Modification Tracking
• 3.7 Encrypting Attribute Values
  • 3.7.1 Attribute Encryption and Performance
  • 3.7.2 Attribute Encryption Usage Considerations
  • 3.7.3 To Configure Attribute Encryption

4 Directory Server Instances and Suffixes

• 4.1 Quick Procedure for Creating Server Instances and Suffixes
• 4.2 Creating and Deleting a Directory Server Instance
  • 4.2.1 To Create a Directory Server Instance
  • 4.2.2 To Delete a Directory Server Instance
• 4.3 Starting, Stopping, and Restarting a Directory Server Instance
  • 4.3.1 To Start, Stop, and Restart Directory Server
  • 4.3.2 To List All the Running Instances
  • 4.3.3 To Stop the Running Instances
• 4.4 Creating Suffixes
  • 4.4.1 To Create a Suffix
• 4.5 Disabling or Enabling a Suffix
  • 4.5.1 To Disable then Enable a Suffix
• 4.6 Setting Referrals and Making a Suffix Read-Only
  • 4.6.1 To Set Referrals to Make a Suffix Read-Only
• 4.7 Importing Data From an LDIF File
  • 4.7.1 Initializing a Suffix
    • 4.7.1.1 To Initialize a Suffix
  • 4.7.2 To Load Sample Data in Directory Server Instance
  • 4.7.3 Adding, Modifying, and Deleting Entries in Bulk
    • 4.7.3.1 To Add, Modify and Delete Entries in Bulk
• 4.8 Deleting a Suffix
  • 4.8.1 To Delete a Suffix
• 4.9 Compacting a Suffix
  • 4.9.1 To Compact a Suffix Offline
• 4.10 Rewriting a Suffix
  • 4.10.1 To Rewrite a Suffix

5 Directory Server Security

• 5.1 Using SSL With Directory Server
• 5.2 Managing Certificates
  • 5.2.1 To View the Default Self-Signed Certificate
  • 5.2.2 To Manage Self-Signed Certificates
  • 5.2.3 To Request a CA-Signed Server Certificate
  • 5.2.4 To Add the CA-Signed Server Certificate and the Trusted CA Certificate
  • 5.2.5 To Renew an Expired CA-Signed Server Certificate
  • 5.2.6 To Export and Import a CA-Signed Server Certificate
  • 5.2.7 Configuring the Certificate Database Password
    • 5.2.7.1 To Configure the Server So the User is Prompted for a Certificate Password
  • 5.2.8 Backing Up and Restoring the Certificate Database for Directory Server
• 5.3 Configuring SSL Communication
  • 5.3.1 Disabling Non Secure Communication
    • 5.3.1.1 To Disable the LDAP Clear Port
  • 5.3.2 Choosing Encryption Ciphers
    • 5.3.2.1 To Choose an Encryption Cipher
• 5.4 Configuring Credential Levels and Authentication Methods
  • 5.4.1 Setting SASL Encryption Levels in Directory Server
    • 5.4.1.1 To Require SASL Encryption
    • 5.4.1.2 To Disallow SASL Encryption
  • 5.4.2 SASL Authentication Through DIGEST-MD5
    • 5.4.2.1 To Configure the DIGEST-MD5 Mechanism
    • 5.4.2.2 DIGEST-MD5 Identity Mappings
  • 5.4.3 SASL Authentication Through GSSAPI
    • 5.4.3.1 To Configure the Kerberos System
    • 5.4.3.2 To Configure the GSSAPI Mechanism
    • 5.4.3.3 GSSAPI Identity Mappings
• 5.5 Configuring LDAP Clients to Use Security
  • 5.5.1 Using SASL DIGEST-MD5 in Clients
    • 5.5.1.1 Specifying a Realm
    • 5.5.1.2 Specifying Environment Variables
    • 5.5.1.3 Examples of the ldapsearch Command
  • 5.5.2 Using Kerberos SASL GSSAPI in Clients
    • 5.5.2.1 To Configure Kerberos V5 on a Host
    • 5.5.2.2 To Specify SASL Options for Kerberos Authentication
    • 5.5.2.3 Example Configuration of Kerberos Authentication Using GSSAPI With SASL
• 5.6 Pass-Through Authentication
  • 5.6.1 PTA Plug-In and DSCC
  • 5.6.2 Configuring the PTA Plug-in
    • 5.6.2.1 Setting up the PTA Plug-In
    • 5.6.2.2 Configuring PTA to Use a Secure Connection
    • 5.6.2.3 Setting the Optional Connection Parameters
    • 5.6.2.4 Specifying Multiple Servers and Subtrees

