Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide?

• What's New in Oracle Unified Directory
• What's New in Oracle Unified Directory 11g Release 2 (11.1.2)

Part I Introduction to Oracle Unified Directory

1 Overview of Oracle Unified Directory

• 1.1 What is Oracle Unified Directory?
  • 1.1.1 Components of Oracle Unified Directory
  • 1.1.2 Oracle Unified Directory Installation Types
    • 1.1.2.1 Setting Up the Directory Server
    • 1.1.2.2 Setting Up the Proxy Server
    • 1.1.2.3 Setting Up the Replication Gateway Server
  • 1.1.3 Synchronizing Oracle Unified Directory with Other Directories
    • 1.1.3.1 Synchronization between Oracle Unified Directory and Oracle Internet Directory
    • 1.1.3.2 Synchronization between Oracle Unified Directory and Third-Party Directories
• 1.2 Overview of Directory Server
• 1.3 Overview of Proxy Server
  • 1.3.1 What Is the Proxy Server?
  • 1.3.2 Why Use the Proxy Server?
• 1.4 Overview of the Replication Gateway
  • 1.4.1 What Is the Replication Gateway?
  • 1.4.2 The Role of the Replication Gateway
  • 1.4.3 Limitations of the Replication Gateway

2 Example Deployments Using the Directory Server

• 2.1 Small Replicated Topology
  • 2.1.1 The Role of Directory Servers in a Topology
  • 2.1.2 The Role of Replication Servers in a Topology
• 2.2 Multiple Data Center Topology
  • 2.2.1 Multiple Data Centers and Replication Groups
  • 2.2.2 Multiple Data Centers and the Window Mechanism

3 Example Deployments Using the Proxy Server

• 3.1 Deciding Your Proxy Deployment Type
• 3.2 Configuration 1: Simple Load Balancing
• 3.3 Configuration 2: Simple Distribution
• 3.4 Configuration 3: Failover Between Data Centers
• 3.5 Configuration 4: Distribution with Load Balancing
• 3.6 Configuration 5: Distribution with Failover Between Data Centers
• 3.7 Configuration 6: Enterprise User Security
• 3.8 Multiple Replicated Proxies

Part II Oracle Unified Directory Concepts and Architecture

4 Understanding Oracle Unified Directory Concepts and Architecture

• 4.1 Oracle Unified Directory Components
  • 4.1.1 Network Groups
  • 4.1.2 Workflows
  • 4.1.3 Workflow Elements
• 4.2 Architecture of Oracle Unified Directory

5 Understanding Oracle Unified Directory High Availability Deployments

• 5.1 What is High Availability?
• 5.2 Availability and Single Points of Failure
  • 5.2.1 Types of SPOFs
    • 5.2.1.1 Hardware Failure
    • 5.2.1.2 Software Failure
  • 5.2.2 Common Approach to Mitigate SPOFs - Redundancy
• 5.3 Using Redundancy for High Availability
  • 5.3.1 Redundancy at the Hardware Level
  • 5.3.2 Redundancy at Directory Server Level Using Replication
  • 5.3.3 Using Directory Proxy Server as Part of a Redundant Solution
  • 5.3.4 Using Application Isolation for High Availability
  • 5.3.5 Using Replication Gateway for High Availability
• 5.4 Sample Topologies Using Redundancy for High Availability

6 Understanding the Oracle Unified Directory Replication Model

• 6.1 Overview of the Replication Architecture
  • 6.1.1 Basic Replication Architecture
  • 6.1.2 Replication Servers
  • 6.1.3 Replication Change Numbers
  • 6.1.4 Replication Server State
  • 6.1.5 Operation Dependencies
• 6.2 How Replication Works
  • 6.2.1 Replication Initialization
    • 6.2.1.1 Replicating Configuration Data Manually
  • 6.2.2 Directory Server Change Processing
  • 6.2.3 Replication Server Selection
    • 6.2.3.1 Replication Server Selection Algorithm
    • 6.2.3.2 Replication Server Load Balancing
  • 6.2.4 Change Replay
  • 6.2.5 Auto Repair
  • 6.2.6 Directory Server Crashes
  • 6.2.7 Replication Server Crashes
• 6.3 Historical Information and Conflict Resolution
  • 6.3.1 What is a Replication Conflict?
  • 6.3.2 Resolving Modify Conflicts
  • 6.3.3 Resolving Naming Conflicts
  • 6.3.4 Purging Historical Information
• 6.4 Schema Replication
  • 6.4.1 Schema Replication Architecture
• 6.5 Replication Status
  • 6.5.1 Replication Status Definitions
  • 6.5.2 Degraded Status
  • 6.5.3 Full Update Status and Bad Generation ID Status
• 6.6 Replication Groups
• 6.7 Assured Replication
  • 6.7.1 Assured Replication Modes
    • 6.7.1.1 Safe Data Mode
    • 6.7.1.2 Safe Read Mode
    • 6.7.1.3 Safe Read Mode and Replication Groups
  • 6.7.2 Assured Replication Connection Algorithm
  • 6.7.3 Assured Replication and Replication Status
  • 6.7.4 Assured Replication Monitoring
• 6.8 Fractional Replication
  • 6.8.1 Fractional Data Set Identification
  • 6.8.2 Fractional Replication Filtering
  • 6.8.3 Fractional Replication and Local Operations

7 Understanding the Oracle Unified Directory Indexing Model

• 7.1 Overview of Indexes
  • 7.1.1 What is an Index?
  • 7.1.2 Understanding the Importance of Indexing
• 7.2 Index Types
  • 7.2.1 Approximate Indexes
  • 7.2.2 Equality Indexes
  • 7.2.3 Ordering Indexes
  • 7.2.4 Presence Indexes
  • 7.2.5 Substring Indexes
• 7.3 Index Entry Limit
• 7.4 Search Evaluation
• 7.5 Maintaining Indexes

8 Understanding the Oracle Unified Directory Access Control Model

• 8.1 Access Control Principles
  • 8.1.1 Access Control Overview
  • 8.1.2 ACI Structure
  • 8.1.3 Directory Server Global ACIs
  • 8.1.4 ACI Evaluation
  • 8.1.5 ACI Limitations
  • 8.1.6 Access Control and Replication
• 8.2 ACI Syntax
  • 8.2.1 ACI Syntax Overview
  • 8.2.2 Defining Targets
    • 8.2.2.1 Targeting a Directory Entry
    • 8.2.2.2 To Target Attributes
    • 8.2.2.3 To Target an Entry and Attributes
    • 8.2.2.4 To Target Entries or Attributes Using LDAP Filters
    • 8.2.2.5 To Target Attribute Values Using LDAP Filters
    • 8.2.2.6 To Target a Single Directory Entry
    • 8.2.2.7 To Specify the Scope of an ACI
    • 8.2.2.8 To Target LDAP Controls
    • 8.2.2.9 To Target LDAP Extended Operations
  • 8.2.3 Defining Permissions
    • 8.2.3.1 To Allow or Deny Access
    • 8.2.3.2 To Assign Rights
    • 8.2.3.3 Rights Required for LDAP Operations
    • 8.2.3.4 Permissions Syntax
• 8.3 Bind Rules
  • 8.3.1 Bind Rules Overview
  • 8.3.2 Using Boolean Bind Rules
• 8.4 Bind Rule Syntax
  • 8.4.1 Bind Rule Syntax Overview
  • 8.4.2 Defining User Access (userdn Keyword)
    • 8.4.2.1 Defining General Access (all Keyword)
    • 8.4.2.2 Defining Anonymous Access (anyone Keyword)
    • 8.4.2.3 Defining Self Access (self Keyword)
    • 8.4.2.4 Defining Parent Access (parent Keyword)
    • 8.4.2.5 Specifying Users With LDAP URLs
    • 8.4.2.6 Specifying Users With Wildcards
    • 8.4.2.7 Specifying Users With a Logical OR of LDAP URLs
    • 8.4.2.8 Excluding Specific LDAP URLs
  • 8.4.3 Defining Group Access (groupdn Keyword)
    • 8.4.3.1 Specifying a Group With a Single LDAP URL
    • 8.4.3.2 Specifying a Group With a Logical OR of LDAP URLs
  • 8.4.4 Defining Access Based on Value Matching (userattr Keyword)
    • 8.4.4.1 Bind-Type Format
    • 8.4.4.2 Attribute-Value Format
    • 8.4.4.3 USERDN Bind Type Example
    • 8.4.4.4 GROUPDN Bind Type Example
    • 8.4.4.5 LDAPURL Bind Type Example
    • 8.4.4.6 Attribute Value Example
    • 8.4.4.7 Inheritance
    • 8.4.4.8 Inheritance Example
    • 8.4.4.9 Add Permissions
  • 8.4.5 Defining Access From a Specific IP Address (ip Keyword)
  • 8.4.6 Defining Access From a Specific Domain (dns Keyword)
  • 8.4.7 Defining Access at a Specific Time of Day or Day of Week (timeofday and dayofweek Keywords)
  • 8.4.8 Defining Access Based on Authentication Method (authmethod Keyword)
    • 8.4.8.1 Authentication Method Examples
  • 8.4.9 Defining Access Based on a Connection's Security Strength Factor (ssf Keyword)
    • 8.4.9.1 DIGEST-MD5 QOP Key Size Mapping
    • 8.4.9.2 TLS Cipher Key Size Mapping
    • 8.4.9.3 Example
• 8.5 Compatibility With the Oracle Directory Server Enterprise Edition Access Control Model
  • 8.5.1 Global ACI
  • 8.5.2 Distinguished Name (DN) Wildcard Matching
  • 8.5.3 Privilege Subsystem Impact
  • 8.5.4 The targetscope Keyword
  • 8.5.5 LDAP Modify Increment
  • 8.5.6 Macro Support
  • 8.5.7 The roledn Keyword
• 8.6 Using Macro ACIs for Advanced Access Control
  • 8.6.1 What are Macros?
  • 8.6.2 Macro ACI Example
  • 8.6.3 Macro ACI Syntax
    • 8.6.3.1 Matching for ($dn) in the Target
    • 8.6.3.2 Macro Matching for ($attr.attrName)

9 Understanding the Oracle Unified Directory Schema Model

• 9.1 Understanding Matching Rules
  • 9.1.1 Matching Rule Description Format
  • 9.1.2 Commonly Used Matching Rules
  • 9.1.3 Relative Time Matching Rules
  • 9.1.4 Partial Date Or Time Matching Rules
  • 9.1.5 Value Normalization
• 9.2 Understanding Attribute Syntaxes
  • 9.2.1 The Attribute Syntax Description Format
  • 9.2.2 Commonly Used Attribute Syntaxes
  • 9.2.3 The Pattern-Matching Syntax Extension
  • 9.2.4 The Enumeration Syntax Extension
  • 9.2.5 Substitution Syntax Extension
• 9.3 Understanding Attribute Types
  • 9.3.1 Attribute Type Description Format
  • 9.3.2 Attribute Type Inheritance
  • 9.3.3 Attribute Type Implementation
• 9.4 Understanding Object Classes
  • 9.4.1 Object Class Description Format
  • 9.4.2 Object Class Kinds
  • 9.4.3 Object Class Inheritance
  • 9.4.4 Directory Server Object Class Implementation
• 9.5 Understanding Name Forms
  • 9.5.1 Name Form Description Format
• 9.6 Understanding DIT Content Rules
  • 9.6.1 DIT Content Rule Description Format
  • 9.6.2 DIT Content Rule Implementation
• 9.7 Understanding DIT Structure Rules
  • 9.7.1 DIT Structure Rule Description Format
  • 9.7.2 DIT Structure Rules and Multiple Schemas
• 9.8 Understanding Matching Rule Uses

10 Understanding Root Users and the Privilege Subsystem

• 10.1 Root User Accounts
• 10.2 Privilege Subsystem
• 10.3 Assigning Privileges to Normal Users
• 10.4 Assigning Privileges to Root Users

