Red Hat Directory Server 5.1

700
Red Hat Directory Server 8.1 Administration Guide Ella Deon Lackey Publication date: April 28, 2009, updated on June 12, 2010

description

Read Hat Book

Transcript of Red Hat Directory Server 5.1

Page 1: Red Hat Directory Server 5.1

Red Hat DirectoryServer 8.1

Administration GuideElla Deon Lackey

Publication date: April 28, 2009, updated on June 12, 2010

Page 2: Red Hat Directory Server 5.1

Administration Guide

Red Hat Directory Server 8.1 Administration GuideAuthor Ella Deon Lackey Copyright © 2009 Red Hat, Inc.

Copyright © 2009 Red Hat, Inc..

The text of and illustrations in this document are licensed by Red Hat under a Creative CommonsAttribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is availableat http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute thisdocument or an adaptation of it, you must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the InfinityLogo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United Statesand/or other countries.

All other trademarks are the property of their respective owners.

1801 Varsity Drive Raleigh, NC 27606-2072 USA Phone: +1 919 754 3700 Phone: 888 733 4281 Fax: +1 919 754 3701

Page 3: Red Hat Directory Server 5.1

iii

Preface xv1. Directory Server Overview ............................................................................................. xv2. Examples and Formatting .............................................................................................. xvi

2.1. Command and File Examples ............................................................................. xvi2.2. Tool Locations .................................................................................................... xvi2.3. LDAP Locations ................................................................................................. xvi2.4. Text Formatting and Styles ................................................................................. xvi

3. Additional Reading ....................................................................................................... xvii4. Giving Feedback ......................................................................................................... xviii5. Documentation History .................................................................................................. xix

1. Basic Red Hat Directory Server Settings 11.1. Directory Server File Locations ..................................................................................... 11.2. LDAP Tool Locations .................................................................................................... 31.3. Starting and Stopping Servers ...................................................................................... 3

1.3.1. Starting and Stopping Directory Server from the Console ..................................... 31.3.2. Starting and Stopping Directory Server from the Command Line ........................... 41.3.3. Starting and Stopping Administration Server ........................................................ 5

1.4. Starting the Console ..................................................................................................... 51.4.1. Starting the Directory Server Console ................................................................. 51.4.2. Logging into Directory Server ............................................................................. 61.4.3. Changing Login Identity ..................................................................................... 71.4.4. Viewing the Current Console Bind DN ................................................................ 8

1.5. Enabling LDAPI ............................................................................................................ 81.6. Changing Directory Server Port Numbers ...................................................................... 91.7. Creating a New Directory Server Instance ................................................................... 111.8. Configuring the Directory Manager .............................................................................. 131.9. Enabling Plug-ins ....................................................................................................... 13

2. Configuring Directory Databases 152.1. Creating and Maintaining Suffixes ............................................................................... 15

2.1.1. Creating Suffixes ............................................................................................. 152.1.2. Maintaining Suffixes ......................................................................................... 24

2.2. Creating and Maintaining Databases ........................................................................... 262.2.1. Creating Databases ......................................................................................... 262.2.2. Maintaining Directory Databases ...................................................................... 312.2.3. Configuring Attribute Encryption ........................................................................ 36

2.3. Creating and Maintaining Database Links .................................................................... 422.3.1. Creating a New Database Link ......................................................................... 432.3.2. Configuring the Chaining Policy ........................................................................ 562.3.3. Maintaining Database Links .............................................................................. 632.3.4. Configuring Database Link Defaults .................................................................. 642.3.5. Deleting Database Links .................................................................................. 652.3.6. Database Links and Access Control Evaluation ................................................. 662.3.7. Tuning Database Link Performance .................................................................. 67

2.4. Configuring Cascading Chaining ................................................................................. 712.4.1. Overview of Cascading Chaining ...................................................................... 722.4.2. Configuring Cascading Chaining Using the Console ........................................... 742.4.3. Configuring Cascading Chaining from the Command Line .................................. 752.4.4. Detecting Loops .............................................................................................. 772.4.5. Summary of Cascading Chaining Configuration Attributes ................................... 782.4.6. Cascading Chaining Configuration Example ...................................................... 78

Page 4: Red Hat Directory Server 5.1

Administration Guide

iv

2.5. Using Referrals .......................................................................................................... 832.5.1. Starting the Server in Referral Mode ................................................................. 832.5.2. Setting Default Referrals .................................................................................. 842.5.3. Creating Smart Referrals .................................................................................. 852.5.4. Creating Suffix Referrals .................................................................................. 90

3. Creating Directory Entries 933.1. Managing Entries from the Directory Console ............................................................... 93

3.1.1. Creating a Root Entry ...................................................................................... 933.1.2. Creating Directory Entries ................................................................................ 963.1.3. Modifying Directory Entries ............................................................................. 1003.1.4. Deleting Directory Entries ............................................................................... 108

3.2. Managing Entries from the Command Line ................................................................ 1093.2.1. Providing Input from the Command Line .......................................................... 1103.2.2. Creating a Root Entry from the Command Line ................................................ 1113.2.3. Adding Entries Using LDIF ............................................................................. 1113.2.4. Adding and Modifying Entries Using ldapmodify ............................................... 1113.2.5. Deleting Entries Using ldapdelete ................................................................... 1143.2.6. Using Special Characters ............................................................................... 115

3.3. Tracking Modifications to Directory Entries ................................................................. 1153.4. LDIF Update Statements ........................................................................................... 117

3.4.1. Adding an Entry Using LDIF ........................................................................... 1183.4.2. Renaming an Entry Using LDIF ...................................................................... 1193.4.3. Modifying an Entry Using LDIF ....................................................................... 1203.4.4. Deleting an Entry Using LDIF ......................................................................... 1233.4.5. Modifying an Entry in an Internationalized Directory ......................................... 124

3.5. Maintaining Referential Integrity ................................................................................. 1243.5.1. How Referential Integrity Works ...................................................................... 1243.5.2. Using Referential Integrity with Replication ...................................................... 1253.5.3. Enabling and Disabling Referential Integrity ..................................................... 1263.5.4. Modifying the Update Interval ......................................................................... 1293.5.5. Modifying the Attribute List ............................................................................. 130

3.6. Assigning and Managing Unique Numeric Attribute Values .......................................... 1323.6.1. Overview of Unique Number Assignments ....................................................... 1323.6.2. Looking at the DNA Plug-in Syntax ................................................................. 1353.6.3. Configuring Unique Number Assignments ........................................................ 137

3.7. Enforcing Attribute Uniqueness .................................................................................. 1403.7.1. Overview of Attribute Uniqueness ................................................................... 1403.7.2. Attribute Uniqueness Plug-in Syntax ............................................................... 1413.7.3. Creating an Instance of the Attribute Uniqueness Plug-in .................................. 1433.7.4. Configuring Attribute Uniqueness .................................................................... 1443.7.5. Attribute Uniqueness Plug-in Syntax Examples ................................................ 1463.7.6. Replication and the Attribute Uniqueness Plug-in ............................................. 147

4. Populating Directory Databases 1494.1. Importing Data .......................................................................................................... 149

4.1.1. Importing Entries with Large Attributes ............................................................ 1494.1.2. Importing a Database from the Console .......................................................... 1494.1.3. Initializing a Database from the Console .......................................................... 1514.1.4. Importing from the Command Line .................................................................. 153

4.2. Exporting Data ......................................................................................................... 1564.2.1. Exporting Directory Data to LDIF Using the Console ........................................ 158

Page 5: Red Hat Directory Server 5.1

v

4.2.2. Exporting a Single Database to LDIF Using the Console ................................... 1594.2.3. Exporting to LDIF from the Command Line ...................................................... 160

4.3. Backing up and Restoring Data ................................................................................. 1624.3.1. Backing up All Databases .............................................................................. 1624.3.2. Backing up the dse.ldif Configuration File ........................................................ 1654.3.3. Restoring All Databases ................................................................................. 1654.3.4. Restoring a Single Database .......................................................................... 1674.3.5. Restoring Databases That Include Replicated Entries ....................................... 1684.3.6. Restoring the dse.ldif Configuration File .......................................................... 168

5. Organizing Entries with Roles, Class of Service, and Views 1715.1. Using Roles ............................................................................................................. 171

5.1.1. About Roles .................................................................................................. 1715.1.2. Managing Roles Using the Console ................................................................ 1735.1.3. Managing Roles Using the Command Line ...................................................... 1895.1.4. Using Roles Securely ..................................................................................... 191

5.2. Assigning Class of Service ........................................................................................ 1925.2.1. About CoS .................................................................................................... 1935.2.2. Managing CoS Using the Console .................................................................. 1975.2.3. Managing CoS from the Command Line .......................................................... 2115.2.4. Creating Role-Based Attributes ....................................................................... 2185.2.5. Access Control and CoS ................................................................................ 219

5.3. Using Views ............................................................................................................. 2195.3.1. Creating Views in the Console ........................................................................ 2205.3.2. Deleting Views from the Directory Server Console ........................................... 2275.3.3. Creating Views from the Command Line ......................................................... 2275.3.4. Deleting Views from the Command Line .......................................................... 228

5.4. Using Groups ........................................................................................................... 2285.4.1. Managing Static Groups ................................................................................. 2285.4.2. Managing Dynamic Groups ............................................................................ 2325.4.3. Creating and Managing Groups in the Command Line ...................................... 2355.4.4. Using the memberOf Attribute to Manage Group Membership Information .......... 236

6. Managing Access Control 2436.1. Access Control Principles .......................................................................................... 243

6.1.1. ACI Structure ................................................................................................. 2436.1.2. ACI Placement .............................................................................................. 2436.1.3. ACI Evaluation ............................................................................................... 2446.1.4. ACI Limitations .............................................................................................. 244

6.2. Default ACIs ............................................................................................................. 2456.3. Creating ACIs Manually ............................................................................................ 246

6.3.1. The ACI Syntax ............................................................................................. 2466.3.2. Defining Targets ............................................................................................. 2476.3.3. Defining Permissions ..................................................................................... 252

6.4. Bind Rules ............................................................................................................... 2566.4.1. Bind Rule Syntax ........................................................................................... 2566.4.2. Defining User Access - userdn Keyword .......................................................... 2576.4.3. Defining Group Access - groupdn Keyword ..................................................... 2606.4.4. Defining Role Access - roledn Keyword ........................................................... 2626.4.5. Defining Access Based on Value Matching ...................................................... 2626.4.6. Defining Access from a Specific IP Address .................................................... 2666.4.7. Defining Access from a Specific Domain ......................................................... 267

Page 6: Red Hat Directory Server 5.1

Administration Guide

vi

6.4.8. Defining Access at a Specific Time of Day or Day of Week ............................... 2686.4.9. Defining Access Based on Authentication Method ............................................ 2696.4.10. Using Boolean Bind Rules ............................................................................ 270

6.5. Creating ACIs from the Console ................................................................................ 2716.5.1. Displaying the Access Control Editor ............................................................... 2726.5.2. Creating a New ACI ....................................................................................... 2736.5.3. Editing an ACI ............................................................................................... 2786.5.4. Deleting an ACI ............................................................................................. 279

6.6. Viewing ACIs ............................................................................................................ 2796.7. Checking Access Rights on Entries (Get Effective Rights) ........................................... 280

6.7.1. Rights Shown with a Get Effective Rights Search ............................................. 2806.7.2. The Format of a Get Effective Rights Search ................................................... 2816.7.3. Using Get Effective Rights from the Console ................................................... 2886.7.4. Get Effective Rights Return Codes .................................................................. 289

6.8. Logging Access Control Information ........................................................................... 2906.9. Access Control Usage Examples ............................................................................... 290

6.9.1. Granting Anonymous Access .......................................................................... 2916.9.2. Granting Write Access to Personal Entries ...................................................... 2936.9.3. Restricting Access to Key Roles ..................................................................... 2966.9.4. Granting a Group Full Access to a Suffix ......................................................... 2976.9.5. Granting Rights to Add and Delete Group Entries ............................................ 2986.9.6. Granting Conditional Access to a Group or Role .............................................. 3006.9.7. Denying Access ............................................................................................. 3026.9.8. Setting a Target Using Filtering ....................................................................... 3046.9.9. Allowing Users to Add or Remove Themselves from a Group ............................ 3046.9.10. Defining Permissions for DNs That Contain a Comma .................................... 3056.9.11. Proxied Authorization ACI Example ............................................................... 306

6.10. Advanced Access Control: Using Macro ACIs ........................................................... 3076.10.1. Macro ACI Example ..................................................................................... 3076.10.2. Macro ACI Syntax ........................................................................................ 308

6.11. Access Control and Replication ............................................................................... 3116.12. Compatibility with Earlier Releases .......................................................................... 311

7. Managing User Authentication 3137.1. Managing the Password Policy .................................................................................. 313

7.1.1. Configuring the Password Policy ..................................................................... 3137.1.2. Setting User Passwords ................................................................................. 3247.1.3. Password Change Extended Operation ........................................................... 3247.1.4. Configuring the Account Lockout Policy ........................................................... 3257.1.5. Managing the Password Policy in a Replicated Environment ............................. 3277.1.6. Synchronizing Passwords ............................................................................... 328

7.2. Inactivating Users and Roles ..................................................................................... 3297.2.1. Inactivating User and Roles Using the Console ................................................ 3297.2.2. Inactivating User and Roles Using the Command Line ..................................... 3307.2.3. Activating User and Roles Using the Console .................................................. 3307.2.4. Activating User and Roles Using the Command Line ........................................ 331

7.3. Setting Resource Limits Based on the Bind DN .......................................................... 3317.3.1. Setting Resource Limits Using the Console ..................................................... 3327.3.2. Setting Resource Limits Using the Command Line ........................................... 332

7.4. Using Pass-through Authentication ............................................................................ 3337.4.1. How Directory Server Uses PTA ..................................................................... 3337.4.2. PTA Plug-in Syntax ........................................................................................ 334

Page 7: Red Hat Directory Server 5.1

vii

7.4.3. Configuring the PTA Plug-in ........................................................................... 3367.4.4. PTA Plug-in Syntax Examples ........................................................................ 339

7.5. Configuring Autobind ................................................................................................ 3417.5.1. Overview of Autobind and LDAPI .................................................................... 3417.5.2. Configuring Autobind ...................................................................................... 343

7.6. Allowing Unauthenticated Binds ................................................................................. 344

8. Managing Replication 3458.1. Replication Overview ................................................................................................ 345

8.1.1. What Directory Units Are Replicated ............................................................... 3458.1.2. Read-Write and Read-Only Replicas ............................................................... 3458.1.3. Suppliers and Consumers .............................................................................. 3458.1.4. Changelog ..................................................................................................... 3468.1.5. Replication Identity ......................................................................................... 3468.1.6. Replication Agreement ................................................................................... 3478.1.7. Replicating Attributes with Fractional Replication .............................................. 3478.1.8. Compatibility with Earlier Versions of Directory Server ...................................... 347

8.2. Replication Scenarios ............................................................................................... 3488.2.1. Single-Master Replication ............................................................................... 3488.2.2. Multi-Master Replication ................................................................................. 3498.2.3. Cascading Replication .................................................................................... 351

8.3. Creating the Supplier Bind DN Entry .......................................................................... 3538.4. Configuring Single-Master Replication ........................................................................ 354

8.4.1. Configuring the Read-Write Replica on the Supplier Server ............................... 3548.4.2. Configuring the Read-Only Replica on the Consumer ....................................... 3568.4.3. Create the Replication Agreement .................................................................. 358

8.5. Configuring Multi-Master Replication .......................................................................... 3648.5.1. Configuring the Read-Write Replicas on the Supplier Servers ........................... 3658.5.2. Configuring the Read-Only Replicas on the Consumer Servers ......................... 3678.5.3. Setting up the Replication Agreements ............................................................ 3698.5.4. Preventing Monopolization of the Consumer in Multi-Master Replication ............. 376

8.6. Configuring Cascading Replication ............................................................................ 3778.6.1. Configuring the Read-Write Replica on the Supplier Server ............................... 3778.6.2. Configuring the Read-Only Replica on the Consumer Server ............................ 3798.6.3. Configuring the Read-Only Replica on the Hub ................................................ 3808.6.4. Setting up the Replication Agreements ............................................................ 383

8.7. Configuring Replication from the Command Line ........................................................ 3908.7.1. Configuring Suppliers from the Command Line ................................................ 3918.7.2. Configuring Consumers from the Command Line ............................................. 3948.7.3. Configuring Hubs from the Command Line ...................................................... 3958.7.4. Configuring Replication Agreements from the Command Line ........................... 3968.7.5. Initializing Consumers Online from the Command Line ..................................... 400

8.8. Making a Replica Updatable ..................................................................................... 4018.9. Deleting the Changelog ............................................................................................ 401

8.9.1. Removing the Changelog ............................................................................... 4028.9.2. Moving the Changelog to a New Location ....................................................... 402

