Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide?

• New and Changed Features for Oracle Unified Directory 11g Release 2 (11.1.2.3)
• New and Changed Features for Oracle Unified Directory 11g Release 2 (11.1.2.2)
• New and Changed Features for Oracle Unified Directory 11g Release 2 (11.1.2.1)
• New and Changed Features for Oracle Unified Directory 11g Release 2 (11.1.2.3)

Part I Introduction to Oracle Unified Directory

1 Introduction to Oracle Unified Directory

• 1.1 What is Oracle Unified Directory?
  • 1.1.1 Components of Oracle Unified Directory
  • 1.1.2 Oracle Unified Directory Installation Types
    • 1.1.2.1 Setting Up the Directory Server
    • 1.1.2.2 Setting Up the Proxy Server
    • 1.1.2.3 Setting Up the Replication Gateway Server
  • 1.1.3 Synchronizing Oracle Unified Directory with Other Directories
    • 1.1.3.1 Synchronization between Oracle Unified Directory and Oracle Internet Directory
    • 1.1.3.2 Synchronization between Oracle Unified Directory and Third-Party Directories
• 1.2 Overview of Directory Server
• 1.3 Overview of Proxy Server
  • 1.3.1 What Is the Proxy Server?
  • 1.3.2 Why Use the Proxy Server?
• 1.4 Overview of the Replication Gateway
  • 1.4.1 What Is the Replication Gateway?
  • 1.4.2 The Role of the Replication Gateway
  • 1.4.3 Limitations of the Replication Gateway

2 Example Deployments Using the Directory Server

• 2.1 Small Replicated Topology
  • 2.1.1 The Role of Directory Servers in a Topology
  • 2.1.2 The Role of Replication Servers in a Topology
• 2.2 Multiple Data Center Topology
  • 2.2.1 Multiple Data Centers and Replication Groups
  • 2.2.2 Multiple Data Centers and the Window Mechanism

3 Example Deployments Using the Proxy Server

• 3.1 Deciding Your Proxy Deployment Type
• 3.2 Supported Proxy Deployments
  • 3.2.1 Configuration 1: Simple Load Balancing
  • 3.2.2 Configuration 2: Simple Distribution
  • 3.2.3 Configuration 3: Failover Between Data Centers
  • 3.2.4 Configuration 4: Distribution with Load Balancing
  • 3.2.5 Configuration 5: Distribution with Failover Between Data Centers
  • 3.2.6 Configuration 6: Enterprise User Security
  • 3.2.7 Configuration 7: Multiple Replicated Proxies
  • 3.2.8 Configuration 8: Virtualization

4 Example Mixed Deployments

• 4.1 Considerations For Mixed Deployment Scenarios
  • 4.1.1 Installing Oracle Unified Directory as a Directory Server
  • 4.1.2 Installing Oracle Unified Directory as a Proxy
• 4.2 Configuration 1: Pass-Through Authentication
• 4.3 Configuration 2: Shadow Joiner

Part II Oracle Unified Directory Concepts and Architecture

5 Understanding Oracle Unified Directory Concepts and Architecture

• 5.1 Oracle Unified Directory Components
  • 5.1.1 Network Groups
  • 5.1.2 Workflows
  • 5.1.3 Workflow Elements
• 5.2 Architecture of Oracle Unified Directory

6 Understanding Oracle Unified Directory High Availability Deployments

• 6.1 What is High Availability?
• 6.2 Availability and Single Points of Failure
  • 6.2.1 Types of SPOFs
    • 6.2.1.1 Hardware Failure
    • 6.2.1.2 Software Failure
  • 6.2.2 Common Approach to Mitigate SPOFs - Redundancy
• 6.3 Using Redundancy for High Availability
  • 6.3.1 Redundancy at the Hardware Level
  • 6.3.2 Redundancy at Directory Server Level Using Replication
  • 6.3.3 Using Directory Proxy Server as Part of a Redundant Solution
  • 6.3.4 Using Application Isolation for High Availability
  • 6.3.5 Using Replication Gateway for High Availability
• 6.4 Sample Topologies Using Redundancy for High Availability

7 Understanding the Oracle Unified Directory Replication Model

• 7.1 Overview of the Replication Architecture
  • 7.1.1 Basic Replication Architecture
  • 7.1.2 Replication Servers
  • 7.1.3 Replication Change Numbers
  • 7.1.4 Replication Server State
  • 7.1.5 Operation Dependencies
• 7.2 How Replication Works
  • 7.2.1 Replication Initialization
    • 7.2.1.1 Replicating Configuration Data Manually
  • 7.2.2 Directory Server Change Processing
  • 7.2.3 Replication Server Selection
    • 7.2.3.1 Replication Server Selection Algorithm
    • 7.2.3.2 Replication Server Load Balancing
  • 7.2.4 Change Replay
  • 7.2.5 Auto Repair
  • 7.2.6 Directory Server Crashes
  • 7.2.7 Replication Server Crashes
• 7.3 Historical Information and Conflict Resolution
  • 7.3.1 What is a Replication Conflict?
  • 7.3.2 Resolving Modify Conflicts
  • 7.3.3 Resolving Naming Conflicts
  • 7.3.4 Purging Historical Information
• 7.4 Schema Replication
  • 7.4.1 Schema Replication Architecture
• 7.5 Replication Status
  • 7.5.1 Replication Status Definitions
  • 7.5.2 Degraded Status
  • 7.5.3 Full Update Status and Bad Generation ID Status
• 7.6 Replication Groups
• 7.7 Assured Replication
  • 7.7.1 Assured Replication Modes
    • 7.7.1.1 Safe Data Mode
    • 7.7.1.2 Safe Read Mode
    • 7.7.1.3 Safe Read Mode and Replication Groups
  • 7.7.2 Assured Replication Connection Algorithm
  • 7.7.3 Assured Replication and Replication Status
  • 7.7.4 Assured Replication Monitoring
• 7.8 Fractional Replication
  • 7.8.1 Fractional Data Set Identification
  • 7.8.2 Fractional Replication Filtering
  • 7.8.3 Fractional Replication and Local Operations

8 Understanding the Oracle Unified Directory Indexing Model

• 8.1 Overview of Indexes
  • 8.1.1 What is an Index?
  • 8.1.2 Understanding the Importance of Indexing
• 8.2 Index Types
  • 8.2.1 Approximate Indexes
  • 8.2.2 Equality Indexes
  • 8.2.3 Ordering Indexes
  • 8.2.4 Presence Indexes
  • 8.2.5 Substring Indexes
• 8.3 Index Entry Limit
• 8.4 Search Evaluation
• 8.5 Maintaining Indexes

9 Understanding the Oracle Unified Directory Access Control Model

• 9.1 Access Control Principles
  • 9.1.1 Access Control Overview
  • 9.1.2 ACI Structure
  • 9.1.3 Directory Server Global ACIs
  • 9.1.4 ACI Evaluation
  • 9.1.5 ACI Limitations
  • 9.1.6 Access Control and Replication
  • 9.1.7 Anonymous Read Access ACI
• 9.2 ACI Syntax
  • 9.2.1 ACI Syntax Overview
  • 9.2.2 Defining Targets
    • 9.2.2.1 Targeting a Directory Entry
    • 9.2.2.2 Targeting Attributes
    • 9.2.2.3 Targeting Both an Entry and Attributes
    • 9.2.2.4 Targeting Entries or Attributes Using LDAP Filters
    • 9.2.2.5 Targeting Attribute Values Using LDAP Filters
    • 9.2.2.6 Targeting a Single Directory Entry
    • 9.2.2.7 Specifying the Scope of an ACI
    • 9.2.2.8 Targeting LDAP Controls
    • 9.2.2.9 Targeting LDAP Extended Operations
  • 9.2.3 Defining Permissions
    • 9.2.3.1 Allowing or Denying Access
    • 9.2.3.2 Assigning Rights
    • 9.2.3.3 Rights Required for LDAP Operations
    • 9.2.3.4 Permissions Syntax
• 9.3 Bind Rules
  • 9.3.1 Bind Rules Overview
  • 9.3.2 Using Boolean Bind Rules
• 9.4 Bind Rule Syntax
  • 9.4.1 Bind Rule Syntax Overview
  • 9.4.2 Defining User Access (userdn Keyword)
    • 9.4.2.1 Defining General Access (all Keyword)
    • 9.4.2.2 Defining Anonymous Access (anyone Keyword)
    • 9.4.2.3 Defining Self Access (self Keyword)
    • 9.4.2.4 Defining Parent Access (parent Keyword)
    • 9.4.2.5 Specifying Users With LDAP URLs
    • 9.4.2.6 Specifying Users With Wildcards
    • 9.4.2.7 Specifying Users With a Logical OR of LDAP URLs
    • 9.4.2.8 Excluding Specific LDAP URLs
  • 9.4.3 Defining Group Access (groupdn Keyword)
    • 9.4.3.1 Specifying a Group With a Single LDAP URL
    • 9.4.3.2 Specifying a Group With a Logical OR of LDAP URLs
  • 9.4.4 Defining Access Based on Value Matching (userattr Keyword)
    • 9.4.4.1 Bind-Type Format
    • 9.4.4.2 Attribute-Value Format
    • 9.4.4.3 USERDN Bind Type Example
    • 9.4.4.4 GROUPDN Bind Type Example
    • 9.4.4.5 LDAPURL Bind Type Example
    • 9.4.4.6 Attribute Value Example
    • 9.4.4.7 Inheritance
    • 9.4.4.8 Inheritance Example
    • 9.4.4.9 Add Permissions
  • 9.4.5 Defining Access From a Specific IP Address (ip Keyword)
  • 9.4.6 Defining Access From a Specific Domain (dns Keyword)
  • 9.4.7 Defining Access at a Specific Time of Day or Day of Week (timeofday and dayofweek Keywords)
  • 9.4.8 Defining Access Based on Authentication Method (authmethod Keyword)
    • 9.4.8.1 Authentication Method Examples
  • 9.4.9 Defining Access Based on a Connection's Security Strength Factor (ssf Keyword)
    • 9.4.9.1 DIGEST-MD5 QOP Key Size Mapping
    • 9.4.9.2 TLS Cipher Key Size Mapping
    • 9.4.9.3 Example
• 9.5 Compatibility With the Oracle Directory Server Enterprise Edition Access Control Model
  • 9.5.1 Global ACI
  • 9.5.2 Distinguished Name (DN) Wildcard Matching
  • 9.5.3 Privilege Subsystem Impact
  • 9.5.4 The targetscope Keyword
  • 9.5.5 LDAP Modify Increment
  • 9.5.6 Macro Support
  • 9.5.7 The roledn Keyword
• 9.6 Using Macro ACIs for Advanced Access Control
  • 9.6.1 What are Macros?
  • 9.6.2 Macro ACI Example
  • 9.6.3 Macro ACI Syntax
    • 9.6.3.1 Matching for ($dn) in the Target
    • 9.6.3.2 Macro Matching for ($attr.attrName)
• 9.7 Understanding Virtual ACIs
  • 9.7.1 Virtual ACI Overview
  • 9.7.2 Virtual ACI Syntax
  • 9.7.3 Virtual ACI Configuration Model
  • 9.7.4 Virtual ACI Usage Considerations

10 Understanding the Oracle Unified Directory Schema Model

• 10.1 Understanding Matching Rules
  • 10.1.1 Matching Rule Description Format
  • 10.1.2 Commonly Used Matching Rules
  • 10.1.3 Relative Time Matching Rules
  • 10.1.4 Partial Date Or Time Matching Rules
  • 10.1.5 Value Normalization
• 10.2 Understanding Attribute Syntaxes
  • 10.2.1 The Attribute Syntax Description Format
  • 10.2.2 Commonly Used Attribute Syntaxes
  • 10.2.3 The Pattern-Matching Syntax Extension
  • 10.2.4 The Enumeration Syntax Extension
  • 10.2.5 Substitution Syntax Extension
• 10.3 Understanding Attribute Types
  • 10.3.1 Attribute Type Description Format
  • 10.3.2 Attribute Type Inheritance
  • 10.3.3 Attribute Type Implementation
• 10.4 Understanding Object Classes
  • 10.4.1 Object Class Description Format
  • 10.4.2 Object Class Kinds
  • 10.4.3 Object Class Inheritance
  • 10.4.4 Directory Server Object Class Implementation
• 10.5 Understanding Name Forms
  • 10.5.1 Name Form Description Format
• 10.6 Understanding DIT Content Rules
  • 10.6.1 DIT Content Rule Description Format
  • 10.6.2 DIT Content Rule Implementation
• 10.7 Understanding DIT Structure Rules
  • 10.7.1 DIT Structure Rule Description Format
  • 10.7.2 DIT Structure Rules and Multiple Schemas
• 10.8 Understanding Matching Rule Uses

11 Understanding Root Users and the Privilege Subsystem

• 11.1 Root User Accounts
• 11.2 Privilege Subsystem
• 11.3 Assigning Privileges to Normal Users
• 11.4 Assigning Privileges to Root Users