11 Understanding the Proxy Functionality

• 11.1 Load Balancing Using the Proxy
  • 11.1.1 Failover Load Balancing
  • 11.1.2 Optimal Load Balancing
    • 11.1.2.1 Determining Saturation Level
  • 11.1.3 Proportional Load Balancing
  • 11.1.4 Saturation Load Balancing
  • 11.1.5 Search Filter Load Balancing
• 11.2 Data Distribution Using the Proxy
  • 11.2.1 Numeric Distribution
  • 11.2.2 Lexico Distribution
  • 11.2.3 Capacity Distribution
  • 11.2.4 DN Pattern Distribution
• 11.3 Global Index Catalog
• 11.4 DN Renaming Using the Proxy
  • 11.4.1 How the DN Renaming Workflow Element Works
• 11.5 RDN Changing
• 11.6 Understanding the Transformation Framework
  • 11.6.1 Overview of Transformation
    • 11.6.1.1 Transformation Models
    • 11.6.1.2 Implementing Transformation in Oracle Unified Directory
  • 11.6.2 Components of Transformation
    • 11.6.2.1 Transformation Types
    • 11.6.2.2 Transformation Conditions
    • 11.6.2.3 Defining Attribute Values for Transformation
  • 11.6.3 Configuring Transformation
    • 11.6.3.1 Overview of the Configuration Model
    • 11.6.3.2 Example of Configuring Transformation Using CLI

12 Understanding Oracle Unified Directory Mapping

• 12.1 An Overview of Identity Mappers
• 12.2 Supported Identity Mappers
  • 12.2.1 Exact Match Identity Mapper
  • 12.2.2 Match And Replace Identity Mapper
• 12.3 Components of Identity Mappers
  • 12.3.1 Global Configuration
  • 12.3.2 Network Group
• 12.4 Configuring Identity Mappers
  • 12.4.1 Configuring Global Identity Mappers
  • 12.4.2 Configuring Network Group Identity Mappers
• 12.5 Selecting Identity Mappers
• 12.6 Ordering Identity Mappers

Part III Basic Administration

13 Starting and Stopping the Server

• 13.1 Starting the Server
  • 13.1.1 To Start the Server by Using start-ds
  • 13.1.2 To Start the Server as a Foreground Process
  • 13.1.3 To Restart the Server
  • 13.1.4 To Start the Server by Using a Script (UNIX/Linux)
• 13.2 Stopping the Server
  • 13.2.1 To Stop the Server by Using stop-ds
  • 13.2.2 To Stop the Server that is Running in the Foreground
  • 13.2.3 To Stop the Server by Using a Script (UNIX/Linux)
• 13.3 Checking if the Server is Started or Stopped
  • 13.3.1 To Check the Server Status
• 13.4 Running the Server as a Non-Root User
  • 13.4.1 Reasons for Running the Server as a Non-Root User
  • 13.4.2 How to Run as a Non-Root User on the Standard LDAP Ports

14 Configuring the Server Instance

• 14.1 Managing the Server Configuration With dsconfig
  • 14.1.1 Overview of the dsconfig Command
    • 14.1.1.1 dsconfig and Certificate Checking
    • 14.1.1.2 dsconfig Sub-Commands
    • 14.1.1.3 dsconfig Advanced Properties
  • 14.1.2 Using dsconfig in Interactive Mode
  • 14.1.3 Getting Help With dsconfig
    • 14.1.3.1 Global Usage
    • 14.1.3.2 Finding the Correct Subcommand
    • 14.1.3.3 Getting Help for an Individual Subcommand
    • 14.1.3.4 Displaying a Summary of a Component's Properties
    • 14.1.3.5 Displaying Detailed Help on a Property
  • 14.1.4 Configuring a Server Instance With dsconfig
    • 14.1.4.1 To Display the Properties of a Component
    • 14.1.4.2 To List Components
    • 14.1.4.3 To Create a Component
    • 14.1.4.4 To Modify the Properties of a Component
    • 14.1.4.5 To Modify the Values of a Multi-Valued Property
    • 14.1.4.6 To Delete a Component
    • 14.1.4.7 To Use dsconfig in Batch Mode
  • 14.1.5 Configuring Connection Handlers With dsconfig
    • 14.1.5.1 To Display All Connection Handlers
    • 14.1.5.2 Configuring the LDAP Connection Handler
    • 14.1.5.3 Configuring the LDIF Connection Handler
    • 14.1.5.4 Configuring the JMX Connection Handler
  • 14.1.6 Configuring Network Groups With dsconfig
    • 14.1.6.1 Creating a Network Group
    • 14.1.6.2 Modifying Network Group Properties
    • 14.1.6.3 Creating a Network Group Quality of Service Policy
    • 14.1.6.4 Modifying a Network Group Quality of Service Policy
    • 14.1.6.5 Relocating the Root DSE Entry for a Network Group
  • 14.1.7 Configuring Workflows With dsconfig
    • 14.1.7.1 Listing Existing Workflows
    • 14.1.7.2 Viewing Workflow Properties
    • 14.1.7.3 Creating a Workflow
  • 14.1.8 Configuring Workflow Elements With dsconfig
    • 14.1.8.1 Listing Workflow Elements
    • 14.1.8.2 Creating Workflow Elements
    • 14.1.8.3 Modifying Workflow Elements
  • 14.1.9 Configuring Plug-Ins With dsconfig
    • 14.1.9.1 Overview of Plug-In Types
    • 14.1.9.2 Modifying the Plug-In Configuration
  • 14.1.10 Configuring Suffixes with dsconfig
    • 14.1.10.1 Configuring Suffixes with dsconfig During Setup
    • 14.1.10.2 Configuring Suffixes with dsconfig on a Running Server
• 14.2 Managing the Server Configuration With Oracle Directory Services Manager
  • 14.2.1 Selecting a Configuration View
  • 14.2.2 Shortcuts to Configuring Objects With ODSM
  • 14.2.3 Configuring Suffixes With ODSM
    • 14.2.3.1 Create a Suffix
    • 14.2.3.2 Display and Edit Suffix Properties
    • 14.2.3.3 Delete a Suffix
  • 14.2.4 Configuring Workflow Elements With ODSM
    • 14.2.4.1 Create a Workflow Element
    • 14.2.4.2 Display and Edit Workflow Element Properties
    • 14.2.4.3 Delete a Workflow Element
  • 14.2.5 Configuring Workflows With ODSM
    • 14.2.5.1 Create a Workflow
    • 14.2.5.2 Display and Edit Workflow Properties
    • 14.2.5.3 Delete a Workflow
  • 14.2.6 Configuring Connection Handlers With ODSM
    • 14.2.6.1 Create a Connection Handler
    • 14.2.6.2 Modify a Connection Handler
    • 14.2.6.3 Delete a Connection Handler
  • 14.2.7 Configuring Network Groups With ODSM
    • 14.2.7.1 Create a Network Group
    • 14.2.7.2 Modify a Network Group
    • 14.2.7.3 Delete a Network Group
  • 14.2.8 Modify the General Server Configuration
• 14.3 Managing Administration Traffic to the Server
  • 14.3.1 Overview of the Administration Connector
  • 14.3.2 Accessing Administrative Suffixes
  • 14.3.3 To Configure the Administration Connector
  • 14.3.4 Key Managers and Trust Managers for the Administration Connector
• 14.4 Configuring Commands As Tasks
  • 14.4.1 Commands That Can Schedule Tasks
  • 14.4.2 Controlling Which Tasks Can Be Run
  • 14.4.3 Scheduling and Configuring Tasks
    • 14.4.3.1 To Schedule a Task
    • 14.4.3.2 To Schedule a Recurring Task
    • 14.4.3.3 To Configure Task Notification
    • 14.4.3.4 To Configure Task Dependencies
  • 14.4.4 Managing and Monitoring Scheduled Tasks
    • 14.4.4.1 To Obtain Information About Scheduled Tasks
    • 14.4.4.2 To Cancel a Scheduled Task
    • 14.4.4.3 To Cancel a Recurring Task
• 14.5 Deploying and Configuring the DSML Gateway
  • 14.5.1 Deploying the DSML Gateway
    • 14.5.1.1 Deploying the DSML Gateway in Oracle WebLogic Server
    • 14.5.1.2 Deploying the DSML Gateway in IBM WebSphere
  • 14.5.2 Confirming the DSML Gateway Deployment
    • 14.5.2.1 To Confirm the DSML Gateway Deployment with JXplorer
    • 14.5.2.2 Confirming the DSML Gateway Deployment with the Directory Server Resource Kit

15 Configuring the Proxy Components

• 15.1 Managing the Proxy Configuration With dsconfig
  • 15.1.1 Configuring Communication With Remote LDAP Servers
    • 15.1.1.1 Components of Communication with the Remote Server
    • 15.1.1.2 Configuring LDAP Server Extensions
    • 15.1.1.3 Configuring Proxy LDAP Workflow Elements
  • 15.1.2 Configuring the Bind Mode
    • 15.1.2.1 Configuring the Bind Mode Parameters to Optimize the Server
  • 15.1.3 Configuring Load Balancing With dsconfig
    • 15.1.3.1 To Configure Load Balancing
    • 15.1.3.2 Creating a Load Balancing Workflow Element
    • 15.1.3.3 Creating a Load Balancing Algorithm
    • 15.1.3.4 Creating Load Balancing Routes
    • 15.1.3.5 Modifying Load Balancing Properties
  • 15.1.4 Configuring Distribution With dsconfig
    • 15.1.4.1 To Configure Distribution
    • 15.1.4.2 Creating a Distribution Workflow Element
    • 15.1.4.3 Creating a Distribution Algorithm
    • 15.1.4.4 Creating Distribution Partitions
    • 15.1.4.5 Managing Modify DN Requests
    • 15.1.4.6 Configuring Criticality in Workflows
    • 15.1.4.7 Configuring Criticality in Workflow Elements
    • 15.1.4.8 Deleting a Distribution Configuration
  • 15.1.5 Configuring DN Renaming With dsconfig
    • 15.1.5.1 Modifying a DN Renaming Configuration
  • 15.1.6 Configuring RDN Changing With dsconfig
    • 15.1.6.1 Modifying a RDN Renaming Configuration
  • 15.1.7 Configuring Global Indexes By Using the Command Line
    • 15.1.7.1 Configuring Global Index Catalogs by Using gicadm
    • 15.1.7.2 Replication of Global Index Catalogs
    • 15.1.7.3 Configuring Controls Required by the Global Index Catalog with Oracle Unified Directory
  • 15.1.8 Configuring Microsoft Active Directory Paging
    • 15.1.8.1 Configuring Active Directory Paging Workflow Elements
    • 15.1.8.2 Scanning Specific Attributes Returned by an Active Directory
• 15.2 Managing the Proxy Configuration With ODSM
  • 15.2.1 Configuring Load Balancing With ODSM
  • 15.2.2 Configuring Distribution With ODSM
  • 15.2.3 Configuring Criticality in Workflows With ODSM
  • 15.2.4 Configuring Transformations With ODSM
    • 15.2.4.1 Create Transformations
    • 15.2.4.2 Modifying Transformations
    • 15.2.4.3 Deleting Transformations
    • 15.2.4.4 Selecting Values from Value Definition Screen

16 Example Proxy Configurations

• 16.1 Configuring Load Balancing
  • 16.1.1 To Configure Simple Load Balancing
• 16.2 Configuring Distribution
  • 16.2.1 To Configure Simple Distribution
• 16.3 Configuring Distribution and Load Balancing
  • 16.3.1 To Configure Distribution with Load Balancing
• 16.4 Configuring Failover Between Data Centers
• 16.5 Configuring Distribution with Failover Between Data Centers

