Manuals / HP / Computer Equipment / Software

HP UX Red Hat Direry Server Software manual Chaining Ldap Controls, Plug-in

Models: UX Red Hat Direry Server Software

1 638

Download 638 pages 23.73 Kb

Page 93

Configuring the Chaining Policy

plug-in:

aci: (targetattr "*")(target="ldap:///ou=customers,l=us,dc=example,dc=com")

(version 3.0; acl "RefInt Access for chaining"; allow

(read,write,search,compare) userdn = "ldap:///cn=referential integrity

postoperation,cn=plugins,cn=config";)

3.1.1.2. Chaining Component Operations from the Command-Line

1.Specify components to include in chaining using the nsActiveChainingComponents attribute in the cn=config,cn=chaining database,cn=plugins,cn=config entry of the configuration file.

For example, to allow the referential integrity component to chain operations, add the following to the database link configuration file:

nsActiveChainingComponents: cn=referential integrity postoperation,cn=components,cn=config

See Table 3.2, “Components Allowed to Chain” for a list of the components which can be chained.

2.Restart the server for the change to take effect. 2

service dirsrv restart instance

3.Create an ACI in the suffix on the remote server to which the operation will be chained. For example, this creates an ACI for the Referential Integrity plug-in:

aci: (targetattr "*")(target="ldap:///ou=customers,l=us,dc=example,dc=com") (version 3.0; acl "RefInt Access for chaining"; allow (read,write,search,compare) userdn = "ldap:///cn=referential integrity postoperation,cn=plugins,cn=config";)

3.1.2. Chaining LDAP Controls

It is possible to not chain operation requests made by LDAP controls. By default, requests made by the following controls are forwarded to the remote server by the database link:

•Virtual List View (VLV). This control provides lists of parts of entries rather than returning all entry information.

•Server-side sorting. This control sorts entries according to their attribute values.

2The command to restart the Directory Server on platforms other than Red Hat Enterprise Linux is described in Section 3, “Starting and Stopping Servers”.

73

Image 93

HP UX Red Hat Direry Server Software Chaining Ldap Controls, Chaining Component Operations from the Command-Line, Plug-in