8.10. Initializing Consumers ............................................................................................. 4028.10.1. When to Initialize a Consumer ...................................................................... 4038.10.2. Online Consumer Initialization Using the Console ........................................... 4038.10.3. Initializing Consumers Online Using the Command Line ................................. 4048.10.4. Manual Consumer Initialization Using the Command Line ............................... 4058.10.5. Filesystem Replica Initialization ..................................................................... 406

Page 8: Red Hat Directory Server 5.1

Administration Guide

viii

8.11. Forcing Replication Updates .................................................................................... 4078.11.1. Forcing Replication Updates from the Console ............................................... 4088.11.2. Forcing Replication Updates from the Command Line ..................................... 408

8.12. Replicating Account Lockout Attributes ..................................................................... 4098.12.1. Configuring Directory Server to Replicate Password Policy Attributes ............... 4108.12.2. Configuring Fractional Replication for Password Policy Attributes .................... 410

8.13. Replication over SSL .............................................................................................. 4108.14. Setting Replication Timeout Periods ......................................................................... 4118.15. Replicating o=NetscapeRoot for Administration Server Failover ................................. 4128.16. Replication with Earlier Releases ............................................................................. 413

8.16.1. Using Legacy Replication ............................................................................. 4138.16.2. Legacy Replication and Parent Object Classes .............................................. 4148.16.3. Configuring Legacy Replication ..................................................................... 414

8.17. Using the Retro Changelog Plug-in .......................................................................... 4158.17.1. Enabling the Retro Changelog Plug-in ........................................................... 4168.17.2. Trimming the Retro Changelog ..................................................................... 4178.17.3. Searching and Modifying the Retro Changelog ............................................... 4178.17.4. Retro Changelog and the Access Control Policy ............................................ 417

8.18. Monitoring Replication Status .................................................................................. 4188.18.1. Monitoring Replication Status from the Directory Server Console ..................... 4188.18.2. Monitoring Replication Status from Administration Express ............................. 419

8.19. Solving Common Replication Conflicts ..................................................................... 4208.19.1. Solving Naming Conflicts .............................................................................. 4218.19.2. Solving Orphan Entry Conflicts ..................................................................... 4238.19.3. Solving Potential Interoperability Problems .................................................... 423

8.20. Troubleshooting Replication-Related Problems ......................................................... 424

9. Synchronizing Red Hat Directory Server with Microsoft Active Directory 4299.1. About Windows Sync ................................................................................................ 4299.2. Configuring Windows Sync ........................................................................................ 432

9.2.1. Step 1: Configure SSL on Directory Server ...................................................... 4329.2.2. Step 2: Configure the Active Directory Domain ................................................ 4339.2.3. Step 3: Select or Create the Sync Identity ....................................................... 4359.2.4. Step 4: Install the Password Sync Service ....................................................... 4369.2.5. Step 5: Configure the Password Sync Service ................................................. 4389.2.6. Step 6: Configure the Directory Server Database for Synchronization ................ 4399.2.7. Step 7: Create the Synchronization Agreement ................................................ 4419.2.8. Step 8: Configure Directory Server User and Group Entries for Synchronization................................................................................................................................ 4449.2.9. Step 9: Begin Synchronization ........................................................................ 444

9.3. Synchronizing Users ................................................................................................. 4459.3.1. User Attributes Synchronized between Directory Server and Active Directory ...... 4469.3.2. User Schema Differences between Red Hat Directory Server and ActiveDirectory ................................................................................................................. 4479.3.3. Configuring User Sync for Directory Server Users ............................................ 4489.3.4. Configuring User Sync for Active Directory Users ............................................. 451

9.4. Synchronizing Groups ............................................................................................... 4529.4.1. About Windows Group Types ......................................................................... 4529.4.2. Group Attributes Synchronized between Directory Server and Active Directory ... 4539.4.3. Group Schema Differences between Red Hat Directory Server and ActiveDirectory ................................................................................................................. 4549.4.4. Configuring Group Sync for Directory Server Groups ........................................ 454

Page 9: Red Hat Directory Server 5.1

ix

9.4.5. Configuring Group Sync for Active Directory Groups ........................................ 4569.5. Deleting and Resurrecting Entries ............................................................................. 457

9.5.1. Deleting Entries ............................................................................................. 4579.5.2. Resurrecting Entries ....................................................................................... 458

9.6. Sending Synchronization Updates ............................................................................. 4589.6.1. Performing a Manual Sync Update ................................................................. 4589.6.2. Sending a Total Update (Full Synchronization) ................................................. 4599.6.3. Sending Sync Updates in the Command Line .................................................. 4609.6.4. Checking Synchronization Status .................................................................... 460

9.7. Modifying the Sync Agreement .................................................................................. 4619.7.1. Editing the Sync Agreement in the Console ..................................................... 4619.7.2. Adding and Editing the Sync Agreement in the Command Line ......................... 463

9.8. Configuring Unidirectional Synchronization ................................................................. 4679.9. Password Sync Service ............................................................................................ 467

9.9.1. Modifying Password Sync .............................................................................. 4679.9.2. Starting and Stopping the Password Sync Service ........................................... 4689.9.3. Uninstalling Password Sync Service ................................................................ 4689.9.4. Upgrading Password Sync ............................................................................. 468

9.10. Troubleshooting ...................................................................................................... 469

10. Managing the Directory Schema 47110.1. Overview of Schema ............................................................................................... 471

10.1.1. Default Schema Files ................................................................................... 47110.1.2. Object Classes ............................................................................................ 47110.1.3. Attributes ..................................................................................................... 47210.1.4. About Extending the Schema ....................................................................... 47310.1.5. Schema Replication ..................................................................................... 474

10.2. Managing Object Identifiers ..................................................................................... 47410.3. Attribute Syntax ...................................................................................................... 47510.4. Managing Custom Schema in the Console ............................................................... 476

10.4.1. Viewing Attributes and Object Classes .......................................................... 47610.4.2. Creating Attributes ....................................................................................... 47810.4.3. Creating Object Classes ............................................................................... 48010.4.4. Editing Custom Schema Elements ................................................................ 48210.4.5. Deleting Schema .......................................................................................... 482

10.5. Managing Schema Using ldapmodify ....................................................................... 48310.5.1. Creating Attributes ....................................................................................... 48310.5.2. Creating Object Classes ............................................................................... 48410.5.3. Deleting Schema .......................................................................................... 485

10.6. Creating Custom Schema Files ............................................................................... 48510.7. Dynamically Reloading Schema ............................................................................... 487

10.7.1. Reloading Schema Using schema-reload.pl ................................................... 48710.7.2. Reloading Schema Using ldapmodify ............................................................ 48810.7.3. Reloading Schema with Replication .............................................................. 48910.7.4. Schema Reload Errors ................................................................................. 489

10.8. Turning Schema Checking On and Off ..................................................................... 489

11. Managing Indexes 49311.1. About Indexes ........................................................................................................ 493

11.1.1. About Index Types ....................................................................................... 49311.1.2. About Default, System, and Standard Indexes ................................................ 49411.1.3. Overview of the Searching Algorithm ............................................................. 497

Page 10: Red Hat Directory Server 5.1

Administration Guide

x

11.1.4. Approximate Searches .................................................................................. 49811.1.5. Indexing Performance ................................................................................... 49811.1.6. Balancing the Benefits of Indexing ................................................................ 500

11.2. Creating Standard Indexes ...................................................................................... 50211.2.1. Creating Indexes from the Server Console ..................................................... 50211.2.2. Creating Indexes from the Command Line ..................................................... 503

11.3. Applying New Indexes to Existing Databases ............................................................ 50511.3.1. Running the db2index.pl Script ...................................................................... 50511.3.2. Using a cn=tasks Entry to Create an Index .................................................... 505

11.4. Creating Browsing (VLV) Indexes ............................................................................. 50611.4.1. Creating Browsing Indexes from the Server Console ...................................... 50611.4.2. Creating Browsing Indexes from the Command Line ....................................... 50711.4.3. Setting Access Control for VLV Information .................................................... 510

11.5. Changing the Index Sort Order ................................................................................ 51011.5.1. Changing the Sort Order in the Console ........................................................ 51011.5.2. Changing the Sort Order in the Command Line .............................................. 511

11.6. Changing the Width for Indexed Substring Searches ................................................. 51111.7. Deleting Indexes ..................................................................................................... 512

11.7.1. Deleting Indexes from the Server Console ..................................................... 51311.7.2. Deleting Indexes from the Command Line ..................................................... 51311.7.3. Deleting Browsing Indexes from the Server Console ....................................... 51511.7.4. Deleting Browsing Indexes from the Command Line ....................................... 515

12. Managing SSL 51912.1. Introduction to TLS/SSL in the Directory Server ........................................................ 519

12.1.1. Enabling SSL: Summary of Steps ................................................................. 51912.1.2. Command-Line Functions for Start TLS ......................................................... 520

12.2. Obtaining and Installing Server Certificates .............................................................. 52112.2.1. Step 1: Generate a Certificate Request ......................................................... 52112.2.2. Step 2: Send the Certificate Request ............................................................ 52412.2.3. Step 3: Install the Certificate ......................................................................... 52412.2.4. Step 4: Trust the Certificate Authority ............................................................ 52512.2.5. Step 5: Confirm That The New Certificates Are Installed ................................. 526

12.3. Using certutil .......................................................................................................... 52612.3.1. Creating Directory Server Certificates through the Command Line ................... 52712.3.2. certutil Usage .............................................................................................. 529

12.4. Starting the Server with TLS/SSL Enabled ............................................................... 53012.4.1. Enabling TLS/SSL Only in the Directory Server .............................................. 53112.4.2. Enabling TLS/SSL in the Directory Server, Administration Server, and Console................................................................................................................................ 53312.4.3. Creating a Password File for the Directory Server .......................................... 53512.4.4. Creating a Password File for the Administration Server ................................... 535

12.5. Updating Attribute Encryption for New SSL/TLS Certificates ...................................... 53612.6. Using External Security Devices .............................................................................. 53712.7. Setting Security Preferences ................................................................................... 537

12.7.1. Available Ciphers ......................................................................................... 53812.7.2. Selecting the Encryption Cipher .................................................................... 539

12.8. Using Certificate-Based Authentication ..................................................................... 54012.8.1. Configuring Directory Server to Accept Certificate-Based Authentication fromLDAP Clients .......................................................................................................... 54112.8.2. Mapping DNs to Certificates ......................................................................... 54212.8.3. Editing the certmap.conf File ........................................................................ 546

Page 11: Red Hat Directory Server 5.1

xi

12.8.4. Example certmap.conf Mappings .................................................................. 54712.8.5. Allowing and Requiring Client Authentication to the Console ........................... 54812.8.6. Connecting to the Directory Server with Certificate-Based Authentication ......... 549

12.9. Managing Certificates for the Directory Server .......................................................... 54912.9.1. Renewing Certificates ................................................................................... 54912.9.2. Changing the CA Trust Options .................................................................... 55012.9.3. Changing Security Device Passwords ........................................................... 55012.9.4. Managing Certificate Lists ............................................................................ 551

13. Managing SASL 55313.1. Overview of SASL in Directory Server ...................................................................... 553

13.1.1. About SASL Identity Mapping ....................................................................... 55413.1.2. Default SASL Mappings for Directory Server .................................................. 55613.1.3. Authentication Mechanisms for SASL in Directory Server ................................ 55713.1.4. About Kerberos with Directory Server ............................................................ 558

13.2. Configuring SASL Identity Mapping .......................................................................... 56113.2.1. Configuring SASL Identity Mapping from the Console ..................................... 56113.2.2. Configuring SASL Identity Mapping from the Command Line ........................... 562

13.3. Configuring SASL Authentication at Directory Server Startup ..................................... 56313.4. Using an External Keytab ........................................................................................ 563

14. Monitoring Server and Database Activity 56514.1. Viewing and Configuring Log Files ........................................................................... 565

14.1.1. Defining a Log File Rotation Policy ............................................................... 56514.1.2. Defining a Log File Deletion Policy ................................................................ 56614.1.3. Access Log .................................................................................................. 56714.1.4. Error Log ..................................................................................................... 56814.1.5. Audit Log ..................................................................................................... 570

14.2. Manual Log File Rotation ........................................................................................ 57114.3. Monitoring Server Activity ........................................................................................ 571

14.3.1. Monitoring the Server from the Directory Server Console ................................ 57214.3.2. Monitoring the Directory Server from the Command Line ................................ 576

14.4. Monitoring Database Activity ................................................................................... 57814.4.1. Monitoring Database Activity from the Directory Server Console ...................... 57814.4.2. Monitoring Databases from the Command Line .............................................. 582

14.5. Monitoring Database Link Activity ............................................................................ 58514.6. Enabling and Disabling Counters ............................................................................. 586

15. Monitoring Directory Server Using SNMP 58715.1. About SNMP .......................................................................................................... 58715.2. Configuring the Master Agent .................................................................................. 58815.3. Configuring the Subagent ........................................................................................ 588

15.3.1. Subagent Configuration File .......................................................................... 58815.3.2. Starting the Subagent .................................................................................. 58915.3.3. Testing the Subagent ................................................................................... 589

15.4. Configuring SNMP Traps ......................................................................................... 59015.5. Configuring the Directory Server for SNMP .............................................................. 59015.6. Using the Management Information Base ................................................................. 591

15.6.1. Operations Table .......................................................................................... 59115.6.2. Entries Table ................................................................................................ 59315.6.3. Entity Table .................................................................................................. 59315.6.4. Interaction Table .......................................................................................... 594

Page 12: Red Hat Directory Server 5.1

Administration Guide

xii

16. Tuning Directory Server Performance 59716.1. Tuning Server Performance ..................................................................................... 59716.2. Tuning Database Performance ................................................................................ 598

16.2.1. Optimizing Search Performance .................................................................... 59816.2.2. Tuning Transaction Logging .......................................................................... 59916.2.3. Changing the Location of the Database Transaction Log ................................. 60016.2.4. Changing the Database Checkpoint Interval .................................................. 60116.2.5. Disabling Durable Transactions ..................................................................... 60116.2.6. Specifying Transaction Batching .................................................................... 602

16.3. Tuning the Database Cache Settings ....................................................................... 60216.3.1. Tuning Entry Cache ..................................................................................... 60216.3.2. Tuning Database Cache ............................................................................... 603

16.4. Managing Special Entries ........................................................................................ 604

A. LDAP Data Interchange Format 607A.1. About the LDIF File Format ...................................................................................... 607A.2. Continuing Lines in LDIF .......................................................................................... 608A.3. Representing Binary Data ......................................................................................... 609

A.3.1. Standard LDIF Notation ................................................................................. 609A.3.2. Base-64 Encoding ......................................................................................... 609

A.4. Specifying Directory Entries Using LDIF .................................................................... 610A.4.1. Specifying Domain Entries ............................................................................. 610A.4.2. Specifying Organizational Unit Entries ............................................................ 611A.4.3. Specifying Organizational Person Entries ........................................................ 612

A.5. Defining Directories Using LDIF ................................................................................ 613A.5.1. LDIF File Example ......................................................................................... 614

A.6. Storing Information in Multiple Languages ................................................................. 615

B. Finding Directory Entries 619B.1. Finding Entries Using the Directory Server Console .................................................... 619B.2. Using ldapsearch ..................................................................................................... 620

B.2.1. Using Special Characters ............................................................................... 621B.2.2. ldapsearch Command-Line Format ................................................................. 621B.2.3. Commonly Used ldapsearch Options .............................................................. 621B.2.4. ldapsearch Examples ..................................................................................... 623

B.3. LDAP Search Filters ................................................................................................. 626B.3.1. Using Attributes in Search Filters ................................................................... 627B.3.2. Using Operators in Search Filters ................................................................... 627B.3.3. Using Compound Search Filters ..................................................................... 628B.3.4. Search Filter Examples .................................................................................. 629

B.4. Using Persistent Search ........................................................................................... 630B.4.1. An Overview of Persistent Searches ............................................................... 630B.4.2. Running a Persistent Search .......................................................................... 631

B.5. Searching an Internationalized Directory .................................................................... 632B.5.1. Matching Rule Filter Syntax ........................................................................... 632B.5.2. Supported Search Types ................................................................................ 635B.5.3. International Search Examples ....................................................................... 635

C. LDAP URLs 639C.1. Components of an LDAP URL .................................................................................. 639C.2. Escaping Unsafe Characters .................................................................................... 640C.3. Examples of LDAP URLs ......................................................................................... 641

Page 13: Red Hat Directory Server 5.1

xiii

D. Internationalization 643D.1. About Locales .......................................................................................................... 643D.2. Identifying Supported Locales ................................................................................... 644D.3. Supported Language Subtypes ................................................................................. 645D.4. Troubleshooting Matching Rules ............................................................................... 646

Glossary 649

Index 663

Page 14: Red Hat Directory Server 5.1

xiv

Page 15: Red Hat Directory Server 5.1

xv

PrefaceRed Hat Directory Server (Directory Server) is a powerful and scalable distributed directory serverbased on the industry-standard Lightweight Directory Access Protocol (LDAP). Directory Server is thecornerstone for building a centralized and distributed data repository that can be used in your intranet,over your extranet with your trading partners, or over the public Internet to reach your customers.