17 Managing Directory Data

• 17.1 Importing and Exporting Data
  • 17.1.1 Populating a Stand-Alone Directory Server With Data
  • 17.1.2 Importing Data Using import-ldif
    • 17.1.2.1 import-ldif Operation Modes
    • 17.1.2.2 To Import Data in Offline Mode
    • 17.1.2.3 To Replace Existing Data During an Offline Import
    • 17.1.2.4 To Append Imported Data to Existing Data
    • 17.1.2.5 To Import Fractional Files
    • 17.1.2.6 To Import Fractional Files by Using Filters
    • 17.1.2.7 To Include or Exclude Attributes During Import
    • 17.1.2.8 To Import a Compressed LDIF File
    • 17.1.2.9 To Record Rejected or Skipped Entries During Import
    • 17.1.2.10 To Import Data From a MakeLDIF Template
    • 17.1.2.11 To Run an Import in Online Mode
    • 17.1.2.12 To Schedule an Import
  • 17.1.3 Exporting Data Using export-ldif
    • 17.1.3.1 export-ldif Operation Modes
    • 17.1.3.2 To Export Data to LDIF
    • 17.1.3.3 To Export Partial Data
    • 17.1.3.4 To Export Part of a Back End by Using Filters
    • 17.1.3.5 To Include or Exclude Attributes During Export
    • 17.1.3.6 To Export to LDIF and Then Compress the File
    • 17.1.3.7 To Run an Export in Online Mode
    • 17.1.3.8 To Schedule an Export
  • 17.1.4 Creating MakeLDIF Template Files
    • 17.1.4.1 The Template File Format
    • 17.1.4.2 make-ldif Template File Tags
    • 17.1.4.3 Defining Custom Tags
• 17.2 Importing Large Data Sets
  • 17.2.1 Setting the Import Options
  • 17.2.2 Tuning the JVM and Java Arguments
• 17.3 Backing Up and Restoring Data
  • 17.3.1 Overview of the Backup and Restore Process
  • 17.3.2 Backing Up Data
    • 17.3.2.1 To Back Up All Back Ends
    • 17.3.2.2 To Back Up All Back Ends with Encryption and Signed Hashes
    • 17.3.2.3 To Perform an Incremental Backup on All Back Ends
    • 17.3.2.4 To Back Up a Specific Back End
    • 17.3.2.5 To Perform an Incremental Backup on a Specific Back End
    • 17.3.2.6 To Schedule a Backup as a Task
  • 17.3.3 Backing Up the Server Configuration
  • 17.3.4 Backing Up for Disaster Recovery
    • 17.3.4.1 To Back Up the Directory Server For Disaster Recovery
  • 17.3.5 Backing up and Restoring Data Using File System Snapshots
    • 17.3.5.1 To Take a ZFS Snapshot On a Dedicated Backup Server
    • 17.3.5.2 To Restore a Directory Server From a ZFS Snapshot
  • 17.3.6 Restoring Data
    • 17.3.6.1 To Restore a Back End
    • 17.3.6.2 To Restore a Back End From Incremental Backups
    • 17.3.6.3 To Schedule a Restore as a Task
    • 17.3.6.4 To Restore the Configuration File
    • 17.3.6.5 To Restore a Directory Server During Disaster Recovery
  • 17.3.7 Restoring Replicated Directory Servers
  • 17.3.8 Deleting Backup Data
    • 17.3.8.1 To Delete Backup Files
• 17.4 Searching Directory Data
  • 17.4.1 Overview of the ldapsearch Command
  • 17.4.2 ldapsearch Location and Format
    • 17.4.2.1 Common ldapsearch Options
  • 17.4.3 Understanding Search Criteria
    • 17.4.3.1 Specifying Filter Types and Operators
    • 17.4.3.2 Using Compound Search Filters
    • 17.4.3.3 Using UTF-8 Encoding in Search Filters
    • 17.4.3.4 Using Special Characters in Search Filters
  • 17.4.4 ldapsearch Examples
    • 17.4.4.1 To Return All Entries
    • 17.4.4.2 To Search For a Specific User
    • 17.4.4.3 To Search for Specific User Attributes
    • 17.4.4.4 To Perform a Search With Base Scope
    • 17.4.4.5 To Perform a Search With One-Level Scope
    • 17.4.4.6 To Perform a Search With Subtree Scope
    • 17.4.4.7 To Return Attribute Names Only
    • 17.4.4.8 To Return User Attributes Only
    • 17.4.4.9 To Return Base DNs Only
    • 17.4.4.10 To Search For Specific Object Classes
    • 17.4.4.11 To Return a Count of All Entries in the Directory
    • 17.4.4.12 To Perform a Search With a Compound Filter
    • 17.4.4.13 To Perform a Search Using a Filter File
    • 17.4.4.14 To Limit the Number of Entries Returned in a Search
  • 17.4.5 Searching Data With Oracle Directory Services Manager
    • 17.4.5.1 Perform a Complex LDAP Search
• 17.5 Using Advanced Search Features
  • 17.5.1 Searching for Special Entries and Attributes
    • 17.5.1.1 To Search for Operational Attributes
    • 17.5.1.2 To Search the Root DSE Entry
    • 17.5.1.3 To Search for ACI Attributes
    • 17.5.1.4 To Search the Schema Entry
    • 17.5.1.5 To Search the Configuration Entry
    • 17.5.1.6 To Search the Monitoring Entry
  • 17.5.2 Searching Over SSL
    • 17.5.2.1 To Search Over SSL With Blind Trust
    • 17.5.2.2 To Search Over SSL Using a Trust Store
    • 17.5.2.3 To Search Over SSL With No Trust Store
    • 17.5.2.4 To Search Over SSL Using a Keystore
    • 17.5.2.5 To Search Using StartTLS
    • 17.5.2.6 To Search Using SASL With DIGEST-MD5 Client Authentication
    • 17.5.2.7 To Search Using SASL With the GSSAPI Mechanism
    • 17.5.2.8 To Search Using SASL With the PLAIN Mechanism
  • 17.5.3 Searching Using Controls
    • 17.5.3.1 Viewing the Available Controls
    • 17.5.3.2 Searching Using the Join Search Control
    • 17.5.3.3 Searching Using the Proximity Search Control
    • 17.5.3.4 Searching Using the Account Usability Request Control
    • 17.5.3.5 Searching Using the Authorization Identity Request Control
    • 17.5.3.6 Searching Using the Get Effective Rights Control
    • 17.5.3.7 Searching Using the LDAP Assertion Control
    • 17.5.3.8 Searching Using the LDAP Subentry Control
    • 17.5.3.9 Searching Using the Manage DSA IT Control
    • 17.5.3.10 Searching Using the Matched Values Filter Control
    • 17.5.3.11 Searching Using the Password Policy Control
    • 17.5.3.12 Searching Using the Persistent Search Control
    • 17.5.3.13 Searching Using the Proxied Authorization Control
    • 17.5.3.14 Searching Using the Server-Side Sort Control
    • 17.5.3.15 Searching Using the Simple Paged Results Control
    • 17.5.3.16 Searching Using the Virtual List View Control
  • 17.5.4 Searching in Verbose Mode and With a Properties File
    • 17.5.4.1 To Search in Verbose Mode
    • 17.5.4.2 To Search Using a Properties File
  • 17.5.5 Searching Internationalized Entries
    • 17.5.5.1 Examples
    • 17.5.5.2 Supported Collation Rules
• 17.6 Adding, Modifying, and Deleting Directory Data
  • 17.6.1 Adding Directory Entries
    • 17.6.1.1 To Create a Root Entry
    • 17.6.1.2 To Add an Entry Using the --defaultAdd Option With ldapmodify
    • 17.6.1.3 To Add Entries Using an LDIF Update Statement With ldapmodify
  • 17.6.2 Adding Attributes
    • 17.6.2.1 To Add an Attribute to an Entry
    • 17.6.2.2 To Add an ACI Attribute
    • 17.6.2.3 To Add an International Attribute
  • 17.6.3 Modifying Directory Entries
    • 17.6.3.1 To Modify an Attribute Value
    • 17.6.3.2 To Modify an Attribute With Before and After Snapshots
    • 17.6.3.3 To Delete an Attribute
    • 17.6.3.4 To Change an RDN
    • 17.6.3.5 To Move an Entry
  • 17.6.4 Deleting Directory Entries
    • 17.6.4.1 To Delete an Entry With ldapmodify
    • 17.6.4.2 To Delete an Entry With ldapdelete
    • 17.6.4.3 To Delete Multiple Entries by Using a DN File
• 17.7 Indexing Directory Data
  • 17.7.1 Configuring Indexes on the Local DB Back End
    • 17.7.1.1 To Create a New Local DB Index
  • 17.7.2 Configuring VLV Indexes
    • 17.7.2.1 To Create a New VLV Index
• 17.8 Reducing Stored Data Size
  • 17.8.1 To Enable or Disable Compact Encoding
  • 17.8.2 To Enable or Disable Entry Compression
• 17.9 Ensuring Attribute Value Uniqueness
  • 17.9.1 Overview of the Unique Attribute Plug-In
  • 17.9.2 Configuring the Unique Attribute Plug-In Using dsconfig
    • 17.9.2.1 To Ensure Uniqueness of the Value of the uid Attribute
    • 17.9.2.2 To Ensure Uniqueness of the Value of Any Other Attribute
  • 17.9.3 Replication and the Unique Attribute Plug-In
• 17.10 Configuring Virtual Attributes
  • 17.10.1 To List the Existing Virtual Attributes
  • 17.10.2 To Create a New Virtual Attribute
  • 17.10.3 To Enable or Disable a Virtual Attribute
  • 17.10.4 To Display the Configuration of a Virtual Attribute
  • 17.10.5 To Change the Configuration of a Virtual Attribute
• 17.11 Using LDAP Subentries
  • 17.11.1 Relative Subtrees
• 17.12 Using Collective Attributes
  • 17.12.1 Extensions to the Collective Attributes Standard
    • 17.12.1.1 Naming Collective Attributes
    • 17.12.1.2 Collective Attributes and Conflict Resolution
    • 17.12.1.3 Excluding Collective Attributes From Specific Entries
  • 17.12.2 Configuring Collective Attributes
    • 17.12.2.1 To Create a New Collective Attribute
    • 17.12.2.2 To Delete a Collective Attribute
    • 17.12.2.3 To List the Collective Attributes That Apply to an Entry
  • 17.12.3 Inherited Collective Attributes
    • 17.12.3.1 Specifying Inherited Collective Attributes
• 17.13 Configuring Referrals
  • 17.13.1 Referrals in a Replicated Topology
  • 17.13.2 Configuring the Referral List Manually
  • 17.13.3 Smart Referrals
    • 17.13.3.1 To Configure a Smart Referral
    • 17.13.3.2 To Modify a Smart Referral
    • 17.13.3.3 To Delete a Smart Referral
  • 17.13.4 LDAP URLs
    • 17.13.4.1 Example LDAP URLs
• 17.14 Managing Virtual Attributes With Oracle Directory Services Manager
  • 17.14.1 Display Existing Virtual Attributes
  • 17.14.2 Create Virtual Attributes
• 17.15 Managing Data With Oracle Directory Services Manager
  • 17.15.1 Display Entries
  • 17.15.2 View the Attributes of an Entry
  • 17.15.3 Search for Entries
  • 17.15.4 Add an Entry
  • 17.15.5 Add an Entry Based on an Existing Entry
  • 17.15.6 Delete an Entry
  • 17.15.7 Delete an Entry and its Subtree
  • 17.15.8 Modify an Entry's RDN
  • 17.15.9 Import Data From an LDIF File
  • 17.15.10 Export Data to an LDIF File

18 Accessing Oracle Unified Directory by Using Oracle Directory Services Manager

• 18.1 Invoking Oracle Directory Services Manager
• 18.2 Connecting to the Server From Oracle Directory Services Manager
• 18.3 Displaying Server Information With Oracle Directory Services Manager
  • 18.3.1 View Version Information
  • 18.3.2 View the Server Role
  • 18.3.3 View Server Statistics
  • 18.3.4 View the Configured Connection Handlers
  • 18.3.5 View the Configured Naming Contexts
  • 18.3.6 View the Configured Data Sources