6 Directory Server Access Control

• 6.1 Creating, Viewing, and Modifying ACIs
  • 6.1.1 To Create, Modify, and Delete ACIs
  • 6.1.2 To View ACI Attribute Values
  • 6.1.3 To View ACIs at the Root Level
  • 6.1.4 ACI Syntax
  • 6.1.5 ACI Targets
    • 6.1.5.1 Target Syntax
    • 6.1.5.2 Target Keywords
  • 6.1.6 ACI Permissions
    • 6.1.6.1 Permission Syntax
    • 6.1.6.2 Permission Rights
    • 6.1.6.3 Permissions for Typical LDAP Operations
  • 6.1.7 ACI Bind Rules
    • 6.1.7.1 Introduction to Bind Rules
    • 6.1.7.2 Bind Rule Syntax
    • 6.1.7.3 Bind Rule Keywords
    • 6.1.7.4 Boolean Bind Rules
  • 6.1.8 To Allow Normal Users to Manage User Accounts Using dsutil Command
• 6.2 Access Control Usage Examples
  • 6.2.1 Granting Anonymous Access
    • 6.2.1.1 ACI "Anonymous Example.com"
    • 6.2.1.2 ACI "Anonymous World"
  • 6.2.2 Granting Write Access to Personal Entries
    • 6.2.2.1 ACI "Write Example.com"
    • 6.2.2.2 ACI "Write Subscribers"
  • 6.2.3 Granting Access to a Certain Level
    • 6.2.3.1 ACI "Read Example.com only"
  • 6.2.4 Restricting Access to Key Roles
    • 6.2.4.1 ACI "Roles"
  • 6.2.5 Granting a Role Full Access to an Entire Suffix
    • 6.2.5.1 ACI "Full Access"
  • 6.2.6 Granting a Group Full Access to a Suffix
    • 6.2.6.1 ACI "HR"
  • 6.2.7 Granting Rights to Add and Delete Group Entries
    • 6.2.7.1 ACI "Create Group"
    • 6.2.7.2 ACI "Delete Group"
  • 6.2.8 Allowing Users to Add or Remove Themselves From a Group
    • 6.2.8.1 ACI "Group Members"
  • 6.2.9 Granting Conditional Access to a Group or Role
    • 6.2.9.1 ACI "Company333"
  • 6.2.10 Denying Access
    • 6.2.10.1 ACI "Billing Info Read"
    • 6.2.10.2 ACI "Billing Info Deny"
  • 6.2.11 Proxy Authorization
    • 6.2.11.1 Example Proxy Authorization
  • 6.2.12 Setting a Target Using Filtering
  • 6.2.13 Defining Permissions for DNs That Contain a Comma
• 6.3 Viewing Effective Rights
  • 6.3.1 Restricting Access to the Get Effective Rights Control
  • 6.3.2 Using the Get Effective Rights Control
• 6.4 Advanced Access Control: Using Macro ACIs
  • 6.4.1 Macro ACI Example
  • 6.4.2 Macro ACI Syntax
    • 6.4.2.1 Matching for ($dn) in the Target
    • 6.4.2.2 Substituting ($dn) in the Subject
    • 6.4.2.3 Substituting [$dn] in the Subject
    • 6.4.2.4 Macro Matching for ($attr.attrName)
• 6.5 Logging Access Control Information
  • 6.5.1 To Set Logging for ACIs
• 6.6 Client-Host Access Control Through TCP Wrapping
  • 6.6.1 To Enable TCP Wrapping
  • 6.6.2 To Disable TCP Wrapping

7 Directory Server Backup and Restore

• 7.1 Binary Backup
  • 7.1.1 Backing Up Directory Data Only
    • 7.1.1.1 To Back Up Your Directory Data
    • 7.1.1.2 To Back Up the dse.ldif File
  • 7.1.2 Backing Up a File System
    • 7.1.2.1 About Frozen Mode
    • 7.1.2.2 To Back Up a File System Using dsconf
    • 7.1.2.3 To Back Up a Files System Using dsadm
    • 7.1.2.4 To Restore the File System
• 7.2 Backing Up to LDIF
  • 7.2.1 Exporting to LDIF
    • 7.2.1.1 To Export a Suffix to LDIF
• 7.3 Binary Restore
  • 7.3.1 To Restore Your Server
• 7.4 Restoring Replicated Suffixes
  • 7.4.1 Restoring the Supplier in a Single-Master Scenario
  • 7.4.2 Restoring a Supplier in a Multi-Master Scenario
  • 7.4.3 Restoring a Hub
  • 7.4.4 Restoring a Dedicated Consumer
  • 7.4.5 Restoring a Master in a Multi-Master Scenario
    • 7.4.5.1 To Begin Accepting Updates Through the Command Line
• 7.5 Disaster Recovery
  • 7.5.1 To Make a Backup for Disaster Recovery
  • 7.5.2 To Restore for Disaster Recovery