This Administrator's Guide describes all of the administration tasks you need to perform to maintainDirectory Server.

1. Directory Server OverviewDirectory Server provides the following key features:

• Multi-master replication — Provides a highly available directory service for both read and writeoperations. Multi-master replication can be combined with simple and cascading replicationscenarios to provide a highly flexible and scalable replication environment.

• Chaining and referrals — Increases the power of your directory by storing a complete logical viewof your directory on a single server while maintaining data on a large number of Directory Serverstransparently for clients.

• Roles and classes of service — Provides a flexible mechanism for grouping and sharing attributesbetween entries in a dynamic fashion.

• Improved access control mechanisms — Provides support for macros that dramatically reduce thenumber of access control statements used in the directory and increase the scalability of accesscontrol evaluation.

• Resource-limits by bind DN — Grants the power to control the amount of server resources allocatedto search operations based on the bind DN of the client.

• Multiple databases — Provides a simple way of breaking down your directory data to simplify theimplementation of replication and chaining in your directory service.

• Password policy and account lockout — Defines a set of rules that govern how passwords and useraccounts are managed in the Directory Server.

• TLS and SSL — Provides secure authentication and communication over the network, using theMozilla Network Security Services (NSS) libraries for cryptography.

The major components of Directory Server include the following:

• An LDAP server — The LDAP v3-compliant network daemon.

• Directory Server Console — A graphical management console that dramatically reduces the effort ofsetting up and maintaining your directory service.

• SNMP agent — Can monitor the Directory Server using the Simple Network Management Protocol(SNMP).

Page 16: Red Hat Directory Server 5.1

Preface

xvi

2. Examples and FormattingEach of the examples used in this guide, such as file locations and commands, have certain definedconventions.

2.1. Command and File ExamplesAll of the examples for Red Hat Directory Server commands, file locations, and other usage are givenfor Red Hat Enterprise Linux 5 (32-bit) systems. Be certain to use the appropriate commands and filesfor your platform.

To start the Red Hat Directory Server:

service dirsrv start

Example 1. Example Command

2.2. Tool LocationsThe tools for Red Hat Directory Server are located in the /usr/bin and the /usr/sbin directories.These tools can be run from any location without specifying the tool location.

2.3. LDAP LocationsThere is an important consideration with the Red Hat Directory Server tools. The LDAP toolsreferenced in this guide are Mozilla LDAP, installed with Red Hat Directory Server in the /usr/lib/mozldap directory on Red Hat Enterprise Linux 5 (32-bit) (or /usr/lib64/mozldap for 64-bitsystems).

However, Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP in the /usr/bin directory. It is possible to use the OpenLDAP commands as shown in the examples, but you mustuse the -x argument to disable SASL, which OpenLDAP tools use by default.

2.4. Text Formatting and StylesCertain words are represented in different fonts, styles, and weights. Different character formatting isused to indicate the function or purpose of the phrase being highlighted.

Formatting Style Purpose

Monospace font Monospace is used for commands, packagenames, files and directory paths, and any textdisplayed in a prompt.

Monospace with abackground

This type of formatting is used for anythingentered or returned in a command prompt.

Italicized text Any text which is italicized is a variable, suchas instance_name or hostname. Occasionally,this is also used to emphasize a new term orother phrase.

Bolded text Most phrases which are in bold are applicationnames, such as Cygwin, or are fields or

Page 17: Red Hat Directory Server 5.1

Additional Reading

xvii

Formatting Style Purposeoptions in a user interface, such as a UserName Here: field or Save button.

Other formatting styles draw attention to important text.

NOTEA note provides additional information that can help illustrate the behavior of the system orprovide more detail for a specific issue.

IMPORTANTImportant information is necessary, but possibly unexpected, such as a configurationchange that will not persist after a reboot.

WARNINGA warning indicates potential data loss, as may happen when tuning hardware formaximum performance.

3. Additional ReadingThe Directory Server Administrator's Guide describes how to set up, configure, and administer RedHat Directory Server and its contents. this manual does not describe many of the basic directory andarchitectural concepts that you need to deploy, install, and administer a directory service successfully.Those concepts are contained in the Red Hat Directory Server Deployment Guide. You should readthat book before continuing with this manual.

When you are familiar with Directory Server concepts and have done some preliminary planning foryour directory service, install the Directory Server. The instructions for installing the various DirectoryServer components are contained in the Red Hat Directory Server Installation Guide. Many of thescripts and commands used to install and administer the Directory Server are explained in detail in theRed Hat Directory Server Configuration, Command, and File Reference.

Also, Managing Servers with Red Hat Console contains general background information on how touse the Red Hat Console. You should read and understand the concepts in that book before youattempt to administer Directory Server.

The document set for Directory Server contains the following guides:

• Red Hat Directory Server Release Notes contain important information on new features, fixed bugs,known issues and workarounds, and other important deployment information for this specific versionof Directory Server.

• Red Hat Directory Server Deployment Guide provides an overview for planning a deployment of theDirectory Server.

• Red Hat Directory Server Administrator's Guide contains procedures for the day-to-day maintenanceof the directory service. Includes information on configuring server-side plug-ins.

Page 18: Red Hat Directory Server 5.1

Preface

xviii

• Red Hat Directory Server Configuration, Command, and File Reference provides referenceinformation on the command-line scripts, configuration attributes, and log files shipped withDirectory Server.

• Red Hat Directory Server Installation Guide contains procedures for installing your Directory Serveras well as procedures for migrating from a previous installation of Directory Server.

• Red Hat Directory Server Schema Reference provides reference information about the DirectoryServer schema.

• Red Hat Directory Server Plug-in Programmer's Guide describes how to write server plug-ins inorder to customize and extend the capabilities of Directory Server.

• Using Red Hat Console gives an overview of the primary user interface and how it interacts withthe Directory Server and Administration Server, as well as how to perform basic management tasksthrough the main Console window.

• Using the Admin Server describes the different tasks and tools associated with the AdministrationServer and how to use the Administration Server with the Configuration and User Directory Serverinstances.

For the latest information about Directory Server, including current release notes, complete productdocumentation, technical notes, and deployment information, see the Red Hat Directory Serverdocumentation site at http://www.redhat.com/docs/manuals/dir-server/.

4. Giving FeedbackIf there is any error in this Administrator's Guide or there is any way to improve the documentation,please let us know. Bugs can be filed against the documentation for Red Hat Directory Server throughBugzilla, http://bugzilla.redhat.com/bugzilla. Make the bug report as specific as possible, so we can bemore effective in correcting any issues:

• Select the Red Hat Directory Server product.

• Set the component to Doc - administration-guide.

• Set the version number to 8.1.

• For errors, give the page number (for the PDF) or URL (for the HTML), and give a succinctdescription of the problem, such as incorrect procedure or typo.

For enhancements, put in what information needs to be added and why.

• Give a clear title for the bug. For example, "Incorrect command example for setupscript options" is better than "Bad example".

We appreciate receiving any feedback — requests for new sections, corrections, improvements,enhancements, even new ways of delivering the documentation or new styles of docs. You arewelcome to contact Red Hat Content Services directly at [email protected].

1 mailto:[email protected]

Page 19: Red Hat Directory Server 5.1

Documentation History

xix

5. Documentation HistoryRevision8.1.12

June 12, 2010 Ella Deon Lackey

Correcting procedure for changing the transaction log location, per Bugzilla #578642.

Revision8.1.11

March 27, 2010 Ella Deon Lackey

Changing some WinSync attributes, per Bugzilla #577390 and Bugzilla #577400.

Revision8.1.10

February 11, 2010 Ella Deon Lackey

Clarifying how passwordUnlock works, per Bugzilla #552377.Changing thensDirectoryServerTask object class to extensibleObject, per Bugzilla #555787.Correcting the nsds5replicacredentials example in the replication agreements command-lineexample, per Bugzilla #560032.

Revision 8.1.9 January 11, 2010 Ella Deon Lackey

Adding section on nsslapd-cachememsize and the import buffer size, per Bugzilla #531043.Fixing example for deleting schema elements from the command line, per Bugzilla #554846.Fixing the command-line example for initiating a full sync, and adding a note that it is a full update,per Bugzilla #533412.Correcting the ACI set for the sync user, per Bugzilla #537881.Correcting an error in the screenshot for creating new groups for sync, per Bugzilla #532162.

Revision 8.1.8 October 13, 2009 Ella Deon Lackey

Correcting passwordIsGlobalPolicy configuration, per Bugzilla #526449.

Revision 8.1.7 October 7, 2009 Ella Deon Lackey

Adding a small section about setting replication timeout periods, per Bug #238078.

Revision 8.1.6 September 9, 2009 Ella Deon Lackey

Removing any references to the Directory Server Gateway or Org Chart.

Revision 8.1.5 September 5, 2009 Ella Deon Lackey

Fixing the ldapmodify examples for adding new role entries to include the -a option, which is requred;related to Bug #521336.

Revision 8.1.4 August 26, 2009 Ella Deon Lackey

Adding information about setting database and entry cache memory sizes, per Bugzilla #503615.Correcting the description for setting password policy attributes; this is set on the subtree or specificentry, not cn=config. Related to Bugzilla #503102.

Revision 8.1.3 August 20, 2009 Ella Deon Lackey

Adding a note on an error synchronizing Active Directory modRDN operations, per Bugzilla #517905.

Revision 8.1.2 August 6, 2009 Ella Deon Lackey

Made some edits to the sections for configuring SSL and client authentication, per Bugzilla #513504.Fixing links in configuration for o=Netscape replication, per Bugzilla #514020.

Revision 8.1.1 July 19, 2009 Ella Deon Lackey

Fixing a typo, improving the description of dnaNextRange, and adding the step to index DNAmanaged attributes, per Bugzilla #510198, #512557, and #509991.

Revision 8.1.0 April 28, 2009 Ella Deon Lackey

Initial draft for version 8.1.

Page 20: Red Hat Directory Server 5.1

xx

Page 21: Red Hat Directory Server 5.1

Chapter 1.

1

Basic Red Hat Directory ServerSettingsRed Hat Directory Server product includes a directory service, an administration server to managemultiple server instances, and a Java-based console to manage server instances through a graphicalinterface. This chapter provides an overview of the basic tasks for administering a directory service.

The Directory Server is a robust, scalable server designed to manage an enterprise-wide directory ofusers and resources. It is based on an open-systems server protocol called the Lightweight DirectoryAccess Protocol (LDAP). Directory Server runs the ns-slapd daemon on the host machine. Theserver manages the directory databases and responds to client requests.

Directory Server 8.1 is comprised of several components, which work in tandem:

• The Directory Server is the core LDAP server daemon. It is compliant with LDAP v3 standards. Thiscomponent includes command-line server management and administration programs and scripts forcommon operations like export and backing up databases.

• The Directory Server Console is the user interface that simplifies managing users, groups, and otherLDAP data for your enterprise. The Console is used for all aspects of server management, includingmaking backups; configuring security, replication, and databases; adding entries; and monitoringservers and viewing statistics.

• The Administration Server is the management agent which administers Directory Server instances.It communicates with the Directory Server Console and performs operations on the Directory Serverinstances. It also provides a simple HTML interface and online help pages.

Most Directory Server administrative tasks are available through the Directory Server Console, but it isalso possible to administer the Directory Server by manually editing the configuration files or by usingcommand-line utilities.

1.1. Directory Server File LocationsRed Hat Directory Server 8.1 conforms to the Filesystem Hierarchy Standards. For more informationon FHS, see the FHS homepage, http://www.pathname.com/fhs/. The files and directories installedwith Directory Server are listed in the tables below for each supported platform.

In the file locations listed in the following tables, instance is the server instance name that was givenduring setup. By default, this is the leftmost component of the fully-qualified host and domain name.For example, if the hostname is ldap.example.com, the instance name is ldap by default.

The Administration Server directories are named the same as the Directory Server directories, onlyinstead of the instance as a directory name, the Administration Server directories are named admin-serv. For any directory or folder named slapd-instance, substitute admin-serv, such as /etc/dirsrv/slapd-example and /etc/dirsrv/admin-serv.

File or Directory Location

Log files /var/log/dirsrv/slapd-instance

Configuration files /etc/dirsrv/slapd-instance

Instance directory /usr/lib/dirsrv/slapd-instance

Page 22: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

2

File or Directory Location

Database files /var/lib/dirsrv/slapd-instance

Runtime files /var/lock/dirsrv/slapd-instance

/var/run/dirsrv/slapd-instance

Initscripts /etc/rc.d/init.d/dirsrv and /etc/sysconfig/dirsrv

/etc/rc.d/init.d/dirsrv-admin and /etc/sysconfig/dirsrv-admin

Tools /usr/bin/

/usr/sbin/

Table 1.1. Red Hat Enterprise Linux 4 and 5 (x86)

File or Directory Location

Log files /var/log/dirsrv/slapd-instance

Configuration files /etc/dirsrv/slapd-instance

Instance directory /usr/lib64/dirsrv/slapd-instance

Database files /var/lib/dirsrv/slapd-instance

Runtime files /var/lock/dirsrv/slapd-instance

/var/run/dirsrv/slapd-instance

Initscripts /etc/rc.d/init.d/dirsrv and /etc/sysconfig/dirsrv

/etc/rc.d/init.d/dirsrv-admin and /etc/sysconfig/dirsrv-admin

Tools /usr/bin/

/usr/sbin/

Table 1.2. Red Hat Enterprise Linux 4 and 5 (x86_64)

File or Directory Location

Log files /var/opt/log/dirsrv/slapd-instance

Configuration files /etc/opt/dirsrv/slapd-instance

Instance directory /opt/dirsrv/slapd-instance

Database files /var/opt/dirsrv/slapd-instance

Runtime files /var/opt/dirsrv/instance

Binaries /opt/dirsrv/bin/

/opt/dirsrv/sbin/

Libraries /opt/dirsrv/lib/

Table 1.3. HP-UX 11i (IA64)

Page 23: Red Hat Directory Server 5.1

LDAP Tool Locations

3

1.2. LDAP Tool LocationsRed Hat Directory Server uses Mozilla LDAP tools — such as ldapsearch, ldapmodify, andldapdelete — for command-line operations. The MozLDAP tools are installed with Directory Server.

Platform Directory Location

Red Hat Enterprise Linux 4 i386 /usr/lib/mozldap6

Red Hat Enterprise Linux 4 x86_64 /usr/lib64/mozldap6

Red Hat Enterprise Linux 5 i386 /usr/lib/mozldap

Red Hat Enterprise Linux 5 x86_64 /usr/lib64/mozldap

HP-UX /opt/dirsrv/bin

For all Red Hat Directory Server guides and documentation, the LDAP tools used in the examples,such as ldapsearch and ldapmodify, are the Mozilla LDAP tools. For most Linux systems,OpenLDAP tools are already installed in the /usr/bin/ directory. These OpenLDAP tools are notsupported for Directory Server operations. For the best results with the Directory Server, make surethe path to the Mozilla LDAP tools comes first in the PATH or use the full path and file name for everyLDAP operation.

However, these OpenLDAP tools can be used for Directory Server operations with certain cautions:

• The output of the other tools may be different, so it may not look like the examples in thedocumentation.

• The OpenLDAP tools require a -x argument to disable SASL so that it can be used for a simplebind, meaning the -D and -w arguments or an anonymous bind.

• The OpenLDAP tools' arguments for using TLS/SSL and SASL are quite different than the MozillaLDAP arguments. See the OpenLDAP documentation for instructions on those arguments.

1.3. Starting and Stopping ServersThe Directory Server is running when the setup-ds-admin.pl script completes. Avoid stopping andstarting the server to prevent interrupting replication, searches, and other server operations.

• If the Directory Server has SSL enabled, you cannot restart the server from the Console; youmust use the command-line. It is possible to restart without being prompted for a password; seeSection 12.4.3, “Creating a Password File for the Directory Server” for more information.

• Rebooting the host system can automatically start the ns-slapd process. The directory providesstartup or run command (rc) scripts. On Red Hat Enterprise Linux, use the chkconfig commandto enable the Directory Server and Administration Server to start on boot. For HP-UX, check theoperating system documentation for details on adding these scripts.

1.3.1. Starting and Stopping Directory Server from the Console1. Start the Directory Server Console.

redhat-idm-console -a http://localhost:9830

2. In the Tasks tab, click Start the Directory Server, Stop the Directory Server, or Restart theDirectory Server.

Page 24: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

4

When the Directory Server is successfully started or stopped from the Directory Server Console, theserver displays a message box stating that the server has either started or shut down.