19 Managing Users and Groups

• 19.1 Managing User Accounts
  • 19.1.1 Changing Passwords
    • 19.1.1.1 To Change the Directory Manager's Password
    • 19.1.1.2 To Reset and Generate a New Password for a User
    • 19.1.1.3 To Change a User's Password
  • 19.1.2 Managing a User's Account Information
    • 19.1.2.1 To View a User's Account Information
    • 19.1.2.2 To View Account Status Information
    • 19.1.2.3 To Disable an Account
    • 19.1.2.4 To Enable an Account
    • 19.1.2.5 To Enable an Account Using orclIsEnabled
  • 19.1.3 Setting Resource Limits on a User Account
    • 19.1.3.1 To Set Resource Limits on an Account
• 19.2 Configuring Root Users
  • 19.2.1 Configuring Root Users by Using the Command-Line Utilities
    • 19.2.1.1 To Change the Global Root User Privileges
    • 19.2.1.2 To Create a New Root User
    • 19.2.1.3 To Edit an Existing Root User
  • 19.2.2 Configuring Root Users by Using ODSM
    • 19.2.2.1 Configure the Global Root User Privileges
    • 19.2.2.2 Create a New Root User
    • 19.2.2.3 Edit an Existing Root User
• 19.3 Defining Groups
  • 19.3.1 Defining Static Groups
    • 19.3.1.1 To Create a Static Group With groupOfNames
    • 19.3.1.2 To Create a Static Group With groupOfUniqueNames
    • 19.3.1.3 To Create a Static Group With groupOfEntries
    • 19.3.1.4 To List All Members of a Static Group
    • 19.3.1.5 To List All Static Groups of Which a User Is a Member
    • 19.3.1.6 To Determine Whether a User is a Member of a Group
  • 19.3.2 Defining Dynamic Groups
    • 19.3.2.1 To Create a Dynamic Group
    • 19.3.2.2 To List All Members of a Dynamic Group
    • 19.3.2.3 To List All Dynamic Groups of Which a User Is a Member
    • 19.3.2.4 To Determine Whether a User Is a Member of a Dynamic Group
  • 19.3.3 Defining Virtual Static Groups
    • 19.3.3.1 To Create a Virtual Static Group
    • 19.3.3.2 To List All Members of a Virtual Static Group
    • 19.3.3.3 To List All Virtual Static Groups of Which a User Is a Member
    • 19.3.3.4 To Determine Whether a User is a Member of a Virtual Static Group
  • 19.3.4 Defining Nested Groups
    • 19.3.4.1 To Create a Nested Group
• 19.4 Maintaining Referential Integrity
  • 19.4.1 Overview of the Referential Integrity Plug-In
  • 19.4.2 To Enable the Referential Integrity Plug-In
• 19.5 Simulating ODSEE Roles in an Oracle Unified Directory Server
  • 19.5.1 To Determine Whether a User is a Member of a Role
  • 19.5.2 To Alter Membership by Using the nsRoleDN Attribute

Part IV Advanced Administration: Security, Access Control, and Password Policies

20 Configuring Security Between Clients and Servers

• 20.1 Getting SSL Up and Running Quickly
  • 20.1.1 To Accept SSL-Based Connections Using a Self-Signed Certificate
• 20.2 Configuring Key Manager Providers
  • 20.2.1 Key Manager Provider Overview
  • 20.2.2 Using the JKS Key Manager Provider
    • 20.2.2.1 To Generate the Private Key
    • 20.2.2.2 To Self-Sign the Certificate
    • 20.2.2.3 To Sign the Certificate by Using an External Certificate Authority
    • 20.2.2.4 To Configure the JKS Key Manager Provider
  • 20.2.3 Using the PKCS #12 Key Manager Provider
  • 20.2.4 Using the PKCS #11 Key Manager Provider
  • 20.2.5 Replacing a Certificate in a Production Server
  • 20.2.6 Configuring Key Managers With ODSM
• 20.3 Configuring Trust Manager Providers
  • 20.3.1 Overview of Certificate Trust Mechanisms
  • 20.3.2 Using the Blind Trust Manager Provider
  • 20.3.3 Using the JKS Trust Manager Provider
  • 20.3.4 Using the PKCS #12 Trust Manager Provider
  • 20.3.5 Configuring Trust Managers With ODSM
• 20.4 Configuring Certificate Mappers
  • 20.4.1 Using the Subject Equals DN Certificate Mapper
  • 20.4.2 Using the Subject Attribute to User Attribute Certificate Mapper
  • 20.4.3 Using the Subject DN to User Attribute Certificate Mapper
  • 20.4.4 Using the Fingerprint Certificate Mapper
• 20.5 Configuring SSL and StartTLS for LDAP and JMX
  • 20.5.1 Configuring the LDAP and LDAPS Connection Handlers
    • 20.5.1.1 To Enable a Connection Handler
    • 20.5.1.2 To Specify a Connection Handler's Listening Port
    • 20.5.1.3 To Specify a Connection Handler's Authorization Policy
    • 20.5.1.4 To Specify a Nickname for a Connection Handler's Certificate
    • 20.5.1.5 To Specify a Connection Handler's Key Manager Provider
    • 20.5.1.6 To Specify a Connection Handler's Trust Manager Provider
    • 20.5.1.7 To Enable StartTLS Support
    • 20.5.1.8 To Enable SSL-Based Communication
  • 20.5.2 Enabling SSL in the JMX Connection Handler
• 20.6 Using SASL Authentication
  • 20.6.1 Supported SASL Mechanisms
  • 20.6.2 Authorization IDs
  • 20.6.3 SASL Options for the ANONYMOUS Mechanism
  • 20.6.4 SASL Options for the CRAM-MD5 Mechanism
  • 20.6.5 SASL Options for the DIGEST-MD5 Mechanism
  • 20.6.6 SASL Options for the EXTERNAL Mechanism
  • 20.6.7 SASL Options for the GSSAPI Mechanism
  • 20.6.8 SASL Options for the PLAIN Mechanism
• 20.7 Configuring SASL Authentication
  • 20.7.1 Configuring SASL External Authentication
    • 20.7.1.1 Configuring the LDAP Connection Handler to Allow SASL EXTERNAL Authentication
    • 20.7.1.2 Configuring the EXTERNAL SASL Mechanism Handler
  • 20.7.2 Configuring SASL DIGEST-MD5 Authentication
  • 20.7.3 Configuring SASL GSSAPI Authentication
• 20.8 Configuring Kerberos and the Oracle Unified Directory Server for GSSAPI SASL Authentication
  • 20.8.1 To Configure Kerberos V5 on a Host
  • 20.8.2 To Specify SASL Options for Kerberos Authentication
  • 20.8.3 Example Configuration of Kerberos Authentication Using GSSAPI With SASL
    • 20.8.3.1 Assumptions for This Example
    • 20.8.3.2 All Machines: Edit the Kerberos Client Configuration File
    • 20.8.3.3 All Machines: Edit the Administration Server ACL Configuration File
    • 20.8.3.4 KDC Machine: Edit the KDC Server Configuration File
    • 20.8.3.5 KDC Machine: Create the KDC Database
    • 20.8.3.6 KDC Machine: Create an Administration Principal and Keytab
    • 20.8.3.7 KDC Machine: Start the Kerberos Daemons
    • 20.8.3.8 KDC Machine: Add Host Principals for the KDC and Oracle Unified Directory Machines
    • 20.8.3.9 KDC Machine: Add an LDAP Principal for the Directory Server
    • 20.8.3.10 KDC Machine: Add a Test User to the KDC
    • 20.8.3.11 Directory Server Machine: Install Oracle Unified Directory
    • 20.8.3.12 Directory Server Machine: Create and Configure the Directory Server LDAP
    • 20.8.3.13 Directory Server Machine: Configure the Directory Server to Enable GSSAPI
    • 20.8.3.14 Directory Server Machine: Add a Test User to the Directory Server
    • 20.8.3.15 Directory Server Machine: Obtain a Kerberos Ticket as the Test User
    • 20.8.3.16 Client Machine: Authenticate to the Directory Server Through GSSAPI
  • 20.8.4 Creating a Kerberos Workflow Element Using dsconfig
  • 20.8.5 Troubleshooting Kerberos Configuration
• 20.9 Testing SSL, StartTLS, and SASL Authentication With ldapsearch
  • 20.9.1 ldapsearch Command Line Arguments Applicable To Security
  • 20.9.2 Testing SSL
  • 20.9.3 Testing StartTLS
  • 20.9.4 Testing SASL External Authentication
• 20.10 Debugging SSL Using OpenSSL s_client Test Utility
  • 20.10.1 Scenario 1- Connection Refused
  • 20.10.2 Scenario 2- Verify Return Code: 18 (Self Signed Certificate)
  • 20.10.3 Scenario 3 - Verify Return Code: 0 (ok)
  • 20.10.4 Scenario 4 - SSLHandshakeException
  • 20.10.5 Scenario 5 - SASL EXTERNAL Bind Request Could Not Be Processed
• 20.11 Debugging SSL or TLS Using Java Debug Information
  • 20.11.1 Enabling SSL Debug Recording
  • 20.11.2 Disabling SSL Debug Recording
• 20.12 Controlling Connection Access Using Allowed and Denied Rules
  • 20.12.1 Property Syntax of Allowed and Denied Client Rules
  • 20.12.2 Configuring Allowed and Denied Client Rules
• 20.13 Configuring Unlimited Strength Cryptography

21 Configuring Security Between the Proxy and the Data Source

• 21.1 How the Proxy Manages Secure Connections
• 21.2 Modes of Secure Connection
  • 21.2.1 The always Secure Mode
  • 21.2.2 The never Secure Mode
  • 21.2.3 The user Secure Mode
• 21.3 Configuring Security Between the Proxy and Data Source Using dsconfig
  • 21.3.1 To Configure Security Between the Proxy and Directory Servers Using dsconfig
  • 21.3.2 Configurable LDAP Extension Properties Relevant to Security

22 Controlling Access To Data

• 22.1 Managing Global ACIs With dsconfig
  • 22.1.1 Default Global ACIs
  • 22.1.2 To Display the Global ACIs
  • 22.1.3 To Delete a Global ACI
  • 22.1.4 To Add a Global ACI
• 22.2 Managing ACIs With ldapmodify
  • 22.2.1 To View ACI Attribute Values
  • 22.2.2 To Add an ACI
  • 22.2.3 To Remove an ACI
• 22.3 Managing Access Control With Oracle Directory Services Manager
  • 22.3.1 Display the Configured ACIs
  • 22.3.2 Create an Access Control Point
  • 22.3.3 Create an Access Control Point Based on an Existing Access Control Point
  • 22.3.4 Delete an Access Control Point
  • 22.3.5 Add an ACI
  • 22.3.6 Add an ACI Based on an Existing ACI
  • 22.3.7 Modify an ACI
• 22.4 Managing Macro ACIs With Oracle Directory Services Manager
  • 22.4.1 Editing a Target
  • 22.4.2 Editing a Target Filter
  • 22.4.3 Editing Bind Rules for User DN or Group DN
  • 22.4.4 Editing Bind Rules for User Attributes
• 22.5 Access Control Usage Examples
  • 22.5.1 Disabling Anonymous Access
  • 22.5.2 Granting Write Access to Personal Entries
    • 22.5.2.1 Granting Write Access Based on DNS
    • 22.5.2.2 Granting Write Access Based on Authentication Method
  • 22.5.3 Granting a Group Full Access to a Suffix
  • 22.5.4 Granting Rights to Add and Delete Group Entries
    • 22.5.4.1 Creating a "Create Group" ACI
    • 22.5.4.2 Creating a "Delete Group" ACI
  • 22.5.5 Allowing Users to Add or Remove Themselves From a Group
  • 22.5.6 Granting Conditional Access to a Group
  • 22.5.7 Denying Access
  • 22.5.8 Defining Permissions for DNs That Contain a Comma
• 22.6 Proxy Authorization ACIs
• 22.7 Viewing Effective Rights
  • 22.7.1 The Get Effective Rights Control
  • 22.7.2 Using the Get Effective Rights Control
  • 22.7.3 Understanding Effective Rights Results
    • 22.7.3.1 Rights Information
    • 22.7.3.2 write, selfwrite_add, and selfwrite_delete Permissions
    • 22.7.3.3 Logging Information
  • 22.7.4 Restricting Access to the Get Effective Rights Control