Contents

Administrators Guide Red Hat Directory Server Copyright 2008 Red Hat, Inc Red Hat Directory Server 8.0 Administrators GuideRed Hat Directory Server General Red Hat Directory Server Usage Creating and Maintaining Databases Creating and Maintaining SuffixesCreating and Maintaining Database Links Creating a New Database LinkPage Red Hat Directory Server Page Red Hat Directory Server Page Red Hat Directory Server Page Red Hat Directory Server Page Xvi Preface Directory Server OverviewWhen shown as below, it indicates computer output Example and Default ReferencesDocument Conventions PrefaceXix Document ConventionsRelated Information Chapter Directory Server File LocationsRed Hat Enterprise Linux 4 and 5 General Red Hat Directory Server UsageFile or Directory Location HP-UX 11i IA64 Sun Solaris 9 sparcLdap Tool Locations BinariesStarting and Stopping Servers Ldap Tool LocationsPlatform Directory Location Opt/dirsrv/binStarting and Stopping Directory Server from the Console Starting and Stopping Directory Server fromStart the Directory Server Console Solaris uses /etc/init.d Starting and Stopping Administration ServerStarting the Directory Server Console On Solaris, the service is init.dConsole HP-UX has a different location for the scriptLogin screen Changing Login IdentityLogging into Directory Server Click Log on to the Directory Server as a New UserChanging Directory Server Port Numbers Viewing the Current Console Bind DNViewing the Current Console Bind DN General Red Hat Directory Server Usage Configuration tab, select the Configuration DS tab Open the Administration Server ConsoleCreating a New Directory Server Instance Creating a New Directory Server InstanceConfiguring the Directory Manager Configuring the Directory Manager Page Creating a Root Entry Managing Entries from the Directory ConsoleCreating Directory Entries Directory Server Console, select the Configuration tabCreating Directory Entries Template Object ClassRole NsRoleDefinition Class of Service CosSuperDefinition Creating an Entry Using a Predefined TemplateCreating Other Types of Entries Entry Templates and Corresponding Object ClassesDisplaying the Property Editor Modifying Directory EntriesRemoving an Object Class Adding an Object Class to an EntryAdding an Attribute to an Entry Modifying Directory EntriesAdding Very Large Attributes Removing an Attribute Value Adding Attribute ValuesLanguage Subtype Adding an Attribute SubtypeBinary Subtype Instead, usePronunciation Subtype Deleting Directory EntriesAdding a Subtype to an Attribute Deleting Directory EntriesManaging Entries from the Command-Line Providing Input from the Command-LineEntries, use Ctrl or Shift Select Delete from the Edit menu Creating a Root Entry from the Command-Line See , Ldif Update StatementsCreating a Root Entry from Adding Entries Using Ldif Adding and Modifying Entries Using ldapmodifyImport the Ldif file from the Directory Server Console Adding Entries Using ldapmodify Command-LineParameter Name Description Modifying Entries Using ldapmodify Input from the Command-LineLdapmodify Parameters Used for Adding Entries Deleting Entries Using ldapdelete Deleting Entries Using ldapdeleteLdapmodify Parameters Used for Modifying Entries Hostname is cyclops Server uses port numberThis ldapdelete example has the following values Are branch points in the directory treeUsing Special Characters Using Special CharactersTracking Modifications to Directory Entries Ldapdelete Parameters Used for Deleting EntriesLdif Update Statements Select the Track Entry Modification Times checkboxOpen the Tasks tab, and click Restart Directory Server General format of Ldif update statements is as follows Ldif Update StatementsFollowing sections describe the change types in detail Adding an Entry Using LdifRenaming an Entry Using Ldif Renaming an Entry Using LdifFollowing command renames Sue Jacobs to Susan Jacobs Addattribute Modifying an Entry Using LdifAdding Attributes to Existing Entries Using Ldif Modifying an Entry Using LdifFollowing example adds two telephone numbers to the entry Changing an Attribute Value Using Ldif Deleting All Values of an Attribute Using Ldif Deleting a Specific Attribute Value Using LdifEntry is now as follows Barneys entry then becomes Deleting an Entry Using LdifModifying an Entry in an Internationalized Directory Maintaining Referential IntegrityHow Referential Integrity Works Modifying an Entry in an InternationalizedUsing Referential Integrity with Replication You can enable or disable referential integrity as follows Modifying the Update IntervalEnabling/Disabling Referential Integrity DirectoryModifying the Attribute List Modifying the Attribute List TIPPage A Sample Directory Tree with One Root Suffix Creating and Maintaining SuffixesConfiguring Directory Databases Creating Suffixes 1, Using Referrals in a SuffixCreating Suffixes Creating Suffixes A Sample Directory Tree with a Sub SuffixCreating a New Sub Suffix Using the Console Creating a New Root Suffix Using the ConsoleCreating Root and Sub Suffixes from the Command-Line Attribute Name Value Attribute. See , Creating Creating and Maintaining Database Links forMaintaining Databases for more information Creating and Maintaining Databases forUsing Referrals in a Suffix Maintaining SuffixesSuffix Attributes Disabling a Suffix Enabling Referrals Only During Update OperationsMaintaining Suffixes To requests from client applications Click SaveCreating and Maintaining Databases Creating DatabasesDeleting a Suffix Creating Databases Configuring Directory Databases For example, add a new database to the server example1 Adding Multiple Databases for a Single SuffixConfiguring Directory Databases Placing a Database in Read-Only Mode Maintaining Directory DatabasesMaintaining Directory Databases Making a Database Read-Only from the Command Line Making a Database Read-Only Using the ConsoleSelect the database is read-only checkbox Change the read-only attribute to onDeleting a Database Placing the Entire Directory Server in Read-Only ModeSelect the Make Entire Server Read-Only checkbox Click Save, and then restart the serverDatabase Encryption Configuring Transaction Logs for Frequent Database UpdatesDatabase Encryption Encryption KeysConfiguring Database Encryption from the Console Encryption CiphersSelect the Attribute