8 Directory Server Password Policy

• 8.1 Password Policies and Worksheet
  • 8.1.1 Password Policy Settings
    • 8.1.1.1 Policy for Account Lockout
    • 8.1.1.2 Policy for Password Changes
    • 8.1.1.3 Policy for Password Content
    • 8.1.1.4 Policy for Password Expiration
    • 8.1.1.5 Policy for Tracking Last Authentication Time
  • 8.1.2 Worksheet for Defining Password Policy
• 8.2 Managing the Default Password Policy
  • 8.2.1 Correlation Between Password Policy Attributes and dsconf Server Properties
  • 8.2.2 To View Default Password Policy Settings
  • 8.2.3 To Change Default Password Policy Settings
  • 8.2.4 Preventing Binds With No Password
• 8.3 Managing Specialized Password Policies
  • 8.3.1 Which Password Policy Applies
  • 8.3.2 To Create a Password Policy
  • 8.3.3 To Assign a Password Policy to an Individual Account
  • 8.3.4 To Assign a Password Policy Using Roles and CoS
  • 8.3.5 To Set Up a First Login Password Policy
• 8.4 Modifying Passwords From the Command Line When pwdSafeModify Is TRUE
• 8.5 Resetting Expired Passwords
  • 8.5.1 To Reset a Password With the Password Modify Extended Operation
  • 8.5.2 To Allow Grace Authentications When Passwords Expire
• 8.6 Setting Account Properties
  • 8.6.1 To Set the Look-Through Limit for an Account
  • 8.6.2 To Set the Size Limit for an Account
  • 8.6.3 To Set the Time Limit for an Account
  • 8.6.4 To Set the Idle Timeout for an Account
• 8.7 Manually Locking Accounts
  • 8.7.1 To Check Account Status
  • 8.7.2 To Render Accounts Inactive
  • 8.7.3 To Reactivate Accounts
• 8.8 Password Policy Compatibility
  • 8.8.1 Setting the Compatibility Mode
  • 8.8.2 Guidelines for Choosing a Compatibility Mode
    • 8.8.2.1 Important Information About pwd-compat-mode
    • 8.8.2.2 New Directory Server 11g Release 1 (11.1.1.7) Deployment
    • 8.8.2.3 Migrating a Deployment to Directory Server 11g Release 1 (11.1.1.7)
  • 8.8.3 Administrative Password Reset Classification

9 Directory Server Groups, Roles, and CoS

• 9.1 About Groups, Roles, and Class of Service
• 9.2 Managing Groups
  • 9.2.1 To Create a New Static Group
  • 9.2.2 To Create a New Dynamic Group
• 9.3 Managing Roles
  • 9.3.1 Using Roles Securely
  • 9.3.2 Managing Roles From the Command Line
    • 9.3.2.1 Example of a Managed Role Definition
    • 9.3.2.2 Example of a Filtered Role Definition
    • 9.3.2.3 Example of a Nested Role Definition
  • 9.3.3 Extending the Scope of a Role
    • 9.3.3.1 To Extend the Scope of a Role
• 9.4 Class of Service
  • 9.4.1 Using CoS Securely
    • 9.4.1.1 Protecting the CoS Definition Entry
    • 9.4.1.2 Protecting the CoS Template Entries
    • 9.4.1.3 Protecting the Target Entries of a CoS
    • 9.4.1.4 Protecting Other Dependencies
  • 9.4.2 Managing CoS From the Command Line
    • 9.4.2.1 Creating the CoS Definition Entry From the Command Line
    • 9.4.2.2 Creating the CoS Template Entry From the Command Line
  • 9.4.3 Creating Role-Based Attributes
  • 9.4.4 Monitoring the CoS Plug-In
  • 9.4.5 Setting CoS Logging
• 9.5 Maintaining Referential Integrity
  • 9.5.1 How Referential Integrity Works
  • 9.5.2 To Configure the Referential Integrity Plug-In