1.3.2. Starting and Stopping Directory Server from the CommandLineThere are two ways to start, stop, or restart the Directory Server:

• There are scripts in the instance directories. For example:

/usr/lib/dirsrv/slapd-instance/start-slapd/usr/lib/dirsrv/slapd-instance/restart-slapd/usr/lib/dirsrv/slapd-instance/stop-slapd

• The Directory Server service can also be stopped and started using system tools on Red HatEnterprise Linux. For example, Linux uses the service tool:

service dirsrv {start|stop|restart} instance

NOTEThe service name for the Directory Server process on Red Hat Enterprise Linux isdirsrv.

The Directory Server instance name can be specific in both the start|stop|restart-slapd andsystem scripts. If an instance name is not given, the start or stop operation applies to all instances onthe machine.

Page 25: Red Hat Directory Server 5.1

Starting and Stopping Administration Server

5

1.3.3. Starting and Stopping Administration ServerThere are two ways to start, stop, or restart the Administration Server:

• There are scripts in the /usr/sbin directory.

/usr/sbin/start|stop|restart-ds-admin

• The Administration Server service can also be stopped and started using system tools on Red HatEnterprise Linux. For example, on Red Hat Enterprise Linux, the command is service:

service dirsrv-admin {start|stop|restart}

NOTEThe service name for the Administration Server process on Red Hat Enterprise Linux isdirsrv-admin.

1.4. Starting the Console

1.4.1. Starting the Directory Server ConsoleThere is a simple script to launch the Directory Server Console. On Red Hat Enterprise Linux, thescript is in the standard /usr/bin directory, so it can be run as follows:

redhat-idm-console

HP-UX has a different location for the script:

/opt/dirsrv/bin/redhat-idm-console

NOTEMake sure that the correct Sun JDK or OpenJDK version is set in the PATH beforelaunching the Console. Run the following to see if the Java program is in the PATH and toget the version and vendor information:

java -version

The login screen prompts for the username, password, and Administration Server location. It ispossible to pass other information along with the Console command to supply the AdministrationServer URL, password, and username. For example:

redhat-idm-console -a http://localhost:9830 -u "cn=Directory Manager" -w secret

Option Description

-a adminURL Specifies a base URL for the instance of Administration Server to log into.

Page 26: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

6

Option Description

-f fileName Writes errors and system messages to fileName.

-h Prints out the help message for redhat-idm-console.

-s Specifies the directory instance to access, either by specifying the DN of the server instance entry (SIE) or theinstance name, such as slapd-example.

-u Gives the user DN to use to log into the Console.

-w Gives the password to use to log into the Console.

-w - Reads the password from the standard output.

-x options Specifies extra options. There are three values for extraOptions:nowinpos, which puts the Console window in the upper left corner of the screennologo, which keeps the splash screen from being displayed and only opens the login dialogjavalaf, which uses the Java look and feel for the Console interface rather than the platform-specific styles

To use multiple options, separate them with a comma.

-y file Reads the password from the specified input file.

Table 1.4. redhat-idm-console Options

1.4.2. Logging into Directory ServerAfter starting the Directory Server Console, a login screen opens, requiring the username andpassword for the user logging in and the URL for the Administration Server instance being access.The user logged in at the Console is the user who is binding to Directory Server. This determinesthe access permissions granted and allowed operations while access the directory tree. The useraccount used to log into the Directory Server Console can make significant differences in the access;for example, the Directory Manager has access to every user and configuration entry in DirectoryServer, while the admin entry created during installation has access to only configuration entries, notuser entries. Regular user accounts are more limited.

To bind to, or log into, the Directory Server, supply a username and password at the login box.

Page 27: Red Hat Directory Server 5.1

Changing Login Identity

7

1.4.3. Changing Login IdentityAt any time during a session, you can log in as a different user, without having to restart the Console.To change the login identity:

1. In the Directory Server Console, select the Tasks tab.

2. Click Log on to the Directory Server as a New User.

3. A login dialog box appears.

Page 28: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

8

Enter the full distinguished name of the entry with which to bind to the server. For example, to bindas user Barbara Jensen, enter her full DN in the login box:

cn=Barbara Jensen, ou=People,dc=example,dc=com

1.4.4. Viewing the Current Console Bind DNTo see the bind DN that is currently logged into the Directory Server Console, click the login icon in thelower-left corner of the window. The current bind DN appears next to the login icon.

Figure 1.1. Viewing the Bind DN

1.5. Enabling LDAPIInter-process communication (IPC) is a way for separate processes on a Unix machine or a network tocommunicate directly with each other. LDAPI allows LDAP connections to run over IPC connections,meaning that LDAP operations can run over Unix sockets. These connections are much faster andmore secure than regular LDAP connections.

LDAPI is enabled through two configuration attributes:

• nsslapd-ldapilisten to enable LDAPI for Directory Server

• nsslapd-ldapifilepath to point to the Unix socket file

To enable LDAPI:

1. Modify the nsslapd-ldapilisten to turn LDAPI on and add the socket file attribute.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=configchangetype: modifyreplace: nsslapd-ldapilistennsslapd-ldapilisten: on-add: nsslapd-ldapifilepath

Page 29: Red Hat Directory Server 5.1

Changing Directory Server Port Numbers

9

nsslapd-ldapifilepath: /var/run/slapd-example.socket

2. Restart the server to apply the new configuration.

service dirsrv restart example

1.6. Changing Directory Server Port NumbersThe standard and secure LDAP port numbers used by Directory Server can be changed through theDirectory Server Console or by changing the value of the nsslapd-port or nsslapd-secureportattribute under the cn=config entry in the dse.ldif.

NOTEModifying the standard or secure port numbers for a Configuration Directory Server, whichmaintains the o=NetscapeRoot subtree should be done through the Directory ServerConsole.

Changing the configuration directory or user directory port or secure port numbers has the followingrepercussions:

• The Directory Server port number must also be updated in the Administration Server configuration.

• If there are other Directory Server instances that point to the configuration or user directory, updatethose servers to point to the new port number.

To modify a Directory Server LDAP or LDAPS port for either a user or a configuration directory:

1. In the Directory Server Console, select the Configuration tab, and then select the top entry in thenavigation tree in the left pane.

2. Select the Settings tab in the right pane.

Page 30: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

10

3. Change the port numbers. The port number for the server to use for non-SSL communicationsin the Port field, with a default value of 389. The port number for the server to use for SSLcommunications is in the Encrypted Port field, with a default value of 636.

4. Click Save.

5. The Console returns a warning, You are about to change the port number for the ConfigurationDirectory. This will affect all Administration Servers that use this directory and you'll need to updatethem with the new port number. Are you sure you want to change the port number? Click Yes.

6. Then a dialog appears, reading that the changes will not take effect until the server is restarted.Click OK.

NOTEDo not restart the Directory Server at this point. If you do, you will not be able to makethe necessary changes to the Administration Server through the Console.

7. Open the Administration Server Console.

8. In the Configuration tab, select the Configuration DS tab.

9. In the LDAP Port field, type in the new LDAP port number for your Directory Server instance.

10. Check the Secure Connection box if this is a secure port.

NOTEIf you try to save these changes at this step, you will get a warning box that reads,Invalid LDAP Host/LDAP Port, can not connect. Click OK, and ignore this warning.

11. In the Tasks tab of the Directory Server Console, click Restart Directory Server. A dialog toconfirm that you want to restart the server. Click Yes.

Page 31: Red Hat Directory Server 5.1

Creating a New Directory Server Instance

11

12. Open the Configuration DS tab of the Administration Server Console and select Save.

A dialog will appear, reading The Directory Server setting has been modified. You must shutdownand restart your Administration Server and all the servers in the Server Group for the changes totake effect. Click OK.

13. In the Tasks tab of the Administration Server Console, click Restart Admin Server. A dialogopens reading that the Administration Server has been successfully restarted. Click Close.

NOTEYou must close and reopen the Console before you can do anything else in theConsole. Refresh may not update the Console, and, if you try to do anything, you willget a warning that reads Unable to contact LDAP server.

1.7. Creating a New Directory Server InstanceAdditional instances can be created through the Directory Server Console or using the setup-ds.plscript. For information on using the setup-ds.pl script, see the Directory Server Installation Guide.To create an instance using the Directory Server Console:

1. In the Red Hat Console window, select Server Group in the navigation tree, and then right-click.

2. From the pop-up menu, select Create Instance and then Directory Server.

Page 32: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

12

3. Fill in the instance information.

• A unique name for the server. This name must only have alphanumeric characters, a dash (-),or an underscore (_).

• A port number for LDAP communications.

• The root suffix for the new Directory Server instance.

• A DN for the Directory Manager. This user has total access to every entry in the directory,without normal usage constraints (such as search timeouts); this is described in Section 1.8,“Configuring the Directory Manager”.

• The password for the Directory Manager.

• The user ID as which to run the Directory Server daemon.

4. Click OK.

Page 33: Red Hat Directory Server 5.1

Configuring the Directory Manager

13

A status box appears to confirm that the operation was successful. To dismiss it, click OK.

1.8. Configuring the Directory ManagerThe Directory Manager is the privileged database administrator, comparable to the root user in UNIX.Access control does not apply to the Directory Manager entry; likewise, limits on searches and otheroperations do not apply. The Directory Manager entry is created during installation; the default DN iscn=Directory Manager.The password for this user is defined in the nsslapd-rootdn attribute.

To change the Directory Manager DN and password and the encryption scheme used for thispassword:

1. Log in to the Directory Server Console as Directory Manager. For information on changing the bindDN, see Section 1.4.3, “Changing Login Identity”.

2. In the Directory Server Console, select the Configuration tab, and then select the top entry in thenavigation tree in the left pane.

3. Select the Manager tab in the right pane.

4. Change the Directory Manager settings:

• Change the distinguished name for the Directory Manager in the Root DN field. The defaultvalue is cn=Directory Manager.

• Set the storage scheme for the server to use to store the password for Directory Manager in theManager Password Encryption pull-down menu.

• Enter a new password, and confirm it.

1.9. Enabling Plug-insTo enable and disable plug-ins over LDAP using the Directory Server Console:

Page 34: Red Hat Directory Server 5.1

Chapter 1. Basic Red Hat Directory Server Settings

14

1. In the Directory Server Console, select the Configuration tab.

2. Double-click the Plugins folder in the navigation tree.

3. Select the plug-in from the Plugins list.

4. To disable the plug-in, clear the Enabled checkbox. To enable the plug-in, check this checkbox.

5. Click Save.

6. Restart the Directory Server.1

service dirsrv restart instance_name

To disable or enable a plug-in through the command line, use the ldapmodify utility to edit the valueof the nsslapd-pluginEnabled attribute. For example: 2

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ACL Plugin,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginEnablednsslapd-pluginEnabled: on

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 35: Red Hat Directory Server 5.1

Chapter 2.

15

Configuring Directory DatabasesThe directory is made up of databases, and the directory tree is distributed across the databases. Thischapter describes how to create suffixes, the branch points for the directory tree, and how to createthe databases associated with each suffix. This chapter also describes how to create database links toreference databases on remote servers and how to use referrals to point clients to external sources ofdirectory data.

For a discussion of concepts about distributing directory data, see the Directory Server DeploymentGuide.

2.1. Creating and Maintaining SuffixesDifferent pieces of the directory tree can be stored in different databases, and then these databasescan be distributed across multiple servers. The directory tree contains branch points called nodes.These nodes may be associated with databases. A suffix is a node of the directory tree associatedwith a particular database. For example, a simple directory tree might appear as illustrated inFigure 2.1, “A Directory Tree with One Root Suffix”.

Figure 2.1. A Directory Tree with One Root Suffix

The ou=people suffix and all the entries and nodes below it might be stored in one database, theou=groups suffix on another database, and the ou=contractors suffix on yet another database.

• Section 2.1.1, “Creating Suffixes”

• Section 2.1.2, “Maintaining Suffixes”

2.1.1. Creating SuffixesBoth root and sub suffixes can be created to organize the contents of the directory tree. A root suffix isthe parent of a sub suffix. It can be part of a larger tree designed for the Directory Server. A sub suffixis a branch underneath a root suffix. The data for root and sub suffixes are contained by databases.

A directory might contain more than one root suffix. For example, an ISP might host severalwebsites, one for example.com and one for redhat.com. The ISP would create two root suffixes,

Page 36: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

16

one corresponding to the dc=example,dc=com naming context and one corresponding to thedc=redhat,dc=com naming context, as shown in Figure 2.2, “A Directory Tree with Two RootSuffixes”.

Figure 2.2. A Directory Tree with Two Root Suffixes

It is also possible to create root suffixes to exclude portions of the directory tree from searchoperations. For example, Example Corporation wants to exclude their European office from a searchon the general Example Corporation directory. To do this, they create two root suffixes. One root suffixcorresponds to the general Example Corporation directory tree, dc=example,dc=com, and one rootsuffix corresponds to the European branch of their directory tree, l=europe,dc=example,dc=com.From a client application's perspective, the directory tree looks as illustrated in Figure 2.3, “A DirectoryTree with a Root Suffix Off Limits to Search Operations”.

Figure 2.3. A Directory Tree with a Root Suffix Off Limits to Search Operations

Searches performed by client applications on the dc=example,dc=com branch of ExampleCorporation's directory will not return entries from the l=europe,dc=example,dc=com branch ofthe directory, as it is a separate root suffix.

If Example Corporation decides to include the entries in the European branch of their directory treein general searches, they make the European branch a sub suffix of the general branch. To do this,they create a root suffix for Example Corporation, dc=example,dc=com, and then create a sub suffixbeneath it for their European directory entries, l=europe,dc=example,dc=com. From a clientapplication's perspective, the directory tree appears as illustrated in Figure 2.4, “A Directory Tree witha Sub Suffix”.

Page 37: Red Hat Directory Server 5.1

Creating Suffixes

17

Figure 2.4. A Directory Tree with a Sub Suffix

This section describes creating root and sub suffixes for the directory using either the Directory ServerConsole or the command line.

• Section 2.1.1.1, “Creating a New Root Suffix Using the Console”

• Section 2.1.1.2, “Creating a New Sub Suffix Using the Console”

• Section 2.1.1.3, “Creating Root and Sub Suffixes from the Command Line”

2.1.1.1. Creating a New Root Suffix Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Right-click Data in the left navigation pane, and select New Root Suffix from the pop-up menu.

Page 38: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

18

3. Enter a unique suffix in the New suffix field.

The suffix must be named with dc naming conventions, such as dc=example,dc=com.

4. Select the Create associated database automatically to create a database at the same time asthe new root suffix, and enter a unique name for the new database in the Database name field,such as example2. The name can be a combination of alphanumeric characters, dashes (-), andunderscores (_). No other characters are allowed.

Page 39: Red Hat Directory Server 5.1

Creating Suffixes

19

Deselect the checkbox to create a database for the new root suffix later. This option specifies adirectory where the database will be created. The new root suffix will be disabled until a databaseis created.

The new root suffix is listed under the Data folder.

2.1.1.2. Creating a New Sub Suffix Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Under the Data in the left navigation pane, select the suffix under which to add a new sub suffix.Right-click the suffix, and select New Sub Suffix from the pop-up menu.

Page 40: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

20

The Create new sub suffix dialog box is displayed.

3. Enter a unique suffix name in the New suffix field. The suffix must be named in line with dcnaming conventions, such as ou=groups.

The root suffix is automatically added to the name. For example, it the sub suffix ou=groupsis created under the dc=example,dc=com suffix, the Console automatically names itou=groups,dc=example,dc=com.

Page 41: Red Hat Directory Server 5.1

Creating Suffixes

21

4. Select the Create associated database automatically checkbox to create a database at thesame time as the new sub suffix, and enter a unique name for the new database in the Databasename field, such as example2. The name can be a combination of alphanumeric characters,dashes (-), and underscores (_). No other characters are allowed.

If the checkbox is not selected, than the database for the new sub suffix must be created later. Thenew sub suffix is disabled until a database is created.

The suffix appears automatically under its root suffix in the Data tree in the left navigation pane.

2.1.1.3. Creating Root and Sub Suffixes from the Command LineUse the ldapmodify command-line utility to add new suffixes to the directory configuration file. Thesuffix configuration information is stored in the cn=mapping tree,cn=config entry.

NOTEAvoid creating entries under the cn=config entry in the dse.ldif file. The cn=configentry in the simple, flat dse.ldif configuration file is not stored in the same highlyscalable database as regular entries. As a result, if many entries, particularly entries thatare likely to be updated frequently, are stored under cn=config, performance will suffer.

1. Add a new root suffix to the configuration file using the ldapmodify utility. 1

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

Page 42: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

22

ldapmodify binds to the server and prepares it to add an entry to the configuration file.