Encryption tab Configuring Database Encryption Using the Command-Line Run the ldapmodify command1Exporting and Importing an Encrypted Database See .3, Importing from the Command-Linefor more information Creating and Maintaining Database Links Configuring the Chaining PolicyChaining Component Operations Creating and Maintaining Database LinksNsActiveChainingComponents Cn=resource Component Name Description PermissionsNsActiveChainingComponents Cn=certificate-based Configuring the Chaining PolicyComponents Allowed to Chain Chaining Component Operations Using the ConsoleChaining Component Operations from the Command-Line Chaining Ldap ControlsPlug-in Chaining Ldap Controls from the Command-Line Chaining Ldap Controls Using the ConsoleCreating a New Database Link Creating a New Database Link Using the ConsoleLdap Controls and Their OIDs Creating a New Database LinkConfiguring Directory Databases Specify the configuration information for the database link Creating a Database Link from the Command-LineProviding Bind Credentials Providing Suffix InformationNsMultiplexorBindDN cannot be that of the Directory Manager Providing an Ldap URL Providing a List of Failover Servers Summary of Database Link Configuration AttributesFile Attributes ValueOperations 1, Chaining ComponentAttributes Value Run ldapmodify1 to add a database link to server a Create an administrative user on server B, as follows Updating Remote Server Authentication Information Chaining Using SSLEnable SSL on the server that contains the database link Maintaining Database LinksDatabase Links and Access Control Evaluation Database Links and Access ControlDeleting Database Links Configuring Directory Databases Managing Connections to the Remote Server Using the Console Advanced Feature Tuning Database Link PerformanceManaging Connections to the Remote Server EvaluationAttribute Name Description Detecting Errors During Normal Processing Advanced Feature Tuning Database LinkDatabase Link Connection Management Attributes Managing Threaded Operations Database Link Processing Error Detection ParametersAdvanced Feature Configuring Cascading Chaining Overview of Cascading ChainingPerformance Configuring Directory Databases Advanced Feature Configuring Cascading Configuring Cascading Chaining Defaults Using the ConsoleConfiguring Cascading Chaining Using the Console Chaining Configuring Cascading Chaining from the Command-LineConfiguring Directory Databases Summary of Cascading Chaining Configuration Attributes Detecting LoopsAttribute Description Cascading Chaining Configuration Example Cascading Chaining Configuration AttributesAci This attribute must contain the following ACI 101 Configuring Server One102 Configuring Server Two103 Configuring Directory Databases Allow this Configuring Server ThreeUsing Referrals Starting the Server in Referral ModeClient on server two Setting a Default Referral Using the Console Setting Default ReferralsSetting a Default Referral from the Command-Line Setting Default ReferralsCreating Smart Referrals Creating Smart Referrals Using the Directory Server ConsoleCreating Smart Referrals from the Command Line Creating Smart Referrals109 Creating Suffix Referrals Creating Suffix Referrals Using the ConsoleCreating Suffix Referrals Creating Suffix Referrals from the Command-LineConfiguring Directory Databases Importing Data Import Method ComparisonAction Import Initialize Database Importing a Database from the Console Populating Directory DatabasesFollowing sections describe importing data Initializing a Database from the Console Initializing a Database from the ConsoleImporting Using the ldif2db Command-Line Script Importing from the Command-LineOption Description Importing from the Command-LineImporting Using the ldif2db.pl Perl Script Ldif2db ParametersRun the ldif2db script Run the ldif2ldap command-line script Importing Using the ldif2ldap Command-Line ScriptExporting Data Ldif2db OptionsSplitting a Database Contents into Two Databases Exporting Directory Data to Ldif Using Exporting Directory Data to Ldif Using the ConsoleExporting to Ldif from the Command-Line Exporting a Single Database to Ldif Using the ConsoleLdif file in this case would be Run the db2ldif command-line scriptDirectory and is automatically named With the -noption or 123Backing up All Databases Backing up and Restoring DataBacking up All Databases from the Server Console Db2ldif OptionsRun the db2bak command-line script Backing up All Databases from the Command-LineBacking up All Databases Click Back Up Directory ServerClick Restore Directory Server Backing up the dse.ldif Configuration FileRestore Directory dialog box is displayed 126 Restoring All DatabasesUsing the bak2db Command-Line Script Restoring Your Database from the Command-LineUsing bak2db.pl Perl Script Restoring All DatabasesRestoring a Single Database Run the bak2db.pl Perl scriptRestart the Directory Server Restoring the dse.ldif Configuration File Restoring Databases That Include Replicated EntriesRestoring Databases That Include 130 About Roles Using RolesManaging Entries with Roles, Class of Service, and Views Managing Roles Using the Console Managing Roles Using the Console134 Creating a Managed RoleCreating a Filtered Role Follow the steps of .2.1, Creating a Managed Role135 Viewing and Editing an Entrys Roles Creating a Nested RoleCreate a new role, as in .2.1, Creating a Managed Role 136Modifying a Role Entry Making a Role Inactive137 Deleting a Role Reactivating a RoleManaging Roles Using the Command-Line Managing Roles Using the Command-LineObject Classes and Attributes for Roles Dialog box appears to confirm the deletion. Click YesExamples Managed Role Definition 141 Example Filtered Role DefinitionExample Nested Role Definition Using Roles SecurelyAssigning Class of Service Assigning Class of ServiceAbout the CoS Definition Entry About CoSAbout the CoS Template Entry How a Pointer CoS WorksAbout CoS Sample Pointer CoS How an Indirect CoS WorksSample Indirect CoS How a Classic CoS WorksSample Classic CoS Searches for CoS-Specified AttributesManaging CoS Using the Console Managing CoS Using the ConsoleCreating a New CoS 150 Property Editor opens Creating the CoS Template EntryDeleting a CoS Editing an Existing CoSCreating the CoS Definition Entry from the Command-Line Managing CoS from the