10 Directory Server Replication

• 10.1 Planning Your Replication Deployment
• 10.2 Recommended Interface for Configuring and Managing Replication
• 10.3 Summary of Steps for Configuring Replication
  • 10.3.1 Summary of Steps for Configuring Replication
• 10.4 Enabling Replication on a Dedicated Consumer
  • 10.4.1 To Create a Suffix for a Consumer Replica
  • 10.4.2 To Enable a Consumer Replica
  • 10.4.3 To Perform Advanced Consumer Configuration
• 10.5 Enabling Replication on a Hub
  • 10.5.1 To Create a Suffix for a Hub Replica
  • 10.5.2 To Enable a Hub Replica
  • 10.5.3 To Modify Change Log Settings on a Hub Replica
• 10.6 Enabling Replication on a Master Replica
  • 10.6.1 To Create a Suffix for a Master Replica
  • 10.6.2 To Enable a Master Replica
  • 10.6.3 To Modify Change Log Settings on a Master Replica
• 10.7 Configuring the Replication Manager
  • 10.7.1 Using a Non-Default Replication Manager
    • 10.7.1.1 To Set A Non-Default Replication Manager
  • 10.7.2 To Change the Default Replication Manager Password
• 10.8 Creating and Changing Replication Agreements
  • 10.8.1 To Create a Replication Agreement
  • 10.8.2 To Change the Destination of a Replication Agreement
• 10.9 Fractional Replication
  • 10.9.1 Considerations for Fractional Replication
  • 10.9.2 To Configure Fractional Replication
• 10.10 Replication Priority
  • 10.10.1 To Configure Replication Priority
• 10.11 Initializing Replicas
  • 10.11.1 To Initialize a Replicated Suffix from a Remote (Supplier) Server
  • 10.11.2 Replica Initialization From LDIF
    • 10.11.2.1 To Initialize a Replicated Suffix From LDIF
    • 10.11.2.2 To Export a Replicated Suffix to LDIF
    • 10.11.2.3 Filtering an LDIF File for Fractional Replication
  • 10.11.3 Initializing a Replicated Suffix by Using Binary Copy
    • 10.11.3.1 Restrictions for Using Binary Copy With Replication
    • 10.11.3.2 Making a Binary Copy for Initializing a Server
  • 10.11.4 Initializing Replicas in Cascading Replication
    • 10.11.4.1 To Initialize Replicas in Cascading Replication
• 10.12 Indexing Replicated Suffixes
• 10.13 Incrementally Adding Many Entries to Large Replicated Suffixes
  • 10.13.1 To Add Many Entries to Large Replicated Suffixes
• 10.14 Replication and Referential Integrity
• 10.15 Replication Over SSL
  • 10.15.1 To Configure Replication Operations for SSL
  • 10.15.2 To Configure Client Authentication Based Replication for SSL
• 10.16 Replication Over a WAN
  • 10.16.1 Configuring Network Parameters
    • 10.16.1.1 Configuring Window Size
    • 10.16.1.2 Configuring Group Size
  • 10.16.2 Scheduling Replication Activity
    • 10.16.2.1 To Schedule Replication Activity
  • 10.16.3 Configuring Replication Compression
    • 10.16.3.1 To Configure Replication Compression
• 10.17 Modifying the Replication Topology
  • 10.17.1 Changing the Replication Manager
  • 10.17.2 Managing Replication Agreements
    • 10.17.2.1 Disabling a Replication Agreement
    • 10.17.2.2 Enabling a Replication Agreement
    • 10.17.2.3 Deleting a Replication Agreement
  • 10.17.3 Promoting or Demoting Replicas
    • 10.17.3.1 To Promote or Demote a Replica
  • 10.17.4 Disabling a Replicated Suffix
    • 10.17.4.1 To Disable a Replicated Suffix
  • 10.17.5 Keeping Replicated Suffixes Synchronized
    • 10.17.5.1 Replication Retry Algorithm
    • 10.17.5.2 To Force Replication Updates
  • 10.17.6 Moving a Master Replica to a New Machine
    • 10.17.6.1 To Remove a Master From an Existing Replication Topology
    • 10.17.6.2 To Add a Master to an Existing Replication Topology
• 10.18 Replication With Releases Prior to Directory Server 11g Release 1 (11.1.1.6)
  • 10.18.1 Replicating Between Directory Server 11g Release 1 (11.1.1.6) and Directory Server 6 or 5.2
• 10.19 Using the Retro Change Log
  • 10.19.1 To Enable the Retro Change Log
  • 10.19.2 To Configure the Retro Change Log to Record Updates for Specified Suffixes
  • 10.19.3 To Configure the Retro Change Log to Record Attributes of a Deleted Entry
  • 10.19.4 To Trim the Retro Change Log
  • 10.19.5 Access Control and the Retro Change Log
• 10.20 Getting Replication Status
  • 10.20.1 Getting Replication Status in DSCC
  • 10.20.2 Getting Replication Status by Using the Command Line
• 10.21 Solving Common Replication Conflicts
  • 10.21.1 Solving Replication Conflicts by Using DSCC
  • 10.21.2 Solving Replication Conflicts by Using the Command Line
  • 10.21.3 Solving Naming Conflicts
    • 10.21.3.1 To Rename a Conflicting Entry That has a Multivalued Naming Attribute
    • 10.21.3.2 To Rename a Conflicting Entry With a Single-Valued Naming Attribute
  • 10.21.4 Solving Orphan Entry Conflicts
  • 10.21.5 Solving Potential Interoperability Problems

11 Directory Server Schema

• 11.1 Managing Schema Checking
  • 11.1.1 To Fix Schema Compliance Problems
• 11.2 Extending Directory Server Schema
  • 11.2.1 Extending Schema Through LDAP
    • 11.2.1.1 To Extend Schema Through LDAP
  • 11.2.2 Extending Schema With a Custom Schema File
    • 11.2.2.1 To Extend Schema With a Custom Schema File
    • 11.2.2.2 When Creating Custom Schema Files
  • 11.2.3 Extending Schema Using a Schema File and Replication
    • 11.2.3.1 To Extend Schema Using a Schema File and Replication
• 11.3 About Custom Schema
  • 11.3.1 Default Directory Server Schema
  • 11.3.2 Object Identifiers
  • 11.3.3 Naming Attributes and Object Classes
  • 11.3.4 When Defining New Object Classes
  • 11.3.5 When Defining New Attributes
• 11.4 Managing Attribute Types Over LDAP
  • 11.4.1 Creating Attribute Types
    • 11.4.1.1 To Create an Attribute Type
  • 11.4.2 Viewing Attribute Types
    • 11.4.2.1 To View Attribute Types
  • 11.4.3 Deleting Attribute Types
  • 11.4.4 To Delete Attribute Types
• 11.5 Managing Object Classes Over LDAP
  • 11.5.1 Creating Object Classes
    • 11.5.1.1 To Create an Object Class
  • 11.5.2 Viewing Object Classes
    • 11.5.2.1 To View an Object Class
  • 11.5.3 Deleting Object Classes
    • 11.5.3.1 To Delete an Object Class
• 11.6 Replicating Directory Schema
  • 11.6.1 Limiting Schema Replication
    • 11.6.1.1 To Limit Schema Replication