12 Understanding the Proxy, Distribution, and Virtualization Functionality

• 12.1 Understanding How to Access Remote Data Sources
  • 12.1.1 Enabling LDAP Clients to Access Identity Data Stored in an RDBMS
    • 12.1.1.1 Why Use an RDBMS Workflow Element?
    • 12.1.1.2 RDBMS Workflow Element Features
    • 12.1.1.3 RDBMS Workflow Element Caching
    • 12.1.1.4 RDBMS Workflow Element Configuration
  • 12.1.2 Enabling Communication with a Remote LDAP Server
• 12.2 Understanding Load Balancing Using the Proxy
  • 12.2.1 Failover Load Balancing
  • 12.2.2 Optimal Load Balancing
    • 12.2.2.1 Determining Saturation Level
  • 12.2.3 Proportional Load Balancing
  • 12.2.4 Saturation Load Balancing
  • 12.2.5 Search Filter Load Balancing
• 12.3 Understanding Data Distribution Using the Proxy
  • 12.3.1 Numeric Distribution
  • 12.3.2 Lexico Distribution
  • 12.3.3 Capacity Distribution
  • 12.3.4 DN Pattern Distribution
• 12.4 Understanding Data Integration Using the Proxy
  • 12.4.1 Retrieving All Attribute Values from an Active Directory Server
  • 12.4.2 Integrating with Enterprise User Security Databases
  • 12.4.3 Enabling LDAP Clients to Update User Passwords Stored in Active Directory
    • 12.4.3.1 Why Use the Ad Password Workflow Element?
    • 12.4.3.2 Ad Password Workflow Element Functionality
    • 12.4.3.3 Ad Password Workflow Element Check for an SSL Connection
    • 12.4.3.4 Considering Your Requirements for Using the Ad Password Workflow Element
  • 12.4.4 Understanding Pass-Through Authentication
    • 12.4.4.1 Using the Pass-Through Authentication Mechanism
    • 12.4.4.2 Pass-Through Authentication Configuration Model
    • 12.4.4.3 Pass-Through Authentication Configuration Parameters
    • 12.4.4.4 Implementing Pass-Through Authentication for Different Servers
    • 12.4.4.5 Implementing Pass-Through Authentication for a Kerberos Server
  • 12.4.5 Understanding Oracle Unified Directory Plug-Ins
• 12.5 Understanding Virtualization
  • 12.5.1 Using Entries from Multiple Directories
    • 12.5.1.1 Understanding the Join Workflow Element
    • 12.5.1.2 Understanding Join Participants
    • 12.5.1.3 Understanding Join Rules
    • 12.5.1.4 Understanding Join Policies
    • 12.5.1.5 Understanding Joiner Types
    • 12.5.1.6 Understanding the Join Condition
    • 12.5.1.7 Creating Virtual Attributes
    • 12.5.1.8 Understanding Attribute Flow Settings
    • 12.5.1.9 Handling Bind Operations
    • 12.5.1.10 Handling Translation of DN Attributes
    • 12.5.1.11 Configuring the Criticality of Join Participants
    • 12.5.1.12 Managing Enabled Operations
    • 12.5.1.13 Handling Cascading Write Operations to Secondary Participants
    • 12.5.1.14 Implementing Pass-Through Authentication Using the Join Workflow Element
    • 12.5.1.15 Handling LDAP Operations in Join Workflow Elements
  • 12.5.2 Optimizing Search Results From Virtual Directories Using Workflow Elements
  • 12.5.3 Adding memberof User Attributes to person Entries
    • 12.5.3.1 Using the memberof Attribute in a Search Filter
  • 12.5.4 Renaming DNs Using the Proxy
    • 12.5.4.1 How the DN Renaming Workflow Element Works
  • 12.5.5 Changing RDN Values Using the Proxy
• 12.6 Understanding the Global Index Catalog
• 12.7 Understanding the Transformation Framework
  • 12.7.1 Overview of Transformation
    • 12.7.1.1 Transformation Models
    • 12.7.1.2 Implementing Transformation in Oracle Unified Directory
  • 12.7.2 Components of Transformation
    • 12.7.2.1 Transformation Types
    • 12.7.2.2 Transformation Conditions
    • 12.7.2.3 Defining Attribute Values for Transformation
  • 12.7.3 Transformation Use Case Examples
    • 12.7.3.1 Mapping Activation or Deactivation for a Specific Back End Directory
    • 12.7.3.2 Mapping Object Classes

13 Understanding Oracle Unified Directory Identity Mapping

• 13.1 An Overview of Identity Mappers
• 13.2 Supported Identity Mappers
  • 13.2.1 Exact Match Identity Mapper
  • 13.2.2 Match And Replace Identity Mapper
• 13.3 Components of Identity Mappers
  • 13.3.1 Global Configuration
  • 13.3.2 Network Group
• 13.4 Configuring Identity Mappers
  • 13.4.1 Configuring Global Identity Mappers
  • 13.4.2 Configuring Network Group Identity Mappers
• 13.5 Selecting Identity Mappers
• 13.6 Ordering Identity Mappers

14 Understanding Data Encryption in Oracle Unified Directory

• 14.1 What is Attribute Encryption?
• 14.2 Encrypting Attributes
• 14.3 Supported Algorithms for Attribute Encryption
• 14.4 Support for Indexes Encryption
• 14.5 Support for Encryption in Replication Topology
  • 14.5.1 Understanding Encryption in a Replication Server Database (or changelog)
  • 14.5.2 Updating Servers from 11.1.2.2.0
  • 14.5.3 Using an ODSEE Gateway
• 14.6 Attribute Encryption Usage Considerations
• 14.7 Configuring Attribute Encryption
  • 14.7.1 Configuration Parameters
  • 14.7.2 Configuring Attribute Encryption Using the dsconfig Command
  • 14.7.3 Configuring Attribute Encryption Using the dsconfig Interactive Mode
  • 14.7.4 Configuring Attribute Encryption Using ODSM
  • 14.7.5 Sample Configuration Scenarios
    • 14.7.5.1 Enabling Encryption for Attributes of Specific Suffixes
    • 14.7.5.2 Disabling Encryption
    • 14.7.5.3 Enabling Encryption for a Specific Attribute Using an Algorithm
    • 14.7.5.4 Modifying Attributes
    • 14.7.5.5 Fetching Attributes
• 14.8 Configuring Attribute Encryption in Replication Enabled Topology

Part III Basic Administration

15 Starting and Stopping the Server

• 15.1 Starting the Server
  • 15.1.1 Starting the Server Using start-ds
  • 15.1.2 Starting the Server as a Foreground Process
  • 15.1.3 Restarting the Server
  • 15.1.4 Starting the Server Using a Script (UNIX/Linux)
• 15.2 Stopping the Server
  • 15.2.1 Stopping the Server Using stop-ds
  • 15.2.2 Stopping the Server that is Running in the Foreground
  • 15.2.3 Stopping the Server Using a Script (UNIX/Linux)
• 15.3 Checking if the Server is Started or Stopped
• 15.4 Running the Server as a Non-Root User
  • 15.4.1 Reasons for Running the Server as a Non-Root User
  • 15.4.2 Running the Server as a Non-Root User on the Standard LDAP Ports

16 Accessing Oracle Unified Directory Using ODSM

• 16.1 Invoking ODSM
• 16.2 Connecting to the Server Using ODSM
• 16.3 Displaying Server Information Using ODSM
  • 16.3.1 Viewing the Server Role
  • 16.3.2 Viewing Version Information
  • 16.3.3 Viewing Server Statistics
  • 16.3.4 Viewing the Configured Connection Handlers
  • 16.3.5 Viewing the Configured Naming Contexts
  • 16.3.6 Viewing the Configured Data Sources
  • 16.3.7 Viewing the Server Metrics
    • 16.3.7.1 Viewing Usage Since Startup
    • 16.3.7.2 Viewing Current Usage
    • 16.3.7.3 Viewing Cache Usage

17 Configuring the Server Instance

• 17.1 Managing the Server Configuration Using dsconfig
  • 17.1.1 Using the dsconfig Command
    • 17.1.1.1 Running dsconfig and Certificate Checking
    • 17.1.1.2 Working with dsconfig Subcommands
    • 17.1.1.3 Working with dsconfig Advanced Properties
  • 17.1.2 Using dsconfig in Interactive Mode
  • 17.1.3 Getting Help With dsconfig
    • 17.1.3.1 Displaying Global Usage
    • 17.1.3.2 Finding the Correct Subcommand
    • 17.1.3.3 Getting Help for an Individual Subcommand
    • 17.1.3.4 Displaying a Summary of a Component's Properties
    • 17.1.3.5 Displaying Detailed Help on a Property
  • 17.1.4 Configuring a Server Instance Using dsconfig
    • 17.1.4.1 Viewing the Properties of a Component
    • 17.1.4.2 Listing Components
    • 17.1.4.3 Configuring How Server Changes Are Recorded
    • 17.1.4.4 Creating a Component
    • 17.1.4.5 Modifying Component Properties
    • 17.1.4.6 Modifying the Values of a Multi-Valued Property
    • 17.1.4.7 Deleting a Component
    • 17.1.4.8 Using dsconfig in Batch Mode
  • 17.1.5 Configuring Connection Handlers Using dsconfig
    • 17.1.5.1 Viewing All Connection Handlers
    • 17.1.5.2 Configuring the LDAP Connection Handler
    • 17.1.5.3 Configuring the LDIF Connection Handler
    • 17.1.5.4 Configuring the JMX Connection Handler
  • 17.1.6 Configuring Network Groups Using dsconfig
    • 17.1.6.1 Creating a Network Group
    • 17.1.6.2 Modifying Network Group Properties
    • 17.1.6.3 Creating a Network Group Quality of Service Policy
    • 17.1.6.4 Modifying a Network Group Quality of Service Policy
    • 17.1.6.5 Relocating the Root DSE Entry for a Network Group
    • 17.1.6.6 Customizing the Root DSE Entry for a Network Group
  • 17.1.7 Configuring Workflows Using dsconfig
    • 17.1.7.1 Listing Existing Workflows
    • 17.1.7.2 Viewing Workflow Properties
    • 17.1.7.3 Creating a Workflow
  • 17.1.8 Configuring Workflow Elements Using dsconfig
    • 17.1.8.1 Listing Workflow Elements
    • 17.1.8.2 Creating Workflow Elements
    • 17.1.8.3 Modifying Workflow Elements
  • 17.1.9 Configuring Plug-Ins Using dsconfig
    • 17.1.9.1 Understanding the Plug-In Types
    • 17.1.9.2 Modifying the Plug-In Configuration
  • 17.1.10 Configuring Suffixes with dsconfig
    • 17.1.10.1 Configuring Suffixes with dsconfig During Setup
    • 17.1.10.2 Configuring Suffixes with dsconfig on a Running Server
  • 17.1.11 Configuring Access Control Groups With dsconfig
    • 17.1.11.1 Creating Access Control Groups
    • 17.1.11.2 Deleting Access Control Groups
• 17.2 Managing Suffixes Using manage-suffix
  • 17.2.1 Creating an Integrated Suffix Using manage-suffix
  • 17.2.2 Creating a Non-Integrated Suffix Using manage-suffix
  • 17.2.3 Viewing Suffix Information
  • 17.2.4 Modifying a Suffix Configuration
  • 17.2.5 Deleting a Suffix Using manage-suffix
• 17.3 Managing the Server Configuration Using ODSM
  • 17.3.1 Selecting a Configuration View
  • 17.3.2 Using Shortcuts to Configure Objects Using ODSM
  • 17.3.3 Configuring Suffixes Using ODSM
    • 17.3.3.1 Creating a Suffix
    • 17.3.3.2 Displaying and Editing Suffix Properties
    • 17.3.3.3 Deleting a Suffix
  • 17.3.4 Configuring Workflow Elements Using ODSM
    • 17.3.4.1 Creating a Workflow Element
    • 17.3.4.2 Displaying and Editing Workflow Element Properties
    • 17.3.4.3 Deleting a Workflow Element
  • 17.3.5 Configuring Workflows Using ODSM
    • 17.3.5.1 Creating a Workflow
    • 17.3.5.2 Displaying and Editing Workflow Properties
    • 17.3.5.3 Deleting a Workflow
  • 17.3.6 Configuring Connection Handlers Using ODSM
    • 17.3.6.1 Creating a Connection Handler
    • 17.3.6.2 Modifying a Connection Handler
    • 17.3.6.3 Deleting a Connection Handler
  • 17.3.7 Configuring Network Groups Using ODSM
    • 17.3.7.1 Creating a Network Group
    • 17.3.7.2 Modifying a Network Group
    • 17.3.7.3 Deleting a Network Group
  • 17.3.8 Modifying the General Server Configuration
• 17.4 Managing Administration Traffic to the Server
  • 17.4.1 Understanding the Administration Connector
  • 17.4.2 Accessing Administrative Suffixes
  • 17.4.3 Configuring the Administration Connector
  • 17.4.4 Modifying Key Manager and Trust Manager Properties for the Administration Connector
• 17.5 Configuring Commands As Tasks
  • 17.5.1 Commands That Can Schedule Tasks
  • 17.5.2 Controlling Which Tasks Can Run
  • 17.5.3 Scheduling and Configuring Tasks
    • 17.5.3.1 Scheduling a Task
    • 17.5.3.2 Scheduling a Recurring Task
    • 17.5.3.3 Configuring Task Notification
    • 17.5.3.4 Configuring Task Dependencies
  • 17.5.4 Managing and Monitoring Scheduled Tasks
    • 17.5.4.1 Viewing Information About Scheduled Tasks
    • 17.5.4.2 Canceling a Scheduled Task
    • 17.5.4.3 Canceling a Recurring Task
• 17.6 Deploying and Configuring the DSML Gateway
  • 17.6.1 Deploying the DSML Gateway
    • 17.6.1.1 Configuring WebLogic Server for the DSML Gateway
    • 17.6.1.2 Deploying the DSML Gateway WAR File
  • 17.6.2 Confirming the DSML Gateway Deployment
    • 17.6.2.1 Confirming the DSML Gateway Deployment Using JXplorer
    • 17.6.2.2 Confirming the DSML Gateway Deployment Using the Directory Server Resource Kit
• 17.7 Managing the ODSM Session Timeout