2. Create the root suffix entry.

dn: cn="dc=example,dc=com",cn=mapping tree,cn=configobjectclass: topobjectclass: extensibleObjectobjectclass: nsMappingTreensslapd-state: backendnsslapd-backend: UserDatacn: "dc=example,dc=com"

Example 2.1. Example Root Suffix Entry

3. Create a sub suffix for groups under this root suffix using ldapmodify to add the sub suffix entry:

dn: cn="ou=groups,dc=example,dc=com",cn=mapping tree,cn=configobjectclass: topobjectclass: extensibleObjectobjectclass: nsMappingTreensslapd-state: backendnsslapd-backend: GroupDatansslapd-parent-suffix: "dc=example,dc=com" cn: "ou=groups,dc=example,dc=com"

NOTETo maintain suffixes using the Directory Server Console, respect the same spacing usedto name the root and sub suffixes in the command line. For example, if a root suffix isnamed ou=groups ,dc=example,dc=com, with two spaces after groups, any subsuffixes created under this root will need to specify two spaces after ou=groups, as well.

The following table describes the attributes used to configure a suffix entry:

Attribute Name Value

dn Defines the DN for the suffix. The DN iscontained in quotes. The value entered takes theform cn="dc=domain,dc=com",cn=mappingtree, cn=config. This attribute is required.

cn Defines the relative DN (RDN) of the entry. Thisattribute is required.

objectclass Tells the server that the entry is root orsub suffix entry. It always takes the valuensMappingTree. This attribute is required.

nsslapd-state Determines how the suffix handles operations.This attribute takes the following values:• backend: The backend (database) is used to

process all operations.

• disabled: The database is not available forprocessing operations. The server returns a

Page 43: Red Hat Directory Server 5.1

Creating Suffixes

23

Attribute Name ValueNo such search object error in response torequests made by client applications.

• referral: A referral is returned for requestsmade to this suffix.

• referral on update: The database isused for all operations except update requests,which receive a referral.

The default value is disabled.

nsslapd-referral Defines the LDAP URL of the referral to bereturned by the suffix. This attribute can be multi-valued, with one referral per value. This attributeis required when the value of the nsslapd-state attribute is referral or referral onupdate.

nsslapd-backend Gives the name of the database or databaselink used to process requests. This attribute canbe multi-valued, with one database or databaselink per value. See Section 2.3, “Creatingand Maintaining Database Links” for moreinformation about database links. This attribute isrequired when the value of the nsslapd-stateattribute is set to backend or referral onupdate.

nsslapd-distribution-plugin Specifies the shared library to be used with thecustom distribution function. This attribute isrequired only when more than one database isspecified in the nsslapd-backend attribute.See Section 2.2, “Creating and MaintainingDatabases” for more information about thecustom distribution function.

nsslapd-distribution-funct Specifies the name of the custom distributionfunction. This attribute is required only whenmore than one database is specified in thensslapd-backend attribute. See Section 2.2,“Creating and Maintaining Databases” formore information about the custom distributionfunction.

nsslapd-parent-suffix Provides the DN of the parent entry for a subsuffix. By default, this attribute is not present,which means that the suffix is regarded as a rootsuffix. For example, to create a sub suffix nameso=sales,dc=example,dc=com under the rootsuffix dc=example,dc=com, add nsslapd-parent-suffix: "dc=example,dc=com" tothe sub suffix.

Table 2.1. Suffix Attributes

Page 44: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

24

2.1.2. Maintaining SuffixesThis section describes the following procedures:

• Section 2.1.2.1, “Disabling a Suffix”

• Section 2.1.2.2, “Deleting a Suffix”

2.1.2.1. Disabling a SuffixSometimes, a database may need taken down for maintenance, but the data the database containsare not replicated. Rather than returning a referral, disable the suffix responsible for the database.

Once a suffix is disabled, the contents of the database related to the suffix are invisible to clientapplications when they perform LDAP operations such as search, add, and modify.

To disable a suffix:

1. In the Directory Server Console, select the Configuration tab.

2. Under Data in the left navigation pane, click the suffix to disable.

3. Click the Suffix Setting tab, and deselect the Enable this suffix checkbox.

2.1.2.2. Deleting a Suffix

WARNINGDeleting a suffix also deletes all database entries and replication information associatedwith that suffix.

Page 45: Red Hat Directory Server 5.1

Maintaining Suffixes

25

1. In the Directory Server Console, select the Configuration tab.

2. Under Data in the left navigation pane, select the suffix to delete.

3. Right-click the suffix, and select Delete from the menu.

4. Select either Delete this suffix and all of its sub suffixes or Delete this suffix only.

Page 46: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

26

2.2. Creating and Maintaining DatabasesAfter creating suffixes to organizing the directory data, create databases to contain that directory data.Databases are used to store directory data.

2.2.1. Creating DatabasesThe directory tree can be distributed over multiple Directory Server databases. There are two ways todistribute data across multiple databases:

• One database per suffix. The data for each suffix is contained in a separate database.

Three databases are added to store the data contained in separate suffixes.

This division of the tree corresponds to three databases.

Page 47: Red Hat Directory Server 5.1

Creating Databases

27

Database one contains the data for ou=people plus the data for dc=example,dc=com, so thatclients can conduct searches based at dc=example,dc=com. Database two contains the data forou=groups, and database three contains the data for ou=contractors.

• Multiple databases for one suffix.

Suppose the number of entries in the ou=people branch of the directory tree is so large that twodatabases are needed to store them. In this case, the data contained by ou=people could bedistributed across two databases.

DB1 contains people with names from A-K, and DB2 contains people with names from L-Z. DB3contains the ou=groups data, and DB4 contains the ou=contractors data.

Custom distribution plug-in distributes data from a single suffix across multiple databases. ContactRed Hat Professional Services for information on how to create distribution logic for DirectoryServer.

Page 48: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

28

2.2.1.1. Creating a New Database for an Existing Suffix Using the Console1. In the Directory Server Console, select the Configuration tab.

2. In the left pane, expand Data, then click the suffix to which to add the new database.

3. Right-click the suffix, and select New Database from the pop-up menu.

4. Enter a unique name for the database, such as example2. The database name can be acombination of alphanumeric characters, dashes (-), and underscores (_).

Page 49: Red Hat Directory Server 5.1

Creating Databases

29

The Create database in field is automatically filled with the default database directory (/var/lib/dirsrv/slapd-instance_name/db) and the name of the new database. It is alsopossible to enter or browse for a different directory location.

2.2.1.2. Creating a New Database for a Single Suffix from the CommandLineUse the ldapmodify command-line utility to add a new database to the directoryconfiguration file. The database configuration information is stored in the cn=ldbmdatabase,cn=plugins,cn=config entry.

For example, add a new database to the server example1:

1. Run ldapmodify:1

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add an entry to the configuration file.

2. Create the entry for the new database.

dn: cn=UserData,cn=ldbm database,cn=plugins,cn=configobjectclass: extensibleObjectobjectclass: nsBackendInstancensslapd-suffix: ou=people,dc=example,dc=com

The entry added corresponds to a database named UserData that contains the data for the rootor sub suffix ou=people,dc=example,dc=com.

3. Create a root or sub suffix, as described in Section 2.1.1.3, “Creating Root and Sub Suffixes fromthe Command Line”. The database name, given in the DN attribute, must correspond with thevalue in the nsslapd-backend attribute of the suffix entry.

2.2.1.3. Adding Multiple Databases for a Single SuffixA single suffix can be distributed across multiple databases. However, to distribute the suffix, a customdistribution function has to be created to extend the directory. For more information on creating acustom distribution function, contact Red Hat Professional Services.

NOTEOnce entries have been distributed, they cannot be redistributed. The following restrictionsapply:

• The distribution function cannot be changed once entry distribution has been deployed.

• The LDAP modrdn operation cannot be used to rename entries if that would causethem to be distributed into a different database.

• Distributed local databases cannot be replicated.

Page 50: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

30

• The ldapmodify operation cannot be used to change entries if that would cause themto be distributed into a different database.

Violating these restrictions prevents Directory Server from correctly locating and returningentries.

After creating a custom distribution logic plug-in, add it to the directory.

The distribution logic is a function declared in a suffix. This function is called for every operationreaching this suffix, including subtree search operations that start above the suffix. A distributionfunction can be inserted into a suffix using both the Console and the command line.

2.2.1.3.1. Adding the Custom Distribution Function to a Suffix Using theDirectory Server Console1. In the Directory Server Console, select the Configuration tab.

2. Expand Data in the left navigation pane. Select the suffix to which to apply the distributionfunction.

3. Select the Databases tab in the right window.

4. The databases associated with the suffix are already listed in the Databases tab. Click Add toassociate additional databases with the suffix.

5. Enter the path to the distribution library.

6. Enter the name of the distribution function in the Function name field.

2.2.1.3.2. Adding the Custom Distribution Function to a Suffix Using theCommand Line1. Run ldapmodify.1

Page 51: Red Hat Directory Server 5.1

Maintaining Directory Databases

31

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Add the following attributes to the suffix entry itself, supplying the information about the customdistribution logic:

changetype: modifyadd: nsslapd-backendnsslapd-backend: Database1 -add: nsslapd-backendnsslapd-backend: Database2 -add: nsslapd-backendnsslapd-backend: Database3 -add: nsslapd-distribution-pluginnsslapd-distribution-plugin: /full/name/of/a/shared/library -add: nsslapd-distribution-functnsslapd-distribution-funct: distribution-function-name

The nsslapd-backend attribute specifies all of the databases associated with this suffix. Thensslapd-distribution-plugin attribute specifies the name of the library that the plug-in uses. The nsslapd-distribution-funct attribute provides the name of the distributionfunction itself.

For more information about using the ldapmodify command-line utility, see Section 3.2.4, “Addingand Modifying Entries Using ldapmodify”.

2.2.2. Maintaining Directory Databases• Section 2.2.2.1, “Placing a Database in Read-Only Mode”

• Section 2.2.2.2, “Deleting a Database”

• Section 2.2.2.3, “Configuring Transaction Logs for Frequent Database Updates”

2.2.2.1. Placing a Database in Read-Only ModeWhen a database is in read-only mode, you cannot create, modify, or delete any entries. One of thesituations when read-only mode is useful is for manually initializing a consumer or before backing upor exporting data from the Directory Server. Read-only mode ensures a faithful image of the state ofthese databases at a given time.

The Directory Server Console and the command-line utilities do not automatically put the directoryin read-only mode before export or backup operations because this would make your directoryunavailable for updates. However, with multi-master replication, this might not be a problem.

• Section 2.2.2.1.1, “Making a Database Read-Only Using the Console”

• Section 2.2.2.1.2, “Making a Database Read-Only from the Command Line”

• Section 2.2.2.1.3, “Placing the Entire Directory Server in Read-Only Mode”

Page 52: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

32

2.2.2.1.1. Making a Database Read-Only Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Expand Data in the left pane. Expand the suffix containing the database to put in read-only mode.

3. Select the database to put into read-only mode.

4. Select the Database Settings tab in the right pane.

5. Select the database is read-only checkbox.

The change takes effect immediately.

Before importing or restoring the database, ensure that the databases affected by the operation arenot in read-only mode.

To disable read-only mode, open the database up in the Directory Server Console again and uncheckthe database is read-only checkbox.

2.2.2.1.2. Making a Database Read-Only from the Command LineTo manually place a database into read-only mode:

1. Run ldapmodify.1

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Change the read-only attribute to on

dn: cn=database_name,cn=ldbm database,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-readonlynsslapd-readonly: on

Page 53: Red Hat Directory Server 5.1

Maintaining Directory Databases

33

NOTEBy default, the name of the database created at installation time is userRoot.

2.2.2.1.3. Placing the Entire Directory Server in Read-Only ModeIf the Directory Server maintains more than one database and all databases need to be placed inread-only mode, this can be done in a single operation.

WARNINGThis operation also makes the Directory Server configuration read-only; therefore, youcannot update the server configuration, enable or disable plug-ins, or even restart theDirectory Server while it is in read-only mode. Once read-only mode is enabled, it cannotcannot be undone from the Console; you must modify the configuration files.

NOTEIf Directory Server contains replicas, do not use read-only mode because it will disablereplication.

To put the Directory Server in read-only mode:

1. In the Directory Server Console, select the Configuration tab, and then select the top entry in thenavigation tree in the left pane.

2. Select the Settings tab in the right pane.

Page 54: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

34

3. Select the Make Entire Server Read-Only checkbox.

4. Click Save, and then restart the server.

2.2.2.2. Deleting a DatabaseDeleting a database deletes the configuration information and entries for that database only, not thephysical database itself.

1. In the Directory Server Console, select the Configuration tab.

2. Expand the Data folder, and then select the suffix.

3. Select the database to delete.

4. Right-click the database and select Delete from the pop-up menu.

Page 55: Red Hat Directory Server 5.1

Maintaining Directory Databases

35

5. Confirm that the database should be deleted in the Delete Database dialog box.

2.2.2.3. Configuring Transaction Logs for Frequent Database UpdatesWhen the server is going to be asked to perform frequent database updates (LDAP adds, modifies,replication), the database transaction log files should be configured to be on a different disk than theprimary database files.

Storing the transaction log files on a separate physical disk improves performance because the diskheads do not thrash moving between the log files and the data files.

1. Stop the Directory Server instance.

service dirsrv stop example

2. Create the new directory, if necessary, where the transaction logs will be located.

mkdir /home/exampledb-txnlogs

3. Set the appropriate file permissions on the directory so that the Directory Server user can accessit; the default Directory Server user and group are nobody:nobody.

chown nobody:nobody /home/exampledb-txnlogs

Page 56: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

36

4. Open the Directory Server instance's configuration directory.

cd /etc/dirsrv/slapd-instance_name

5. Edit the dse.ldif file, and change the nsslapd-db-logdirectory directive for the new logfile path:

nsslapd-db-logdirectory: /home/exampledb-txnlogs

This attribute goes on the same entry that has the nsslapd-dbcachesize attribute.

6. Open the database directory.

cd /var/lib/dirsrv/slapd-instance_name/db

7. Remove all of the __db.* files.

8. Move the log.* files to the new location.

9. Start the Directory Server instance again.

service dirsrv start example

2.2.3. Configuring Attribute EncryptionThe Directory Server offers a number of mechanisms to secure access to sensitive data, such asaccess control rules to prevent unauthorized users from reading certain entries or attributes withinentries and SSL to protect data from eavesdropping and tampering on untrusted networks. However,if a copy of the server's database files should fall into the hands of an unauthorized person, they couldpotentially extract sensitive information from those files. Because information in a database is stored inplain text, some sensitive information, such as government identification numbers or passwords, maynot be protected enough by standard access control measures.

For highly sensitive information, this potential for information loss could present a significant securityrisk. In order to remove that security risk, Directory Server allows portions of its database to beencrypted. Once encrypted, the data are safe even in the event that an attacker has a copy of theserver's database files.

Database encryption allows attributes to be encrypted in the database. Both encryption and theencryption cipher are configurable per attribute per backend. When configured, every instance of aparticular attribute, even index data, is encrypted for every entry stored in that database.

NOTETo enable attribute encryption on an attribute with existing stored data, export thedatabase to LDIF first, then make the configuration change, then re-import the data tothe database. The server does not enforce consistency between encryption configurationand stored data; therefore, pay careful attention that all existing data are exported beforeenabling or disabling encryption.

Page 57: Red Hat Directory Server 5.1

Configuring Attribute Encryption

37

Indexed attributes may be encrypted, and attribute encryption is fully compatible with indexing. Thecontents of the index files that are normally derived from attribute values are also encrypted to preventan attacker from recovering part or all of the encrypted data from an analysis of the indexes.

Since the server pre-encrypts all index keys before looking up an index for an encrypted attribute,there is some effect on server performance for searches that make use of an encrypted index, but theeffect is not serious enough that it is no longer worthwhile to use an index.

2.2.3.1. Encryption KeysIn order to use attribute encryption, the server must be configured for SSL and have SSL enabledbecause attribute encryption uses the server's SSL encryption key and the same PIN input methodsas SSL. The PIN must either be entered manually upon server startup or a PIN file must be used.

Randomly generated symmetric cipher keys are used to encrypt and decrypt attribute data. A separatekey is used for each configured cipher. These keys are wrapped using the public key from the server'sSSL certificate, and the resulting wrapped key is stored within the server's configuration files. Theeffective strength of the attribute encryption is never higher than the strength of the server's SSLkey used for wrapping. Without access to the server's private key, it is not possible to recover thesymmetric keys from the wrapped copies.

WARNINGThere is no mechanism for recovering a lost key. Therefore, it is especially importantto back up the server's certificate database safely. If the server's certificate were lost, itwould not be possible to decrypt any encrypted data stored in its database.

WARNINGIf the SSL certificate is expiring and needs to be renewed, export the encrypted backendinstance before the renewal. Update the certificate, then re-import the exported LDIF file.