12 Directory Server Indexing

• 12.1 Managing Indexes
  • 12.1.1 To List Indexes
  • 12.1.2 To Create Indexes
  • 12.1.3 To Modify Indexes
  • 12.1.4 To Generate Indexes
  • 12.1.5 Analyzing Indexes
    • 12.1.5.1 To Analyze Index Filters
    • 12.1.5.2 To Analyze Attribute Indexes
  • 12.1.6 To Delete Indexes
  • 12.1.7 Changing the Index List Threshold
    • 12.1.7.1 To Change the Index List Threshold
  • 12.1.8 Reindexing a Suffix
    • 12.1.8.1 Reindexing a Suffix While the Directory Server Is Running
    • 12.1.8.2 Reindexing a Suffix by Reinitialization
• 12.2 Managing Browsing Indexes
  • 12.2.1 Browsing Indexes for Client Searches
    • 12.2.1.1 To Create a Browsing Index
    • 12.2.1.2 To Add or Modify Browsing Index Entries
    • 12.2.1.3 To Regenerate Browsing Indexes

13 Directory Server Logging

• 13.1 Log Analysis Tool
• 13.2 Viewing Directory Server Logs
  • 13.2.1 To Tail Directory Server Logs
• 13.3 Configuring Logs for Directory Server
  • 13.3.1 To Modify Log Configuration
  • 13.3.2 To Enable the Audit Log
  • 13.3.3 To Configure Directory Server Control OIDs in the Access Log
• 13.4 Rotating Directory Server Logs Manually
  • 13.4.1 To Rotate Log Files Manually

14 Directory Server Monitoring

• 14.1 Setting Up and Enabling SNMP for Directory Server
  • 14.1.1 To Set Up SNMP
  • 14.1.2 Enabling SNMP Monitoring
• 14.2 Monitoring a Server Using cn=monitor

Part II Directory Proxy Server Administration

15 Directory Proxy Server Tools

• 15.1 Using DSCC for Directory Proxy Server
  • 15.1.1 To Access DSCC for Directory Proxy Server
• 15.2 Command-Line Tools for Directory Proxy Server
  • 15.2.1 Location of Directory Proxy Server Commands
  • 15.2.2 Setting Environment Variables for dpconf
  • 15.2.3 Comparison of dpadm and dpconf
  • 15.2.4 Setting Multi-Valued Properties With dpconf
  • 15.2.5 Obtaining Help for Using dpadm and dpconf

16 Directory Proxy Server Instances

• 16.1 Working With Directory Proxy Server Instances
  • 16.1.1 To Create a Directory Proxy Server Instance
  • 16.1.2 To Find the Status of a Directory Proxy Server Instance
  • 16.1.3 To Start and Stop Directory Proxy Server
  • 16.1.4 Using Quiesce Mode on Directory Proxy Server
  • 16.1.5 To List All the Running Instances
  • 16.1.6 To Stop the Running Instances
  • 16.1.7 To View Whether It Is Necessary to Restart a Directory Proxy Server Instance
  • 16.1.8 To Restart Directory Proxy Server
  • 16.1.9 To Delete a Directory Proxy Server Instance
• 16.2 Configuring Directory Proxy Server Instances
  • 16.2.1 To Display the Configuration of Directory Proxy Server Instance
  • 16.2.2 To Modify the Configuration of Directory Proxy Server
  • 16.2.3 Configuring the Proxy Manager
    • 16.2.3.1 To Configure the Proxy Manager
  • 16.2.4 Configuration Changes Requiring Server Restart
• 16.3 Backing Up and Restoring Directory Proxy Server Instances
  • 16.3.1 To Back Up a Directory Proxy Server Instance
  • 16.3.2 To Restore a Directory Proxy Server Instance

17 LDAP Data Views

• 17.1 Creating LDAP Data Views
  • 17.1.1 Creating and Configuring LDAP Data Sources
    • 17.1.1.1 To Create an LDAP Data Source
    • 17.1.1.2 To Configure an LDAP Data Source
  • 17.1.2 Creating and Configuring LDAP Data Source Pools
    • 17.1.2.1 To Create an LDAP Data Source Pool
    • 17.1.2.2 To Configure an LDAP Data Source Pool
  • 17.1.3 Attaching LDAP Data Sources to a Data Source Pool
    • 17.1.3.1 To Attach an LDAP Data Source to a Data Source Pool
  • 17.1.4 Working with LDAP Data Views
    • 17.1.4.1 To Create an LDAP Data View
    • 17.1.4.2 To Configure an LDAP Data View
• 17.2 Accessing Configuration Entries for a Directory Server by Using Directory Proxy Server
  • 17.2.1 To Access the Configuration Entries of a Directory Server by Using Directory Proxy Server
• 17.3 Renaming Attributes and DNs
  • 17.3.1 To Configure Attribute Renaming
  • 17.3.2 To Configure DN Renaming
• 17.4 Configuring View Exclusion Base and Alternate Search Base
  • 17.4.1 To Manually Configure the excluded-subtrees and alternate-search-base-dn Properties
• 17.5 Creating and Configuring Data Views for Example Use Cases
  • 17.5.1 Default Data View
  • 17.5.2 Data Views That Route All Requests, Irrespective of the Target DN of the Request
  • 17.5.3 Data Views That Route Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources
    • 17.5.3.1 To Configure Data Views That Route Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources
  • 17.5.4 Data Views That Provide a Single Point of Access When Different Subtrees Are Stored in Different Data Sources
    • 17.5.4.1 To Configure Data Views That Provide a Single Point of Access When Different Subtrees Are Stored on Different Data Sources
  • 17.5.5 Data Views That Provide a Single Point of Access When Superior and Subordinate Subtrees Are Stored in Different Data Sources
    • 17.5.5.1 To Configure Data Views That Provide a Single Point of Access When Superior and Subordinate Subtrees Are Stored in Different Data Sources