Command-LineManaging CoS from the Command-Line CoS Type Object Classes DescriptionCoS Definition Entry Object Classes CoS Definition Entry AttributesAttribute Definition Managing CoS from the Command-Line CoS Type CoS definition CoS DefinitionsPointer CoS Indirect CoSBe added to any other search filter using or Creating the CoS Template Entry from the Command-Line158 Example of a Pointer CoSCreate the template entry Example of an Indirect CoSExample of a Classic CoS Creating Role-Based Attributes Creating Role-Based AttributesClassic CoS definition entry looks like Access Control and CoS Using ViewsCreating Views in the Console Creating Views in the ConsoleDeleting Views from the Directory Server Console Creating Views from the Command LineDeleting Views from the Command Line Using GroupsDeleting Views from the Command Line Managing Static GroupsModifying a Static Group Adding a New Static GroupAdding a New Dynamic Group Managing Dynamic GroupsModifying a Dynamic Group Managing Dynamic Groups168 ACI Structure Access Control PrinciplesManaging Access Control ACI PlacementACI Evaluation ACI LimitationsDefault ACIs Default ACIsCreating ACIs Manually Defining Targets ACI SyntaxDefining Targets Aci attribute uses the following syntaxKeyword Valid Expressions Wildcard Allowed Ldif Target KeywordsTargetattr Targetfilter175 Targeting a Directory EntryTargeting Attributes 177 Targeting Both an Entry and Attributes178 Targeting Entries or Attributes Using Ldap FiltersTargeting Attribute Values Using Ldap Filters Targeting a Single Directory Entry Defining PermissionsAssigning Rights Allowing or Denying AccessDefining Permissions Assigning rightsUser Rights Rights Required for Ldap OperationsSelfwrite to the targeted entry, excluding Proxy rights183 Access Control and the modrdn Operation Bind RulesPermissions Syntax Bind Rule Syntax Bind Rule SyntaxUserdn Yes, in DN onlyLdif Bind Rule Keywords Defining User Access userdn KeywordGroupdn Ldap///DN DN Roledn Userattr DnsGeneral Access all Keyword Anonymous Access anyone KeywordSelf Access self Keyword Parent Access parent KeywordWildcards ExamplesScenExamplerio Description Userdn Keyword Examples Defining Group Access groupdn KeywordDefining Group Access groupdn Keyword Defining Role Access roledn KeywordGroupdn Examples Defining Access Based on Value Matching Using the userattr KeywordDefining Access Based on Value Matching Example with Userdn Bind Type Example with Groupdn Bind TypeAttrValue is any string representing an attribute value Example with Roledn Bind Type Example with Ldapurl Bind Type193 Example with Any Attribute Value Using the userattr Keyword with InheritanceGranting Add Permission Using the userattr Keyword Using Inheritance With the userattr KeywordDefining Access from a Specific IP Address Defining Access from a Specific Domain Defining Access from a Specific DomainInstead, use a fully qualified name Dns keyword allows wildcards. For exampleDefining Access at a Specific Time of Day or Day of Week Defining Access Based on Authentication Defining Access Based on Authentication MethodAuthmethod = saslmechanism Using Boolean Bind Rules Authentication bind DN and password over LdapsMethod Creating ACIs from the Console Displaying the Access Control Editor Displaying the Access Control EditorClick New to open the Access Control Editor Creating a New ACI Access Control Editor WindowCreating a New ACI Managing Access Control Creating a New ACI Managing Access Control Editing an ACI Editing an ACIViewing ACIs Deleting an ACIControl Manager Get Effective Rights Control Get Effective Rights Control PermissionsGet effective rights result looks like the following Permissions That Can Be Set on Entries Using Get Effective Rights from the Command-LinePermissions That Can Be Set on Attributes Permission DescriptionUsing Get Effective Rights from 214 Get Effective Rights Return Codes Using Get Effective Rights from the ConsoleCheck the Show effective rights checkbox Code DescriptionLogging Access Control Information Access Control Usage ExamplesReturned Result Codes Granting Anonymous Access Granting Anonymous AccessClick OK in the Access Control Editor window Click New to display the Access Control EditorACI Anonymous example.com ACI Anonymous WorldGranting Write Access to Personal Entries Granting Write Access to Personal EntriesFilter for subentries field, type the following filter 220 ACI Write example.comACI Write Subscribers Restricting Access to Key Roles Restricting Access to Key Roles See , Using RolesACI Roles Granting a Group Full Access to a Suffix ACI HRLdif statement should read as follows ACI Create Group Granting Rights to Add and Delete Group EntriesManaging Access Control Granting Conditional Access to a Group or Role ACI Delete GroupEntries 228 ACI HostedCompany1Denying Access Denying AccessLdif statement should be similar to the following ACI Billing Info Read 231 ACI Billing Info DenyAllowing Users to Add or Remove Themselves from a Group Setting a Target Using FilteringAllowing Users to Add or Remove ACI Group MembersDefining Permissions for DNs That Contain a Comma Proxied Authorization ACI ExampleAdvanced Access Control Using Macro ACIs Macro ACI ExampleThemselves from a Group 236 Example Directory Tree for Macro ACIsMacro ACI Syntax Macro ACI SyntaxMacro Matching for $dn Macros in ACI KeywordsMacro ACI Keyword $dn in the subject is replaced with dc=hostedCompany1 Steps for expanding this ACI are as followsMacro Matching for $attr.attrName For example, consider the following ACI240 Access Control and Replication Access Control and ReplicationCompatibility with Earlier Releases 242 Configuring the Password Policy Managing the Password PolicyManaging User Accounts and Passwords Configuring a Global Password Policy Using the ConsoleConfiguring the Password Policy Check the Enable fine-grained password policy checkbox Configuring a Subtree/User Password Policy Using the ConsoleAttribute Name Definition Configuring a Global Password Policy Using the Command-LineGiven by the passwordMaxAge attribute Users password will expire after an intervalMaking passwords expire helps protect Directory data because the longer a passwordFor example, setting the minimum password Discourage users from reusing old passwordsChanging their passwords during a single Session to cycle through