This appendix describes various service package details in Oracle Communications Delegated Administrator.
This section describes the LDAP attributes provided by the sample service packages with mail service, instant messaging service, and contacts service.
Note:
Sample service packages with calendar service do not provide specific calendar attributes. For sample service package templates that combine services such as mail service and calendar service, mail attributes are provided, but no calendar attributes.Mail service includes LDAP attributes defined for mail users. Table A-1 defines these attributes.
Table A-1 Mail service attributes that can be used in a service package
LDAP Attribute | Display Name | Definition |
---|---|---|
mailMsgMaxBlocks |
Max Message Size (blocks) |
Size in units of MTA blocks of the largest message that can be sent to the user or group. |
mailAllowedServiceAccess |
Allowed Services |
Filter specifying the available client access to specified services. For example: +imap:ALL$+pop:ALL$+smtp:ALL$+http:ALL |
mailMsgQuota |
Max no. of Messages |
Maximum number of messages permitted for a user (including all user folders). |
mailQuota |
Mail Quota |
Disk space (in bytes) allowed for the user s mailbox. |
For more information about these attributes, see Communications Suite Schema Reference.
IM service includes LDAP attributes defined for IM users. Table A-2 defines these attributes.
Table A-2 Instant Messaging Server service attributes that can be used in a service package
LDAP Attribute | Display Name | Definition |
---|---|---|
inetUserStatus |
User Status |
User status is set by default when the package is assigned using either commadmin command or the console. |
For more information about Instant Messaging Server attributes, see the discussion about Instant Messaging object classes and attributes in Communications Suite Schema Reference.
Contacts service includes LDAP attributes defined for Contacts users. Table A-3 defines these attributes.
Table A-3 Contacts service attributes that can be used in a service package
LDAP Attribute | Display Name | Definition |
---|---|---|
nabStatus |
Contacts Service Status |
Set by default when package is assigned using both the commadmin command and the console. Enables or disables the service. Absence of this attribute or a value of active indicates active status. Values of removed, deleted, or inactive disable the service. Any other value also may enable the service but is not recommended. Allowed values: active, inactive, removed, or deleted. |
nabStore |
Back-end Store |
Indicates the back-end host in which a user's data resides if the deployment is setup with multiple back ends. |
corpDirectoryUrl |
CorpDir Url |
Causes a domain to point to a different corporate directory. Also allows support for multiple corporate directories within that domain. You can add one or more corpDirectoryUrl attributes to the domain entry. The value of this attribute must be a valid corporate directory LDAP URL. |
For more information about these attributes, see the discussion about Delegated Administrator object classes and attributes in Communications Suite Schema Reference.
This section lists the sample Class-of-Service templates and attribute values provided by the templates. These templates are contained in the cos.sample.ldif file.
Platinum
mailMsgMaxBlocks: 800 mailquota: 10000000 mailmsgquota: 6000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL daServiceType: mail user
Gold
mailMsgMaxBlocks: 700 mailquota: 8000000 mailmsgquota: 3000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL daServiceType: mail user
Silver
mailMsgMaxBlocks: 300 mailquota: 6291456 mailmsgquota: 2000 mailAllowedServiceAccess: +pop:ALL$+imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user
Bronze
mailMsgMaxBlocks: 700 mailquota: 5242288 mailmsgquota: 3000 mailAllowedServiceAccess: +pop:ALL$+imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user
Ruby
mailMsgMaxBlocks: 600 mailquota: 1048576 mailmsgquota: 2000 mailAllowedServiceAccess: +pops:ALL$+smtps:ALL$+http:ALL daServiceType: mail user
Emerald
mailMsgMaxBlocks: 600 mailquota: 2097152 mailmsgquota: 2000 mailAllowedServiceAccess: +pop:ALL$+smtp:ALL$+http:ALL daServiceType: mail user
Diamond
mailMsgMaxBlocks: 5000 mailquota: 3145728 mailmsgquota: 3000 mailAllowedServiceAccess: +imaps:ALL$+smtps:ALL$+http:ALL daServiceType: mail user
Topaz
mailMsgMaxBlocks: 3000 mailquota: 4194304 mailmsgquota: 2000 mailAllowedServiceAccess: +imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user
None (standardUserCalendar)
There is no predefined Class-of-Service template that provides calendar service and contains attribute values. Calendar service is provided without associated attributes. Because no sample template exists, Delegated Administrator generates a default service package, without a template, directly from the User Calendar Class-of-Service definition. Its name is the same as that of the Class-of-Service definition: standardUserCalendar. This service package provides calendar service only.