18 Directory Proxy Server Load Balancing and Client Affinity

• 18.1 Configuring Load Balancing
  • 18.1.1 To Select a Load Balancing Algorithm
  • 18.1.2 To Configure Weights for Load Balancing
  • 18.1.3 Example Configurations for Load Balancing
    • 18.1.3.1 To Configure the Proportional Algorithm for Load Balancing
    • 18.1.3.2 To Configure the Saturation Algorithm for Load Balancing
    • 18.1.3.3 To Configure the Operational Affinity Algorithm for Global Account Lockout
    • 18.1.3.4 To Configure Operational Affinity Algorithm for Cache Optimization
    • 18.1.3.5 To Configure the Failover Algorithm for Load Balancing
    • 18.1.3.6 To Configure the Adaptive Failover Algorithm for Load Balancing
    • 18.1.3.7 To Configure the Fastest Server Algorithm for Load Balancing
  • 18.1.4 Configuring Directory Proxy Server To Perform Load Balancing
• 18.2 Configuring Client Affinity
  • 18.2.1 To Configure Client Affinity
  • 18.2.2 Example Configurations for Client Affinity
    • 18.2.2.1 To Configure Client Affinity for Replication Delay When a Data Source Pool Contains Masters and Consumers
    • 18.2.2.2 To Configure Client Affinity to Verify Each Write Operation With a Read Operation
    • 18.2.2.3 To Configure Client Affinity for Client—Based Routing
    • 18.2.2.4 To Configure Client Affinity for Connection-Based Routing

19 Directory Server Attribute Value Uniqueness

• 19.1 Overview of Attribute Value Uniqueness
• 19.2 Enforcing Uniqueness of the uid and Other Attributes
  • 19.2.1 To Enforce Uniqueness of the uid Attribute
  • 19.2.2 To Enforce Uniqueness of Another Attribute
• 19.3 Using the Uniqueness Plug-In With Replication
  • 19.3.1 Single-Master Replication Scenario
  • 19.3.2 Multimaster Replication Scenario

20 Directory Proxy Server Certificates

• 20.1 Default Self-Signed Certificate
  • 20.1.1 Viewing the Default Self-Signed Certificate
• 20.2 Creating, Requesting and Installing Certificates for Directory Proxy Server
  • 20.2.1 To Create a Non-default Self-Signed Certificate for Directory Proxy Server
  • 20.2.2 To Request a CA-Signed Certificate for Directory Proxy Server
  • 20.2.3 To Install a CA-Signed Server Certificate for Directory Proxy Server
• 20.3 Renewing an Expired CA-Signed Certificate for Directory Proxy Server
  • 20.3.1 To Renew an Expired CA-Signed Server Certificate for Directory Proxy Server
• 20.4 Listing Certificates
  • 20.4.1 To List Server Certificates
  • 20.4.2 To List CA Certificates
• 20.5 Adding a Certificate From a Back-End LDAP Server to the Certificate Database on Directory Proxy Server
  • 20.5.1 To Add a Certificate From a Back-End Directory Server to the Certificate Database on Directory Proxy Server
• 20.6 Exporting a Certificate to a Back-End LDAP Server
  • 20.6.1 To Configure Directory Proxy Server to Export a Client Certificate to a Back-End LDAP Server
• 20.7 Backing Up and Restoring a Certificate Database for Directory Proxy Server
• 20.8 Prompting for a Password to Access the Certificate Database
  • 20.8.1 To Prompt for a Password to Access the Certificate Database
  • 20.8.2 To Disable the Password Prompt to Access the Certificate Database

21 Directory Proxy Server Distribution

• 21.1 Configuring Directory Proxy Server Distribution Algorithms
  • 21.1.1 Configuring Pattern Matching Distribution Algorithm
  • 21.1.2 Configuring Numeric Distribution Algorithm
  • 21.1.3 Configuring Lexicographic Distribution Algorithm
  • 21.1.4 Configuring Replication Distribution Algorithm
  • 21.1.5 Configuring Custom Distribution Algorithm
    • 21.1.5.1 To Configure Custom Distribution Algorithm
• 21.2 Configuring Directory Proxy Server for Distribution of Suffix Data
• 21.3 Creating and Configuring Data Views for Example Use Cases
  • 21.3.1 Data Views That Provide a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources
    • 21.3.1.1 To Configure Data Views That Provide a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources
  • 21.3.2 Data Views With Hierarchy and a Distribution Algorithm
    • 21.3.2.1 To Configure Data Views With Hierarchy and a Distribution Algorithm