2.2.3.2. Encryption CiphersThe encryption cipher is configurable on a per-attribute basis and must be selected by theadministrator at the time encryption is enabled for an attribute. Configuration can be done through theConsole or through the command line.

The following ciphers are supported:

• Advanced Encryption Standard (AES)

• Triple Data Encryption Standard (3DES)

All ciphers are used in Cipher Block Chaining mode.

Once the encryption cipher is set, it should not be changed without exporting and re-importing thedata.

2.2.3.3. Configuring Attribute Encryption from the Console1. In the Configuration tab, select the Data node.

Page 58: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

38

2. Expand the suffix, and select the database to edit.

3. Select the Attribute Encryption tab.

4. Click the Add Attribute button to open the list of attributes. Select the attribute to encrypt.

Page 59: Red Hat Directory Server 5.1

Configuring Attribute Encryption

39

NOTEFor existing attribute values to be encrypted, the information must be exported fromthe database, then re-imported. See Section 2.2.3.5, “Exporting and Importing anEncrypted Database”.

5. Select which encryption cipher to use.

Page 60: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

40

NOTEThe encryption cipher to use is set separately for each attribute, so attribute encryption isapplied to each attribute one at a time.

To remove encryption from attributes, select them from the list of encrypted attributes in the AttributeEncryption table, click the Delete button, and then click Save to apply the changes. Any deletedattributes have to be manually re-added after saving.

2.2.3.4. Configuring Attribute Encryption Using the Command Line1. Run the ldapmodify command1:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Add an encryption entry for the attribute being encrypted. For example, this entry encrypts thetelephoneNumber attribute with the AES cipher:

dn: cn=telephoneNumber,cn=encrypted attributes,cn=Database1,cn=ldbm database,cn=plugins,cn=configobjectclass: topobjectclass: nsAttributeEncryptioncn: telephoneNumbernsEncryptionAlgorithm: AES

3. For existing attributes in entries to be encrypted, the information must be exported, then re-imported. See Section 2.2.3.5, “Exporting and Importing an Encrypted Database”.

For more information on attribute encryption configuration schema, refer to "DatabaseAttributes under cn=attributeName,cn=encrypted attributes,cn=database_name,cn=ldbmdatabase,cn=plugins,cn=config" in the Directory Server Configuration, Command, and File Reference.

Page 61: Red Hat Directory Server 5.1

Configuring Attribute Encryption

41

2.2.3.5. Exporting and Importing an Encrypted DatabaseExporting and importing encrypted databases is similar to exporting and importing regular databases.However, the encrypted information must be decrypted when it is exported to LDIF, then re-encryptedwhen it is imported to the database. Using the -E option when running the db2ldif and ldif2dbscripts will decrypt the data on export and re-encrypt it on import.

1. Export the data using the db2ldif script, as follows:

db2ldif -n Database1 -E -a /path/to/output.ldif -s "dc=example,dc=com" -s "o=userRoot"

See Section 4.2.3, “Exporting to LDIF from the Command Line” for more information.

2. Make any configuration changes.

3. Re-import the data using the ldif2db script, as follows:

ldif2db -n Database1 -E -i /path/to/output.ldif

See Section 4.1.4, “Importing from the Command Line” for more information.

NOTEWhen enabling encryption for data that is already present in the the database, severaladditional security concerns arise:

• It is possible for old, unencrypted data to persist in the server's database page poolbacking file, even after a successful re-import with encryption. To remove this data, stopthe server and delete the db/guardian file, then re-start the server. This will forcerecovery, a side-effect of which is deleting the backing file. However, it is possible thatthe data from the deleted file could still be recovered from the hard drive unless stepsare taken to overwrite the disk blocks that it occupied.

• After enabling encryption and importing data, be sure to delete the LDIF file because itcontains plain text values for the now-encrypted data. Ensure that the disk blocks that itoccupied are overwritten.

• The unencrypted data previously stored in the server's database may persist on diskafter a successful re-import with encryption. This is because the old database filesare deleted as part of the import process. Ensure that the disk blocks that those filesoccupied are overwritten.

• Data stored in the server's replication log database is never encrypted; therefore, careshould be taken to protect those files if replication is used.

• The server does not attempt to protect unencrypted data stored in memory. This datamay be copied into a system page file by the operating system. For this reason, ensurethat any page or swap files are adequately protected.

2.2.3.6. Updating Attribute Encryption Keys for New SSL/TLS CertificatesWhen SSL is first configured, there is no problem with attribute encryption. However, if the SSLcertificate is changed, then attribute encryption fails, with messages like these:

Page 62: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

42

Apr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - attrcrypt_unwrap_key: failed to unwrap key for cipher AESApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to retrieve key for cipher AES in attrcrypt_cipher_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to initialize cipher AES in attrcrypt_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - attrcrypt_unwrap_key: failed to unwrap key for cipher AESApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to retrieve key for cipher AES in attrcrypt_cipher_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to initialize cipher AES in attrcrypt_init

This is because the previously-generated keys do not work with the new server certificate. To correctthese errors, force the server to generate new keys for attribute encryption:

1. Stop the server.

service dirsrv stop

2. Open the dse.ldif file.

vim /etc/dirsrv/dse.ldif

3. There are special encryption key entries for the encryption ciphers used for attribute encryptionunder the database configuration. For example:

dn: cn=AES,cn=encrypted attribute keys,cn=userRoot,cn=ldbm database,cn=plugins,cn=configobjectClass: topobjectClass: extensibleObjectcn: AESnssymmetrickey:: mSLm/RlCLvPZrSdARHPowedF9zKx+kjVTww5ARE4w0lbl2YlYvrI3bNg=

Delete these entries.

4. Start the server again.

service dirsrv start

2.3. Creating and Maintaining Database LinksChaining means that a server contacts other servers on behalf of a client application and then returnsthe combined results. Chaining is implemented through a database link, which points to data storedremotely. When a client application requests data from a database link, the database link retrieves thedata from the remote database and returns it to the client.

• Section 2.3.1, “Creating a New Database Link”

• Section 2.3.2, “Configuring the Chaining Policy”

• Section 2.3.3, “Maintaining Database Links”

• Section 2.3.4, “Configuring Database Link Defaults”

• Section 2.3.5, “Deleting Database Links”

Page 63: Red Hat Directory Server 5.1

Creating a New Database Link

43

• Section 2.3.6, “Database Links and Access Control Evaluation”

• Section 2.3.7, “Tuning Database Link Performance”

For more general information about chaining, refer to the chapter "Designing the Directory Topology,"in the Directory Server Deployment Guide. Section 14.5, “Monitoring Database Link Activity” covershow to monitor database link activity.

2.3.1. Creating a New Database LinkThe basic database link configuration requires four piece of information:

• Suffix information. A suffix is created in the directory tree that is managed by the database link, not aregular database. This suffix corresponds to the suffix on the remote server that contains the data.

• Bind credentials. When the database link binds to a remote server, it impersonates a user, and thisspecifies the DN and the credentials for each database link to use to bind with remote servers.

• LDAP URL. This supplies the LDAP URL of the remote server to which the database link connects.

• List of failover servers. This supplies a list of alternative servers for the database link to contact inthe event of a failure. This configuration item is optional.

2.3.1.1. Creating a New Database Link Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Create a new suffix as described in Section 2.1.1, “Creating Suffixes”.

Deselect the Create associated database automatically checkbox. It is simpler to configure adatabase link on a suffix without a database associated with it because having both a databaseand database link requires custom distribution functions to distribute directory data.

3. In the left pane, right-click the new suffix, and select New Database Link from the pop-up menu.

Page 64: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

44

4. Fill in the database link name. The name can be a combination of alphanumeric characters,dashes (-), and underscores (_). No other characters, like spaces, are allowed.

5. Set the radio button for the appropriate method for authentication.

Page 65: Red Hat Directory Server 5.1

Creating a New Database Link

45

There are four authentication methods:

• Simple means that the server connects over the standard port with no encryption. The onlyrequired information is the bind DN and password for the user as whom the server connects tothe remote server.

• Server TLS/SSL Certificate uses the local server's SSL certificate to authenticate to the remoteserver. A certificate must be installed on the local server for certificate-based authentication, andthe remote server must have certificate mapping configured so that it can map the subject DN inthe local server's certificate to the corresponding user entry.

Configuring SSL and certificate mapping is described in Chapter 12, Managing SSL.

Page 66: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

46

NOTEWhen the database link and remote server are configured to communicate usingSSL, this does not mean that the client application making the operation requestmust also communicate using SSL. The client can bind using a normal port.

• SASL/DIGEST-MD5 requires the standard port to connect to the server. Like simpleauthentication, this requires only the bind DN and password to authenticate.

• SASL/GSSAPI also requires the standard LDAP connection because the Directory Server doesnot support using GSS-API over SSL/TLS.

The local server must have a Kerberos keytab (as in Section 13.1.4.2, “About the KDC Serverand Keytabs”), and the remote server must have a SASL mapping to map the local server'sprincipal to the real user entry (as in Section 13.2.1, “Configuring SASL Identity Mapping fromthe Console”).

6. In the Remote Server Information section, select the connection type for the local server to useto connect to the remote server. There are three options:

• Use LDAP. This sets either a standard, unencrypted connection or allows SASL authentication,since Directory Server supports SASL over standard LDAP but not SSL.

• Use TLS/SSL. This uses a secure connection over the server's secure LDAPS port, such as636. This setting is required to use TLS/SSL, but it cannot be set if the authentication will beperformed with SASL.

When using SSL/TLS, make sure that the remote server's port number is set to its secure port.

• Use Start TLS. This uses Start TLS to establish a secure connection over the server's standardport.

7. In the Remote Server Information section, fill in the name and port number for the remote server.

For any failover servers, fill in the hostname and port number, and click the Add button. A failoverserver is a backup server, so that if the primary remote server fails, the database link contacts thefirst server in the failover servers list and cycles through the list until a server is accessed.

The new database link is listed under the suffix, in place of the database.

NOTEThe Console provides a checklist of information that needs to be present on the remoteserver for the database link to bind successfully. To view this checklist, click the new

Page 67: Red Hat Directory Server 5.1

Creating a New Database Link

47

database link, and click the Authentication tab. The checklist is in the Remote serverchecklist box.

2.3.1.2. Creating a Database Link from the Command Line1. Use the ldapmodify command-line utility to create a new database link from the command line.

The new instance must be located in the cn=chaining database,cn=plugins,cn=configentry.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Specify the configuration information for the database link:

dn: cn=examplelink,cn=chaining database,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsBackendInstance nsslapd-suffix: ou=people,dc=example,dc=com suffix being chained nsfarmserverurl: ldap://people.example.com:389/ LDAP URL to remote server nsmultiplexorbinddn: cn=proxy admin,cn=config bind DN nsmultiplexorcredentials: secret bind password cn: examplelink

Default configuration attributes are contained in the cn=default instance config,cn=chaining database,cn=plugins,cn=config entry. These configuration attributes apply toall database links at creation time. Changes to the default configuration only affect new database links.The default configuration attributes on existing database links cannot be changed.

Each database link contains its own specific configuration information, which is stored with thedatabase link entry itself, cn=database_link, cn=chaining database,cn=plugins,cn=config.For more information about configuration attributes, refer to the Directory Server Configuration,Command, and File Reference.

• Section 2.3.1.2.1, “Providing Suffix Information”

• Section 2.3.1.2.2, “Providing Bind Credentials”

• Section 2.3.1.2.3, “Providing an LDAP URL”

• Section 2.3.1.2.4, “Providing a List of Failover Servers”

• Section 2.3.1.2.5, “Using Different Bind Mechanisms”

• Section 2.3.1.2.6, “Summary of Database Link Configuration Attributes”

• Section 2.3.1.2.7, “Database Link Configuration Example”

2.3.1.2.1. Providing Suffix InformationUse the nsslapd-suffix attribute to define the suffix managed by the database link. For example,for the database link to point to the people information for a remote site of the company, enter thefollowing suffix information:

Page 68: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

48

nsslapd-suffix: l=Zanzibar,ou=people,dc=example,dc=com

The suffix information is stored in the cn=database_link, cn=chainingdatabase,cn=plugins,cn=config entry.

NOTEAfter creating the database link, any alterations to the nsslapd-nsslapd-suffixattribute are applied only after the server containing the database link is restarted.

2.3.1.2.2. Providing Bind CredentialsFor a request from a client application to be chained to a remote server, special bind credentials canbe supplied for the client application. This gives the remote server the proxied authorization rightsneeded to chain operations. Without bind credentials, the database link binds to the remote server asanonymous.

Providing bind credentials involves the following steps:

1. On the remote server:• Create an administrative user for the database link.

For information on adding entries, see Chapter 3, Creating Directory Entries.

• Provide proxy access rights for the administrative user created in step 1 on the subtree chainedto by the database link.

For more information on configuring ACIs, see Chapter 6, Managing Access Control

2. On the server containing the database link, use ldapmodify to provide a user DN for thedatabase link in the nsMultiplexorBindDN attribute of the cn=database_link, cn=chainingdatabase,cn=plugins,cn=config entry.

WARNINGThe nsMultiplexorBindDN cannot be that of the Directory Manager.

Use ldapmodify to provide a user password for the database link in thensMultiplexorCredentials attribute of the cn=database_link, cn=chainingdatabase,cn=plugins,cn=config entry.

For example, a client application sends a request to Server A. Server A contains a database link thatchains the request to a database on Server B.

Page 69: Red Hat Directory Server 5.1

Creating a New Database Link

49

The database link on Server A binds to Server B using a special user as definedin the nsMultiplexorBindDN attribute and a user password as defined in thensMultiplexorCredentials attribute. In this example, Server A uses the following bindcredentials:

nsMultiplexorBindDN: cn=proxy admin,cn=confignsMultiplexorCredentials: secret

Server B must contain a user entry corresponding to the nsMultiplexorBindDN, and set the proxyauthentication rights for this user. To set the proxy authorization correctly, set the proxy ACI as anyother ACI.

WARNINGCarefully examine access controls when enabling chaining to avoid giving access torestricted areas of the directory. For example, if a default proxy ACI is created on abranch, the users that connect via the database link will be able to see all entries belowthe branch. There may be cases when not all of the subtrees should be viewed by a user.To avoid a security hole, create an additional ACI to restrict access to the subtree.

Page 70: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

50

For more information on ACIs, see Chapter 6, Managing Access Control. For more information aboutthe proxy authentication control, refer to the LDAP C-SDK documentation at http://www.mozilla.org/directory.

NOTEWhen a database link is used by a client application to create or modify entries, theattributes creatorsName and modifiersName do not reflect the real creator or modifierof the entries. These attributes contain the name of the administrative user grantedproxied authorization rights on the remote data server.

2.3.1.2.3. Providing an LDAP URLOn the server containing the database link, identify the remote server that the database link connectswith using an LDAP URL. Unlike the standard LDAP URL format, the URL of the remote server doesnot specify a suffix. It takes the form ldap://hostname:port.

The URL of the remote server using the nsFarmServerURL attribute is set in the cn=database_link, cn=chaining database,cn=plugins,cn=config entry of the configuration file.

nsFarmServerURL: ldap://example.com:389/

NOTEDo not forget to use the trailing slash (/) at the end of the URL.

For the database link to connect to the remote server using LDAP over SSL, the LDAP URL of theremote server uses the protocol LDAPS instead of LDAP in the URL and points to the secure port ofthe server.For example:

nsFarmServerURL: ldaps://africa.example.com:636/

NOTESSL has to be enabled on the local Directory Server and the remote Directory Serverto be chained over SSL. For more information on enabling SSL, see Section 12.1.1,“Enabling SSL: Summary of Steps”.

When the database link and remote server are configured to communicate using SSL,this does not mean that the client application making the operation request must alsocommunicate using SSL. The client can bind using a normal port.

2.3.1.2.4. Providing a List of Failover ServersThere can be additional LDAP URLs for servers included to use in the case of failure. Add alternateservers to the nsFarmServerURL attribute, separated by spaces.

Page 71: Red Hat Directory Server 5.1

Creating a New Database Link

51

nsFarmServerURL: ldap://example.com us.example.com:389 africa.example.com:1000/

In this sample LDAP URL, the database link first contacts the server example.com on the standardport to service an operation. If it does not respond, the database link then contacts the serverus.example.com on port 389. If this server fails, it then contacts africa.example.com on port1000.

2.3.1.2.5. Using Different Bind MechanismsThe local server can connect to the remote server using several different connection types andauthentication mechanisms.

There are three ways that the local server can connect to the remote server:

• Over the standard LDAP port

• Over a dedicated TLS/SSL port

• Using Start TLS, which is a secure connection over a standard port

Ultimately, there are two connection settings. The TLS/SSL option signifies that both of the serversare configured to run and accept connections over TLS/SSL, but there is no separate configurationattribute for enforcing TLS/SSL.