18 Managing Directory Data

• 18.1 Importing and Exporting Data
  • 18.1.1 Populating a Stand-Alone Directory Server With Data
  • 18.1.2 Importing Data Using import-ldif
    • 18.1.2.1 import-ldif Operation Modes
    • 18.1.2.2 Importing Data in Offline Mode
    • 18.1.2.3 Replacing Existing Data During an Offline Import
    • 18.1.2.4 Appending Imported Data to Existing Data
    • 18.1.2.5 Importing Fractional Files
    • 18.1.2.6 Importing Fractional Files Using Filters
    • 18.1.2.7 Including or Excluding Attributes During Import
    • 18.1.2.8 Importing a Compressed LDIF File
    • 18.1.2.9 Recording Rejected or Skipped Entries During Import
    • 18.1.2.10 Importing Data From a MakeLDIF Template
    • 18.1.2.11 Running an Import in Online Mode
    • 18.1.2.12 Scheduling an Import
  • 18.1.3 Exporting Data Using export-ldif
    • 18.1.3.1 export-ldif Operation Modes
    • 18.1.3.2 Exporting Data to LDIF
    • 18.1.3.3 Exporting Partial Data
    • 18.1.3.4 Exporting Part of a Back End Using Filters
    • 18.1.3.5 Including or Excluding Attributes During Export
    • 18.1.3.6 Exporting to LDIF and Then Compress the File
    • 18.1.3.7 Running an Export in Online Mode
    • 18.1.3.8 Scheduling an Export
  • 18.1.4 Creating MakeLDIF Template Files
    • 18.1.4.1 The Template File Format
    • 18.1.4.2 make-ldif Template File Tags
    • 18.1.4.3 Defining Custom Tags
• 18.2 Importing Large Data Sets
  • 18.2.1 Setting the Import Options
  • 18.2.2 Tuning the JVM and Java Arguments
• 18.3 Backing Up and Restoring Data
  • 18.3.1 Overview of the Backup and Restore Process
  • 18.3.2 Backing Up Data
    • 18.3.2.1 Backing Up All Back Ends
    • 18.3.2.2 Backing Up All Back Ends with Encryption and Signed Hashes
    • 18.3.2.3 Performing an Incremental Backup on All Back Ends
    • 18.3.2.4 Backing Up a Specific Back End
    • 18.3.2.5 Performing an Incremental Backup on a Specific Back End
    • 18.3.2.6 Scheduling a Backup as a Task
  • 18.3.3 Backing Up the Server Configuration
  • 18.3.4 Backing Up for Disaster Recovery
    • 18.3.4.1 Backing Up the Directory Server For Disaster Recovery
  • 18.3.5 Backing up and Restoring Data Using File System Snapshots
    • 18.3.5.1 Taking a ZFS Snapshot On a Dedicated Backup Server
    • 18.3.5.2 Restoring a Directory Server From a ZFS Snapshot
  • 18.3.6 Restoring Data
    • 18.3.6.1 Restoring a Back End
    • 18.3.6.2 Restoring a Back End From Incremental Backups
    • 18.3.6.3 Scheduling a Restore as a Task
    • 18.3.6.4 Restoring the Configuration File
    • 18.3.6.5 Restoring a Directory Server During Disaster Recovery
  • 18.3.7 Restoring Replicated Directory Servers
  • 18.3.8 Deleting Backup Data
    • 18.3.8.1 Deleting Backup Files
• 18.4 Searching Directory Data
  • 18.4.1 Overview of the ldapsearch Command
  • 18.4.2 ldapsearch Location and Format
    • 18.4.2.1 Common ldapsearch Options
  • 18.4.3 Understanding Search Criteria
    • 18.4.3.1 Specifying Filter Types and Operators
    • 18.4.3.2 Using Compound Search Filters
    • 18.4.3.3 Using UTF-8 Encoding in Search Filters
    • 18.4.3.4 Using Special Characters in Search Filters
  • 18.4.4 ldapsearch Examples
    • 18.4.4.1 Returning All Entries
    • 18.4.4.2 Searching For a Specific User
    • 18.4.4.3 Searching for Specific User Attributes
    • 18.4.4.4 Performing a Search With Base Scope
    • 18.4.4.5 Performing a Search With One-Level Scope
    • 18.4.4.6 Performing a Search With Subtree Scope
    • 18.4.4.7 Returning Attribute Names Only
    • 18.4.4.8 Returning User Attributes Only
    • 18.4.4.9 Returning Base DNs Only
    • 18.4.4.10 Searching For Specific Object Classes
    • 18.4.4.11 Returning A Count of Matching Entries in the Directory
    • 18.4.4.12 Performing a Search With a Compound Filter
    • 18.4.4.13 Performing a Search Using a Filter File
    • 18.4.4.14 Limiting the Number of Entries Returned in a Search
  • 18.4.5 Searching Data Using ODSM
    • 18.4.5.1 Performing a Complex LDAP Search
• 18.5 Using Advanced Search Features
  • 18.5.1 Searching for Special Entries and Attributes
    • 18.5.1.1 Searching for Operational Attributes
    • 18.5.1.2 Searching the Root DSE Entry
    • 18.5.1.3 Searching for ACI Attributes
    • 18.5.1.4 Searching the Schema Entry
    • 18.5.1.5 Searching the Configuration Entry
    • 18.5.1.6 Searching the Monitoring Entry
  • 18.5.2 Searching Over SSL
    • 18.5.2.1 Searching Over SSL With Blind Trust
    • 18.5.2.2 Searching Over SSL Using a Trust Store
    • 18.5.2.3 Searching Over SSL With No Trust Store
    • 18.5.2.4 Searching Over SSL Using a Keystore
    • 18.5.2.5 Searching Using StartTLS
    • 18.5.2.6 Searching Using SASL With DIGEST-MD5 Client Authentication
    • 18.5.2.7 Searching Using SASL With the GSSAPI Mechanism
    • 18.5.2.8 Searching Using SASL With the PLAIN Mechanism
  • 18.5.3 Searching Using Controls
    • 18.5.3.1 Viewing the Available Controls
    • 18.5.3.2 Searching Using the Join Search Control
    • 18.5.3.3 Searching Using the Proximity Search Control
    • 18.5.3.4 Searching Using the Account Usability Request Control
    • 18.5.3.5 Searching Using the Authorization Identity Request Control
    • 18.5.3.6 Searching Using the Get Effective Rights Control
    • 18.5.3.7 Searching Using the LDAP Assertion Control
    • 18.5.3.8 Searching Using the LDAP Subentry Control
    • 18.5.3.9 Searching Using the Manage DSA IT Control
    • 18.5.3.10 Searching Using the Matched Values Filter Control
    • 18.5.3.11 Searching Using the Password Policy Control
    • 18.5.3.12 Searching Using the Persistent Search Control
    • 18.5.3.13 Searching Using the Proxied Authorization Control
    • 18.5.3.14 Searching Using the Server-Side Sort Control
    • 18.5.3.15 Searching Using the Simple Paged Results Control
    • 18.5.3.16 Searching Using the Virtual List View Control
  • 18.5.4 Searching in Verbose Mode and With a Properties File
    • 18.5.4.1 Searching in Verbose Mode
    • 18.5.4.2 Searching Using a Properties File
  • 18.5.5 Searching Internationalized Entries
    • 18.5.5.1 Examples
    • 18.5.5.2 Supported Collation Rules
• 18.6 Adding, Modifying, and Deleting Directory Data
  • 18.6.1 Adding Directory Entries
    • 18.6.1.1 Creating a Root Entry
    • 18.6.1.2 Adding an Entry Using the --defaultAdd Option With ldapmodify
    • 18.6.1.3 Adding Entries Using an LDIF Update Statement With ldapmodify
  • 18.6.2 Adding Attributes
    • 18.6.2.1 Adding an Attribute to an Entry
    • 18.6.2.2 Adding an ACI Attribute
    • 18.6.2.3 Adding an International Attribute
  • 18.6.3 Modifying Directory Entries
    • 18.6.3.1 Modifying an Attribute Value
    • 18.6.3.2 Modifying an Attribute With Before and After Snapshots
    • 18.6.3.3 Deleting an Attribute
    • 18.6.3.4 Changing an RDN
    • 18.6.3.5 Moving an Entry
  • 18.6.4 Deleting Directory Entries
    • 18.6.4.1 Deleting an Entry Using ldapmodify
    • 18.6.4.2 Deleting an Entry Using ldapdelete
    • 18.6.4.3 Deleting Multiple Entries Using a DN File
• 18.7 Indexing Directory Data
  • 18.7.1 Configuring Indexes on the Local DB Back End
    • 18.7.1.1 Creating a New Local DB Index
  • 18.7.2 Configuring VLV Indexes
    • 18.7.2.1 Creating a New VLV Index
• 18.8 Reducing Stored Data Size
  • 18.8.1 Enabling or Disabling Compact Encoding
  • 18.8.2 Enabling or Disabling Entry Compression
  • 18.8.3 Saving Database Space Using Tokens for Attribute Values
• 18.9 Configuring Selective Attribute Caching
  • 18.9.1 What is Selective Attribute Caching?
  • 18.9.2 Configuring the Attributes
  • 18.9.3 Monitoring
• 18.10 Ensuring Attribute Value Uniqueness
  • 18.10.1 Overview of the Unique Attribute Plug-In
  • 18.10.2 Configuring the Unique Attribute Plug-In Using dsconfig
    • 18.10.2.1 Ensuring Uniqueness of the uid Attribute Value
    • 18.10.2.2 Ensuring Uniqueness of Any Other Attribute Value
  • 18.10.3 Ensuring Unique Attribute Values in a Replication Environment
• 18.11 Configuring Virtual Attributes
  • 18.11.1 Configuring Virtual Attributes Using dsconfig
    • 18.11.1.1 Listing the Existing Virtual Attributes Using dsconfig
    • 18.11.1.2 Creating a New Virtual Attribute Using dsconfig
    • 18.11.1.3 Enabling or Disabling a Virtual Attribute Using dsconfig
    • 18.11.1.4 Viewing the Configuration of a Virtual Attribute Using dsconfig
    • 18.11.1.5 Changing the Configuration of a Virtual Attribute Using dsconfig
  • 18.11.2 Configuring Virtual Attributes Using ODSM
    • 18.11.2.1 Listing Existing Virtual Attributes Using ODSM
    • 18.11.2.2 Creating Virtual Attributes Using ODSM
    • 18.11.2.3 Viewing the Configuration of a Virtual Attribute Using ODSM
    • 18.11.2.4 Changing the Configuration of a Virtual Attribute Using ODSM
    • 18.11.2.5 Enabling or Disabling a Virtual Attribute Using ODSM
• 18.12 Using LDAP Subentries
  • 18.12.1 Relative Subtrees
• 18.13 Using Collective Attributes
  • 18.13.1 Extensions to the Collective Attributes Standard
    • 18.13.1.1 Naming Collective Attributes
    • 18.13.1.2 Collective Attributes and Conflict Resolution
    • 18.13.1.3 Excluding Collective Attributes From Specific Entries
  • 18.13.2 Configuring Collective Attributes
    • 18.13.2.1 Creating a New Collective Attribute
    • 18.13.2.2 Deleting a Collective Attribute
    • 18.13.2.3 Listing the Collective Attributes That Apply to an Entry
  • 18.13.3 Inherited Collective Attributes
    • 18.13.3.1 Specifying Inherited Collective Attributes
• 18.14 Configuring Referrals
  • 18.14.1 Referrals in a Replicated Topology
  • 18.14.2 Configuring the Referral List Manually
  • 18.14.3 Smart Referrals
    • 18.14.3.1 Configuring a Smart Referral
    • 18.14.3.2 Modifying a Smart Referral
    • 18.14.3.3 Deleting a Smart Referral
  • 18.14.4 LDAP URLs
    • 18.14.4.1 Example LDAP URLs
• 18.15 Retaining Case Sensitivity in Attributes During Upgrade
• 18.16 Managing Data Using ODSM
  • 18.16.1 Viewing Entries
  • 18.16.2 Viewing the Attributes of an Entry
  • 18.16.3 Searching for Entries
  • 18.16.4 Adding an Entry
  • 18.16.5 Adding an Entry Based on an Existing Entry
  • 18.16.6 Deleting an Entry
  • 18.16.7 Deleting an Entry and Its Subtree
  • 18.16.8 Modifying an Entry's RDN
  • 18.16.9 Importing Data From an LDIF File
  • 18.16.10 Exporting Data to an LDIF File

19 Managing Users and Groups

• 19.1 Managing User Accounts
  • 19.1.1 Changing Passwords
    • 19.1.1.1 Changing the Directory Manager's Password
    • 19.1.1.2 Resetting and Generating a New Password for a User
    • 19.1.1.3 Changing a User's Password
  • 19.1.2 Managing a User's Account Information
    • 19.1.2.1 Viewing a User's Account Information
    • 19.1.2.2 Viewing Account Status Information
    • 19.1.2.3 Disabling an Account
    • 19.1.2.4 Enabling an Account
    • 19.1.2.5 Enabling an Account Using orclIsEnabled
  • 19.1.3 Setting Resource Limits on a User Account
    • 19.1.3.1 Setting Resource Limits on an Account
• 19.2 Configuring Root Users
  • 19.2.1 Configuring Root Users Using the Command-Line Utilities
    • 19.2.1.1 Changing the Global Root User Privileges
    • 19.2.1.2 Creating a New Root User
    • 19.2.1.3 Editing an Existing Root User
  • 19.2.2 Configuring Root Users Using ODSM
    • 19.2.2.1 Configuring the Global Root User Privileges
    • 19.2.2.2 Creating a New Root User
    • 19.2.2.3 Editing an Existing Root User
• 19.3 Defining Groups
  • 19.3.1 Defining Static Groups
    • 19.3.1.1 Creating a Static Group With groupOfNames
    • 19.3.1.2 Creating a Static Group With groupOfUniqueNames
    • 19.3.1.3 Creating a Static Group With groupOfEntries
    • 19.3.1.4 Viewing All Members of a Static Group
    • 19.3.1.5 Viewing All Static Groups of Which a User Is a Member
    • 19.3.1.6 Determining Whether a User is a Member of a Group
  • 19.3.2 Defining Dynamic Groups
    • 19.3.2.1 Creating a Dynamic Group
    • 19.3.2.2 Viewing All Members of a Dynamic Group
    • 19.3.2.3 Viewing All Dynamic Groups of Which a User Is a Member
    • 19.3.2.4 Determining Whether a User Is a Member of a Dynamic Group
  • 19.3.3 Defining Virtual Static Groups
    • 19.3.3.1 Creating a Virtual Static Group
    • 19.3.3.2 Viewing All Members of a Virtual Static Group
    • 19.3.3.3 Viewing All Virtual Static Groups of Which a User Is a Member
    • 19.3.3.4 Determining Whether a User is a Member of a Virtual Static Group
  • 19.3.4 Defining Nested Groups
    • 19.3.4.1 Creating a Nested Group
• 19.4 Maintaining Referential Integrity
  • 19.4.1 Overview of the Referential Integrity Plug-In
  • 19.4.2 Enabling the Referential Integrity Plug-In
• 19.5 Simulating ODSEE Roles in an Oracle Unified Directory Server
  • 19.5.1 Determining Whether a User is a Member of a Role
  • 19.5.2 Altering Membership Using the nsRoleDN Attribute