imsample
# # User im templates # dn: cn=imsample,o=imuser,o=cosTemplates,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleobject objectclass: cosTemplate cn: imsample inetUserStatus: active daServiceType: im user
contactssample
dn: cn=contactssample,o=contactsuser,o=cosTemplates,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleobject objectclass: cosTemplate nab: value cn: contactssample daServiceType: contacts user
The following sample templates apply both mail and calendar service.
Mercury
mailMsgMaxBlocks: 800 mailquota: 10000000 mailmsgquota: 6000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL daServiceType: mail user daServiceType: calendar user
Venus
mailMsgMaxBlocks: 700 mailquota: 8000000 mailmsgquota: 3000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL daServiceType: mail user daServiceType: calendar user
Earth
mailMsgMaxBlocks: 300 mailquota: 6291456 mailmsgquota: 2000 mailAllowedServiceAccess: +pop:ALL$+imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user daServiceType: calendar user
Mars
mailMsgMaxBlocks: 700 mailquota: 5242288 mailmsgquota: 3000 mailAllowedServiceAccess: +pop:ALL$+imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user daServiceType: calendar user
The following sample template applies both mail and IM services.
mailimsample
Mail Services mailMsgMaxBlocks: 800 mailquota: 9M mailmsgquota: 6000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL IM Services inetUserStatus: active daServiceType: mail user daServiceType: im user
The following sample template applies both calendar and IM services. The template provides IM service attributes but no calendar service attributes.
calendarimsample
Calendar Services N/A IM Services inetUserStatus: active daServiceType: calendar user daServiceType: im user
The following sample template applies mail and contacts services.
mailcontactssample
Contacts Services dn: cn=mailcontactssample,o=mailcontactsuser,o=cosTemplates,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleobject objectclass: cosTemplate cn: mailcontactssample nab: value Mail Services mailMsgMaxBlocks: 300 mailquota: 6291456 mailmsgquota: 2000 mailAllowedServiceAccess: +pop:ALL$+imap:ALL$+smtp:ALL$+http:ALL daServiceType: mail user daServiceType: contacts user
The following sample template applies calendar and contacts services. The template provides contacts service attributes but no calendar service attributes.
calendarcontactssample
Contacts Services dn: cn=calendarcontactssample,o=calendarcontactsuser,o=cosTemplates,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleobject objectclass: cosTemplate cn: calendarcontactssample inetUserStatus: active nab: value Calendar Services N/A daServiceType: calendar user daServiceType: contacts user
The following sample template applies mail, calendar, and IM services. The template provides mail and IM service attributes but no calendar service attributes.
mailcalendarimsample
Mail Services mailMsgMaxBlocks: 800 mailquota: 9M mailmsgquota: 6000 mailAllowedServiceAccess: +imaps:ALL$+pops:ALL$+smtps:ALL$+http:ALL Calendar Services N/A IM Services inetUserStatus: active daServiceType: mail user daServiceType: calendar user daServiceType: im user
Neptune
Contacts Services dn: cn=neptune,o=mailcalendarimcontactsuser,o=cosTemplates,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleobject objectclass: cosTemplate cn: neptune Mail Services mailMsgMaxBlocks: 800 mailquota: 10000000 mailmsgquota: 6000 mailAllowedServiceAccess: +imap:ALL$+imaps:ALL$+pop:ALL$+pops:ALL$+smtp:ALL$+http:ALL nab: value inetUserStatus: active Calendar Services N/A IM Services inetUserStatus: active daServiceType: calendar user daServiceType: mail user daServiceType: im user daServiceType: contacts user
Atlantic
mailMsgMaxBlocks: 800 daServiceType: mail group
Pacific
mailMsgMaxBlocks: 900 daServiceType: mail group
Indian
mailMsgMaxBlocks: 1000 daServiceType: mail group
Arctic
mailMsgMaxBlocks: 1200 daServiceType: mail group
None (standardGroupCalendar)
There is no predefined Class-of-Service template that provides calendar service to groups and contains attribute values. Calendar service is provided without associated attributes.