the password historyPasswords can be two 2 to 512 characters Shorter passwords are easier to crackIt down. This attribute is set to 8 by default Attributes, respectively. By default, thisDefault method This attribute is set to 3 by defaultCompatibility with Unix passwords Lowercase letters a to zPassword Policy Attributes CoS specification entry at the subtree level. For example 254 Password Change Extended Operation Setting User PasswordsSetting User Passwords Start the serverLdappasswd Options Parameter Description256 Configuring the Account Lockout Policy Configuring the Account Lockout Policy Using the ConsoleConfiguring the Account Lockout Policy Attribute Name Definition Managing the Password Policy in a Replicated Environment Managing the Password Policy in aAccount Lockout Policy Attributes Synchronizing Passwords Replicated Environment Inactivating Users and RolesInactivating User and Roles Using the Console Inactivating User and Roles Using the Command-LineOption Name Description Activating User and Roles Using the Command-Line Activating User and Roles Using the ConsoleActivating User and Roles Using DN of the user account or role to activateSetting Resource Limits Using the Console Setting Resource Limits Based on the Bind DNEntering a value of -1indicates no limit Click OK Setting Resource Limits Using the Command-Line266 Replication Overview What Directory Units Are ReplicatedRead-Write and Read-Only Replicas Changelog Suppliers and ConsumersReplication Identity Managing ReplicationReplication Agreement Compatibility with Earlier Versions of Directory ServerReplication Agreement Single-Master Replication Replication ScenariosMulti-Master Replication Multi-Master Replication272 Multi-Master Replication Two MastersMulti-Master Replication Four Masters Replication Cascading ReplicationCreating the Supplier Bind DN Entry Creating the Supplier Bind DN EntryConfiguring Single-Master Replication Configuring the Read-Write Replica on Configuring the Read-Write Replica on the Supplier ServerConfiguring the Read-Only Replica on the Consumer Supplier Server Create the Replication Agreement Create the Replication Agreement Managing Replication Create the Replication Agreement Replication will not begin until the consumer is initialized Configuring Multi-Master Replication Configuring the Read-Write Replicas on the Supplier Servers Configuring Multi-Master Replication287 Configuring the Read-Write Replicas onManaging Replication Supplier Servers Configuring the Read-Only Replicas on the Consumer ServersManaging Replication Setting up the Replication Agreements Setting up the Replication AgreementsManaging Replication Setting up the Replication Agreements Managing Replication Setting up the Replication Agreements Replication will not begin until the consumer is initialized 297 Preventing Monopolization of the ConsumerConfiguring Cascading Replication Configuring the Read-Write Replica on the Supplier Server Configuring the Read-Only Replica on the Consumer Server Configuring the Read-Only Replica on Configuring the Read-Only Replica on the Hub Consumer Server Managing Replication Setting up the Replication Agreements Managing Replication DN and password Managing Replication Setting up the Replication Agreements Replication will not begin until the consumer is initialized Configuring Replication from the Command Line Configuring Suppliers from the Command LineConfiguring Replication from the Command 312 Line Changelog AttributesObject Class or Attribute Description Values Changelog, to which314 Consumer. This is required forConfiguring Consumers from the Command Configuring Consumers from the Command LineForward update requests. By Replica AttributesConfiguring Hubs from the Command Line Configuring Replication Agreements from the Command Line Parameter to SSL. If TLS/SSL 318 Qualified host and domainReplication between Servers Nsds5replicabindcredentials Configuring Replication Agreements fromNsds5replicatedattributelist Objectclass=* $ Exclude Attributes will not beMidnight and 2359 is PM. For example, the setting Replication Agreement Attributes320 Command Line Initializing Consumers Online from the Command LineDeleting the Changelog Making a Replica UpdatableRemoving the Changelog Initializing ConsumersMoving the Changelog to a New Location Moving the Changelog to a New LocationOnline Consumer Initialization Using the Console When to Initialize a ConsumerInitializing Consumers Online Using Initializing Consumers Online Using the Command LineExporting a Replica to Ldif Manual Consumer Initialization Using the Command LineImporting the Ldif File to the Consumer Server Filesystem Replica InitializationInitializing the Consumer Replica from the Backup Files Forcing Replication Updates Forcing Replication UpdatesStop the destination Directory Server if it is running Restart the destination Directory Server. For exampleForcing Replication Updates from the Command-Line Forcing Replication Updates from the ConsoleExample 8.1. ReplicateNow Script Example Replicating Account Lockout AttributesReplicateNow Variables Replicating Account Lockout AttributesReplication over SSL Select SSL Client Authentication Select Simple AuthenticationReplicating o=NetscapeRoot for Directory Server Installation Guide Administration Server Failover Replication with Earlier ReleasesSee , Enabling and Disabling Plug-ins Using the Retro Changelog Plug-in Attributes of a Retro Changelog Entry Enabling the Retro Changelog Plug-inEnabling the Retro Changelog Plug-in Retro Changelog EntryTrimming the Retro Changelog Retro Changelog and the Access Control Retro Changelog and the Access Control PolicyMonitoring Replication Status Searching and Modifying the Retro ChangelogMonitoring Replication Status from Administration Express Directory Server Console Replication StatusTable Header Description Table header shows the replica ID 341 PolicySolving Common Replication Conflicts Solving Naming Conflicts Renaming an Entry with a Multi-Valued Naming AttributeSolving Naming Conflicts 344 Unique identifier attribute nsuniqueid cannot be deletedRenaming an Entry with a Single-Valued Naming Attribute Solving Orphan Entry Conflicts Solving Potential Interoperability ProblemsTroubleshooting Replication-Related Troubleshooting Replication-Related ProblemsError/Symptom