Part IV Configuring Proxy, Distribution, and Virtualization Functionality

20 Configuring Access to Remote Data Sources

• 20.1 Configuring Access to Identity Data Stored in an RDBMS
  • 20.1.1 Understanding the RDBMS Workflow Element Use Case
    • 20.1.1.1 LDAP Clients
    • 20.1.1.2 Oracle Unified Directory Proxy Server
    • 20.1.1.3 RDBMS Workflow Element and Supporting Components
    • 20.1.1.4 Oracle Database
  • 20.1.2 Before You Begin Configuring the RDBMS Workflow Element
    • 20.1.2.1 Setting Up an Oracle Unified Directory Proxy Server
    • 20.1.2.2 Installing a JDBC Driver JAR File for the RDBMS
  • 20.1.3 Creating the Components to Communicate with the RDBMS
    • 20.1.3.1 Creating an RDBMS Extension
    • 20.1.3.2 Creating an RDBMS Workflow Element
    • 20.1.3.3 Creating a Workflow for the RDBMS Entries
    • 20.1.3.4 Creating an Access Control Group for the RDBMS Workflow
    • 20.1.3.5 Associating the Workflow to a Network Group
    • 20.1.3.6 Configuring the LDAP-SQL Mappings
  • 20.1.4 Granting Access to the Virtual Data
• 20.2 Configuring Communication With Remote LDAP Servers
  • 20.2.1 Configuring LDAP Server Extensions
    • 20.2.1.1 Viewing the Existing LDAP Server Extensions
    • 20.2.1.2 Viewing LDAP Server Extension Properties
    • 20.2.1.3 Viewing Advanced LDAP Server Extension Properties
    • 20.2.1.4 Creating an LDAP Server Extension
    • 20.2.1.5 Modifying the Properties of an LDAP Server Extension
    • 20.2.1.6 Modifying the Advanced Properties of an LDAP Server Extension
    • 20.2.1.7 Modifying the LDAP Data Source Monitoring Connection Properties
  • 20.2.2 Configuring Proxy LDAP Workflow Elements
    • 20.2.2.1 Viewing the Existing Proxy LDAP Workflow Elements
    • 20.2.2.2 Viewing the Properties of a Proxy LDAP Workflow Element
    • 20.2.2.3 Creating a Proxy LDAP Workflow Element
    • 20.2.2.4 Modifying the Properties of a Proxy LDAP Workflow Element
  • 20.2.3 Configuring the Bind Mode
    • 20.2.3.1 Configuring the Bind Mode Parameters to Optimize the Server

21 Configuring Load Balancing Using the Proxy

• 21.1 Configuring Load Balancing Using the dsconfig Command
  • 21.1.1 Creating a Load Balancing Workflow Element
  • 21.1.2 Creating a Load Balancing Algorithm
  • 21.1.3 Creating Load Balancing Routes
  • 21.1.4 Modifying Load Balancing Properties
    • 21.1.4.1 Setting the Priority in a Failover Algorithm
    • 21.1.4.2 Setting the switch-back Flag
    • 21.1.4.3 Setting the Saturation Precision for the Optimal or Saturation Algorithm
    • 21.1.4.4 Setting the Weight of a Proportional Algorithm
    • 21.1.4.5 Setting the Threshold for a Saturation Algorithm
    • 21.1.4.6 Setting the Saturation Threshold Alert
    • 21.1.4.7 Setting Client Connection Affinity
    • 21.1.4.8 Deleting Load Balancing Elements
• 21.2 Configuring Load Balancing Using ODSM

22 Configuring Distribution Using the Proxy

• 22.1 Configuring Distribution Using the dsconfig Command
  • 22.1.1 Creating a Distribution Workflow Element
  • 22.1.2 Creating a Distribution Algorithm
  • 22.1.3 Creating Distribution Partitions
    • 22.1.3.1 Creating a capacity Distribution Partition
    • 22.1.3.2 Creating a lexico or numeric Distribution Partition
    • 22.1.3.3 Creating a dnpattern Distribution Partition
    • 22.1.3.4 DN Pattern String Syntax
    • 22.1.3.5 Using DN Pattern negative-match
  • 22.1.4 Managing Modify DN Requests
  • 22.1.5 Configuring Criticality in Workflows Using dsconfig
  • 22.1.6 Configuring Criticality in Workflow Elements Using dsconfig
  • 22.1.7 Deleting a Distribution Configuration
• 22.2 Configuring Distribution Using ODSM
  • 22.2.1 Configuring Criticality in Workflows Using ODSM

23 Configuring Integration Using the Proxy

• 23.1 Retrieving All Attribute Values from an Active Directory Server
  • 23.1.1 Configuring Active Directory Paging Workflow Elements
  • 23.1.2 Scanning Specific Attributes Returned by an Active Directory
• 23.2 Integrating with Enterprise User Security Databases
• 23.3 Updating User Passwords Stored in Active Directory
  • 23.3.1 Setting Up an Oracle Unified Directory Proxy Server
  • 23.3.2 Creating and Configuring an Ad Password Workflow Element
    • 23.3.2.1 Configuring an Ad Password Workflow Element When SSL is Required for Only Password Modifications
    • 23.3.2.2 Configuring an Ad Password Workflow Element When SSL is Required for All LDAP Operations
  • 23.3.3 Creating a Workflow for the Ad Password Workflow Element
  • 23.3.4 Adding the Workflow to a Network Group
• 23.4 Configuring Pass-Through Authentication
  • 23.4.1 Prerequisites for Configuring Pass-Through Authentication
  • 23.4.2 Best Practices for Configuring Pass-Through Authentication
  • 23.4.3 Configuring Pass-Through Authentication Using dsconfig
    • 23.4.3.1 Configuring Pass-Through Authentication for Different Servers
    • 23.4.3.2 Configuring Pass-Through Authentication for a Kerberos Server
  • 23.4.4 Configuring Pass-Through Authentication Using ODSM
• 23.5 Configuring Oracle Unified Directory Plug-Ins
• 23.6 Configuring a Proxy Instance to Monitor Back-End Servers
• 23.7 Configuring Global Indexes Using the Command Line
  • 23.7.1 Configuring Global Index Catalogs Using gicadm
    • 23.7.1.1 Creating a Global Index Catalog Containing Global Indexes
    • 23.7.1.2 Viewing Global Index Catalog Properties
    • 23.7.1.3 Modifying the Global Index Catalog Properties
    • 23.7.1.4 Modifying the Global Index Catalog Properties
    • 23.7.1.5 Modifying Multi-Valued Global Index Catalog Properties
    • 23.7.1.6 Resetting Global Index Catalog Properties to the Default Values
    • 23.7.1.7 Viewing Global Index Properties
    • 23.7.1.8 Importing Content into a Global Index Catalog
    • 23.7.1.9 Exporting Contents of a Global Index Catalog to a Directory
    • 23.7.1.10 Associating a Global Index Catalog With a Distribution Element
    • 23.7.1.11 Disassociating a Global Index Catalog From a Distribution Element
    • 23.7.1.12 Adding a Global Index to a Global Index Catalog
    • 23.7.1.13 Removing a Global Index From a Global Index Catalog
  • 23.7.2 Replicating Global Index Catalogs
    • 23.7.2.1 Creating a Replicated Topology and Enable Global Index Catalog Replication
    • 23.7.2.2 Enabling Global Index Catalog Replication
    • 23.7.2.3 Initializing Global Index Catalog Replication
    • 23.7.2.4 Disabling Global Index Catalog Replication
    • 23.7.2.5 Viewing the Status of a Replicated Global Index Catalog Configuration
    • 23.7.2.6 Logging of Replication Activities
    • 23.7.2.7 Lifecycle Examples for Replicated Global Index Catalogs
  • 23.7.3 Configuring Controls Required by the Global Index Catalog with Oracle Unified Directory
• 23.8 Configuring Virtual ACIs
  • 23.8.1 Configuring Virtual ACIs Using dsconfig
    • 23.8.1.1 Enabling Virtual ACIs for a Workflow
    • 23.8.1.2 Disabling Virtual ACIs for a Workflow
    • 23.8.1.3 Configuring Replication for Virtual ACIs
  • 23.8.2 Configuring Access Control Groups Using ODSM

24 Configuring Virtualization

• 24.1 Configuring a Virtual Directory View of Your Repositories
  • 24.1.1 Before You Begin
  • 24.1.2 Creating a Join Workflow Element Using the dsconfig Command
  • 24.1.3 Creating a Join Workflow Element Using ODSM
• 24.2 Optimizing Search Results From a Virtual Directory
  • 24.2.1 Eliminating Duplicate Entries from Search Results Using the GetRidofDuplicate Workflow Element
    • 24.2.1.1 Sample Configuration
    • 24.2.1.2 Configuration Parameter
  • 24.2.2 Filtering Search Results Using the HideByFilter Workflow Element
    • 24.2.2.1 Configuration Parameters
• 24.3 Adding the memberof User Attribute to person Entries
• 24.4 Configuring DN Renaming
  • 24.4.1 Creating a DN Renaming Workflow Element
  • 24.4.2 Modifying a DN Renaming Configuration
• 24.5 Configuring RDN Changing
  • 24.5.1 Creating an RDN Changing Workflow Element
  • 24.5.2 Modifying RDN Values
• 24.6 Configuring Transformations
  • 24.6.1 Overview of the Configuration Model
  • 24.6.2 Configuring Transformation Using dsconfig
  • 24.6.3 Configuring Transformations Using ODSM
    • 24.6.3.1 Creating Transformations
    • 24.6.3.2 Modifying Transformations
    • 24.6.3.3 Deleting Transformations
    • 24.6.3.4 Selecting Values from Value Definition Screen

25 Example Proxy, Distribution, and Virtualization Configurations

• 25.1 Configuring Load Balancing Example
  • 25.1.1 Creating the Objects for Simple Load Balancing
  • 25.1.2 Configuring Simple Load Balancing
• 25.2 Configuring Distribution Example
  • 25.2.1 Creating the Objects for Simple Distribution
  • 25.2.2 Configuring a Simple Distribution Deployment
• 25.3 Configuring Distribution with Load Balancing Example
  • 25.3.1 Creating the Objects for Distribution with Load Balancing
  • 25.3.2 Configuring a Distribution with Load Balancing Deployment
• 25.4 Configuring Failover Between Data Centers Example
• 25.5 Configuring Distribution with Failover Between Data Centers Example

Part V Advanced Administration: Security, Access Control, and Password Policies

26 Configuring Security Between Clients and Servers

• 26.1 Getting SSL Up and Running Quickly
  • 26.1.1 Setting Up SSL Using an Existing Private Key and Certificate
  • 26.1.2 Accepting SSL-Based Connections Using a Self-Signed Certificate
• 26.2 Configuring Key Manager Providers
  • 26.2.1 Key Manager Provider Overview
  • 26.2.2 Using the JKS Key Manager Provider
    • 26.2.2.1 Generating the Private Key
    • 26.2.2.2 Self-Signing the Certificate
    • 26.2.2.3 Signing the Certificate Using an External Certificate Authority
    • 26.2.2.4 Configuring the JKS Key Manager Provider
  • 26.2.3 Using the PKCS #12 Key Manager Provider
  • 26.2.4 Using the PKCS #11 Key Manager Provider
  • 26.2.5 Using the Hardware-Based Key Manager Provider
  • 26.2.6 Replacing a Certificate in a Production Server
  • 26.2.7 Configuring Key Managers Using ODSM
• 26.3 Configuring Trust Manager Providers
  • 26.3.1 Overview of Certificate Trust Mechanisms
  • 26.3.2 Using the Blind Trust Manager Provider
  • 26.3.3 Using the JKS Trust Manager Provider
  • 26.3.4 Using the PKCS #12 Trust Manager Provider
  • 26.3.5 Configuring Trust Managers Using ODSM
• 26.4 Configuring Certificate Mappers
  • 26.4.1 Using the Subject Equals DN Certificate Mapper
  • 26.4.2 Using the Subject Attribute to User Attribute Certificate Mapper
  • 26.4.3 Using the Subject DN to User Attribute Certificate Mapper
  • 26.4.4 Using the Fingerprint Certificate Mapper
• 26.5 Configuring SSL and StartTLS for LDAP and JMX
  • 26.5.1 Configuring the LDAP and LDAPS Connection Handlers
    • 26.5.1.1 Enabling a Connection Handler
    • 26.5.1.2 Specifying a Connection Handler's Listening Port
    • 26.5.1.3 Specifying a Connection Handler's Authorization Policy
    • 26.5.1.4 Specifying a Nickname for a Connection Handler's Certificate
    • 26.5.1.5 Specifying a Connection Handler's Key Manager Provider
    • 26.5.1.6 Specifying a Connection Handler's Trust Manager Provider
    • 26.5.1.7 Enabling StartTLS Support
    • 26.5.1.8 Enabling SSL-Based Communication
  • 26.5.2 Enabling SSL in the JMX Connection Handler
• 26.6 Using SASL Authentication
  • 26.6.1 Supported SASL Mechanisms
  • 26.6.2 Authorization IDs
  • 26.6.3 SASL Options for the ANONYMOUS Mechanism
  • 26.6.4 SASL Options for the CRAM-MD5 Mechanism
  • 26.6.5 SASL Options for the DIGEST-MD5 Mechanism
  • 26.6.6 SASL Options for the EXTERNAL Mechanism
  • 26.6.7 SASL Options for the GSSAPI Mechanism
  • 26.6.8 SASL Options for the PLAIN Mechanism
• 26.7 Configuring SASL Authentication
  • 26.7.1 Configuring SASL External Authentication
    • 26.7.1.1 Configuring the LDAP Connection Handler to Allow SASL EXTERNAL Authentication
    • 26.7.1.2 Configuring the EXTERNAL SASL Mechanism Handler
  • 26.7.2 Configuring SASL DIGEST-MD5 Authentication
  • 26.7.3 Configuring SASL GSSAPI Authentication
• 26.8 Configuring Kerberos and the Oracle Unified Directory Server for GSSAPI SASL Authentication
  • 26.8.1 Configuring Kerberos V5 on a Host
  • 26.8.2 Specifying SASL Options for Kerberos Authentication
  • 26.8.3 Example Configuration of Kerberos Authentication Using GSSAPI With SASL
    • 26.8.3.1 Assumptions for This Example
    • 26.8.3.2 All Machines: Edit the Kerberos Client Configuration File
    • 26.8.3.3 All Machines: Edit the Administration Server ACL Configuration File
    • 26.8.3.4 KDC Machine: Edit the KDC Server Configuration File
    • 26.8.3.5 KDC Machine: Create the KDC Database
    • 26.8.3.6 KDC Machine: Create an Administration Principal and Keytab
    • 26.8.3.7 KDC Machine: Start the Kerberos Daemons
    • 26.8.3.8 KDC Machine: Add Host Principals for the KDC and Oracle Unified Directory Machines
    • 26.8.3.9 KDC Machine: Add an LDAP Principal for the Directory Server
    • 26.8.3.10 KDC Machine: Add a Test User to the KDC
    • 26.8.3.11 Directory Server Machine: Install Oracle Unified Directory
    • 26.8.3.12 Directory Server Machine: Create and Configure the Directory Server LDAP
    • 26.8.3.13 Directory Server Machine: Configure the Directory Server to Enable GSSAPI
    • 26.8.3.14 Directory Server Machine: Add a Test User to the Directory Server
    • 26.8.3.15 Directory Server Machine: Obtain a Kerberos Ticket as the Test User
    • 26.8.3.16 Client Machine: Authenticate to the Directory Server Through GSSAPI
  • 26.8.4 Creating a Kerberos Workflow Element Using dsconfig
  • 26.8.5 Troubleshooting Kerberos Configuration
• 26.9 Testing SSL, StartTLS, and SASL Authentication With ldapsearch
  • 26.9.1 ldapsearch Command Line Arguments Applicable To Security
  • 26.9.2 Testing SSL
  • 26.9.3 Testing StartTLS
  • 26.9.4 Testing SASL External Authentication
• 26.10 Debugging SSL Using OpenSSL s_client Test Utility
  • 26.10.1 Scenario 1- Connection Refused
  • 26.10.2 Scenario 2- Verify Return Code: 18 (Self Signed Certificate)
  • 26.10.3 Scenario 3 - Verify Return Code: 0 (ok)
  • 26.10.4 Scenario 4 - SSLHandshakeException
  • 26.10.5 Scenario 5 - SASL EXTERNAL Bind Request Could Not Be Processed
• 26.11 Debugging SSL or TLS Using Java Debug Information
  • 26.11.1 Enabling SSL Debug Recording
  • 26.11.2 Disabling SSL Debug Recording
• 26.12 Controlling Connection Access Using Allowed and Denied Rules
  • 26.12.1 Property Syntax of Allowed and Denied Client Rules
  • 26.12.2 Configuring Allowed and Denied Client Rules
• 26.13 Configuring Unlimited Strength Cryptography