Because no sample template exists, Delegated Administrator generates a default service package, without a template, directly from the Group Calendar Class-of-Service definition. Its name is the same as that of the Class-of-Service definition: standardGroupCalendar.
This service package provides calendar service (to groups) only.
The following sample templates apply both mail and calendar service to groups.
Nile
mailMsgMaxBlocks: 1600 daServiceType: mail group daServiceType: calendar group
Amazon
mailMsgMaxBlocks: 1800 daServiceType: mail group daServiceType: calendar group
Thames
mailMsgMaxBlocks: 2000 daServiceType: mail group daServiceType: calendar group
Danube
mailMsgMaxBlocks: 2200 daServiceType: mail group daServiceType: calendar group
This release of Delegated Administrator provides a Class-of-Service definition for each type of service package:
User mail service
User calendar service
User instant messaging service
User contacts service
User mail and calendar service
User mail and im service
User mail and contacts service
User calendar and im service
User calendar and contacts service
User mail, calendar, and im service
User mail, calendar, im, and contacts
Group mail service
Group calendar service
Group mail and calendar service
When you configure Delegated Administrator, the Class-of-Service definitions are installed in the directory.
In each definition, the daServiceType attribute determines the type of service package with the following syntax:
daServiceType: service type target
where service type is mail, calendar, or im, and target is either user or group. If a Class-of-Service applies to multiple service types, daServiceType is listed multiple times.
The user mail service is defined in a Class-of-Service definition called standardUserMail:
# # Definition for user mail service bundle # dn: cn=standardUserMail,ugldapbasedn changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailuser,o=cosTemplates,ugldapbasedn cosSpecifier: inetCos cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota daServiceType: mail user NOTE: When the Delegated Administrator configuration program installs the standardUserMail definition in the directory, the variable ugldapbasedn, shown above, is replaced by your root suffix (such as o=usergroup).
The daServiceType attribute defines this as a mail service for users.
The user calendar service is defined in a Class-of-Service definition called standardUserCalendar:
# # Definition for user calendar service bundle # dn: cn=standardUserCalendar,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=calendaruser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay daServiceType: calendar user NOTE: When the Delegated Administrator configuration program installs the standardUserCalendar definition in the directory, the variable <ugldapbasedn>, shown above, is replaced by your root suffix (such as o=usergroup).
The daServiceType attribute defines this as a calendar service for users.
Note:
The calendar service definition also includes calendar attributes such as icsPreferredHost.However, Delegated Administrator does not provide service-package templates that specify values for these attributes. The Delegated Administrator console provides one service package with calendar service only: the standardUserCalendar service package. This package does not include calendar attributes.
The user IM service is defined in a Class-of-Service definition called standardUserIM:
# # Definition for user im service bundle # dn: cn=standardUserIM,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=imuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: inetUserStatus daServiceType: im user
Customers may add additional class-of-service entries like the following.
cosAttribute: jabberServiceStatus
cosAttribute: sunPresencePolicy
cosAttribute: sunIMPolicy
cosAttribute: sunFileTransferPolicy
cosAttribute: sunMediaPolicy
cosAttribute: sunFederatedXMPPDomainFilter
cosAttribute: sunAllowedJabberAccessPoint
cosAttribute: sunIMAllowedComponent
NOTE: When the Delegated Administrator configuration program installs the
standardUserIM definition in the directory, the variable
ugldapbasedn, shown above, is replaced by your root suffix
(such as o=usergroup).