22 Directory Proxy Server Virtualization

• 22.1 Creating and Configuring LDIF Data Views
  • 22.1.1 To Create an LDIF Data View
  • 22.1.2 To Configure an LDIF Data View
• 22.2 Defining Access Control on Virtual Data Views
  • 22.2.1 To Define a New ACI Storage Repository
  • 22.2.2 To Configure Virtual Access Controls
• 22.3 Defining Schema Checking on Virtual Data Views
  • 22.3.1 To Define Schema Checking
• 22.4 Creating and Configuring Join Data Views
  • 22.4.1 To Create a Join Data View
  • 22.4.2 To Configure a Join Data View
  • 22.4.3 To Configure a Join Data View to Enable Referencing of a Data View by Multiple Join Data Views
  • 22.4.4 To Configure the Secondary View of a Join View
• 22.5 Creating and Configuring Coordinator Data Views
  • 22.5.1 To Create a Coordinator Data View
  • 22.5.2 To Configure a Coordinator Data View
• 22.6 Creating and Configuring JDBC Data Views
  • 22.6.1 To Create a JDBC Data View
  • 22.6.2 To Configure a JDBC Data View
  • 22.6.3 To Configure JDBC Tables, Attributes, and Object Classes
  • 22.6.4 Defining Relationships Between JDBC Tables
• 22.7 Sample Virtual Configurations
  • 22.7.1 Joining an LDAP Directory and a MySQL Database
    • 22.7.1.1 Configuring and Testing the LDAP Data View
    • 22.7.1.2 Configuring and Testing the JDBC Data View
    • 22.7.1.3 Creating and Testing the Join Data View
  • 22.7.2 Joining Multiple Disparate Data Sources
    • 22.7.2.1 Data Storage Scenario
    • 22.7.2.2 Client Application Requirements
    • 22.7.2.3 Aggregate Data From the HR LDAP Directory and the Administration LDIF File
    • 22.7.2.4 Add Data From Company 22 to Example.Com's DIT by Renaming the DN
    • 22.7.2.5 Add Company 22's Data to the HR Data
    • 22.7.2.6 Enable LDAP Clients to Access the Payroll Data in an SQL Database
    • 22.7.2.7 Add Virtual Access Control

23 Virtual Data Transformations

• 23.1 Configuring Virtual Data Transformations
  • 23.1.1 To Add a Virtual Transformation
  • 23.1.2 To Remove a Virtual Transformation
• 23.2 Virtual Transformation Examples
  • 23.2.1 Deriving an Attribute From the Existing Attributes of an Entry
  • 23.2.2 Mapping a Virtual Attribute to a Physical Attribute
  • 23.2.3 Displaying a Second Virtual Value of an Attribute, Specified by Another Physical Attribute
  • 23.2.4 Storing a Second Value to an Attribute Specified by Another Physical Attribute
  • 23.2.5 Removing an Attribute From the Output
  • 23.2.6 Masking an Attribute While Saving an Entry
  • 23.2.7 Displaying a Default Value of an Attribute
  • 23.2.8 Storing a Default Value to an Attribute

24 Connections Between Directory Proxy Server and Back-End LDAP Servers

• 24.1 Configuring Connections Between Directory Proxy Server and Back-End LDAP Servers
  • 24.1.1 To Configure the Number of Connections Between Directory Proxy Server and Back-End LDAP Servers
  • 24.1.2 To Configure Connection Timeout
  • 24.1.3 To Configure Connection Pool Wait Timeout
• 24.2 Configuring SSL Between Directory Proxy Server and Back-End LDAP Servers
  • 24.2.1 To Configure SSL Between Directory Proxy Server and a Back-End LDAP Server
• 24.3 Choosing SSL Ciphers and SSL Protocols for Directory Proxy Server
  • 24.3.1 To Choose the List of Ciphers and Protocols
• 24.4 Forwarding Requests to Back-End LDAP Servers
  • 24.4.1 Forwarding Requests With Bind Replay
    • 24.4.1.1 To Forward Requests With Bind Replay
  • 24.4.2 Forwarding Requests With Proxy Authorization
    • 24.4.2.1 To Forward Requests by Using Proxy Authorization
    • 24.4.2.2 To Forward Requests by Using Proxy Authorization When the Request Contains a Proxy Authorization Control
  • 24.4.3 Forwarding Requests Without the Client Identity
    • 24.4.3.1 To Forward Requests Without the Client Identity
  • 24.4.4 Forwarding Requests as an Alternate User
    • 24.4.4.1 To Configure Remote User Mapping
    • 24.4.4.2 To Configure Local User Mapping
    • 24.4.4.3 To Configure User Mapping for Anonymous Clients