Reason Impact Remedy Problems If it has been But some consumers Follows Are way behind SupplierReplayed to all Direct consumersSee Section Replication ErrorsMonitoring Replication Status352 Managing Attributes Overview of Extending SchemaViewing Attributes Create new attributes, as in .2, Creating AttributesField Extending the Directory SchemaName SyntaxAttributes Tab Reference Creating AttributesCreating Attributes Field DescriptionEditing Attributes Deleting AttributesOIDs are described in .1, Attributes Tab Reference Managing Object Classes This procedure is explained in .4, Deleting AttributesViewing Object Classes Managing Object ClassesReference Parent358 Creating Object Classes Object Classes Tab ReferenceCreating Object Classes Click OK to save the new object class Editing Object ClassesDeleting Object Classes Deleting Object ClassesTurning Schema Checking On and Off About Index Types About IndexesOverview of Default Indexes About Default, System, and Standard IndexesManaging Indexes Attribute Pres Sub PurposeMaintaining About Default, System, and StandardReferential Integrity forDefault Indexes Overview of System Indexes366 Overview of Standard Indexes Overview of the Searching AlgorithmSystem Indexes Attribute Pres PurposeManaging Indexes Approximate Searches Balancing the Benefits of IndexingApproximate Searches Directory Server is maintaining the following indexes 370 Creating Indexes Creating IndexesCreating Indexes from the Server Console Creating Indexes from the Command-Line Creating Indexes from the Command-LineAdding an Index Entry 374 To create a new index for a particular database, add it toCreating Indexes from the Command-Line Db2index.pl Options Running the db2index.pl ScriptRun the db2index.pl Perl script Db2index Options describes the db2index.pl optionsCreating Browsing Indexes from the Server Console Creating Browsing Indexes from the Command-LineAdding a Browsing Index Entry Creating Browsing Indexes fromManaging Indexes This first browsing index entry must be added to Running the vlvindex ScriptVlvindex Options Setting Access Control for VLV InformationStop the server.3 Run the vlvindex scriptDeleting Indexes Deleting IndexesA text editor, open the dse.ldif file Change ldap//all to ldap//anyone and save your changesDeleting Indexes from the Server Console Deleting Indexes from the Command-LineDeleting Indexes from the Command-Line Deleting an Index EntryLdapdelete Options describes the ldapdelete options Run the db2index.pl Perl script. For example Ldapdelete OptionsDeleting Browsing Indexes from the Server Console Deleting Browsing Indexes from the Command-LineDeleting a Browsing Index Entry Db2index OptionsOption Description Vlvindex Options describes the vlvindex options Managing IndexesSearch Performance Indexing PerformanceBackwards Compatibility and Migration Attribute Name Quick Reference Table Backwards Compatibility and MigrationAttribute Primary Name Attribute Alias Attribute Name Quick Reference Table Attribute Name Quick Reference Table391 392 Enabling SSL Summary of Steps Introduction to TLS/SSL in the Directory ServerCommand-Line Functions for Start TLS Managing SSLTurn on TLS/SSL in the directory Obtaining and Installing Server Certificates Troubleshooting Start TLSObtaining and Installing Server Certificates Generate a Certificate Request Generate a Certificate Request Managing SSL After generating the certificate request, send it to the CA Send the Certificate RequestInstall the Certificate Trust the Certificate Authority Trust the Certificate AuthorityConfirm That The New Certificates Are Installed Using certutilCreate a password file for the security token password Creating Directory Server CertificatesGenerate the Directory Server client certificate 404 Through the Command Line Starting the Server with TLS/SSL EnabledCertutil Usage Certutil OptionsClick Cipher Settings Enabling TLS/SSL Only in the Directory ServerSelect the certificate to use from the drop-down menu Enabling TLS/SSL Only in the Directory Described in , Starting and Stopping Servers Server Click Cipher Settings Check the Use SSL in the Console box. Hit Save409 Creating a Password File for the Directory Server Creating a Password File for Creating a Password File for the Administration ServerSetting Security Preferences Restart the Administration ServerAvailable Ciphers TLSv1 Ciphers Administration ServerClick Cipher Setting Selecting the Encryption CipherSSLv3 Ciphers Using Certificate-Based Authentication Using Certificate-Based AuthenticationEncryption tab, click Save Allowing/Requiring Client Authentication Setting up Certificate-Based AuthenticationConfiguring Ldap Clients to Use SSL Configuring Ldap Clients to Use SSLStop the Directory Server Now start Red Hat ConsoleBegin Certificate Client certificate resembles the followingConfiguring Ldap Clients to Use SSL Click Set Value 420 Managing Sasl Authentication MechanismsSasl is configured by entries under a container entry 422 Sasl Identity MappingManaging Sasl Sasl Identity Mapping Sasl identity mapping entries are children of this entry423 Configuring Sasl Identity Mapping from the Console Configuring Sasl Identity Mapping from Configuring Kerberos Configuring Sasl Identity Mapping from the Command-LineSupported Kerberos Systems Operating System Kerberos VersionRealms Configuring the KDC ServerExample Configuring an Example KDC Server Configuring Sasl Authentication at Configuring Sasl Authentication at Directory Server StartupManaging Sasl Viewing and Configuring Log Files Administration ExpressDefining a Log File Rotation Policy Monitoring Server and Database Activity Viewing the Access Log Access LogDefining a Log File Deletion Policy Defining a Log File Deletion PolicyDisplay to refresh automatically every ten seconds Configuring the Access LogError Log Viewing the Error LogError Log Configuring the Error Log Containing text box, and click RefreshClick Save 436 Audit Log Configuring the Audit LogViewing the Audit Log Audit LogMonitoring Server Activity Manual Log File RotationMonitoring the Server from the Directory Monitoring the Server from the Directory Server ConsoleResource Summary General Information ServerResource Usage Since Startup Average Per Minute Resource Current TotalServer Console Current Resource UsageConnection can account for multiple