The daServiceType attribute defines this as an instant messaging service for users.
The contacts service is defined in a Class-of-Service definition called standardUserContacts:
# # Definition for user contacts service bundle # dn: cn=standardUserContacts,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=contactsuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: nab daServiceType: contacts user
The daServiceType attribute defines this as a contacts service for users.
The user mail and calendar service is defined in a Class-of-Service definition called standardUserMailCalendar:
# # Definition for user mail and user calendar service bundle # dn: cn=standardUserMailCalendar,ugldapbasedn changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailcalendaruser,o=cosTemplates,ugldapbasedn cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay cosAttribute: icsQuota cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota daServiceType: calendar user daServiceType: mail user NOTE: When the Delegated Administrator configuration program installs the standardUserMailCalendar definition in the directory, the variable ugldapbasedn, shown above, is replaced by your root suffix (such as o=usergroup).
The two daServiceType attribute entries define this as a calendar service and mail service for users.
The user mail and IM service is defined in a Class-of-Service definition called standardUserMailIm:
# # Definition for user mail and user im service bundle # dn: cn=standardUserMailIM,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailimuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota cosAttribute: inetUserStatus daServiceType: mail user daServiceType: im user
The two daServiceType attribute entries define this as a mail service and instant messaging service for users.
The user mail and contacts service is defined in a Class-of-Service definition called standardUserMailContacts:
# # Definition for user contacts and mail service bundle # dn: cn=standardUserMailContacts,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailcontactsuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: nab cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota daServiceType: mail user daServiceType: contacts user
The two daServiceType attribute entries define this as a mail service and contacts service for users.
The user calendar and IM service is defined in a Class-of-Service definition called standardUserCalendarIm:
# # Definition for user calendar and user im service bundle # dn: cn=standardUserCalendarIM,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=calendarimuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay cosAttribute: icsQuota cosAttribute: inetUserStatus daServiceType: calendar user daServiceType: im user
The two daServiceType attribute entries define this as a calendar service and instant messaging service for users.
The user calendar and contacts service is defined in a Class-of-Service definition called standardUserCalendarContacts:
# # Definition for user calendar and user contacts service bundle # dn: cn=standardUserCalendarContacts,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=calendarcontactsuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay cosAttribute: icsQuota cosAttribute: inetUserStatus cosAttribute: nab daServiceType: calendar user daServiceType: contacts user
The two daServiceType attribute entries define this as a calendar service and contacts service for users.
The user mail, calendar, and IM service is defined in a Class-of-Service definition called standardUserMailCalendarIM:
# # Definition for user mail and user calendar and user im service bundle # dn: cn=standardUserMailCalendarIM,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailcalendarimuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay cosAttribute: icsQuota cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota cosAttribute: inetUserStatus daServiceType: calendar user daServiceType: mail user daServiceType: im user
The three daServiceType attribute entries define this as a mail service, calendar service, and instant messaging service for users.
The user mail, calendar, IM, and contacts service is defined in a Class-of-Service definition called standardUserMailCalendarIMContacts:
# # Definition for user mail and user calendar and user im and user contacts service bundle # dn: cn=standardUserMailCalendarIMContacts,<ugldapbasedn> changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailcalendarimcontactsuser,o=cosTemplates,<ugldapbasedn> cosSpecifier: inetCos cosAttribute: icsPreferredHost cosAttribute: icsDWPHost cosAttribute: icsFirstDay cosAttribute: icsQuota cosAttribute: mailAllowedServiceAccess cosAttribute: mailMsgMaxBlocks cosAttribute: mailquota cosAttribute: mailmsgquota cosAttribute: inetUserStatus cosAttribute: nab daServiceType: calendar user daServiceType: mail user daServiceType: im user daServiceType: contacts user
The four daServiceType attribute entries define this as a mail service, calendar service, instant messaging service, and contacts service for users.