27 Configuring Security Between the Proxy and the Data Source

• 27.1 How the Proxy Manages Secure Connections
• 27.2 Modes of Secure Connection
  • 27.2.1 The always Secure Mode
  • 27.2.2 The never Secure Mode
  • 27.2.3 The user Secure Mode
• 27.3 Configuring Security Between the Proxy and Data Source Using dsconfig
  • 27.3.1 Configuring Security Between the Proxy and Directory Servers Using dsconfig
  • 27.3.2 Configurable LDAP Extension Properties Relevant to Security

28 Controlling Access To Data

• 28.1 Managing Global ACIs Using dsconfig
  • 28.1.1 Default Global ACIs
  • 28.1.2 Displaying the Global ACIs
  • 28.1.3 Deleting a Global ACI
  • 28.1.4 Adding a Global ACI
• 28.2 Managing ACIs With ldapmodify
  • 28.2.1 Viewing ACI Attribute Values
  • 28.2.2 Adding an ACI
  • 28.2.3 Removing an ACI
• 28.3 Managing Access Control Using ODSM
  • 28.3.1 Displaying the Configured ACIs
  • 28.3.2 Creating an Access Control Point
  • 28.3.3 Creating an Access Control Point Based on an Existing Access Control Point
  • 28.3.4 Deleting an Access Control Point
  • 28.3.5 Adding an ACI
  • 28.3.6 Adding an ACI Based on an Existing ACI
  • 28.3.7 Modifying an ACI
• 28.4 Managing Macro ACIs Using ODSM
  • 28.4.1 Editing a Target
  • 28.4.2 Editing a Target Filter
  • 28.4.3 Editing Bind Rules for User DN or Group DN
  • 28.4.4 Editing Bind Rules for User Attributes
• 28.5 Access Control Usage Examples
  • 28.5.1 Disabling Anonymous Access
  • 28.5.2 Granting Write Access to Personal Entries
    • 28.5.2.1 Granting Write Access Based on DNS
    • 28.5.2.2 Granting Write Access Based on Authentication Method
  • 28.5.3 Granting a Group Full Access to a Suffix
  • 28.5.4 Granting Rights to Add and Delete Group Entries
    • 28.5.4.1 Creating a "Create Group" ACI
    • 28.5.4.2 Creating a "Delete Group" ACI
  • 28.5.5 Allowing Users to Add or Remove Themselves From a Group
  • 28.5.6 Granting Conditional Access to a Group
  • 28.5.7 Denying Access
  • 28.5.8 Defining Permissions for DNs That Contain a Comma
• 28.6 Proxy Authorization ACIs
• 28.7 Viewing Effective Rights
  • 28.7.1 The Get Effective Rights Control
  • 28.7.2 Using the Get Effective Rights Control
  • 28.7.3 Understanding Effective Rights Results
    • 28.7.3.1 Rights Information
    • 28.7.3.2 write, selfwrite_add, and selfwrite_delete Permissions
    • 28.7.3.3 Logging Information
  • 28.7.4 Restricting Access to the Get Effective Rights Control

29 Managing Administrative Users

• 29.1 Before You Begin
• 29.2 About Root Users
  • 29.2.1 Working With Multiple Root Users
  • 29.2.2 Root Users and the Privilege Subsystem
• 29.3 Managing Root Users With dsconfig
  • 29.3.1 Viewing the Default Root User Privileges
  • 29.3.2 Editing the Default Root User Privileges
  • 29.3.3 Creating a Root User
  • 29.3.4 Changing a Root User's Password
  • 29.3.5 Changing a Root User's Privileges
• 29.4 Setting Root User Resource Limits
• 29.5 Managing Administrators
  • 29.5.1 Viewing the Global Administrator Entry
  • 29.5.2 Creating Administrators with Limited Privileges

30 Managing Password Policies

• 30.1 Understanding Password Policy Components
• 30.2 Working with the Default Password Policy Properties
  • 30.2.1 Viewing the Properties of the Default Password Policy
  • 30.2.2 Modifying the Default Password Policy
• 30.3 Working with Attributes for Password Policy State Information
• 30.4 Working with Attributes Used in the pwdPolicy ObjectClass
• 30.5 Understanding Password Policies in a Replicated Environment
• 30.6 Managing Password Policies by Using the Command Line
  • 30.6.1 Configuring the Default Password Policy
  • 30.6.2 Creating a New Password Policy
  • 30.6.3 Creating a First Login Password Policy
  • 30.6.4 Assigning a Password Policy to an Individual Account
  • 30.6.5 Preventing Password Policy Modifications
  • 30.6.6 Assigning a Password Policy to a Group of Users
  • 30.6.7 Defining a Password Policy as an LDAP Subentry
  • 30.6.8 Deleting a Password Policy
• 30.7 Managing Password Policies Using ODSM
  • 30.7.1 Listing the Configured Password Policy Subentries
  • 30.7.2 Creating a Password Policy Subentry
  • 30.7.3 Creating a Password Policy Subentry Based on an Existing Password Policy Subentry
  • 30.7.4 Deleting a Password Policy Subentry
  • 30.7.5 Displaying the Configured Password Policies
  • 30.7.6 Modifying a Password Policy
  • 30.7.7 Creating a Password Policy
  • 30.7.8 Creating a Password Policy Based on an Existing Password Policy
  • 30.7.9 Deleting a Password Policy
  • 30.7.10 Displaying the Supported Password Storage Schemes
  • 30.7.11 Enabling or Disabling a Password Storage Scheme
• 30.8 Managing Password Validators
  • 30.8.1 Managing Password Validators by Using the Command Line
    • 30.8.1.1 Displaying the Available Password Validators
    • 30.8.1.2 Displaying the Properties of a Password Validator
    • 30.8.1.3 Enabling or Disabling a Password Validator
    • 30.8.1.4 Configuring the Values of a Password Validator
    • 30.8.1.5 Associating a Password Validator With a Password Policy
  • 30.8.2 Managing Password Validators Using ODSM
    • 30.8.2.1 Displaying the Available Password Validators
    • 30.8.2.2 Displaying the Properties of a Password Validator
    • 30.8.2.3 Enabling or Disabling a Password Validator
    • 30.8.2.4 Configuring the Properties of a Password Validator
    • 30.8.2.5 Associating a Password Validator With a Password Policy
• 30.9 Managing Password Generators
  • 30.9.1 Displaying the Configured Password Generators
  • 30.9.2 Displaying the Properties of a Password Generator
  • 30.9.3 Enabling or Disabling a Password Generator
  • 30.9.4 Configuring the Properties of a Password Generator
  • 30.9.5 Associating a Password Generator With a Password Policy

31 Integrating Oracle Unified Directory with Oracle Enterprise User Security

• 31.1 Understanding How Oracle Enterprise User Security Works with Oracle Unified Directory
• 31.2 Before You Begin
• 31.3 Enabling Oracle Unified Directory and Oracle Enterprise User Security to Work Together
  • 31.3.1 Configuring Oracle Directory Server as a Directory for Enterprise User Security
    • 31.3.1.1 Task 1: Configure Oracle Unified Directory to Work with Enterprise User Security
    • 31.3.1.2 Task 2: Configure the User and Groups Location
    • 31.3.1.3 Task 3: Select the Oracle Context to be Used by Enterprise User Security
    • 31.3.1.4 Task 4: Register the Database in the LDAP Server
    • 31.3.1.5 Task 5: Configure Roles and Permissions
    • 31.3.1.6 Task 6: Test the Database Configurations
  • 31.3.2 Configuring Oracle Unified Directory Proxy to Work with an External LDAP Directory and Enterprise User Security
    • 31.3.2.1 Task 1: Configure User Identities in the External LDAP Directory
    • 31.3.2.2 Task 2: Configure Oracle Unified Directory Proxy to Work with Enterprise User Security
    • 31.3.2.3 Task 3: Configure the Users and Groups Location
    • 31.3.2.4 Task 4: Select the Oracle Context to be Used By Enterprise User Security
    • 31.3.2.5 Task 5: Register the Database in the LDAP Server
    • 31.3.2.6 Task 6: Configure Roles and Permissions
    • 31.3.2.7 Task 7: Test the Database Configurations
• 31.4 Using Additional Enterprise User Security Configuration Options
  • 31.4.1 Configuring OUD to Support Multiple Enterprise User Security Domains
  • 31.4.2 Using Oracle Unified Directory and Enterprise User Security in High Availability Topologies
• 31.5 Understanding Enterprise User Security Password Warnings
• 31.6 Troubleshooting
  • 31.6.1 Net Configuration Assistant (NetCA) Tool Problems and Solutions
    • 31.6.1.1 LDAP Server Connection Error
    • 31.6.1.2 Schema Error
    • 31.6.1.3 Naming Context Error
  • 31.6.2 Database Configuration Assistant (DBCA) Problems and Solutions
    • 31.6.2.1 TNS-04409 error / TNS-04427: SSL access to the Directory Server
    • 31.6.2.2 TNS-04409 error / TNS-04431: Required suffixes
    • 31.6.2.3 TNS-04411 error when registering the DB with a user different from cn=directory manager
    • 31.6.2.4 TNS-04409 error / TNS-04405
  • 31.6.3 Oracle SQL Problems and Solutions
    • 31.6.3.1 ORA-28030: Server encountered problems accessing LDAP directory service
    • 31.6.3.2 ORA-01017: invalid username/password; logon denied
    • 31.6.3.3 ORA-28274: No ORACLE password attribute corresponding to user nickname exists
    • 31.6.3.4 ORA-28051: the account is locked

Part VI Advanced Administration: Data Replication, Schema Management, and Moving Across Environments