Operations, and therefore multiple threadsConnection Status Monitoring the Directory Server from the Command Line Global Database Cache InformationMonitoring the Directory Server from 444 Attribute DescriptionMonitoring Database Activity Server Monitoring AttributesTime GMT in UTC format Maximum Cache Size setting. See Section See , Tuning DatabaseGeneral Information Database Performance Metric Current TotalCache setting. See , Tuning Tuning Database Performance forSummary Information Monitoring Database Activity fromMonitoring Databases from the Command Line Database Cache Information10. Database File-Specific Directory Server Console Maximum Entries in Cache attribute 11. Directory Server Monitoring Attributes Monitoring Database Link ActivityMonitoring Database Link Activity Lower the number of page evicts the better452 12. Database Link Monitoring AttributesAbout Snmp SnmpSubagent Configuration File Configuring the Master Agent Configuring the SubagentMonitoring Directory Server Using Snmp Agentx-masterAgent-logdir Starting the SubagentServer Starting the SubagentTesting the Subagent Configuring Snmp TrapsConfiguring the Directory Server for Snmp Using the Management Information BaseConfiguring the Directory Server for Snmp Managed Object Description Operations TableEntries Table Operations Table Managed Objects and DescriptionsEntries Table Entity TableEntries Table Managed Objects and Descriptions Interaction Table Entity Table Managed Objects and DescriptionsInteraction Table Management subsystem was initialized, this Interaction Table Managed Objects and DescriptionsObject will contain a value of zero 462Tuning Server Performance Tuning Directory Server PerformanceTuning Database Performance Tuning Directory Server PerformanceOptimizing Search Performance Optimizing Search Performance Changing the Location of the Database Transaction Log Tuning Transaction LoggingChanging the Database Checkpoint Interval Changing the Database Checkpoint IntervalMiscellaneous Tuning Tips Disabling Durable TransactionsSpecifying Transaction Batching Avoid Creating Entries Under the cn=config 470 Bit Check Plug-in Server Plug-in Functionality ReferenceACL Plug-in Details of 7-Bit Check Plug-inACL Preoperation Plug-in Administering Directory Server Plug-insBinary Syntax Plug-in Details of ACI Plug-inCase Exact String Syntax Plug-in Boolean Syntax Plug-inDetails of Binary Syntax Plug-in Details of Boolean Syntax Plug-inChaining Database Plug-in Case Ignore String Syntax Plug-inDetails of Case Exact String Syntax Plug-in Details of Case Ignore String Syntax Plug-inDetails of Class of Service Plug-in Class of Service Plug-inClass of Service Plug-in Country String Syntax Plug-inGeneralized Time Syntax Plug-in Distinguished Name Syntax Plug-in10. Details of Country String Plug-in 11. Details of Distinguished Name Syntax Plug-inInternationalization Plug-in Integer Syntax Plug-in12. Details of Generalized Time Syntax Plug-in 13. Details of Integer Syntax Plug-inLegacy Replication Plug-in Ldbm Database Plug-in14. Details of Internationalization Plug-in 15. Details of ldbm Database Plug-inOctet String Syntax Plug-in Multi-Master Replication Plug-in16. Details of Legacy Replication Plug-in 17. Details of Multi-Master Replication Plug-inCrypt Password Storage Plug-in Clear Password Storage Plug-in19. Details of Clear Password Storage Plug-in 18. Details of Octet String Syntax Plug-in20. Details of Crypt Password Storage Plug-in NS-MTA-MD5 Password Storage Plug-in21. Details of NS-MTA-MD5 Password Storage Plug-in NS-MTA-MD5 Password Storage Plug-inSHA Password Storage Plug-in Ssha Password Storage Plug-in22. Details of SHA Password Storage Plug-in Postal Address String Syntax Plug-in 23. Details of Ssha Password Storage Plug-inPTA Plug-in 24. Details of Postal Address String Syntax Plug-inAuthentication Plug-in Using the Pass-throughSee , Using the Pass-through Referential Integrity Postoperation Plug-in26. Details of Referential Integrity Post-Operation Plug-in Retro Changelog Plug-inRetro Changelog Plug-in See , Managing Indexes forSpace Insensitive String Syntax Plug-in Roles Plug-in27. Details of Retro Changelog Plug-in 28. Details of Roles Plug-in29. Details of Space Insensitive String Syntax Plug-in State Change Plug-inState Change Plug-in See Appendix B, Finding Directory EntriesUID Uniqueness Plug-in Telephone Syntax Plug-in30. Details of State Change Plug-in 31. Details of Telephone Syntax Plug-inURI Plug-in See , Using the Attribute32. Details of UID Uniqueness Plug-in URI Plug-in33. Details of URI Plug-in Enabling and Disabling Plug-insHow Directory Server Uses PTA Using the Pass-through Authentication Plug-inPTA Plug-in Syntax Using the Pass-through Authentication Plug-inVariable Definition PTA Plug-in SyntaxConfiguring the Optional Parameters for See .5, Configuring the OptionalSpecifying the Pass-through Subtree for Configuring the PTA Plug-in Configuring the PTA Plug-inPTA Plug-in Parameters Configuring the Servers to Use a Secure Connection Specifying the Authenticating Directory ServerTurning the Plug-in On or Off Specifying the Pass-through Subtree Specifying the Pass-through SubtreeConfiguring the Optional Parameters PTA Plug-in Syntax Examples PTA Plug-in Syntax ExamplesUsing Non-Default Parameter Values Specifying Multiple Authenticating Directory ServersSpecifying Different Optional Parameters 502 Overview of the Attribute Uniqueness Plug-in Using the Attribute Uniqueness Plug-inAttribute Uniqueness Plug-in Syntax Using the Attribute Uniqueness Plug-inAttribute Uniqueness Plug-in Syntax See .3.1, Turning the Plug-in On or505 Attribute Uniqueness Plug-in Variables Creating an Instance of the Attribute Uniqueness Plug-inConfiguring Attribute Uniqueness Plug-ins Viewing Plug-in Configuration InformationConfiguring Attribute Uniqueness Plug-ins From the Property Editor From the Configuration tabTurning the Plug-in On or Off Specifying a Suffix or Subtree509 Using the markerObjectClass and requiredObjectClass Keywords Attribute Uniqueness Plug-in Syntax Examples From the Command-LineSpecifying One Attribute and One Subtree Specifying One Attribute and Multiple SubtreesSimple Replication Scenario Replication and the Attribute Uniqueness Plug-inMulti-Master Replication Scenario Multi-Master Replication Scenario514 About Windows