23 Managing Administrative Users

• 23.1 Working With Multiple Root Users
• 23.2 Root Users and the Privilege Subsystem
• 23.3 Managing Root Users With dsconfig
  • 23.3.1 To View the Default Root User Privileges
  • 23.3.2 To Edit the Default Root User Privileges
  • 23.3.3 To Create a Root User
  • 23.3.4 To Change a Root User's Password
  • 23.3.5 To Change a Root User's Privileges
• 23.4 Setting Root User Resource Limits
• 23.5 Managing Administrators
  • 23.5.1 To Create a New Administrator
  • 23.5.2 To Create an Administrator with Root User Privileges
• 23.6 Managing Global Administrators

24 Managing Password Policies

• 24.1 Password Policy Components
• 24.2 The Default Password Policy
  • 24.2.1 To View the Properties of the Default Password Policy
  • 24.2.2 To Modify the Default Password Policy
• 24.3 Password Policies in a Replicated Environment
• 24.4 Configuring Password Policies by Using the Command Line
  • 24.4.1 Configuring the Default Password Policy
  • 24.4.2 To Create a New Password Policy
  • 24.4.3 To Create a First Login Password Policy
  • 24.4.4 To Assign a Password Policy to an Individual Account
  • 24.4.5 To Prevent Password Policy Modifications
  • 24.4.6 To Assign a Password Policy to a Group of Users
  • 24.4.7 To Define a Password Policy as an LDAP Subentry
  • 24.4.8 To Delete a Password Policy
• 24.5 Configuring Password Policies by Using Oracle Directory Services Manager
  • 24.5.1 List the Configured Password Policy Subentries
  • 24.5.2 Create a Password Policy Subentry
  • 24.5.3 Create a Password Policy Subentry Based on an Existing Password Policy Subentry
  • 24.5.4 Delete a Password Policy Subentry
  • 24.5.5 Display the Configured Password Policies
  • 24.5.6 Modify a Password Policy
  • 24.5.7 Create a Password Policy
  • 24.5.8 Create a Password Policy Based on an Existing Password Policy
  • 24.5.9 Delete a Password Policy
  • 24.5.10 Display the Supported Password Storage Schemes
  • 24.5.11 Enable or Disable a Password Storage Scheme
• 24.6 Password Validators
  • 24.6.1 Managing Password Validators
    • 24.6.1.1 To Display the Available Password Validators
    • 24.6.1.2 To Display the Properties of a Password Validator
    • 24.6.1.3 To Enable or Disable a Password Validator
    • 24.6.1.4 To Configure the Values of a Password Validator
    • 24.6.1.5 To Associate a Password Validator With a Password Policy
• 24.7 Password Generators
  • 24.7.1 To Display the Configured Password Generators
  • 24.7.2 To Display the Properties of a Password Generator
  • 24.7.3 To Enable or Disable a Password Generator
  • 24.7.4 To Configure the Values of a Password Generator
  • 24.7.5 To Associate a Password Generator With a Password Policy

25 Integrating With Oracle's Enterprise User Security

• 25.1 Integration Scenarios
• 25.2 What's New in this Release
• 25.3 Integrating Oracle Unified Directory with Enterprise User Security
  • 25.3.1 Configuring Enterprise User Security for an Oracle Unified Directory Server
    • 25.3.1.1 Enabling Enterprise User Security During Installation
    • 25.3.1.2 Enabling Enterprise User Security With ODSM for an Existing Instance
  • 25.3.2 Modifying the Oracle Unified Directory Configuration for Enterprise User Security
  • 25.3.3 Configuring Oracle Database for Oracle Unified Directory
    • 25.3.3.1 Configuring the Database
    • 25.3.3.2 Registering Your Database
• 25.4 Integrating with Enterprise User Security and an External LDAP Directory
  • 25.4.1 Configuring External Directories for the Integration
    • 25.4.1.1 User Identities in Microsoft Active Directory
    • 25.4.1.2 User Identities in Oracle Directory Server Enterprise Edition
    • 25.4.1.3 User Identities in Novell eDirectory
    • 25.4.1.4 User Identities in Oracle Unified Directory
  • 25.4.2 Configuring Oracle Unified Directory for the Integration
    • 25.4.2.1 Configuring Enterprise User Security for an Oracle Unified Directory Proxy Server
    • 25.4.2.2 Performing Post Configuration Steps
    • 25.4.2.3 Modifying the Oracle Unified Directory Proxy Server Configuration for Enterprise User Security
    • 25.4.2.4 Configuring Oracle Database for Oracle Unified Directory Proxy Server

Part V Advanced Administration: Data Replication, Schema Management, and Moving Across Environments

26 Replicating Directory Data

• 26.1 Configuring Data Replication With dsreplication
  • 26.1.1 To Enable Replication Between Two Servers
    • 26.1.1.1 Controlling Where Replication Servers are Created
  • 26.1.2 To Initialize a Replicated Server
  • 26.1.3 To Initialize an Entire Topology
  • 26.1.4 To Test Replication
  • 26.1.5 To Obtain the Status of a Replicated Topology
  • 26.1.6 To Merge Two Existing Replicated Topologies
  • 26.1.7 To Disable Replication For a Specific Replication Domain
    • 26.1.7.1 Notes About Disabling the Replication Server
• 26.2 Configuring Large Replication Topologies
  • 26.2.1 To Configure a Dedicated Replication Server
• 26.3 Modifying the Replication Configuration With dsconfig
  • 26.3.1 Retrieving the Replication Domain Name
  • 26.3.2 Changing the Replication Purge Delay
    • 26.3.2.1 How Replication Changes Are Purged
    • 26.3.2.2 To Change the Replication Purge Delay
  • 26.3.3 Changing the Window Size
    • 26.3.3.1 To Change the Window Size
  • 26.3.4 Changing the Initialization Window Size
    • 26.3.4.1 To Change the Initialization Window Size
  • 26.3.5 Changing the Heartbeat Interval
    • 26.3.5.1 To Change the Heartbeat Interval
  • 26.3.6 Changing the Isolation Policy
    • 26.3.6.1 To Change the Isolation Policy
  • 26.3.7 Configuring Encrypted Replication
  • 26.3.8 Configuring Replication Groups
    • 26.3.8.1 To Configure a Replication Group
  • 26.3.9 Configuring Assured Replication
    • 26.3.9.1 To Configure Assured Replication in Safe Data Mode
    • 26.3.9.2 To Configure Assured Replication in Safe Read Mode
  • 26.3.10 Configuring Fractional Replication
    • 26.3.10.1 To Configure Exclusive Fractional Replication
    • 26.3.10.2 To Configure Inclusive Fractional Replication
    • 26.3.10.3 To Configure and Initialize a Fractional Domain
  • 26.3.11 Configuring Replication Status
    • 26.3.11.1 To Configure the Degraded Status Threshold
  • 26.3.12 Configuring the Replication Server Weight
• 26.4 Initializing a Replicated Server With Data
  • 26.4.1 Initializing a Single Replicated Server
  • 26.4.2 Initializing a New Replicated Topology
  • 26.4.3 Adding a Directory Server to an Existing Replicated Topology
  • 26.4.4 Changing the Data Set in an Existing Replicated Topology
    • 26.4.4.1 To Change the Data Set With import-ldif or Binary Copy
  • 26.4.5 Appending Data in an Existing Replicated Topology
• 26.5 Using the External Change Log
  • 26.5.1 Enabling the External Change Log
  • 26.5.2 External Change Log APIs
  • 26.5.3 How a Client Application Uses the External Change Log in Cookie Mode
  • 26.5.4 Format of External Change Log Entries
  • 26.5.5 Specifying the Attributes to be Included in the External Change Log
  • 26.5.6 Specifying the Attributes to be Excluded in the External Change Log
  • 26.5.7 Initializing Client Applications to Use the External Change Log
    • 26.5.7.1 To Initialize a Client Application to Use the External Change Log
    • 26.5.7.2 Reinitializing a Client Application When a Domain is Added
    • 26.5.7.3 Reinitializing a Client Application When a Domain is Removed or Disabled
  • 26.5.8 Controlling Access to the External Change Log
  • 26.5.9 Purging the External Change Log
  • 26.5.10 Disabling the External Change Log on a Server
  • 26.5.11 Disabling the External Change Log for a Specific Domain
  • 26.5.12 Porting Applications That Rely on Other Change Logs
    • 26.5.12.1 Differences Between the ECL and the LDAP Change Log Draft
    • 26.5.12.2 Additional Differences Between the ECL and the Oracle Directory Server Enterprise Edition Retro Change Log
    • 26.5.12.3 API for Compatibility With the LDAP Change Log Draft and the Oracle Directory Server Enterprise Edition Retro Change Log
• 26.6 Configuring Schema Replication
  • 26.6.1 Specifying the Schema Source
  • 26.6.2 Disabling Schema Replication
    • 26.6.2.1 To Specify That Schema Should Not Be Replicated
    • 26.6.2.2 To Disable Schema Replication
• 26.7 Replicating to a Read-Only Server
  • 26.7.1 Configuring a Replica as Read-Only
• 26.8 Detecting and Resolving Replication Inconsistencies
  • 26.8.1 Types of Replication Inconsistencies
  • 26.8.2 Detecting Inconsistencies
  • 26.8.3 Resolving Inconsistencies
  • 26.8.4 Solving Naming Conflicts
• 26.9 Purging Historical Replication Data
• 26.10 Using Isolated Replicas
  • 26.10.1 Deployment Scenarios for Isolated Replicas
    • 26.10.1.1 Using Isolated Replicas in a DMZ
    • 26.10.1.2 Using Isolated Replicas for Testing
• 26.11 Replicating Between Oracle Directory Server Enterprise Edition and Oracle Unified Directory
  • 26.11.1 To Migrate the Oracle Directory Server Enterprise Edition Schema and Configuration
  • 26.11.2 To Configure Replication Between Oracle Directory Server Enterprise Edition and Oracle Unified Directory
  • 26.11.3 To Initialize the Oracle Unified Directory with Oracle Directory Server Enterprise Edition Data

27 Managing Directory Schema

• 27.1 Oracle Unified Directory Schema Overview
  • 27.1.1 Designing and Extending the Schema
  • 27.1.2 Default Schema Files
• 27.2 Configuring Schema Checking
• 27.3 Working With Object Identifiers (OIDs)
  • 27.3.1 Obtaining a Base OID
• 27.4 Extending the Schema
  • 27.4.1 Managing Attribute Types
    • 27.4.1.1 To View Attribute Types
    • 27.4.1.2 To Create an Attribute Type
    • 27.4.1.3 To Delete an Attribute Type
  • 27.4.2 Managing Object Classes
    • 27.4.2.1 To View Object Classes
    • 27.4.2.2 To Create an Object Class
    • 27.4.2.3 To Delete an Object Class
• 27.5 Replicating the Schema
• 27.6 Managing the Schema With Oracle Directory Services Manager
  • 27.6.1 Add a New Attribute Type
  • 27.6.2 Add an Attribute Based on an Existing Attribute
  • 27.6.3 Modify an Attribute
  • 27.6.4 Delete an Attribute
  • 27.6.5 View All Directory Attributes
  • 27.6.6 Search for Attributes
  • 27.6.7 View the Indexing Details of an Attribute
  • 27.6.8 Add a New Object Class
  • 27.6.9 Add an Object Class Based on an Existing Object Class
  • 27.6.10 View the Properties of an Object Class
  • 27.6.11 Modify an Object Class
  • 27.6.12 Delete an Object Class
  • 27.6.13 Search for Object Classes
  • 27.6.14 Display a List of LDAP Syntaxes
  • 27.6.15 Search for a Syntax
  • 27.6.16 Display a List of LDAP Matching Rules
  • 27.6.17 Search for a Matching Rule
  • 27.6.18 Display a List of Content Rules
  • 27.6.19 Search for a Content Rule
  • 27.6.20 Create a New Content Rule
  • 27.6.21 Create a Content Rule Based on an Existing Content Rule
  • 27.6.22 Modify a Content Rule
  • 27.6.23 Delete a Content Rule