32 Replicating Directory Data

• 32.1 Before You Begin Configuring Replication
• 32.2 Configuring Data Replication With dsreplication
  • 32.2.1 Enabling Replication Between Two Servers
    • 32.2.1.1 Controlling Where Replication Servers are Created
  • 32.2.2 Initializing a Replicated Server
  • 32.2.3 Initializing an Entire Topology
  • 32.2.4 Testing Replication
  • 32.2.5 Obtaining the Status of a Replicated Topology
  • 32.2.6 Merging Two Existing Replicated Topologies
  • 32.2.7 Disabling Replication For a Specific Replication Domain
    • 32.2.7.1 Notes About Disabling the Replication Server
• 32.3 Configuring Data Replication Using ODSM
  • 32.3.1 Viewing or Modifying an Existing Replication Server Configuration
  • 32.3.2 Viewing or Modifying a Replicated Suffix Configuration
  • 32.3.3 Launching the Replication Configuration Wizard from the Directory Manager Tab
    • 32.3.3.1 Creating a New Topology from Scratch
    • 32.3.3.2 Adding a Server to an Existing Topology
  • 32.3.4 Launching the Replication Configuration Wizard from the Topology Manager Tab
    • 32.3.4.1 Creating a New Topology from Scratch
    • 32.3.4.2 To Manage an Existing Replication Topology
• 32.4 Configuring Large Replication Topologies
  • 32.4.1 Configuring a Dedicated Replication Server
• 32.5 Modifying the Replication Configuration With dsconfig
  • 32.5.1 Retrieving the Replication Domain Name
  • 32.5.2 Changing the Replication Purge Delay
    • 32.5.2.1 How Replication Changes Are Purged
    • 32.5.2.2 Changing the Replication Purge Delay
  • 32.5.3 Changing the Window Size
    • 32.5.3.1 Changing the Window Size
  • 32.5.4 Changing the Initialization Window Size
    • 32.5.4.1 Changing the Initialization Window Size
  • 32.5.5 Changing the Heartbeat Interval
    • 32.5.5.1 Changing the Heartbeat Interval
  • 32.5.6 Changing the Isolation Policy
    • 32.5.6.1 Changing the Isolation Policy
  • 32.5.7 Configuring Encrypted Replication
  • 32.5.8 Configuring Replication Groups
    • 32.5.8.1 Configuring a Replication Group
  • 32.5.9 Configuring Assured Replication
    • 32.5.9.1 Configuring Assured Replication in Safe Data Mode
    • 32.5.9.2 Configuring Assured Replication in Safe Read Mode
  • 32.5.10 Configuring Fractional Replication
    • 32.5.10.1 Configuring Exclusive Fractional Replication
    • 32.5.10.2 Configuring Inclusive Fractional Replication
    • 32.5.10.3 Configuring and Initialize a Fractional Domain
  • 32.5.11 Configuring Replication Status
    • 32.5.11.1 Configuring the Degraded Status Threshold
  • 32.5.12 Configuring the Replication Server Weight
• 32.6 Initializing a Replicated Server With Data
  • 32.6.1 Initializing a Single Replicated Server
  • 32.6.2 Initializing a New Replicated Topology
  • 32.6.3 Adding a Directory Server to an Existing Replicated Topology
  • 32.6.4 Changing the Data Set in an Existing Replicated Topology
    • 32.6.4.1 Changing the Data Set With import-ldif or Binary Copy
  • 32.6.5 Appending Data in an Existing Replicated Topology
• 32.7 Using the External Change Log
  • 32.7.1 Enabling the External Change Log
  • 32.7.2 External Change Log APIs
  • 32.7.3 How a Client Application Uses the External Change Log in Cookie Mode
  • 32.7.4 Format of External Change Log Entries
  • 32.7.5 Specifying the Attributes to be Included in the External Change Log
  • 32.7.6 Specifying the Attributes to be Excluded in the External Change Log
  • 32.7.7 Initializing Client Applications to Use the External Change Log
    • 32.7.7.1 Initializing a Client Application to Use the External Change Log
    • 32.7.7.2 Reinitializing a Client Application When a Domain is Added
    • 32.7.7.3 Reinitializing a Client Application When a Domain is Removed or Disabled
  • 32.7.8 Controlling Access to the External Change Log
  • 32.7.9 Purging the External Change Log
  • 32.7.10 Disabling the External Change Log on a Server
  • 32.7.11 Disabling the External Change Log for a Specific Domain
  • 32.7.12 Retrieving the last Change Number
  • 32.7.13 Porting Applications That Rely on Other Change Logs
    • 32.7.13.1 Differences Between the ECL and the LDAP Change Log Draft
    • 32.7.13.2 Additional Differences Between the ECL and the Oracle Directory Server Enterprise Edition Retro Change Log
    • 32.7.13.3 API for Compatibility With the LDAP Change Log Draft and the Oracle Directory Server Enterprise Edition Retro Change Log
• 32.8 Managing Tombstones in Oracle Unified Directory
  • 32.8.1 About Tombstone Support
  • 32.8.2 About Tombstone Entries
  • 32.8.3 Enabling or Disabling Tombstone Support
  • 32.8.4 Searching for Tombstone Entries
  • 32.8.5 Purging Tombstone Entries Automatically
  • 32.8.6 Removing Tombstone Entries
• 32.9 Configuring Schema Replication
  • 32.9.1 Specifying the Schema Source
  • 32.9.2 Disabling Schema Replication
    • 32.9.2.1 Specifying That Schema Should Not Be Replicated
    • 32.9.2.2 Disabling Schema Replication
• 32.10 Replicating to a Read-Only Server
  • 32.10.1 Configuring a Replica as Read-Only
• 32.11 Detecting and Resolving Replication Inconsistencies
  • 32.11.1 Types of Replication Inconsistencies
  • 32.11.2 Detecting Inconsistencies
  • 32.11.3 Resolving Inconsistencies
  • 32.11.4 Solving Naming Conflicts
• 32.12 Managing Certificates Using dsreplication
  • 32.12.1 Listing Certificates Using dsreplication list-certs
  • 32.12.2 Regenerating Certificates Using dsreplication regenerate-cert
  • 32.12.3 Providing Certificates Using dsreplication set-cert
  • 32.12.4 Verifying and Fixing Certificates Using dsreplication verify
• 32.13 Verifying and Fixing a Replication Configuration Using dsreplication verify
• 32.14 Purging Historical Replication Data
• 32.15 Using Isolated Replicas
  • 32.15.1 Deployment Scenarios for Isolated Replicas
    • 32.15.1.1 Using Isolated Replicas in a DMZ
    • 32.15.1.2 Using Isolated Replicas for Testing
• 32.16 Replicating Between Oracle Directory Server Enterprise Edition and Oracle Unified Directory
  • 32.16.1 Migrating the Oracle Directory Server Enterprise Edition Schema and Configuration
  • 32.16.2 Configuring Replication Between Oracle Directory Server Enterprise Edition and Oracle Unified Directory
  • 32.16.3 Initializing the Oracle Unified Directory with Oracle Directory Server Enterprise Edition Data

33 Managing Directory Schema

• 33.1 Oracle Unified Directory Schema Overview
  • 33.1.1 Designing and Extending the Schema
  • 33.1.2 Default Schema Files
• 33.2 Configuring Schema Checking
• 33.3 Working With Object Identifiers (OIDs)
  • 33.3.1 Obtaining a Base OID
• 33.4 Extending the Schema
  • 33.4.1 Managing Attribute Types
    • 33.4.1.1 Viewing Attribute Types
    • 33.4.1.2 Creating an Attribute Type
    • 33.4.1.3 Deleting an Attribute Type
  • 33.4.2 Managing Object Classes
    • 33.4.2.1 Viewing Object Classes
    • 33.4.2.2 Creating an Object Class
    • 33.4.2.3 Deleting an Object Class
• 33.5 Replicating the Schema
• 33.6 Managing the Schema Using ODSM
  • 33.6.1 Adding a New Attribute Type
  • 33.6.2 Adding an Attribute Based on an Existing Attribute
  • 33.6.3 Modifying an Attribute
  • 33.6.4 Deleting an Attribute
  • 33.6.5 Viewing All Directory Attributes
  • 33.6.6 Searching for Attributes
  • 33.6.7 Viewing the Indexing Details of an Attribute
  • 33.6.8 Adding a New Object Class
  • 33.6.9 Adding an Object Class Based on an Existing Object Class
  • 33.6.10 Viewing the Properties of an Object Class
  • 33.6.11 Modifying an Object Class
  • 33.6.12 Deleting an Object Class
  • 33.6.13 Searching for Object Classes
  • 33.6.14 Displaying a List of LDAP Syntaxes
  • 33.6.15 Searching for a Syntax
  • 33.6.16 Displaying a List of LDAP Matching Rules
  • 33.6.17 Searching for a Matching Rule
  • 33.6.18 Displaying a List of Content Rules
  • 33.6.19 Searching for a Content Rule
  • 33.6.20 Creating a New Content Rule
  • 33.6.21 Creating a Content Rule Based on an Existing Content Rule
  • 33.6.22 Modifying a Content Rule
  • 33.6.23 Deleting a Content Rule

34 Moving From a Test to a Production Environment

• 34.1 Introduction to Moving Across Environments
• 34.2 Limitations in Moving From Test to Production
• 34.3 Overview of the Test to Production Process
  • 34.3.1 Moving the Binaries
  • 34.3.2 Moving the Configuration
    • 34.3.2.1 Copying the Configuration
    • 34.3.2.2 Editing the Configuration
    • 34.3.2.3 Pasting the Configuration
  • 34.3.3 Moving the Data

Part VII Advanced Administration: Monitoring and Tuning Performance

35 Monitoring Oracle Unified Directory

• 35.1 Monitoring Overview
• 35.2 Configuring Monitor Providers
  • 35.2.1 Viewing Monitor Providers
  • 35.2.2 Disabling a Monitor Provider
• 35.3 Configuring Logs
  • 35.3.1 Configuring Logs Using dsconfig
    • 35.3.1.1 Configuring Log Publishers
    • 35.3.1.2 Configuring Log Retention Policies
    • 35.3.1.3 Configuring Log Rotation Policies
  • 35.3.2 Configuring Logs Using ODSM
    • 35.3.2.1 Modifying Logger Properties
    • 35.3.2.2 Modifying Log Rotation Policies
    • 35.3.2.3 Modifying Log Retention Policies
  • 35.3.3 Logging Operations to Access Log Publishers
    • 35.3.3.1 Overview of the Admin Logger
    • 35.3.3.2 Configuring Logged Operations in Access Log Publishers Using ODSM
  • 35.3.4 Masking Attributes in the Audit Log
• 35.4 Configuring Alerts and Account Status Notification Handlers
  • 35.4.1 Managing Alert Handlers
    • 35.4.1.1 Managing Alert Handlers Using dsconfig
    • 35.4.1.2 Managing Alert Handlers Using ODSM
    • 35.4.1.3 Supported Alert Types
  • 35.4.2 Managing Account Status Notification Handlers
    • 35.4.2.1 Viewing the Configured Account Status Notification Handlers
    • 35.4.2.2 Enabling Account Status Notification Handlers
    • 35.4.2.3 Creating a New Account Status Notification Handler
    • 35.4.2.4 Deleting an Account Status Notification Handler
• 35.5 Monitoring the Server With LDAP
  • 35.5.1 Viewing Monitoring Information Using the cn=monitor Entry
    • 35.5.1.1 Monitored Attributes in the Proxy
    • 35.5.1.2 Viewing the Available Monitoring Information
    • 35.5.1.3 Monitoring General-Purpose Server Information
    • 35.5.1.4 Monitoring System Information
    • 35.5.1.5 Monitoring Version Information
    • 35.5.1.6 Monitoring the User Root Back End
    • 35.5.1.7 Monitoring the Backup Back End
    • 35.5.1.8 Monitoring the Tasks Back End
    • 35.5.1.9 Monitoring the monitor Back End
    • 35.5.1.10 Monitoring the Schema Back End
    • 35.5.1.11 Monitoring the adminRoot Back End
    • 35.5.1.12 Monitoring the ads-truststore Back End
    • 35.5.1.13 Monitoring Client Connections
    • 35.5.1.14 Monitoring the LDAP Connection Handler
    • 35.5.1.15 Monitoring LDAP Connection Handler Statistics
    • 35.5.1.16 Monitoring Connections on the LDAP Connection Handler
    • 35.5.1.17 Monitoring the Administration Connector
    • 35.5.1.18 Monitoring Administration Connector Statistics
    • 35.5.1.19 Monitoring Connections on the Administration Connector
    • 35.5.1.20 Monitoring the LDIF Connection Handler
    • 35.5.1.21 Monitoring the Work Queue
    • 35.5.1.22 Monitoring JVM Stack Trace Information
    • 35.5.1.23 Monitoring the JVM Memory Usage
    • 35.5.1.24 Monitoring the userRoot Database Environment
    • 35.5.1.25 Monitoring the Database Cache
    • 35.5.1.26 Monitoring the Entry Cache
    • 35.5.1.27 Monitoring Network Groups
    • 35.5.1.28 Monitoring Distribution
    • 35.5.1.29 Monitoring Load Balancing
    • 35.5.1.30 Monitoring Remote LDAP Servers
    • 35.5.1.31 Monitoring a Global Index
    • 35.5.1.32 Monitoring a Global Index Catalog
  • 35.5.2 Monitoring Using the manage-tasks Command
  • 35.5.3 Monitoring the Server Using JConsole
    • 35.5.3.1 Configuring JMX on a Server Instance
    • 35.5.3.2 Starting JConsole
    • 35.5.3.3 Accessing a Server Instance From JConsole
    • 35.5.3.4 Viewing Monitoring Information Using JConsole
  • 35.5.4 Accessing Logs
    • 35.5.4.1 Viewing the Access Logs
    • 35.5.4.2 Viewing the Audit Logs
    • 35.5.4.3 Viewing the Debug Logs
    • 35.5.4.4 Viewing the Error Logs
    • 35.5.4.5 Viewing the Replication Repair Logs
    • 35.5.4.6 Viewing the server.out Logs
    • 35.5.4.7 Viewing the Setup Logs
• 35.6 Monitoring the Server With SNMP
  • 35.6.1 Configuring the SNMP Connection Handler and Its Dependencies
    • 35.6.1.1 Configuring SNMP in the Server
    • 35.6.1.2 Viewing the SNMP Connection Handler Properties
    • 35.6.1.3 Accessing SNMP on a Server Instance
    • 35.6.1.4 Configuring SNMP Security Configuration
• 35.7 Monitoring a Replicated Topology
  • 35.7.1 Monitoring Basic Oracle Unified Directory Replication Status Using dsreplication
    • 35.7.1.1 Returning Minimal Basic Replication Status Information
    • 35.7.1.2 Returning Additional Basic Replication Status Information
  • 35.7.2 Monitoring Advanced Oracle Unified Directory Replication Status Using dsreplication
    • 35.7.2.1 Returning a Comprehensive List of Available Replication Status Information
    • 35.7.2.2 Monitoring the Topology and Its Connections
    • 35.7.2.3 Monitoring Replication Latency
    • 35.7.2.4 Monitoring Data Consistency
    • 35.7.2.5 Monitoring Replication Security
    • 35.7.2.6 Monitoring Replicated Updates
    • 35.7.2.7 Monitoring Replication Conflicts
  • 35.7.3 Monitoring Oracle Unified Directory and ODSEE Replication Status in Deployments Using Replication Gateways
    • 35.7.3.1 Using dsreplication to Monitor Changes Made on the Oracle Unified Directory Topology
    • 35.7.3.2 Using the DSCC to Monitor a Replication Gateway
• 35.8 Monitoring the Proxy LDAP Connector
• 35.9 General Purpose Enterprise Monitoring Solutions
  • 35.9.1 General UNIX Monitoring Tools
  • 35.9.2 Solaris Monitoring Tools
  • 35.9.3 HP-UX Monitoring Tools

36 Tuning Performance

• 36.1 Assessing Performance Problems
• 36.2 General Performance Tuning
• 36.3 Tuning Java Virtual Machine Settings Using dsjavaproperties Utility
• 36.4 Tuning the Java Virtual Machine Settings Using the dstune Utility
  • 36.4.1 Using the dstune Utility
    • 36.4.1.1 Tuning Options Provided by the dstune Utility
    • 36.4.1.2 Displaying the Current Tuning Mode
  • 36.4.2 Examples with the Interactive Mode of the dstune Utility
    • 36.4.2.1 Memory-Based Tuning
    • 36.4.2.2 Data-Based Tuning
    • 36.4.2.3 Runtime Tuning
    • 36.4.2.4 Displaying the Current Tuning Settings
• 36.5 Determining the Database Cache Size
• 36.6 Tuning the Server Configuration
  • 36.6.1 Back End Tuning Parameters
  • 36.6.2 Core Server Tuning Parameters
  • 36.6.3 Tuning a Server Containing Static Groups
    • 36.6.3.1 Enabling a FIFO Group Entry Cache
    • 36.6.3.2 Configuring FIFO Group Entry Cache Properties
    • 36.6.3.3 Member or Uniquemember Indexes
    • 36.6.3.4 Managing Static Groups With More Than 100,000 Members
    • 36.6.3.5 Importation/Replication of Static Groups
  • 36.6.4 Additional Tuning Recommendations