25 Connections Between Clients and Directory Proxy Server

• 25.1 Creating, Configuring, and Deleting Connection Handlers
  • 25.1.1 To Create a Connection Handler
  • 25.1.2 To Configure a Connection Handler
  • 25.1.3 To Delete a Connection Handler
  • 25.1.4 To Configure Affinity for Data Views
• 25.2 Creating and Configuring Request Filtering Policies and Search Data Hiding Rules
  • 25.2.1 To Create a Request Filtering Policy
  • 25.2.2 To Configure a Request Filtering Policy
  • 25.2.3 To Create Search Data Hiding Rules
  • 25.2.4 Example Request Filtering Policy and Search Data Hiding Rule
• 25.3 Creating and Configuring a Resource Limits Policy
  • 25.3.1 To Create a Resource Limits Policy
  • 25.3.2 To Configure a Resource Limits Policy
  • 25.3.3 To Block Presence Filters in the Search Operation
  • 25.3.4 To Customize Search Limits
  • 25.3.5 To Limit LDAP Operations Rates
  • 25.3.6 To Disconnect Idle Connections
• 25.4 Configuring Directory Proxy Server as a Connection Based Router
  • 25.4.1 To Configure Directory Proxy Server as a Connection Based Router

26 Directory Proxy Server Logging

• 26.1 Viewing Directory Proxy Server Logs
• 26.2 Configuring Directory Proxy Server Logs
  • 26.2.1 To Configure Directory Proxy Server Logs
  • 26.2.2 To Configure Directory Proxy Server Control OIDs in the Access Log
  • 26.2.3 To Configure Directory Proxy Server Access Log etimes Units
• 26.3 Configuring Directory Proxy Server Log Rotation
  • 26.3.1 To Configure Periodic Log Rotation
  • 26.3.2 To Rotate Log Files
  • 26.3.3 To Disable Log Rotation
  • 26.3.4 Example Configurations for Log Rotation
    • 26.3.4.1 Rotating the Log Based on Log Size
    • 26.3.4.2 Rotating the Log Based on Time
    • 26.3.4.3 Rotating the Log Based on Time and Log Size
    • 26.3.4.4 Compressing Log Files After Rotation
• 26.4 Deleting Directory Proxy Server Logs
  • 26.4.1 To Configure Log Deletion Based on Time
  • 26.4.2 To Configure Log Deletion Based on File Size
  • 26.4.3 To Configure Log Deletion Based on Free Disk Space
• 26.5 Logging Alerts to the syslogd Daemon
  • 26.5.1 To Configure Directory Proxy Server to Log Alerts to the syslogd Daemon
  • 26.5.2 Configuring the Operating System to Accept syslog Alerts
    • 26.5.2.1 To Configure the Solaris OS to Accept syslog alerts
    • 26.5.2.2 To Configure Linux to Accept syslog Alerts
    • 26.5.2.3 To Configure HP-UX to Accept syslog alerts
• 26.6 Tracking Client Requests Through Directory Proxy Server and Directory Server Access Logs
  • 26.6.1 To Track Operations From Directory Server Through Directory Proxy Server to the Client Application

27 Directory Proxy Server Client Authentication

• 27.1 Configuring Listeners Between Clients and Directory Proxy Server
  • 27.1.1 To Configure the Listeners Between a Client and Directory Proxy Server
• 27.2 Authenticating Clients to Directory Proxy Server
  • 27.2.1 To Configure Certificate-based Authentication
  • 27.2.2 To Configure Anonymous Access
  • 27.2.3 To Configure Directory Proxy Server for SASL External Bind

28 Directory Proxy Server Monitoring and Alerts

• 28.1 Retrieving Monitored Data About Directory Proxy Server
• 28.2 Retrieving Monitored Data About Data Sources
  • 28.2.1 To Monitor a Data Source by Listening for Errors
  • 28.2.2 To Monitor a Data Source by Periodically Establishing Dedicated Connections
  • 28.2.3 To Monitor a Data Source by Testing Established Connections
• 28.3 Configuring Administrative Alerts for Directory Proxy Server
  • 28.3.1 To Enable Administrative Alerts
  • 28.3.2 To Configure Administrative Alerts to Be Sent to Syslog
  • 28.3.3 To Configure Administrative Alerts to Be Sent to Email
  • 28.3.4 To Configure Administrative Alerts to Run a Script
• 28.4 Retrieving Monitored Data About Directory Proxy Server by Using the JVM
  • 28.4.1 To View the Heap Size of the JVM
  • 28.4.2 To Monitor the Heap Size of JVM When Directory Proxy Server is Running

Part III Console-Based Administration

29 Using the Directory Service Control Center (DSCC)

• 29.1 About DSCC Administrators
  • 29.1.1 About Directory Service Managers
    • 29.1.1.1 To Create a Directory Service Manager
    • 29.1.1.2 To Reset a Directory Service Manager Password
  • 29.1.2 Designating an Administrative User
  • 29.1.3 To Enable the Administrative Users Feature
  • 29.1.4 To Create an Administrative User
  • 29.1.5 To Configure an Administrative User
• 29.2 Accessing DSCC
• 29.3 Directory Service Control Center Interface
  • 29.3.1 Common Tasks Tab
  • 29.3.2 Directory Servers Tab
  • 29.3.3 Proxy Servers Tab
  • 29.3.4 Server Groups Tab
  • 29.3.5 Settings Tab
• 29.4 DSCC Command Line Interface
  • 29.4.1 dsccagent command
  • 29.4.2 dsccsetup command
  • 29.4.3 dsccreg command
• 29.5 DSCC Online Help
• 29.6 Troubleshooting DSCC

Index