28 Moving From a Test to a Production Environment

• 28.1 Introduction to Moving Across Environments
• 28.2 Limitations in Moving From Test to Production
• 28.3 Overview of the Test to Production Process
  • 28.3.1 Moving the Binaries
  • 28.3.2 Moving the Configuration
    • 28.3.2.1 Copying the Configuration
    • 28.3.2.2 Editing the Configuration
    • 28.3.2.3 Pasting the Configuration
  • 28.3.3 Moving the Data

Part VI Advanced Administration: Monitoring and Tuning Performance

29 Monitoring Oracle Unified Directory

• 29.1 Monitoring Overview
• 29.2 Configuring Monitor Providers
  • 29.2.1 To View Monitor Providers
  • 29.2.2 To Disable a Monitor Provider
• 29.3 Configuring Logs
  • 29.3.1 Configuring Logs by Using dsconfig
    • 29.3.1.1 Configuring Log Publishers
    • 29.3.1.2 Configuring Log Retention Policies
    • 29.3.1.3 Configuring Log Rotation Policies
  • 29.3.2 Configuring Logs by Using ODSM
    • 29.3.2.1 Modify Logger Properties
    • 29.3.2.2 Modify Log Rotation Policies
    • 29.3.2.3 Modify Log Retention Policies
  • 29.3.3 Logging Operations to Access Log Publishers
    • 29.3.3.1 Overview of the Admin Logger
    • 29.3.3.2 Configuring Logged Operations in Access Log Publishers Using ODSM
• 29.4 Configuring Alerts and Account Status Notification Handlers
  • 29.4.1 Managing Alert Handlers
    • 29.4.1.1 Managing Alert Handlers by Using dsconfig
    • 29.4.1.2 Managing Alert Handlers by Using ODSM
    • 29.4.1.3 Supported Alert Types
  • 29.4.2 Managing Account Status Notification Handlers
    • 29.4.2.1 To View the Configured Account Status Notification Handlers
    • 29.4.2.2 To Enable Account Status Notification Handlers
    • 29.4.2.3 To Create a New Account Status Notification Handler
    • 29.4.2.4 To Delete an Account Status Notification Handler
• 29.5 Monitoring the Server With LDAP
  • 29.5.1 Viewing Monitoring Information Using the cn=monitor Entry
    • 29.5.1.1 Monitored Attributes in the Proxy
    • 29.5.1.2 To View the Available Monitoring Information
    • 29.5.1.3 To Monitor General-Purpose Server Information
    • 29.5.1.4 To Monitor System Information
    • 29.5.1.5 To Monitor Version Information
    • 29.5.1.6 To Monitor the User Root Back End
    • 29.5.1.7 To Monitor the Backup Back End
    • 29.5.1.8 To Monitor the Tasks Back End
    • 29.5.1.9 To Monitor the monitor Back End
    • 29.5.1.10 To Monitor the Schema Back End
    • 29.5.1.11 To Monitor the adminRoot Back End
    • 29.5.1.12 To Monitor the ads-truststore Back End
    • 29.5.1.13 To Monitor Client Connections
    • 29.5.1.14 To Monitor the LDAP Connection Handler
    • 29.5.1.15 To Monitor LDAP Connection Handler Statistics
    • 29.5.1.16 To Monitor Connections on the LDAP Connection Handler
    • 29.5.1.17 To Monitor the Administration Connector
    • 29.5.1.18 To Monitor Administration Connector Statistics
    • 29.5.1.19 To Monitor Connections on the Administration Connector
    • 29.5.1.20 To Monitor the LDIF Connection Handler
    • 29.5.1.21 To Monitor the Work Queue
    • 29.5.1.22 To Monitor JVM Stack Trace Information
    • 29.5.1.23 To Monitor the JVM Memory Usage
    • 29.5.1.24 To Monitor the userRoot Database Environment
    • 29.5.1.25 To Monitor the Database Cache
    • 29.5.1.26 To Monitor the Entry Cache
    • 29.5.1.27 To Monitor Network Groups
    • 29.5.1.28 To Monitor Distribution
    • 29.5.1.29 To Monitor Load Balancing
    • 29.5.1.30 To Monitor Remote LDAP Servers
    • 29.5.1.31 To Monitor a Global Index
    • 29.5.1.32 To Monitor a Global Index Catalog
  • 29.5.2 Monitoring Using the manage-tasks Command
  • 29.5.3 Monitoring the Server With JConsole
    • 29.5.3.1 To Configure JMX on a Server Instance
    • 29.5.3.2 Starting JConsole
    • 29.5.3.3 Accessing a Server Instance From JConsole
    • 29.5.3.4 Viewing Monitoring Information With JConsole
  • 29.5.4 Accessing Logs
    • 29.5.4.1 To View the Access Logs
    • 29.5.4.2 To View the Audit Logs
    • 29.5.4.3 To View the Debug Logs
    • 29.5.4.4 To View the Error Logs
    • 29.5.4.5 To View the Replication Repair Logs
    • 29.5.4.6 To View the server.out Logs
    • 29.5.4.7 To View the Setup Logs
• 29.6 Monitoring the Server With SNMP
  • 29.6.1 Configuring the SNMP Connection Handler and Its Dependencies
    • 29.6.1.1 To Configure SNMP in the Server
    • 29.6.1.2 To View the SNMP Connection Handler Properties
    • 29.6.1.3 To Access SNMP on a Server Instance
    • 29.6.1.4 SNMP Security Configuration
• 29.7 Monitoring a Replicated Topology
  • 29.7.1 Monitoring Replication Status With dsreplication
  • 29.7.2 Advanced Replication Monitoring
    • 29.7.2.1 To Monitor the Topology and Its Connections
    • 29.7.2.2 To Monitor Replication Latency
    • 29.7.2.3 To Monitor Data Consistency
    • 29.7.2.4 To Monitor Replication Security
    • 29.7.2.5 To Monitor Replicated Updates
    • 29.7.2.6 To Monitor Replication Conflicts
• 29.8 General Purpose Enterprise Monitoring Solutions
  • 29.8.1 General UNIX Monitoring Tools
  • 29.8.2 Solaris Monitoring Tools
  • 29.8.3 HP-UX Monitoring Tools

30 Tuning Performance

• 30.1 Assessing Performance Problems
• 30.2 General Performance Tuning
• 30.3 Tuning Java Virtual Machine Settings
• 30.4 Determining the Database Cache Size
• 30.5 Tuning the Server Configuration
  • 30.5.1 Back End Tuning Parameters
  • 30.5.2 Core Server Tuning Parameters
  • 30.5.3 Additional Tuning Recommendations