Sync Active Directory Directory Server Synchronization Process 517 About Windows SyncConfigure SSL on Directory Server Configuring Windows SyncConfigure the Active Directory Domain Configure the Active DirectorySelect the Enterprise Root CA option Iv. Accept the certificate request. For example Select or Create the Sync IdentityDomain Install and Configure the Password Sync ServiceReboot the Windows machine to start Password Sync Hit Next, then Finish to install Password Sync523 Install and Configure the PasswordGive trusted peer status to the server Configure the Directory Server Database for SynchronizationCreate the Synchronization Agreement Sync ServiceSetting up the Sync Agreement Begin Synchronization Using Windows SyncBegin Synchronization Synchronizing Users Synchronizing Groups Deleting EntriesSynchronizing Users Synchronizing Users Directory Server Active Directory529 PhysicalDeliveryOfficeName Synchronizing GroupsDeleting Entries Deleting EntriesNtGroupAttributes NtGroupId Name SamAccountName NtGroupType Description Member SeeAlsoManually Updating and Resynchronizing Entries Resurrecting EntriesChecking Synchronization Status Modifying the Sync AgreementChecking Synchronization Status Password Policies Schema DifferencesGroups Values for street and streetAddressModifying Password Sync Password Sync ServiceStarting and Stopping the Password Sync Service Contraints on the initials attributeUninstalling Password Sync Service TroubleshootingTo uninstall the Password Sync service, do the following Open the Add/Remove Programs utility537 Troubleshooting538 About the Ldif File Format Appendix A. Ldap Data Interchange FormatTable A.1. Ldif Fields Continuing Lines in LdifAppendix A. Ldap Data Interchange Format Field DefinitionStandard Ldif Notation Representing Binary DataBase-64 Encoding Representing Binary DataSpecifying Domain Entries Specifying Directory Entries Using LdifSpecifying Organizational Unit Entries Table A.2. Ldif Elements in Domain EntriesDomain Entries Ldif Element DescriptionSpecifying Organizational Unit Entries Specifying Organizational Person Entries Table A.3. Ldif Elements in Organizational Unit EntriesSpecifying Organizational Person Entries Table A.4. Ldif Elements in Person Entries Defining Directories Using Ldif547 Defining Directories Using LdifLdif File Example Storing Information in Multiple Languages Storing Information in Multiple Languages550 File contents are then converted to UTF-8Figure B.1. Browsing Entries in the Directory Tab Finding Entries Using the Directory Server ConsoleAppendix B. Finding Directory Entries Using ldapsearchLdapsearch command must use the following format Ldapsearch Command-Line FormatCommonly Used ldapsearch Options Commonly Used ldapsearch Options Returning All Entries Ldapsearch ExamplesSearching the Schema Entry Specifying Search Filters on the Command LineUsing Ldapbasedn Searching the Root DSE EntrySpecifying Search Filters Using a File Displaying Subsets of AttributesThis example assumes the search base is set with Ldapbasedn Ldap Search Filters Using Client Authentication When SearchingSpecifying DNs That Contain Commas in Search Filters Ldap Search FiltersUsing Operators in Search Filters Using Attributes in Search FiltersSearch Filter Syntax Basic syntax of a search filter isTable B.1. Search Filter Operators Using Compound Search FiltersSearch Filter Syntax Search Type Operator DescriptionOperator Symbol Description Search Filter ExamplesTable B.2. Search Filter Boolean Operators Searching an Internationalized Directory Searching an Internationalized DirectoryMatching Rule Formats Matching Rule Filter SyntaxUsing a Language Tag for the Matching Rule Using an OID for the Matching RuleMatching Rule Filter Syntax 565Using an OID and Suffix for the Matching Rule Using Wildcards in Matching Rule FiltersUsing a Language Tag and Suffix for the Matching Rule Table B.3, Search Types, Operators, and SuffixesSupported Search Types Supported Search TypesSearch Type Operator Suffix Less-Than Example International Search ExamplesLess-Than or Equal-to Example Equality ExampleGreater-Than Example Greater-Than or Equal-to ExampleSubstring Example International Search Examples570 But either one of these will work correctlyLdap URLs have the following syntax Components of an Ldap URLComponent Hostname PortTable C.1. Ldap URL Components Appendix C. Ldap URLsComponent Description Examples of Ldap URLs Escaping Unsafe CharactersEscaping Unsafe Characters Unsafe Character Escape CharactersExample 575 Examples of Ldap URLs576 About Locales Appendix D. InternationalizationIdentifying Supported Locales Appendix D. InternationalizationLocale Language Tag Collation Order Object Identifiers OIDs Table D.1. Supported Locales Supported Language Subtypes579 Supported Language Subtypes Troubleshooting Matching Rules Troubleshooting Matching RulesTable D.2. Supported Language Subtypes 582 See Also access control instruction See Also access control listSee Also ID list scan limit Value GlossarySee base DN See bind DNSee Certificate Authority See Also virtual list view indexThat provides client access to the directory Directory Access Protocol. The ISO X.500 standard protocolSee Ldap client See Also template entrySee directory tree See CoS definition entrySee distinguished name See Directory ManagerSee Directory Server Gateway See Also cascading replication See Ldap Data Interchange Format See Snmp master agent See supplierDirectory tree See object identifier See Also access rightsEncoded messages which form the basis of data exchanges Between Snmp devices. Also protocol data unitReceives to the authenticating directory server Authenticating directory server, pass-through subtrees,Name. Also relative distinguished name Process is called a referral Request for Comments. Procedures or standards documentsSubmitted to the Internet community. People can send Comments on the technologies before they become acceptedDirectory Server during installation Server Instance Entry. The ID assigned to an instanceSee supplier-initiated replication Simple Network Management Protocol SubagentSee Snmp subagent See CoS template entry Protocol. Also Transport Layer SecuritySee Also browsing index Page 600 Index Index Page Index Page Index Ldapbasedn Index Ldif Index MIB Index Page Index Page MIB Page Index