Part VIII Appendixes and Glossary

A Oracle Unified Directory Command-Line Interface

• A.1 General Command-Line Usage Information
  • A.1.1 Summary of Server Commands and Their Use
  • A.1.2 Using a Properties File With Server Commands
    • A.1.2.1 Locating the Properties File
    • A.1.2.2 Order of Precedence of Options and Properties
• A.2 Server Administration Commands
  • A.2.1 create-rc-script
    • A.2.1.1 Synopsis
    • A.2.1.2 Description
    • A.2.1.3 Options
    • A.2.1.4 General Options
    • A.2.1.5 Examples
    • A.2.1.6 Code Generated by the create-rc-script Command
    • A.2.1.7 Exit Codes
    • A.2.1.8 Location
    • A.2.1.9 Related Commands
  • A.2.2 dps2oud
    • A.2.2.1 Synopsis
    • A.2.2.2 Description
    • A.2.2.3 Options
    • A.2.2.4 LDAP Connection Options
    • A.2.2.5 General Options
    • A.2.2.6 Examples
    • A.2.2.7 Exit Codes
    • A.2.2.8 Location
    • A.2.2.9 Related Commands
  • A.2.3 ds2oud
    • A.2.3.1 Synopsis
    • A.2.3.2 Description
    • A.2.3.3 Options
    • A.2.3.4 Oracle Directory Server Enterprise Edition LDAP Connection Options
    • A.2.3.5 Oracle Unified Directory LDAP Connection Options
    • A.2.3.6 Command Input/Output Options
    • A.2.3.7 General Options
    • A.2.3.8 Examples
    • A.2.3.9 Exit Codes
    • A.2.3.10 Location
    • A.2.3.11 Related Commands
  • A.2.4 dsconfig
    • A.2.4.1 Synopsis
    • A.2.4.2 Description
    • A.2.4.3 Help Subcommands
    • A.2.4.4 General Subcommands
    • A.2.4.5 Distribution Subcommands
    • A.2.4.6 General Configuration Subcommands
    • A.2.4.7 Load Balancing Subcommands
    • A.2.4.8 Local Data Source Subcommands
    • A.2.4.9 Integration Subcommands
    • A.2.4.10 Remote Data Source Subcommands
    • A.2.4.11 Replication Subcommands
    • A.2.4.12 Schema Subcommands
    • A.2.4.13 Security Subcommands
    • A.2.4.14 Virtualization Subcommands
    • A.2.4.15 Options
    • A.2.4.16 LDAP Connection Options
    • A.2.4.17 Command Input/Output Options
    • A.2.4.18 General Options
    • A.2.4.19 Examples
    • A.2.4.20 Exit Codes
    • A.2.4.21 Using a Properties File
    • A.2.4.22 Location
    • A.2.4.23 Related Commands
  • A.2.5 dsjavaproperties
    • A.2.5.1 Synopsis
    • A.2.5.2 Description
    • A.2.5.3 Options
    • A.2.5.4 Example
    • A.2.5.5 Exit Codes
    • A.2.5.6 Location
  • A.2.6 dsreplication
    • A.2.6.1 Synopsis
    • A.2.6.2 Description
    • A.2.6.3 Server Subcommands
    • A.2.6.4 Options
    • A.2.6.5 Configuration Options
    • A.2.6.6 LDAP Connection Options
    • A.2.6.7 Command Input/Output Options
    • A.2.6.8 General Options
    • A.2.6.9 Examples
    • A.2.6.10 Exit Codes
    • A.2.6.11 Using a Properties File
    • A.2.6.12 Location
    • A.2.6.13 Related Commands
  • A.2.7 dstune
    • A.2.7.1 Synopsis
    • A.2.7.2 Description
    • A.2.7.3 Subcommands
    • A.2.7.4 Utility Input/Output Options
    • A.2.7.5 General Options
    • A.2.7.6 Examples
    • A.2.7.7 Exit Codes
    • A.2.7.8 Location
    • A.2.7.9 Related Commands
  • A.2.8 gicadm
    • A.2.8.1 Synopsis
    • A.2.8.2 Description
    • A.2.8.3 Options
    • A.2.8.4 LDAP Connection Options
    • A.2.8.5 Command Input/Output Options
    • A.2.8.6 General Options
    • A.2.8.7 Examples
    • A.2.8.8 Exit Codes
    • A.2.8.9 Location
    • A.2.8.10 Related Commands
  • A.2.9 manage-tasks
    • A.2.9.1 Synopsis
    • A.2.9.2 Description
    • A.2.9.3 Options
    • A.2.9.4 LDAP Connection Options
    • A.2.9.5 Command Input/Output Options
    • A.2.9.6 General Options
    • A.2.9.7 Examples
    • A.2.9.8 Exit Codes
    • A.2.9.9 Using a Properties File
    • A.2.9.10 Location
    • A.2.9.11 Related Commands
  • A.2.10 oudCopyConfig
    • A.2.10.1 Synopsis
    • A.2.10.2 Description
    • A.2.10.3 Options
    • A.2.10.4 Examples
    • A.2.10.5 Location
    • A.2.10.6 Related Commands
  • A.2.11 oudExtractMovePlan
    • A.2.11.1 Synopsis
    • A.2.11.2 Description
    • A.2.11.3 Options
    • A.2.11.4 Examples
    • A.2.11.5 Location
    • A.2.11.6 Related Commands
  • A.2.12 oudPasteConfig
    • A.2.12.1 Synopsis
    • A.2.12.2 Description
    • A.2.12.3 Options
    • A.2.12.4 Examples
    • A.2.12.5 Location
    • A.2.12.6 Related Commands
  • A.2.13 oud-replication-gateway-setup
    • A.2.13.1 Synopsis
    • A.2.13.2 Description
    • A.2.13.3 Options
    • A.2.13.4 Replication Gateway Configuration Options
    • A.2.13.5 Oracle Directory Server Enterprise Edition Server Options
    • A.2.13.6 Replication Gateway Security Options
    • A.2.13.7 Oracle Unified Directory Server Options
    • A.2.13.8 Secure Connection Options
    • A.2.13.9 Command Input/Output Options
    • A.2.13.10 General Options
    • A.2.13.11 Examples
    • A.2.13.12 Exit Codes
    • A.2.13.13 Using a Properties File
    • A.2.13.14 Log Files
    • A.2.13.15 Location
    • A.2.13.16 Related Commands
  • A.2.14 oud-setup
    • A.2.14.1 Synopsis
    • A.2.14.2 Description
    • A.2.14.3 Options
    • A.2.14.4 Command Input/Output Options
    • A.2.14.5 General Options
    • A.2.14.6 Examples
    • A.2.14.7 Exit Codes
    • A.2.14.8 Using a Properties File
    • A.2.14.9 Log Files
    • A.2.14.10 Location
    • A.2.14.11 Related Commands
  • A.2.15 oud-proxy-setup
    • A.2.15.1 Synopsis
    • A.2.15.2 Description
    • A.2.15.3 Options
    • A.2.15.4 Command Input/Output Options
    • A.2.15.5 General Options
    • A.2.15.6 Examples
    • A.2.15.7 Exit Codes
    • A.2.15.8 Log Files
    • A.2.15.9 Location
    • A.2.15.10 Related Commands
  • A.2.16 start-ds
    • A.2.16.1 Synopsis
    • A.2.16.2 Description
    • A.2.16.3 Options
    • A.2.16.4 Command Input/Output Options
    • A.2.16.5 General Options
    • A.2.16.6 Examples
    • A.2.16.7 Exit Codes
    • A.2.16.8 Location
    • A.2.16.9 Related Commands
  • A.2.17 status
    • A.2.17.1 Synopsis
    • A.2.17.2 Description
    • A.2.17.3 LDAP Connection Options
    • A.2.17.4 Command Input/Output Options
    • A.2.17.5 General Options
    • A.2.17.6 Examples
    • A.2.17.7 Exit Codes
    • A.2.17.8 Using a Properties File
    • A.2.17.9 Location
  • A.2.18 stop-ds
    • A.2.18.1 Synopsis
    • A.2.18.2 Description
    • A.2.18.3 Options
    • A.2.18.4 LDAP Connection Options
    • A.2.18.5 Command Input/Output Options
    • A.2.18.6 General Options
    • A.2.18.7 Examples
    • A.2.18.8 Exit Codes
    • A.2.18.9 Using a Properties File
    • A.2.18.10 Location
    • A.2.18.11 Related Commands
  • A.2.19 uninstall
    • A.2.19.1 Synopsis
    • A.2.19.2 Description
    • A.2.19.3 Removing a Directory Server
    • A.2.19.4 Removing a Proxy Server
    • A.2.19.5 Removing a Replication Gateway Server
    • A.2.19.6 Command Input/Output Options
    • A.2.19.7 General Options
    • A.2.19.8 Examples
    • A.2.19.9 Exit Codes
    • A.2.19.10 Using a Properties File
    • A.2.19.11 Log Files
    • A.2.19.12 Location
    • A.2.19.13 Related Commands
  • A.2.20 windows-service
    • A.2.20.1 Synopsis
    • A.2.20.2 Description
    • A.2.20.3 Command Options
    • A.2.20.4 General Options
    • A.2.20.5 Examples
    • A.2.20.6 Exit Codes
    • A.2.20.7 Location
    • A.2.20.8 Related Commands
• A.3 Data Administration Commands
  • A.3.1 backup
    • A.3.1.1 Synopsis
    • A.3.1.2 Description
    • A.3.1.3 Options
    • A.3.1.4 Task Back End Connection Options
    • A.3.1.5 Task Scheduling Options
    • A.3.1.6 Command Input/Output Options
    • A.3.1.7 General Options
    • A.3.1.8 Examples
    • A.3.1.9 Exit Codes
    • A.3.1.10 Using a Properties File
    • A.3.1.11 Location
    • A.3.1.12 Related Commands
  • A.3.2 base64
    • A.3.2.1 Synopsis
    • A.3.2.2 Description
    • A.3.2.3 Subcommands
    • A.3.2.4 Global Options
    • A.3.2.5 Examples
    • A.3.2.6 Exit Codes
    • A.3.2.7 Location
  • A.3.3 dbtest
    • A.3.3.1 Synopsis
    • A.3.3.2 Description
    • A.3.3.3 Subcommands
    • A.3.3.4 Global Options
    • A.3.3.5 Examples
    • A.3.3.6 Exit Codes
    • A.3.3.7 Location
    • A.3.3.8 Related Commands
  • A.3.4 encode-password
    • A.3.4.1 Synopsis
    • A.3.4.2 Description
    • A.3.4.3 Options
    • A.3.4.4 Examples
    • A.3.4.5 Exit Codes
    • A.3.4.6 Location
  • A.3.5 export-ldif
    • A.3.5.1 Synopsis
    • A.3.5.2 Description
    • A.3.5.3 Options
    • A.3.5.4 Task Back End Connection Options
    • A.3.5.5 Task Scheduling Options
    • A.3.5.6 Command Input/Output Options
    • A.3.5.7 General Options
    • A.3.5.8 Examples
    • A.3.5.9 Exit Codes
    • A.3.5.10 Using a Properties File
    • A.3.5.11 Location
    • A.3.5.12 Related Commands
  • A.3.6 import-ldif
    • A.3.6.1 Synopsis
    • A.3.6.2 Description
    • A.3.6.3 Options
    • A.3.6.4 Task Back End Connection Options
    • A.3.6.5 Task Scheduling Options
    • A.3.6.6 Command Input/Output Options
    • A.3.6.7 General Options
    • A.3.6.8 Examples
    • A.3.6.9 Exit Codes
    • A.3.6.10 Using a Properties File
    • A.3.6.11 Location
    • A.3.6.12 Related Commands
  • A.3.7 ldif-diff
    • A.3.7.1 Synopsis
    • A.3.7.2 Description
    • A.3.7.3 Options
    • A.3.7.4 Examples
    • A.3.7.5 Exit Codes
    • A.3.7.6 Location
    • A.3.7.7 Related Commands
  • A.3.8 ldifmodify
    • A.3.8.1 Synopsis
    • A.3.8.2 Description
    • A.3.8.3 Options
    • A.3.8.4 Examples
    • A.3.8.5 Exit Codes
    • A.3.8.6 Location
    • A.3.8.7 Related Commands
  • A.3.9 ldifsearch
    • A.3.9.1 Synopsis
    • A.3.9.2 Description
    • A.3.9.3 Options
    • A.3.9.4 Examples
    • A.3.9.5 Exit Codes
    • A.3.9.6 Location
    • A.3.9.7 Related Commands
  • A.3.10 list-backends
    • A.3.10.1 Synopsis
    • A.3.10.2 Description
    • A.3.10.3 Options
    • A.3.10.4 Command Options
    • A.3.10.5 General Options
    • A.3.10.6 Examples
    • A.3.10.7 Exit Codes
    • A.3.10.8 Location
  • A.3.11 make-ldif
    • A.3.11.1 Synopsis
    • A.3.11.2 Description
    • A.3.11.3 Options
    • A.3.11.4 Examples
    • A.3.11.5 Exit Codes
    • A.3.11.6 Locations
    • A.3.11.7 Related Commands
  • A.3.12 manage-account
    • A.3.12.1 Synopsis
    • A.3.12.2 Description
    • A.3.12.3 Subcommands
    • A.3.12.4 Options
    • A.3.12.5 LDAP Connection Options
    • A.3.12.6 General Options
    • A.3.12.7 Examples
    • A.3.12.8 Exit Codes
    • A.3.12.9 Location
    • A.3.12.10 Related Commands
  • A.3.13 rebuild-index
    • A.3.13.1 Synopsis
    • A.3.13.2 Description
    • A.3.13.3 Options
    • A.3.13.4 Command Options
    • A.3.13.5 Task Back End Connection Options
    • A.3.13.6 Task Scheduling Options
    • A.3.13.7 Utility Input/Output Options
    • A.3.13.8 General Options
    • A.3.13.9 Examples
    • A.3.13.10 Exit Codes
    • A.3.13.11 Location
    • A.3.13.12 Related Commands
  • A.3.14 restore
    • A.3.14.1 Synopsis
    • A.3.14.2 Description
    • A.3.14.3 Options
    • A.3.14.4 Task Back End Connection Options
    • A.3.14.5 Task Scheduling Options
    • A.3.14.6 Command Input/Output Options
    • A.3.14.7 General Options
    • A.3.14.8 Examples
    • A.3.14.9 Exit Codes
    • A.3.14.10 Using a Properties File
    • A.3.14.11 Location
    • A.3.14.12 Related Commands
  • A.3.15 split-ldif
    • A.3.15.1 Synopsis
    • A.3.15.2 Description
    • A.3.15.3 Options
    • A.3.15.4 Global Index Options
    • A.3.15.5 Split Options
    • A.3.15.6 General Options
    • A.3.15.7 Examples
    • A.3.15.8 Location
    • A.3.15.9 Related Commands
  • A.3.16 verify-index
    • A.3.16.1 Synopsis
    • A.3.16.2 Description
    • A.3.16.3 Options
    • A.3.16.4 Command Options
    • A.3.16.5 General Options
    • A.3.16.6 Examples
    • A.3.16.7 Exit Codes
    • A.3.16.8 Location
    • A.3.16.9 Related Commands
• A.4 LDAP Client Commands
  • A.4.1 ldapcompare
    • A.4.1.1 Synopsis
    • A.4.1.2 Description
    • A.4.1.3 Options
    • A.4.1.4 Command Options
    • A.4.1.5 LDAP Connection Options
    • A.4.1.6 Command Input/Output Options
    • A.4.1.7 General Options
    • A.4.1.8 Examples
    • A.4.1.9 Exit Codes
    • A.4.1.10 Using a CLI Properties File
    • A.4.1.11 Location
    • A.4.1.12 Related Commands
  • A.4.2 ldapdelete
    • A.4.2.1 Synopsis
    • A.4.2.2 Description
    • A.4.2.3 Before You Begin
    • A.4.2.4 Options
    • A.4.2.5 Command Options
    • A.4.2.6 LDAP Connection Options
    • A.4.2.7 Command Input/Output Options
    • A.4.2.8 General Options
    • A.4.2.9 Examples
    • A.4.2.10 Exit Codes
    • A.4.2.11 Using a CLI Properties File
    • A.4.2.12 Location
    • A.4.2.13 Related Commands
  • A.4.3 ldapmodify
    • A.4.3.1 Synopsis
    • A.4.3.2 Description
    • A.4.3.3 Before You Begin
    • A.4.3.4 Options
    • A.4.3.5 Command Options
    • A.4.3.6 LDAP Connection Options
    • A.4.3.7 Command Input/Output Options
    • A.4.3.8 General Options
    • A.4.3.9 Examples
    • A.4.3.10 Exit Codes
    • A.4.3.11 Using a CLI Properties File
    • A.4.3.12 Location
    • A.4.3.13 Related Commands
  • A.4.4 ldappasswordmodify
    • A.4.4.1 Synopsis
    • A.4.4.2 Description
    • A.4.4.3 Options
    • A.4.4.4 Command Options
    • A.4.4.5 LDAP Connection Options
    • A.4.4.6 Command Input/Output Options
    • A.4.4.7 General Options
    • A.4.4.8 Examples
    • A.4.4.9 Exit Codes
    • A.4.4.10 Using a CLI Properties File
    • A.4.4.11 Location
    • A.4.4.12 Related Commands
  • A.4.5 ldapsearch
    • A.4.5.1 Synopsis
    • A.4.5.2 Description
    • A.4.5.3 Before You Begin
    • A.4.5.4 Options
    • A.4.5.5 Command Options
    • A.4.5.6 LDAP Connection Options
    • A.4.5.7 Command Input/Output Options
    • A.4.5.8 General Options
    • A.4.5.9 Examples
    • A.4.5.10 To Search by Using a Properties File
    • A.4.5.11 Search Attributes
    • A.4.5.12 Exit Codes
    • A.4.5.13 Location
    • A.4.5.14 Related Commands