A Oracle Unified Directory Command Line Interface

• A.1 General Command-Line Usage Information
  • A.1.1 Summary of Server Commands and Their Use
  • A.1.2 Using a Properties File With Server Commands
    • A.1.2.1 Locating the Properties File
    • A.1.2.2 Order of Precedence of Options and Properties
• A.2 Server Administration Commands
  • A.2.1 create-rc-script
    • A.2.1.1 Synopsis
    • A.2.1.2 Description
    • A.2.1.3 Options
    • A.2.1.4 General Options
    • A.2.1.5 Examples
    • A.2.1.6 Code Generated by the create-rc-script Command
    • A.2.1.7 Exit Codes
    • A.2.1.8 Location
    • A.2.1.9 Related Commands
  • A.2.2 dps2oud
    • A.2.2.1 Synopsis
    • A.2.2.2 Description
    • A.2.2.3 Options
    • A.2.2.4 LDAP Connection Options
    • A.2.2.5 General Options
    • A.2.2.6 Examples
    • A.2.2.7 Exit Codes
    • A.2.2.8 Location
    • A.2.2.9 Related Commands
  • A.2.3 ds2oud
    • A.2.3.1 Synopsis
    • A.2.3.2 Description
    • A.2.3.3 Options
    • A.2.3.4 Oracle Directory Server Enterprise Edition LDAP Connection Options
    • A.2.3.5 Oracle Unified Directory LDAP Connection Options
    • A.2.3.6 Command Input/Output Options
    • A.2.3.7 General Options
    • A.2.3.8 Examples
    • A.2.3.9 Exit Codes
    • A.2.3.10 Location
    • A.2.3.11 Related Commands
  • A.2.4 dsconfig
    • A.2.4.1 Synopsis
    • A.2.4.2 Description
    • A.2.4.3 Help Subcommands
    • A.2.4.4 General Subcommands
    • A.2.4.5 Distribution Subcommands
    • A.2.4.6 General Configuration Subcommands
    • A.2.4.7 Load Balancing Subcommands
    • A.2.4.8 Local Storage Subcommands
    • A.2.4.9 Miscellaneous Workflow Elements Subcommands
    • A.2.4.10 Remote Storage Subcommands
    • A.2.4.11 Replication Subcommands
    • A.2.4.12 Schema Subcommands
    • A.2.4.13 Security Subcommands
    • A.2.4.14 Virtualization Subcommands
    • A.2.4.15 Options
    • A.2.4.16 LDAP Connection Options
    • A.2.4.17 Command Input/Output Options
    • A.2.4.18 General Options
    • A.2.4.19 Examples
    • A.2.4.20 Exit Codes
    • A.2.4.21 Using a Properties File
    • A.2.4.22 Location
    • A.2.4.23 Related Commands
  • A.2.5 dsjavaproperties
    • A.2.5.1 Synopsis
    • A.2.5.2 Description
    • A.2.5.3 Options
    • A.2.5.4 Example
    • A.2.5.5 Exit Codes
    • A.2.5.6 Location
  • A.2.6 dsreplication
    • A.2.6.1 Synopsis
    • A.2.6.2 Description
    • A.2.6.3 Server Subcommands
    • A.2.6.4 Options
    • A.2.6.5 Configuration Options
    • A.2.6.6 LDAP Connection Options
    • A.2.6.7 Command Input/Output Options
    • A.2.6.8 General Options
    • A.2.6.9 Examples
    • A.2.6.10 Exit Codes
    • A.2.6.11 Using a Properties File
    • A.2.6.12 Location
    • A.2.6.13 Related Commands
  • A.2.7 gicadm
    • A.2.7.1 Synopsis
    • A.2.7.2 Description
    • A.2.7.3 Options
    • A.2.7.4 LDAP Connection Options
    • A.2.7.5 Command Input/Output Options
    • A.2.7.6 General Options
    • A.2.7.7 Examples
    • A.2.7.8 Exit Codes
    • A.2.7.9 Location
    • A.2.7.10 Related Commands
  • A.2.8 manage-tasks
    • A.2.8.1 Synopsis
    • A.2.8.2 Description
    • A.2.8.3 Options
    • A.2.8.4 LDAP Connection Options
    • A.2.8.5 Command Input/Output Options
    • A.2.8.6 General Options
    • A.2.8.7 Examples
    • A.2.8.8 Exit Codes
    • A.2.8.9 Using a Properties File
    • A.2.8.10 Location
    • A.2.8.11 Related Commands
  • A.2.9 oudCopyConfig
    • A.2.9.1 Synopsis
    • A.2.9.2 Description
    • A.2.9.3 Options
    • A.2.9.4 Examples
    • A.2.9.5 Location
    • A.2.9.6 Related Commands
  • A.2.10 oudExtractMovePlan
    • A.2.10.1 Synopsis
    • A.2.10.2 Description
    • A.2.10.3 Options
    • A.2.10.4 Examples
    • A.2.10.5 Location
    • A.2.10.6 Related Commands
  • A.2.11 oudPasteConfig
    • A.2.11.1 Synopsis
    • A.2.11.2 Description
    • A.2.11.3 Options
    • A.2.11.4 Examples
    • A.2.11.5 Location
    • A.2.11.6 Related Commands
  • A.2.12 oud-replication-gateway-setup
    • A.2.12.1 Synopsis
    • A.2.12.2 Description
    • A.2.12.3 Options
    • A.2.12.4 Replication Gateway Configuration Options
    • A.2.12.5 Oracle Directory Server Enterprise Edition Server Options
    • A.2.12.6 Replication Gateway Security Options
    • A.2.12.7 Oracle Unified Directory Server Options
    • A.2.12.8 Secure Connection Options
    • A.2.12.9 Command Input/Output Options
    • A.2.12.10 General Options
    • A.2.12.11 Examples
    • A.2.12.12 Exit Codes
    • A.2.12.13 Using a Properties File
    • A.2.12.14 Log Files
    • A.2.12.15 Location
    • A.2.12.16 Related Commands
  • A.2.13 oud-setup
    • A.2.13.1 Synopsis
    • A.2.13.2 Description
    • A.2.13.3 Options
    • A.2.13.4 Command Input/Output Options
    • A.2.13.5 General Options
    • A.2.13.6 Examples
    • A.2.13.7 Exit Codes
    • A.2.13.8 Using a Properties File
    • A.2.13.9 Log Files
    • A.2.13.10 Location
    • A.2.13.11 Related Commands
  • A.2.14 oud-proxy-setup
    • A.2.14.1 Synopsis
    • A.2.14.2 Description
    • A.2.14.3 Options
    • A.2.14.4 Command Input/Output Options
    • A.2.14.5 General Options
    • A.2.14.6 Examples
    • A.2.14.7 Exit Codes
    • A.2.14.8 Log Files
    • A.2.14.9 Location
    • A.2.14.10 Related Commands
  • A.2.15 start-ds
    • A.2.15.1 Synopsis
    • A.2.15.2 Description
    • A.2.15.3 Options
    • A.2.15.4 Command Input/Output Options
    • A.2.15.5 General Options
    • A.2.15.6 Examples
    • A.2.15.7 Exit Codes
    • A.2.15.8 Location
    • A.2.15.9 Related Commands
  • A.2.16 status
    • A.2.16.1 Synopsis
    • A.2.16.2 Description
    • A.2.16.3 LDAP Connection Options
    • A.2.16.4 Command Input/Output Options
    • A.2.16.5 General Options
    • A.2.16.6 Examples
    • A.2.16.7 Exit Codes
    • A.2.16.8 Using a Properties File
    • A.2.16.9 Location
  • A.2.17 stop-ds
    • A.2.17.1 Synopsis
    • A.2.17.2 Description
    • A.2.17.3 Options
    • A.2.17.4 LDAP Connection Options
    • A.2.17.5 Command Input/Output Options
    • A.2.17.6 General Options
    • A.2.17.7 Examples
    • A.2.17.8 Exit Codes
    • A.2.17.9 Using a Properties File
    • A.2.17.10 Location
    • A.2.17.11 Related Commands
  • A.2.18 uninstall
    • A.2.18.1 Synopsis
    • A.2.18.2 Description
    • A.2.18.3 Removing a Directory Server
    • A.2.18.4 Removing a Proxy Server
    • A.2.18.5 Removing a Replication Gateway Server
    • A.2.18.6 Command Input/Output Options
    • A.2.18.7 General Options
    • A.2.18.8 Examples
    • A.2.18.9 Exit Codes
    • A.2.18.10 Using a Properties File
    • A.2.18.11 Log Files
    • A.2.18.12 Location
    • A.2.18.13 Related Commands
  • A.2.19 windows-service
    • A.2.19.1 Synopsis
    • A.2.19.2 Description
    • A.2.19.3 Command Options
    • A.2.19.4 General Options
    • A.2.19.5 Examples
    • A.2.19.6 Exit Codes
    • A.2.19.7 Location
    • A.2.19.8 Related Commands
• A.3 Data Administration Commands
  • A.3.1 backup
    • A.3.1.1 Synopsis
    • A.3.1.2 Description
    • A.3.1.3 Options
    • A.3.1.4 Task Back End Connection Options
    • A.3.1.5 Task Scheduling Options
    • A.3.1.6 Command Input/Output Options
    • A.3.1.7 General Options
    • A.3.1.8 Examples
    • A.3.1.9 Exit Codes
    • A.3.1.10 Using a Properties File
    • A.3.1.11 Location
    • A.3.1.12 Related Commands
  • A.3.2 base64
    • A.3.2.1 Synopsis
    • A.3.2.2 Description
    • A.3.2.3 Subcommands
    • A.3.2.4 Global Options
    • A.3.2.5 Examples
    • A.3.2.6 Exit Codes
    • A.3.2.7 Location
  • A.3.3 dbtest
    • A.3.3.1 Synopsis
    • A.3.3.2 Description
    • A.3.3.3 Subcommands
    • A.3.3.4 Global Options
    • A.3.3.5 Examples
    • A.3.3.6 Exit Codes
    • A.3.3.7 Location
    • A.3.3.8 Related Commands
  • A.3.4 encode-password
    • A.3.4.1 Synopsis
    • A.3.4.2 Description
    • A.3.4.3 Options
    • A.3.4.4 Examples
    • A.3.4.5 Exit Codes
    • A.3.4.6 Location
  • A.3.5 export-ldif
    • A.3.5.1 Synopsis
    • A.3.5.2 Description
    • A.3.5.3 Options
    • A.3.5.4 Task Back End Connection Options
    • A.3.5.5 Task Scheduling Options
    • A.3.5.6 Command Input/Output Options
    • A.3.5.7 General Options
    • A.3.5.8 Examples
    • A.3.5.9 Exit Codes
    • A.3.5.10 Using a Properties File
    • A.3.5.11 Location
    • A.3.5.12 Related Commands
  • A.3.6 import-ldif
    • A.3.6.1 Synopsis
    • A.3.6.2 Description
    • A.3.6.3 Options
    • A.3.6.4 Task Back End Connection Options
    • A.3.6.5 Task Scheduling Options
    • A.3.6.6 Command Input/Output Options
    • A.3.6.7 General Options
    • A.3.6.8 Examples
    • A.3.6.9 Exit Codes
    • A.3.6.10 Using a Properties File
    • A.3.6.11 Location
    • A.3.6.12 Related Commands
  • A.3.7 ldif-diff
    • A.3.7.1 Synopsis
    • A.3.7.2 Description
    • A.3.7.3 Options
    • A.3.7.4 Examples
    • A.3.7.5 Exit Codes
    • A.3.7.6 Location
    • A.3.7.7 Related Commands
  • A.3.8 ldifmodify
    • A.3.8.1 Synopsis
    • A.3.8.2 Description
    • A.3.8.3 Options
    • A.3.8.4 Examples
    • A.3.8.5 Exit Codes
    • A.3.8.6 Location
    • A.3.8.7 Related Commands
  • A.3.9 ldifsearch
    • A.3.9.1 Synopsis
    • A.3.9.2 Description
    • A.3.9.3 Options
    • A.3.9.4 Examples
    • A.3.9.5 Exit Codes
    • A.3.9.6 Location
    • A.3.9.7 Related Commands
  • A.3.10 list-backends
    • A.3.10.1 Synopsis
    • A.3.10.2 Description
    • A.3.10.3 Options
    • A.3.10.4 Command Options
    • A.3.10.5 General Options
    • A.3.10.6 Examples
    • A.3.10.7 Exit Codes
    • A.3.10.8 Location
  • A.3.11 make-ldif
    • A.3.11.1 Synopsis
    • A.3.11.2 Description
    • A.3.11.3 Options
    • A.3.11.4 Examples
    • A.3.11.5 Exit Codes
    • A.3.11.6 Locations
    • A.3.11.7 Related Commands
  • A.3.12 manage-account
    • A.3.12.1 Synopsis
    • A.3.12.2 Description
    • A.3.12.3 Subcommands
    • A.3.12.4 Options
    • A.3.12.5 LDAP Connection Options
    • A.3.12.6 General Options
    • A.3.12.7 Examples
    • A.3.12.8 Exit Codes
    • A.3.12.9 Location
    • A.3.12.10 Related Commands
  • A.3.13 rebuild-index
    • A.3.13.1 Synopsis
    • A.3.13.2 Description
    • A.3.13.3 Options
    • A.3.13.4 Command Options
    • A.3.13.5 Task Back End Connection Options
    • A.3.13.6 Task Scheduling Options
    • A.3.13.7 Utility Input/Output Options
    • A.3.13.8 General Options
    • A.3.13.9 Examples
    • A.3.13.10 Exit Codes
    • A.3.13.11 Location
    • A.3.13.12 Related Commands
  • A.3.14 restore
    • A.3.14.1 Synopsis
    • A.3.14.2 Description
    • A.3.14.3 Options
    • A.3.14.4 Task Back End Connection Options
    • A.3.14.5 Task Scheduling Options
    • A.3.14.6 Command Input/Output Options
    • A.3.14.7 General Options
    • A.3.14.8 Examples
    • A.3.14.9 Exit Codes
    • A.3.14.10 Using a Properties File
    • A.3.14.11 Location
    • A.3.14.12 Related Commands
  • A.3.15 split-ldif
    • A.3.15.1 Synopsis
    • A.3.15.2 Description
    • A.3.15.3 Options
    • A.3.15.4 Global Index Options
    • A.3.15.5 Split Options
    • A.3.15.6 General Options
    • A.3.15.7 Examples
    • A.3.15.8 Location
    • A.3.15.9 Related Commands
  • A.3.16 verify-index
    • A.3.16.1 Synopsis
    • A.3.16.2 Description
    • A.3.16.3 Options
    • A.3.16.4 Command Options
    • A.3.16.5 General Options
    • A.3.16.6 Examples
    • A.3.16.7 Exit Codes
    • A.3.16.8 Location
    • A.3.16.9 Related Commands
• A.4 LDAP Client Commands
  • A.4.1 ldapcompare
    • A.4.1.1 Synopsis
    • A.4.1.2 Description
    • A.4.1.3 Options
    • A.4.1.4 Command Options
    • A.4.1.5 LDAP Connection Options
    • A.4.1.6 Command Input/Output Options
    • A.4.1.7 General Options
    • A.4.1.8 Examples
    • A.4.1.9 Exit Codes
    • A.4.1.10 Using a CLI Properties File
    • A.4.1.11 Location
    • A.4.1.12 Related Commands
  • A.4.2 ldapdelete
    • A.4.2.1 Synopsis
    • A.4.2.2 Description
    • A.4.2.3 Before You Begin
    • A.4.2.4 Options
    • A.4.2.5 Command Options
    • A.4.2.6 LDAP Connection Options
    • A.4.2.7 Command Input/Output Options
    • A.4.2.8 General Options
    • A.4.2.9 Examples
    • A.4.2.10 Exit Codes
    • A.4.2.11 Using a CLI Properties File
    • A.4.2.12 Location
    • A.4.2.13 Related Commands
  • A.4.3 ldapmodify
    • A.4.3.1 Synopsis
    • A.4.3.2 Description
    • A.4.3.3 Before You Begin
    • A.4.3.4 Options
    • A.4.3.5 Command Options
    • A.4.3.6 LDAP Connection Options
    • A.4.3.7 Command Input/Output Options
    • A.4.3.8 General Options
    • A.4.3.9 Examples
    • A.4.3.10 Exit Codes
    • A.4.3.11 Using a CLI Properties File
    • A.4.3.12 Location
    • A.4.3.13 Related Commands
  • A.4.4 ldappasswordmodify
    • A.4.4.1 Synopsis
    • A.4.4.2 Description
    • A.4.4.3 Options
    • A.4.4.4 Command Options
    • A.4.4.5 LDAP Connection Options
    • A.4.4.6 Command Input/Output Options
    • A.4.4.7 General Options
    • A.4.4.8 Examples
    • A.4.4.9 Exit Codes
    • A.4.4.10 Using a CLI Properties File
    • A.4.4.11 Location
    • A.4.4.12 Related Commands
  • A.4.5 ldapsearch
    • A.4.5.1 Synopsis
    • A.4.5.2 Description
    • A.4.5.3 Before You Begin
    • A.4.5.4 Options
    • A.4.5.5 Command Options
    • A.4.5.6 LDAP Connection Options
    • A.4.5.7 Command Input/Output Options
    • A.4.5.8 General Options
    • A.4.5.9 Examples
    • A.4.5.10 To Search by Using a Properties File
    • A.4.5.11 Search Attributes
    • A.4.5.12 Exit Codes
    • A.4.5.13 Location
    • A.4.5.14 Related Commands