The connection type is identified in the nsUseStartTLS attribute. When this is on, then the serverinitiates a Start TLS connect over the standard port. If this is off, then the server either usesthe LDAP port or the TLS/SSL port, depending on what is configured for the remote server in thensFarmServerURL attribute.

For example, to use Start TLS:

nsUseStartTLS: on

For example, to use a standard connection or TLS/SSL connection:

nsUseStartTLS: off

There are four different methods which the local server can use to authenticate to the farm server.

• empty. If there is no bind mechanism set, then the server performs simple authentication andrequires the nsMultiplexorBindDN and nsMultiplexorCredentials attributes to give thebind information.

• EXTERNAL. This uses an SSL certificate to authenticate the farm server to the remote server.Either the farm server URL must be set to the secure URL (ldaps) or the nsUseStartTLSattribute must be set to on.

Additionally, the remote server must be configured to map the farm server's certificate to its bindidentity, as described in Section 12.8.2, “Mapping DNs to Certificates”.

• DIGEST-MD5. This uses SASL authentication with DIGEST-MD5 encryption. As with simpleauthentication, this requires the nsMultiplexorBindDN and nsMultiplexorCredentialsattributes to give the bind information.

Page 72: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

52

This bind mechanism cannot be used with Start TLS (nsUseStartTLS: on) or with a TLS/SSLconnection. The Directory Server does not support SASL over SSL.

• GSSAPI. This uses Kerberos-based authentication over SASL. The farm server must be connectedover the standard port, meaning the URL has ldap, because the Directory Server does not supportSASL/GS-API over SSL.

The farm server must be configured with a Kerberos keytab, and the remote server must have adefined SASL mapping for the farm server's bind identity. Setting up Kerberos keytabs and SASLmappings is described in Chapter 13, Managing SASL.

This bind mechanism cannot be used with Start TLS (nsUseStartTLS: on) or with a TLS/SSLconnection. The Directory Server does not support SASL over SSL.

For example:

nsBindMechanism: EXTERNAL

NOTEIf SASL is used, then the local server must also be configured to chain the SASL andpassword policy components. Add the components for the database link configuration, asdescribed in Section 2.3.2, “Configuring the Chaining Policy”. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=config,cn=chaining database,cn=plugins,cn=configchangetype: modifyadd: nsActiveChainingComponentsnsActiveChainingComponents: cn=password policy,cn=components,cn=config-add: nsActiveChainingComponentsnsActiveChainingComponents: cn=sasl,cn=components,cn=config^D

2.3.1.2.6. Summary of Database Link Configuration AttributesThe following table lists the attributes available for configuring a database link. Some of theseattributes were discussed in the earlier sections. All instance attributes are defined in thecn=database_link, cn=chaining database,cn=plugins,cn=config entry.

Values defined for a specific database link take precedence over the global attribute value.

Attributes Value

nsTransmittedControls † Gives the OID of LDAP controls forwarded by thedatabase link to the remote data server.

nsslapd-suffix The suffix managed by the database link. Anychanges to this attribute after the entry hasbeen created take effect only after the servercontaining the database link is restarted.

Page 73: Red Hat Directory Server 5.1

Creating a New Database Link

53

Attributes Value

nsslapd-timelimit Default search time limit for the database link,given in seconds. The default value is 3600seconds.

nsslapd-sizelimit Default size limit for the database link, given innumber of entries. The default value is 2000entries.

nsFarmServerURL Gives the LDAP URL of the remote server(or farm server) that contains the data. Thisattribute can contain optional servers for failover,separated by spaces. If using cascadingchaining, this URL can point to another databaselink.

nsUseStartTLS Sets whether to use Start TLS to establisha secure connection over a standard port.The default is off, which is used for bothsimple (standard) connections and TLS/SSL connections. This cannot be used withSASL authentication methods (set in thensBindMechanism attribute).

nsBindMethod Sets the authentication method to use toauthenticate (bind) to the remote server.The default, if this attribute is not given,is to authenticate using a simple bind,requiring the nsMultiplexorBindDN andnsMultiplexorCredentials attributes forthe bind information.null; this is a simple bind.EXTERNAL (certificate-based); certificatemapping must be enabled for this.DIGEST-MD5 (SASL); this cannot occur overan SSL/TLS or Start TLS connection and, like asimple bind, requires the bind DN and password.GSSAPI (SASL); this requires the keytab to beconfigured on the local server and SASL identitymapping on the remote server.

nsMultiplexorBindDN DN of the administrative entry used tocommunicate with the remote server. The termmultiplexor in the name of the attributemeans the server which contains the databaselink and communicates with the remote server.This bind DN cannot be the Directory Manager.If this attribute is not specified, the database linkbinds as anonymous.

nsMultiplexorCredentials Password for the administrative user, givenin plain text. If no password is provided, itmeans that users can bind as anonymous. Thepassword is encrypted in the configuration file.

Page 74: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

54

Attributes Value

nsCheckLocalACI Reserved for advanced use only. Controlswhether ACIs are evaluated on the databaselink as well as the remote data server. Takes thevalues on or off. Changes to this attribute occuronly after the server has been restarted. Thedefault value is off.

nsProxiedAuthorization Reserved for advanced use only. Disablesproxied authorization. A value of off meansproxied authorization is disabled. The defaultvalue is on.

nsActiveChainingComponents† Lists the components using chaining. Acomponent is any functional unit in the server.The value of this attribute in the databaselink instance overrides the value in the globalconfiguration attribute. To disable chaining ona particular database instance, use the valuenone. The default policy is not to allow chaining.For more information, see Section 2.3.2.1,“Chaining Component Operations”.

nsReferralOnScopedSearch Controls whether referrals are returned byscoped searches. This attribute is for optimizingthe directory because returning referrals inresponse to scoped searches is more efficient.Takes the values on or off. The default value isoff.

nsHopLimit Maximum number of times a request can beforwarded from one database link to another.The default value is 10.

Can be both a global and instance attribute. This global configuration attribute is located in the cn=config, cn=chainingdatabase,cn=plugins,cn=config entry. The global attributes are dynamic, meaning any changes made to themautomatically take effect on all instances of the database link within the directory.

Table 2.2. Database Link Configuration Attributes

2.3.1.2.7. Database Link Configuration ExampleSuppose a server within the us.example.com domain contains the subtree l=WallaWalla,ou=people,dc=example,dc=com on a database and that operation requests for thel=Zanzibar,ou=people,dc=example,dc=com subtree should be chained to a different server inthe africa.example.com domain.

Page 75: Red Hat Directory Server 5.1

Creating a New Database Link

55

1. Run ldapmodify1 to add a database link to Server A:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Specify the configuration information for the database link:

dn: cn=DBLink1,cn=chaining database,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsBackendInstance nsslapd-suffix: c=africa,ou=people,dc=example,dc=comnsfarmserverurl: ldap://africa.example.com:389/ nsmultiplexorbinddn: cn=proxy admin,cn=config nsmultiplexorcredentials: secret cn: DBLink1

dn: cn="c=africa,ou=people,dc=example,dc=com",cn=mapping tree,cn=configobjectclass: topobjectclass: extensibleObjectobjectclass: nsMappingTreensslapd-state: backendnsslapd-backend: DBLink1nsslapd-parent-suffix: "ou=people,dc=example,dc=com"cn: "c=africa,ou=people,dc=example,dc=com"

Page 76: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

56

In the first entry, the nsslapd-suffix attribute contains the suffix on Server B to which to chainfrom Server A. The nsFarmServerURL attribute contains the LDAP URL of Server B.

The second entry creates a new suffix, allowing the server to route requests made to the newdatabase link. The cn attribute contains the same suffix specified in the nsslapd-suffixattribute of the database link. The nsslapd-backend attribute contains the name of thedatabase link. The nsslapd-parent-suffix attribute specifies the parent of this new suffix,"ou=people,dc=example,dc=com".

3. Create an administrative user on Server B, as follows:

dn: cn=proxy admin,cn=configobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: proxy adminsn: proxy adminuserPassword: secretdescription: Entry for use by database links

WARNINGDo not use the Directory Manager user as the proxy administrative user on the remoteserver. This creates a security hole.

4. Add the following proxy authorization ACI to thel=Zanzibar,ou=people,dc=example,dc=com entry on Server B:

aci: (targetattr = "*")(version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap:///cn=proxy admin,cn=config";)

This ACI gives the proxy admin user read-only access to the data contained on the remote serverwithin the l=Zanzibar,ou=people,dc=example,dc=com subtree only.

NOTEWhen a user binds to a database link, the user's identity is sent to the remote server.Access controls are always evaluated on the remote server. For the user to modify orwrite data successfully to the remote server, set up the correct access controls on theremote server. For more information about how access controls are evaluated in thecontext of chained operations, see Section 2.3.6, “Database Links and Access ControlEvaluation”.

2.3.2. Configuring the Chaining PolicyThese procedures describe configuring how Directory Server chains requests made by clientapplications to Directory Servers that contain database links. This chaining policy applies to alldatabase links created on Directory Server.

Page 77: Red Hat Directory Server 5.1

Configuring the Chaining Policy

57

2.3.2.1. Chaining Component OperationsA component is any functional unit in the server that uses internal operations. For example, plug-insare considered to be components, as are functions in the front-end. However, a plug-in may actuallybe comprised of multiple components (for example, the ACI plug-in).

Some components send internal LDAP requests to the server, expecting to access local data only. Forsuch components, control the chaining policy so that the components can complete their operationssuccessfully. One example is the certificate verification function. Chaining the LDAP request made bythe function to check certificates implies that the remote server is trusted. If the remote server is nottrusted, then there is a security problem.

By default, all internal operations are not chained and no components are allowed to chain, althoughthis can be overridden.

Additionally, an ACI must be created on the remote server to allow the specified plug-in to perform itsoperations on the remote server. The ACI must exist in the suffix assigned to the database link.

The following table lists component names, the potential side-effects of allowing them to chain internaloperations, and the permissions they need in the ACI on the remote server:

Component Name Description Permissions

ACI plug-in This plug-in implements accesscontrol. Operations usedto retrieve and update ACIattributes are not chainedbecause it is not safe to mixlocal and remote ACI attributes.However, requests used toretrieve user entries maybe chained by setting thechaining components attribute,nsActiveChainingComponents:cn=ACIPlugin,cn=plugins,cn=config.

Read, search, and compare

Resource limit component This component sets serverlimits depending on the userbind DN. Resource limitscan be applied on remoteusers if the resource limitationcomponent is allowed tochain. To chain resource limitcomponent operations, add thechaining component attribute,nsActiveChainingComponents:cn=resourcelimits,cn=components,cn=config.

Read, search, and compare

Certificate-based authenticationchecking component

This component is used whenthe external bind method isused. It retrieves the usercertificate from the databaseon the remote server. Allowing

Read, search, and compare

Page 78: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

58

Component Name Description Permissionsthis component to chain meanscertificate-based authenticationcan work with a database link.To chain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=certificate-basedauthentication,cn=components,cn=config.

Password policy component This component is usedto allow SASL binds to theremote server. Some formsof SASL authenticationrequire authenticating witha username and password.Enabling the passwordpolicy allows the server toverify and implement thespecific authentication methodrequested and to apply theappropriate password policies.To chain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=passwordpolicy,cn=components,cn=config.

Read, search, and compare

SASL component This component is usedto allow SASL binds tothe remote server. Tochain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=passwordpolicy,cn=components,cn=config.

Read, search, and compare

Referential Integrity plug-in This plug-in ensures thatupdates made to attributescontaining DNs are propagatedto all entries that containpointers to the attribute.For example, when anentry that is a member of agroup is deleted, the entryis automatically removedfrom the group. Using thisplug-in with chaining helpssimplify the managementof static groups when the

Read, write, search, andcompare

Page 79: Red Hat Directory Server 5.1

Configuring the Chaining Policy

59

Component Name Description Permissionsgroup members are remoteto the static group definition.To chain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=referential integritypostoperation,cn=plugins,cn=config.

Attribute Uniqueness plug-in This plug-in checks that all thevalues for a specified attributeare unique (no duplicates).If this plug-in is chained, itconfirms that attribute valuesare unique even on attributeschanged through a databaselink. To chain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=attributeuniqueness,cn=plugins,cn=config

Read, search, and compare

Roles component This component chains theroles and roles assignmentsfor the entries in a database.Chaining this componentmaintains the roles evenon chained databases. Tochain this component'soperations, add the chainingcomponent attribute,nsActiveChainingComponents:cn=roles,cn=components,cn=config.

Read, write, search, andcompare

Table 2.3. Components Allowed to Chain

NOTEThe following components cannot be chained:

• Roles plug-in

• Password policy component

• Replication plug-ins

• Referential Integrity plug-in

When enabling the Referential Integrity plug-in on servers issuing chaining requests,be sure to analyze performance, resource, and time needs as well as integrity needs.Integrity checks can be time-consuming and draining on memory and CPU. For further

Page 80: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

60

information on the limitations surrounding ACIs and chaining, see Section 6.1.4, “ACILimitations”.

2.3.2.1.1. Chaining Component Operations Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Expand Data in the left pane, and click Database Link Settings.

3. Select the Settings tab in the right window.

4. Click the Add button in the Components allowed to chain section.

5. Select the component to chain from the list, and click OK.

6. Restart the server in order for the change to take effect.

Page 81: Red Hat Directory Server 5.1

Configuring the Chaining Policy

61

After allowing the component to chain, create an ACI in the suffix on the remote server to which theoperation will be chained. For example, this creates an ACI for the Referential Integrity plug-in:

aci: (targetattr "*")(target="ldap:///ou=customers,l=us,dc=example,dc=com") (version 3.0; acl "RefInt Access for chaining"; allow (read,write,search,compare) userdn = "ldap:///cn=referential integrity postoperation,cn=plugins,cn=config";)

2.3.2.1.2. Chaining Component Operations from the Command Line1. Specify components to include in chaining using the nsActiveChainingComponents

attribute in the cn=config,cn=chaining database,cn=plugins,cn=config entry of theconfiguration file.

For example, to allow the referential integrity component to chain operations, add the following tothe database link configuration file:

nsActiveChainingComponents: cn=referential integrity postoperation,cn=components,cn=config

See Table 2.3, “Components Allowed to Chain” for a list of the components which can be chained.

2. Restart the server for the change to take effect. 2

service dirsrv restart instance

3. Create an ACI in the suffix on the remote server to which the operation will be chained. Forexample, this creates an ACI for the Referential Integrity plug-in:

aci: (targetattr "*")(target="ldap:///ou=customers,l=us,dc=example,dc=com") (version 3.0; acl "RefInt Access for chaining"; allow (read,write,search,compare) userdn = "ldap:///cn=referential integrity postoperation,cn=plugins,cn=config";)

2.3.2.2. Chaining LDAP ControlsIt is possible to not chain operation requests made by LDAP controls. By default, requests made bythe following controls are forwarded to the remote server by the database link:

• Virtual List View (VLV). This control provides lists of parts of entries rather than returning all entryinformation.

• Server-side sorting. This control sorts entries according to their attribute values.

• Managed DSA. This controls returns smart referrals as entries, rather than following the referral, sothe smart referral itself can be changed or deleted.

• Loop detection. This control keeps track of the number of times the server chains with anotherserver. When the count reaches the configured number, a loop is detected, and the client applicationis notified. For more information about using this control, see Section 2.4.4, “Detecting Loops”.

Page 82: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

62

NOTEServer-side sorting and VLV controls are supported only when a client application requestis made to a single database. Database links cannot support these controls when a clientapplication makes a request to multiple databases.

2.3.2.2.1. Chaining LDAP Controls Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Expand the Data folder in the left pane, and click Database Link Settings.

3. Select the Settings tab in the right window.

4. Click the Add button in the LDAP Controls forwarded by the database link section to add anLDAP control to the list.

5. Select the OID of a control to add to the list, and click OK.

Page 83: Red Hat Directory Server 5.1

Maintaining Database Links

63

2.3.2.2.2. Chaining LDAP Controls from the Command LineAlter the controls that the database link forwards by changing the nsTransmittedControlsattribute of the cn=config,cn=chaining database, cn=plugins,cn=config entry. Forexample, to forward the virtual list view control, add the following to the database link entry in theconfiguration file:

nsTransmittedControls: 2.16.840.1.113730.3.4.9

In addition, if clients of the Directory Server create their own controls and their operations should tobe chained to remote servers, add the OID of the custom control to the nsTransmittedControlsattribute.

The LDAP controls which can be chained and their OIDs are listed in the following table:

Control Name OID

Virtual list view (VLV) 2.16.840.1.113730.3.4.9

Server-side sorting 1.2.840.113556.1.4.473

Managed DSA 2.16.840.1.113730.3.4.2

Loop detection 1.3.6.1.4.1.1466.29539.12

Table 2.4. LDAP Controls and Their OIDs

For more information about LDAP controls, refer to the LDAP C-SDK documentation at http://www.mozilla.org/directory.