B Supported Controls and Operations

• B.1 Supported LDAP Controls
• B.2 Supported Extended Operations

C Standards and Specifications Supported by Oracle Unified Directory

• C.1 RFCs Supported by Oracle Unified Directory
• C.2 Internet Drafts Supported by Oracle Unified Directory
• C.3 Other Specifications Supported by Oracle Unified Directory
• C.4 Protocols and Cipher Suites Supported by Oracle Unified Directory

D Glossary of Terms for Oracle Unified Directory

• D.1 A
  • D.1.1 abandon operation
  • D.1.2 abstract object class
  • D.1.3 Abstract Syntax Notation One
  • D.1.4 access control
  • D.1.5 access control instruction (ACI)
  • D.1.6 access control rule
  • D.1.7 access log
  • D.1.8 account expiration
  • D.1.9 account lockout
  • D.1.10 account status notification
  • D.1.11 account usability control
  • D.1.12 ACID
  • D.1.13 add operation
  • D.1.14 alias
  • D.1.15 AND search filter
  • D.1.16 anonymous bind
  • D.1.17 ANONYMOUS SASL mechanism
  • D.1.18 approximate index
  • D.1.19 approximate search filter
  • D.1.20 ASN.1
  • D.1.21 assertion value
  • D.1.22 attribute
  • D.1.23 attribute description
  • D.1.24 attribute option
  • D.1.25 attribute syntax
  • D.1.26 attribute type
  • D.1.27 attribute usage
  • D.1.28 attribute value
  • D.1.29 attribute value assertion
  • D.1.30 audit log
  • D.1.31 authentication
  • D.1.32 authentication ID
  • D.1.33 authentication password syntax
  • D.1.34 authorization
  • D.1.35 authorization ID
  • D.1.36 authorization identity control
  • D.1.37 auxiliary object class
  • D.1.38 AVA
• D.2 B
  • D.2.1 back end
  • D.2.2 backup
  • D.2.3 base64 encoding
  • D.2.4 Basic Encoding Rules
    • D.2.4.1 Basic Encoding Rules Overview
    • D.2.4.2 The BER Type
    • D.2.4.3 The BER Length
    • D.2.4.4 The BER Value
    • D.2.4.5 BER Encoding Examples
  • D.2.5 BER
  • D.2.6 Berkeley DB Java Edition
  • D.2.7 binary copy
  • D.2.8 bind operation
• D.3 C
  • D.3.1 cancel extended operation
  • D.3.2 CDDL
  • D.3.3 certificate
  • D.3.4 certificate mapper
  • D.3.5 chaining
  • D.3.6 changelog
  • D.3.7 cn=Directory Manager
  • D.3.8 collective attribute
  • D.3.9 Common Development and Distribution License
  • D.3.10 compare operation
  • D.3.11 connection handler
  • D.3.12 connection ID
  • D.3.13 control
  • D.3.14 CRAM-MD5 SASL mechanism
  • D.3.15 crypt algorithm
• D.4 D
  • D.4.1 database
  • D.4.2 database cache
  • D.4.3 debug log
  • D.4.4 delete operation
  • D.4.5 deprecated password storage scheme
  • D.4.6 dereference policy
  • D.4.7 DIGEST-MD5 SASL mechanism
  • D.4.8 directory information tree
  • D.4.9 directory manager
  • D.4.10 directory server
  • D.4.11 directory server agent
  • D.4.12 Directory Services Markup Language
  • D.4.13 distinguished name
  • D.4.14 distribution
  • D.4.15 DIT
  • D.4.16 DIT content rule
  • D.4.17 DIT structure rule
  • D.4.18 DN
  • D.4.19 DSA
  • D.4.20 DSA-specific entry
  • D.4.21 DSE
  • D.4.22 DSML
  • D.4.23 DSML gateway
  • D.4.24 duration
  • D.4.25 dynamic group
• D.5 E
  • D.5.1 entry
  • D.5.2 entry cache
  • D.5.3 entry change notification control
  • D.5.4 entryDN
  • D.5.5 entry ID
  • D.5.6 entryUUID
  • D.5.7 equality index
  • D.5.8 equality search filter
  • D.5.9 error log
  • D.5.10 export
  • D.5.11 extended operation
  • D.5.12 extensible match index
  • D.5.13 extensible match search filter
  • D.5.14 EXTERNAL SASL mechanism
• D.6 F
  • D.6.1 failover algorithm
  • D.6.2 false filter
• D.7 G
  • D.7.1 generalized time
  • D.7.2 get effective rights control
  • D.7.3 global index
  • D.7.4 global index catalog
  • D.7.5 greater than or equal to search filter
  • D.7.6 group
  • D.7.7 GSSAPI SASL mechanism
• D.8 I
  • D.8.1 ID list
  • D.8.2 id2entry database
  • D.8.3 identity mapper
  • D.8.4 idle account lockout
  • D.8.5 in-core restart
  • D.8.6 index
  • D.8.7 index entry limit
  • D.8.8 intermediate response
  • D.8.9 Internet Draft
• D.9 J
  • D.9.1 Java Management Extensions
  • D.9.2 JMX
• D.10 K
  • D.10.1 key manager provider
• D.11 L
  • D.11.1 last login time
  • D.11.2 lastmod plug-in
  • D.11.3 LDAP assertion control
  • D.11.4 ldapcompare command
  • D.11.5 LDAP Data Interchange Format
  • D.11.6 ldapdelete command
  • D.11.7 LDAP false filter
  • D.11.8 LDAP intermediate response
  • D.11.9 LDAP message
  • D.11.10 LDAP modify DN operation
  • D.11.11 LDAP modify operation
  • D.11.12 ldapmodify command
  • D.11.13 LDAP no-op control
  • D.11.14 LDAP post-read control
  • D.11.15 LDAP pre-read control
  • D.11.16 LDAP result
  • D.11.17 LDAPS
  • D.11.18 LDAP search filter
  • D.11.19 ldapsearch command
  • D.11.20 LDAP true filter
  • D.11.21 LDAP Subentry
  • D.11.22 LDAP URL
  • D.11.23 LDIF export
  • D.11.24 LDIF import
  • D.11.25 leaf entry
  • D.11.26 less than or equal to search filter
  • D.11.27 lexico algorithm
  • D.11.28 Lightweight Directory Access Protocol
  • D.11.29 load balancing
  • D.11.30 lookthrough limit
• D.12 M
  • D.12.1 MakeLDIF command
  • D.12.2 manage DSA IT control
  • D.12.3 matched DN
  • D.12.4 matched values control
  • D.12.5 matching rule
  • D.12.6 matching rule use
  • D.12.7 MD5
  • D.12.8 message
  • D.12.9 message ID
  • D.12.10 modification
  • D.12.11 modification type
  • D.12.12 modify DN operation
  • D.12.13 modify operation
  • D.12.14 monitor entry
• D.13 N
  • D.13.1 name form
  • D.13.2 naming context
  • D.13.3 network group
  • D.13.4 non-leaf entry
  • D.13.5 normalized value
  • D.13.6 notice of disconnection unsolicited notification
  • D.13.7 NOT search filter
  • D.13.8 numeric algorithm
  • D.13.9 nsuniqueid
• D.14 O
  • D.14.1 object class
  • D.14.2 object class type
  • D.14.3 object identifier
  • D.14.4 operation ID
  • D.14.5 operational attribute
  • D.14.6 ordering index
  • D.14.7 OR search filter
  • D.14.8 OID Search Count Request Control
  • D.14.9 OID Search Count Response Control
• D.15 P
  • D.15.1 partition
  • D.15.2 password
  • D.15.3 password expiration
  • D.15.4 password generator
  • D.15.5 Password Modify extended operation
  • D.15.6 password policy
  • D.15.7 password policy control
  • D.15.8 password reset
  • D.15.9 password storage scheme
  • D.15.10 password validator
  • D.15.11 persistent search control
  • D.15.12 PLAIN SASL mechanism
  • D.15.13 plug-in
  • D.15.14 presence index
  • D.15.15 presence search filter
  • D.15.16 privilege
  • D.15.17 proportional algorithm
  • D.15.18 protocol data unit
  • D.15.19 protocol op
  • D.15.20 proxied authorization control
• D.16 Q
  • D.16.1 quality of protection
• D.17 R
  • D.17.1 real attributes only control
  • D.17.2 referential integrity
  • D.17.3 referral
  • D.17.4 relative distinguished name
  • D.17.5 replica
  • D.17.6 replication
  • D.17.7 replication repair control
  • D.17.8 request for comments
  • D.17.9 restore
  • D.17.10 result
  • D.17.11 result code
  • D.17.12 root DN
  • D.17.13 root DSE
  • D.17.14 route
• D.18 S
  • D.18.1 salt
  • D.18.2 saturation algorithm
  • D.18.3 saturation alert
  • D.18.4 saturation threshold
  • D.18.5 schema
  • D.18.6 schema checking
  • D.18.7 search attributes
  • D.18.8 search base DN
  • D.18.9 search filter
  • D.18.10 search operation
  • D.18.11 search result done
  • D.18.12 search result entry
  • D.18.13 search result reference
  • D.18.14 search scope
  • D.18.15 Secure Hash Algorithm
  • D.18.16 Secure Sockets Layer
  • D.18.17 server-side sort control
  • D.18.18 simple authentication
  • D.18.19 Simple Authentication and Security Layer
  • D.18.20 simple paged results control
  • D.18.21 size limit
  • D.18.22 smart referral
  • D.18.23 StartTLS extended operation
  • D.18.24 static group
  • D.18.25 structural object class
  • D.18.26 subentry
  • D.18.27 subschema subentry
  • D.18.28 substring assertion
  • D.18.29 substring index
  • D.18.30 substring search filter
  • D.18.31 subtree
  • D.18.32 subtree delete control
  • D.18.33 supported control
  • D.18.34 supported extension
  • D.18.35 supported feature
  • D.18.36 synchronization
• D.19 T
  • D.19.1 task
  • D.19.2 time limit
  • D.19.3 transaction
  • D.19.4 Transport Security Layer
  • D.19.5 true filter
  • D.19.6 trust manager provider
  • D.19.7 typesOnly flag
• D.20 U
  • D.20.1 unbind operation
  • D.20.2 unindexed search
  • D.20.3 UNIX crypt algorithm
  • D.20.4 unsolicited notification
  • D.20.5 URL
  • D.20.6 user attribute
• D.21 V
  • D.21.1 virtual attribute
  • D.21.2 virtual attributes only control
  • D.21.3 virtual directory
  • D.21.4 virtual list view control
  • D.21.5 virtual static group
  • D.21.6 VLV index
• D.22 W
  • D.22.1 "Who Am I?" extended operation
  • D.22.2 work queue
  • D.22.3 worker thread
  • D.22.4 workflow
  • D.22.5 workflow element
  • D.22.6 writability mode