B Supported Controls and Operations

• B.1 Supported LDAP Controls
• B.2 Supported Extended Operations

C Standards and Specifications Supported by Oracle Unified Directory

• C.1 RFCs Supported by Oracle Unified Directory
• C.2 Internet Drafts Supported by Oracle Unified Directory
• C.3 Other Specifications Supported by Oracle Unified Directory

D Glossary of terms for Oracle Unified Directory

• D.1 A
  • D.1.1 abandon operation
  • D.1.2 abstract object class
  • D.1.3 Abstract Syntax Notation One
  • D.1.4 access control
  • D.1.5 access control instruction (ACI)
  • D.1.6 access control rule
  • D.1.7 access log
  • D.1.8 account expiration
  • D.1.9 account lockout
  • D.1.10 account status notification
  • D.1.11 account usability control
  • D.1.12 ACID
  • D.1.13 add operation
  • D.1.14 alias
  • D.1.15 AND search filter
  • D.1.16 anonymous bind
  • D.1.17 ANONYMOUS SASL mechanism
  • D.1.18 approximate index
  • D.1.19 approximate search filter
  • D.1.20 ASN.1
  • D.1.21 assertion value
  • D.1.22 attribute
  • D.1.23 attribute description
  • D.1.24 attribute option
  • D.1.25 attribute syntax
  • D.1.26 attribute type
  • D.1.27 attribute usage
  • D.1.28 attribute value
  • D.1.29 attribute value assertion
  • D.1.30 audit log
  • D.1.31 authentication
  • D.1.32 authentication ID
  • D.1.33 authentication password syntax
  • D.1.34 authorization
  • D.1.35 authorization ID
  • D.1.36 authorization identity control
  • D.1.37 auxiliary object class
  • D.1.38 AVA
• D.2 B
  • D.2.1 back end
  • D.2.2 backup
  • D.2.3 base64 encoding
  • D.2.4 Basic Encoding Rules
    • D.2.4.1 Basic Encoding Rules Overview
    • D.2.4.2 The BER Type
    • D.2.4.3 The BER Length
    • D.2.4.4 The BER Value
    • D.2.4.5 BER Encoding Examples
  • D.2.5 BER
  • D.2.6 Berkeley DB Java Edition
  • D.2.7 binary copy
  • D.2.8 bind operation
• D.3 C
  • D.3.1 cancel extended operation
  • D.3.2 CDDL
  • D.3.3 certificate
  • D.3.4 certificate mapper
  • D.3.5 chaining
  • D.3.6 changelog
  • D.3.7 cn=Directory Manager
  • D.3.8 collective attribute
  • D.3.9 Common Development and Distribution License
  • D.3.10 compare operation
  • D.3.11 connection handler
  • D.3.12 connection ID
  • D.3.13 control
  • D.3.14 CRAM-MD5 SASL mechanism
  • D.3.15 crypt algorithm
• D.4 D
  • D.4.1 database
  • D.4.2 database cache
  • D.4.3 debug log
  • D.4.4 delete operation
  • D.4.5 deprecated password storage scheme
  • D.4.6 dereference policy
  • D.4.7 DIGEST-MD5 SASL mechanism
  • D.4.8 directory information tree
  • D.4.9 directory manager
  • D.4.10 directory server
  • D.4.11 directory server agent
  • D.4.12 Directory Services Markup Language
  • D.4.13 distinguished name
  • D.4.14 distribution
  • D.4.15 DIT
  • D.4.16 DIT content rule
  • D.4.17 DIT structure rule
  • D.4.18 DN
  • D.4.19 DSA
  • D.4.20 DSA-specific entry
  • D.4.21 DSE
  • D.4.22 DSML
  • D.4.23 DSML gateway
  • D.4.24 duration
  • D.4.25 dynamic group
• D.5 E
  • D.5.1 entry
  • D.5.2 entry cache
  • D.5.3 entry change notification control
  • D.5.4 entryDN
  • D.5.5 entry ID
  • D.5.6 entryUUID
  • D.5.7 equality index
  • D.5.8 equality search filter
  • D.5.9 error log
  • D.5.10 export
  • D.5.11 extended operation
  • D.5.12 extensible match index
  • D.5.13 extensible match search filter
  • D.5.14 EXTERNAL SASL mechanism
• D.6 F
  • D.6.1 failover algorithm
  • D.6.2 false filter
• D.7 G
  • D.7.1 generalized time
  • D.7.2 get effective rights control
  • D.7.3 global index
  • D.7.4 global index catalog
  • D.7.5 greater than or equal to search filter
  • D.7.6 group
  • D.7.7 GSSAPI SASL mechanism
• D.8 I
  • D.8.1 ID list
  • D.8.2 id2entry database
  • D.8.3 identity mapper
  • D.8.4 idle account lockout
  • D.8.5 in-core restart
  • D.8.6 index
  • D.8.7 index entry limit
  • D.8.8 intermediate response
  • D.8.9 Internet Draft
• D.9 J
  • D.9.1 Java Management Extensions
  • D.9.2 JMX
• D.10 K
  • D.10.1 key manager provider
• D.11 L
  • D.11.1 last login time
  • D.11.2 lastmod plug-in
  • D.11.3 LDAP assertion control
  • D.11.4 ldapcompare command
  • D.11.5 LDAP Data Interchange Format
  • D.11.6 ldapdelete command
  • D.11.7 LDAP false filter
  • D.11.8 LDAP intermediate response
  • D.11.9 LDAP message
  • D.11.10 LDAP modify DN operation
  • D.11.11 LDAP modify operation
  • D.11.12 ldapmodify command
  • D.11.13 LDAP no-op control
  • D.11.14 LDAP post-read control
  • D.11.15 LDAP pre-read control
  • D.11.16 LDAP result
  • D.11.17 LDAPS
  • D.11.18 LDAP search filter
  • D.11.19 ldapsearch command
  • D.11.20 LDAP true filter
  • D.11.21 LDAP Subentry
  • D.11.22 LDAP URL
  • D.11.23 LDIF export
  • D.11.24 LDIF import
  • D.11.25 leaf entry
  • D.11.26 less than or equal to search filter
  • D.11.27 lexico algorithm
  • D.11.28 Lightweight Directory Access Protocol
  • D.11.29 load balancing
  • D.11.30 lookthrough limit
• D.12 M
  • D.12.1 MakeLDIF command
  • D.12.2 manage DSA IT control
  • D.12.3 matched DN
  • D.12.4 matched values control
  • D.12.5 matching rule
  • D.12.6 matching rule use
  • D.12.7 MD5
  • D.12.8 message
  • D.12.9 message ID
  • D.12.10 modification
  • D.12.11 modification type
  • D.12.12 modify DN operation
  • D.12.13 modify operation
  • D.12.14 monitor entry
• D.13 N
  • D.13.1 name form
  • D.13.2 naming context
  • D.13.3 network group
  • D.13.4 non-leaf entry
  • D.13.5 normalized value
  • D.13.6 notice of disconnection unsolicited notification
  • D.13.7 NOT search filter
  • D.13.8 numeric algorithm
  • D.13.9 nsuniqueid
• D.14 O
  • D.14.1 object class
  • D.14.2 object class type
  • D.14.3 object identifier
  • D.14.4 operation ID
  • D.14.5 operational attribute
  • D.14.6 ordering index
  • D.14.7 OR search filter
• D.15 P
  • D.15.1 partition
  • D.15.2 password
  • D.15.3 password expiration
  • D.15.4 password generator
  • D.15.5 Password Modify extended operation
  • D.15.6 password policy
  • D.15.7 password policy control
  • D.15.8 password reset
  • D.15.9 password storage scheme
  • D.15.10 password validator
  • D.15.11 persistent search control
  • D.15.12 PLAIN SASL mechanism
  • D.15.13 plug-in
  • D.15.14 presence index
  • D.15.15 presence search filter
  • D.15.16 privilege
  • D.15.17 proportional algorithm
  • D.15.18 protocol data unit
  • D.15.19 protocol op
  • D.15.20 proxied authorization control
• D.16 Q
  • D.16.1 quality of protection
• D.17 R
  • D.17.1 real attributes only control
  • D.17.2 referential integrity
  • D.17.3 referral
  • D.17.4 relative distinguished name
  • D.17.5 replica
  • D.17.6 replication
  • D.17.7 replication repair control
  • D.17.8 request for comments
  • D.17.9 restore
  • D.17.10 result
  • D.17.11 result code
  • D.17.12 root DN
  • D.17.13 root DSE
  • D.17.14 route
• D.18 S
  • D.18.1 salt
  • D.18.2 saturation algorithm
  • D.18.3 saturation alert
  • D.18.4 saturation threshold
  • D.18.5 schema
  • D.18.6 schema checking
  • D.18.7 search attributes
  • D.18.8 search base DN
  • D.18.9 search filter
  • D.18.10 search operation
  • D.18.11 search result done
  • D.18.12 search result entry
  • D.18.13 search result reference
  • D.18.14 search scope
  • D.18.15 Secure Hash Algorithm
  • D.18.16 Secure Sockets Layer
  • D.18.17 server-side sort control
  • D.18.18 simple authentication
  • D.18.19 Simple Authentication and Security Layer
  • D.18.20 simple paged results control
  • D.18.21 size limit
  • D.18.22 smart referral
  • D.18.23 StartTLS extended operation
  • D.18.24 static group
  • D.18.25 structural object class
  • D.18.26 subentry
  • D.18.27 subschema subentry
  • D.18.28 substring assertion
  • D.18.29 substring index
  • D.18.30 substring search filter
  • D.18.31 subtree
  • D.18.32 subtree delete control
  • D.18.33 supported control
  • D.18.34 supported extension
  • D.18.35 supported feature
  • D.18.36 synchronization
• D.19 T
  • D.19.1 task
  • D.19.2 time limit
  • D.19.3 transaction
  • D.19.4 Transport Security Layer
  • D.19.5 true filter
  • D.19.6 trust manager provider
  • D.19.7 typesOnly flag
• D.20 U
  • D.20.1 unbind operation
  • D.20.2 unindexed search
  • D.20.3 UNIX crypt algorithm
  • D.20.4 unsolicited notification
  • D.20.5 URL
  • D.20.6 user attribute
• D.21 V
  • D.21.1 virtual attribute
  • D.21.2 virtual attributes only control
  • D.21.3 virtual directory
  • D.21.4 virtual list view control
  • D.21.5 virtual static group
  • D.21.6 VLV index
• D.22 W
  • D.22.1 "Who Am I?" extended operation
  • D.22.2 work queue
  • D.22.3 worker thread
  • D.22.4 workflow
  • D.22.5 workflow element
  • D.22.6 writability mode