The group mail service is defined in a Class-of-Service definition called standardGroupMail:
# # Definition for group mail service bundle # dn: cn=standardGroupMail,ugldapbasedn changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailgroup,o=cosTemplates,ugldapbasedn cosSpecifier: inetCos cosAttribute: mailMsgMaxBlocks daServiceType: mail group NOTE: When the Delegated Administrator configuration program installs the standardGroupMail definition in the directory, the variable ugldapbasedn, shown above, is replaced by your root suffix (such as o=usergroup).
The daServiceType attribute defines this as a mail service for groups.
The group calendar service is defined in a Class-of-Service definition called standardGroupCalendar:
# # Definition for group calendar service bundle # dn: cn=standardGroupCalendar,ugldapbasedn changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=calendargroup,o=cosTemplates,ugldapbasedn cosSpecifier: inetCos cosAttribute: icsdoublebooking cosAttribute: icsautoaccept daServiceType: calendar group NOTE: When the Delegated Administrator configuration program installs the standardGroupCalendar definition in the directory, the variable ugldapbasedn, shown above, is replaced by your root suffix (such as o=usergroup).
The daServiceType attribute defines this as a calendar service for groups.
Note:
The calendar service definition also includes calendar attributes such as icsdoublebooking.However, Delegated Administrator does not provide service-package templates that specify values for these attributes. The Delegated Administrator console provides one service package for groups with calendar service only: the standardGroupCalendar service package. This package does not include calendar attributes.
The user mail and calendar service is defined in a Class-of-Service definition called standardGroupMailCalendar:
# # Definition for group mail and group calendar service bundle # dn: cn=standardGroupMailCalendar,ugldapbasedn changetype: add objectclass: top objectclass: LDAPsubentry objectclass: extensibleObject objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn: o=mailcalendargroup,o=cosTemplates,ugldapbasedn cosSpecifier: inetCos cosAttribute: mgrpMsgMaxSize cosAttribute: mailMsgMaxBlocks daServiceType: calendar group daServiceType: mail group NOTE: When the Delegated Administrator configuration program installs the standardGroupMailCalendar definition in the directory, the variable ugldapbasedn, shown above, is replaced by your root suffix (such as o=usergroup).
The two daServiceType attribute entries define this as a calendar service and mail service for groups.
In the LDAP Directory Information Tree (DIT), the Class-of-Service definitions are located in a node directly under the root suffix. Because they are stored at the top of the DIT, the service packages can be assigned to all user entries in the directory. Figure A-1 shows the location of the mail and calendar service definitions and packages in the DIT.
Figure A-1 Location of Mail and Calendar Class-of-Service Definitions and Packages in the Directory Tree
Figure A-2 shows the location of the IM service definitions and packages in the DIT.
Figure A-2 Location of IM Class-of-Service Definitions and Packages in the Directory Tree
Figure A-3 shows the location of the contacts service definitions and packages in the DIT.
Figure A-3 Location of Contacts Class-of-Service Definitions and Packages in the Directory Tree
Each type of Class-of-Service template is located under its own node. Thus, a template providing mail service to users is located under the Mail User node. This structure enables Delegated Administrator to use the correct Class-of-Service definition (such as standardUserMail) when it assigns a service package to a user or group.
Delegated Administrator uses the classic Class-of-Service definition.
For more information about the Class-of-Service mechanism, see Defining Class-of-Service (CoS) in Sun Java System Directory Server Administration Guide.
The Sun Java System Directory Server Administration Guide also describes related topics such as determining which service attribute value takes precedence if an attribute defined in a service package assigned to a user already exists in that individual user entry.
The COS templates are stored as LDAP Subentries, so you need to filter explicitly for the objectclass=LDAPsubentry when you use ldapsearch to find the service packages.
# ldapsearch -D "cn=Directory Manager" -w password -b "o=costemplates,<ugldapbasedn>" "(|(objectclass=*)(objectclass=LDAPsubentry))"