2.3.3. Maintaining Database LinksAll of the information for the database link for the connection to the remote server.

1. In the Directory Server Console, select the Configuration tab.

2. In the left pane, expand the Data folder, and select the database link under the suffix.

3. In the right navigation pane, click the Authentication tab.

Page 84: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

64

4. Change the connection information.

• The LDAP URL for the remote server.3

• The bind DN and password used by the database link to bind to the remote server.

2.3.4. Configuring Database Link DefaultsConfiguring the default settings for database links defines the settings used for cascading chaining(the number of hops allowed for a client request), the connection rules for the remote server, and howthe server responds to client requests.

1. Select the Configuration tab.

2. Expand the Data folder in the left pane, and click Database Link Settings. Open the DefaultCreation Parameters tab.

3. Fill in the new configuration parameters.

Page 85: Red Hat Directory Server 5.1

Deleting Database Links

65

NOTEChanges made to the default settings of a database link are not applied retroactively. Onlythe database links created after changes are made to the default settings will reflect thechanges.

2.3.5. Deleting Database LinksTo delete a database link, right-click the database link, and select Delete from the pop-up menu.Confirm the delete when prompted.

1. In the Directory Server Console, select the Configuration tab.

2. Under Data in the left navigation pane, open the suffix and select the database link to delete.

3. Right-click the database link, and select Delete from the menu.

Page 86: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

66

2.3.6. Database Links and Access Control EvaluationWhen a user binds to a server containing a database link, the database link sends the user's identity tothe remote server. Access controls are always evaluated on the remote server. Every LDAP operationevaluated on the remote server uses the original identity of the client application passed via theproxied authorization control. Operations succeed on the remote server only if the user has the correctaccess controls on the subtree contained on the remote server. This requires adding the usual accesscontrols to the remote server with a few restrictions:

• Not all types of access control can be used.

For example, role-based or filter-based ACIs need access to the user entry. Because the dataare accessed through database links, only the data in the proxy control can be verified. Considerdesigning the directory in a way that ensures the user entry is located in the same database as theuser's data.

• All access controls based on the IP address or DNS domain of the client may not work since theoriginal domain of the client is lost during chaining. The remote server views the client application asbeing at the same IP address and in the same DNS domain as the database link.

NOTEDirectory Server supports both IPv4 and IPv6 IP addresses.

The following restrictions apply to the ACIs used with database links:

• ACIs must be located with any groups they use. If the groups are dynamic, all users in the groupmust be located with the ACI and the group. If the group is static, it may refer to remote users.

Page 87: Red Hat Directory Server 5.1

Tuning Database Link Performance

67

• ACIs must be located with any role definitions they use and with any users intended to have thoseroles.

• ACIs that refer to values of a user's entry (for example, userattr subject rules) will work if the useris remote.

Though access controls are always evaluated on the remote server, they can also be evaluated onboth the server containing the database link and the remote server. This poses several limitations:

• During access control evaluation, contents of user entries are not necessarily available (forexample, if the access control is evaluated on the server containing the database link and the entryis located on a remote server).

For performance reasons, clients cannot do remote inquiries and evaluate access controls.

• The database link does not necessarily have access to the entries being modified by the clientapplication.

When performing a modify operation, the database link does not have access to the full entry storedon the remote server. If performing a delete operation, the database link is only aware of the entry'sDN. If an access control specifies a particular attribute, then a delete operation will fail when beingconducted through a database link.

NOTEBy default, access controls set on the server containing the database link are notevaluated. To override this default, use the nsCheckLocalACI attribute in thecn=database_link, cn=chaining database,cn=plugins,cn=config entry.However, evaluating access controls on the server containing the database link is notrecommended except with cascading chaining.

2.3.7. Tuning Database Link PerformanceThe following sections provide information on tuning the performance of database links throughconnection and thread management.

• Section 2.3.7.1, “Managing Connections to the Remote Server”

• Section 2.3.7.2, “Detecting Errors During Normal Processing”

• Section 2.3.7.3, “Managing Threaded Operations”

2.3.7.1. Managing Connections to the Remote ServerEach database link maintains a pool of connections to a remote server. The connections to optimizeresources can be configured for the directory.

2.3.7.1.1. Managing Connections to the Remote Server Using the Console1. Select the Configuration tab, expand the Data folder in the left pane, and select the suffix, then

the database link to change.

Page 88: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

68

2. Click the Limits and Controls tab in the right navigation pane.

3. In the Connection Management section, make changes to any of the following fields:

• Maximum TCP connection(s). The maximum number of TCP connections that the database linkestablishes with the remote server. The default value is 3 connections.

• Bind timeout. Amount of time, in seconds, before the database link's bind attempt times out. Thedefault value is 15 seconds.

• Maximum binds per connection. Maximum number of outstanding bind operations per TCPconnection. The default value is 10 outstanding bind operations per connection.

Page 89: Red Hat Directory Server 5.1

Tuning Database Link Performance

69

• Time out before abandon (sec). Number of seconds before the server checks to see if a timed-out connection should be abandoned. The default value is 1 second.

• Maximum LDAP connection(s). Maximum number of LDAP connections that the database linkestablishes with the remote server. The default value is 10 connections.

• Maximum bind retries. Number of times a database link attempts to bind to the remote server.A value of 0 indicates that the database link will try to bind only once. The default value is 3attempts.

• Maximum operations per connection. Maximum number of outstanding operations per LDAPconnection. The default value is 2 operations per connection.

• Connection lifetime (sec). How long a connection made between the database link and remoteserver remains open. Connections between the database link and the remote server can bekept open for an unspecified time or closed after a specific period of time. It is faster to keep theconnections open, but it uses more resources. For slow connections, it may be desirable to limitthe connection time. A value of 0 indicates there is no limit. By default, the value is set to 0.

2.3.7.1.2. Managing Connections to the Remote Server from the Command LineUse ldapmodify to add connection attributes to the database link entry.

The default connection management attributes are stored in the following entry:

cn=default instance config,cn=chaining database,cn=plugins,cn=config

The connection management attributes for a specific database link are stored in the following entry:

cn=database_link,cn=chaining database,cn=plugins,cn=config

The connection management attributes specified in this entry take precedence over the attributesspecified in the cn=default instance config entry.

Attribute Name Description

nsOperationConnectionsLimit Maximum number of LDAP connections thatthe database link establishes with the remoteserver. The default value is 20 connections perdatabase link instance.

nsBindConnectionsLimit Maximum number of TCP connections that thedatabase link establishes with the remote server.The default value is 3 connections.

nsConcurrentOperationsLimit Maximum number of outstanding operationsper LDAP connection. The default value is 2operations per connection.

nsConcurrentBindLimit Maximum number of outstanding bind operationsper TCP connection. The default value is 10outstanding bind operations.

nsBindRetryLimit Number of times a database link attempts tobind to the remote server. A value of zero (0)

Page 90: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

70

Attribute Name Descriptionindicates that the database link will try to bindonly once. The default value is 3 attempts.

nsConnectionLife Connection lifetime, in seconds. Connectionsbetween the database link and the remoteserver can be kept open for an unspecifiedtime or closed after a specific period of time.It is faster to keep the connections open, butit uses more resources. For example, it maybe wise to limit the connection time for a slowconnection. A value of 0 indicates there is nolimit. By default, the value is set to 0. When thevalue is 0 and there is a list of failover servers inthe nsFarmServerURL attribute, the first serveris never contacted after failover to the alternateserver. The default value is 0 seconds.

nsBindTimeout Amount of time, in seconds, before the bindattempt times out. The default value is 15seconds.

nsAbandonedSearchCheckInterval Number of seconds that pass before the serverchecks for abandoned operations. The defaultvalue is 1 second.

Table 2.5. Database Link Connection Management Attributes

For the list of database link configuration attributes, see Table 2.2, “Database Link ConfigurationAttributes”.

2.3.7.2. Detecting Errors During Normal ProcessingProtect server performance by detecting errors during the normal chaining operation between thedatabase link and the remote server. The database link has two attributes — nsMaxResponseDelayand nsMaxTestResponseDelay — which work together to determine if the remote server is nolonger responding.

The first attribute, nsMaxResponseDelay, sets a maximum duration for an LDAP operation tocomplete. If the operation takes more than the amount of time specified in this attribute, the databaselink's server suspects that the remote server is no longer online.

Once the nsMaxResponseDelay period has been met, the database link pings the remoteserver. During the ping, the database link issues another LDAP request, a simple search requestfor an object that does not exist in the remote server. The duration of the ping is set using thensMaxTestResponseDelay.

If the remote server does not respond before the nsMaxTestResponseDelay period has passed,then an error is returned, and the connection is flagged as down. All connections between thedatabase link and remote server will be blocked for 30 seconds, protecting the server from aperformance degradation. After 30 seconds, operation requests made by the database link to theremote server continue as normal.

Both attributes are stored in the cn=config,cn=chaining database,cn=plugins,cn=configentry. The following table describes the attributes in more detail:

Page 91: Red Hat Directory Server 5.1

Configuring Cascading Chaining

71

Attribute Name Description

nsMaxResponseDelay Maximum amount of time it can take a remoteserver to respond to an LDAP operation requestmade by a database link before an error issuspected. This period is given in seconds. Thedefault delay period is 60 seconds. Once thisdelay period has been met, the database linktests the connection with the remote server.

nsMaxTestResponseDelay Duration of the test issued by the databaselink to check whether the remote server isresponding. If a response from the remote serveris not returned before this period has passed,the database link assumes the remote serveris down, and the connection is not used forsubsequent operations. This period is given inseconds. The default test response delay periodis 15 seconds.

Table 2.6. Database Link Processing Error Detection Parameters

2.3.7.3. Managing Threaded OperationsGenerally, Directory Server performs best using a limited number of threads for processing operations.A limited number of threads can generally process operations very quickly, preventing the queue ofoperations waiting for a free thread from growing too long.

However, the database link forwards operations to remote servers for processing. The database linkcontacts the remote server, forwards the operation, waits for the result, and then sends the result backto the client application. The entire operation can take much longer than a local operation.

While the database link waits for results from the remote server, it can process additional operations.By default, the number of threads used by the server is 30. However, when using database links,performance can be improved by increasing the number of threads available for processingoperations. While the local CPU waits for a response from a remote server, it can process otheroperations rather than stand idle.

To change the number of threads used for processing operations, change the nsslapd-threadnumber global configuration attribute in the cn=config entry. Increasing the thread numbercan improve performance; the default thread number is 30. Restart the server after changing thethread count to apply the changes.

2.4. Configuring Cascading ChainingThe database link can be configured to point to another database link, creating a cascading chainingoperation. A cascading chain occurs any time more than one hop is required to access all of the datain a directory tree.

• Section 2.4.1, “Overview of Cascading Chaining”

• Section 2.4.2, “Configuring Cascading Chaining Using the Console”

• Section 2.4.3, “Configuring Cascading Chaining from the Command Line”

Page 92: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

72

• Section 2.4.4, “Detecting Loops”

• Section 2.4.5, “Summary of Cascading Chaining Configuration Attributes”

• Section 2.4.6, “Cascading Chaining Configuration Example”

2.4.1. Overview of Cascading ChainingCascading chaining occurs when more than one hop is required for the directory to process a clientapplication's request.

The client application sends a modify request to Server 1. Server one contains a database link thatforwards the operation to Server 2, which contains another database link. The database link on Server2 forwards the operations to server three, which contains the data the clients wants to modify in adatabase. Two hops are required to access the piece of data the client want to modify.

During a normal operation request, a client binds to the server, and then any ACIs applying to thatclient are evaluated. With cascading chaining, the client bind request is evaluated on Server 1, but theACIs applying to the client are evaluated only after the request has been chained to the destinationserver, in the above example Server 2.

For example, on Server A, a directory tree is split:

Page 93: Red Hat Directory Server 5.1

Overview of Cascading Chaining

73

The root suffix dc=example,dc=comand the ou=people and ou=groups sub suffixes are stored onServer A. The l=europe,dc=example,dc=com and ou=groups suffixes are stored in on Server B,and the ou=people branch of the l=europe,dc=example,dc=com suffix is stored on Server C.

With cascading configured on servers A, B, and C, a client request targeted at theou=people,l=europe,dc=example,dc=com entry would be routed by the directory as follows:

Page 94: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

74

First, the client binds to Server A and chains to Server B using Database Link 1. Then ServerB chains to the target database on Server C using Database Link 2 to access the data in theou=people,l=europe,dc=example,dc=com branch. Because at least two hops are required forthe directory to service the client request, this is considered a cascading chain.

2.4.2. Configuring Cascading Chaining Using the Console1. Select the Configuration tab. Expand the Data folder in the left pane, and select the suffix, then

the database link.

Page 95: Red Hat Directory Server 5.1

Configuring Cascading Chaining from the Command Line

75

2. Click the Limits and Controls tab in the right navigation pane.

3. Select the Check local ACI checkbox to enable the evaluation of local ACIs on the intermediatedatabase links involved in the cascading chain. Selecting this checkbox may require adding theappropriate local ACIs to the database link.

4. Enter the maximum number of times a database link can point to another database link in theMaximum hops field.

By default, the maximum is ten hops. After ten hops, a loop is detected by the server, and an erroris returned to the client application.

2.4.3. Configuring Cascading Chaining from the Command LineTo configure a cascade of database links through the command line:

1. Point one database link to the URL of the server containing the intermediate database link.

To create a cascading chain, the nsFarmServerURL attribute of one database link must containthe URL of the server containing another database link. Suppose the database link on the server

Page 96: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

76

called example1.com points to a database link on the server called africa.example.com. Forexample, the cn=database_link, cn=chaining database, cn=plugins,cn=config entry ofthe database link on Server 1 would contain the following:

nsFarmServerURL: ldap://africa.example.com:389/

2. Configure the intermediate database link or links (in the example, Server 2) to transmit the ProxyAuthorization Control.

By default, a database link does not transmit the Proxy Authorization Control. However, whenone database link contacts another, this control is used to transmit information needed bythe final destination server. The intermediate database link needs to transmit this control. Toconfigure the database link to transmit the proxy authorization control, add the following to thecn=config,cn=chaining database,cn=plugins,cn=config entry of the intermediatedatabase link:

nsTransmittedControls: 2.16.840.1.113730.3.4.12

The OID value represents the Proxy Authorization Control. For more information about chainingLDAP controls, see Section 2.3.2.2, “Chaining LDAP Controls”.

3. Create a proxy administrative user ACI on all intermediate database links.

The ACI must exist on the server that contains the intermediate database link that checks therights of the first database link before translating the request to another server. For example, ifServer 2 does not check the credentials of Server 1, then anyone could bind as anonymous andpass a proxy authorization control allowing them more administrative privileges than appropriate.The proxy ACI prevents this security breach.

a. Create a database, if one does not already exist, on the server containing the intermediatedatabase link. This database will contain the admin user entry and the ACI. For informationabout creating a database, see Section 2.2.1, “Creating Databases”.

b. Create an entry that corresponds to the administrative user in the database.

c. Create an ACI for the administrative user that targets the appropriate suffix. This ensures theadministrator has access only to the suffix of the database link. For example:

aci: (targetattr = "*")(version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap:///cn=proxy admin,cn=config";)

This ACI is like the ACI created on the remote server when configuring simple chaining.

WARNINGCarefully examine access controls when enabling chaining to avoid giving access torestricted areas of the directory. For example, if a default proxy ACI is created on abranch, the users that connect through the database link will be able to see all entriesbelow the branch. There may be cases when not all of the subtrees should be viewedby a user. To avoid a security hole, create an additional ACI to restrict access to thesubtree.

Page 97: Red Hat Directory Server 5.1

Detecting Loops

77

4. Enable local ACI evaluation on all intermediate database links.

To confirm that the proxy administrative ACI is used, enable evaluation of local ACIs onall intermediate database links involved in chaining. Add the following attribute to thecn=database_link, cn=chaining database,cn=plugins,cn=config entry of eachintermediate database link:

nsCheckLocalACI: on

Setting this attribute to on in the cn=default instance config,cn=chainingdatabase,cn=plugins,cn=config entry means that all new database link instances willhave the nsCheckLocalACI attribute set to on in their cn=database_link, cn=chainingdatabase,cn=plugins,cn=config entry.

5. Create client ACIs on all intermediate database links and the final destination database.

Because local ACI evaluation is enabled, the appropriate client application ACIs must be createdon all intermediate database links, as well as the final destination database. To do this on theintermediate database links, first create a database that contains a suffix that represents a rootsuffix of the final destination suffix.

For example, if a client request made to the c=africa,ou=people,dc=example,dc=comsuffix is chained to a remote server, all intermediate database links need to contain a databaseassociated with the dc=example,dc=com suffix.

Add any client ACIs to this superior suffix entry. For example:

aci: (targetattr = "*")(version 3.0; acl "Client authentication for database link users"; allow (all) userdn = "ldap:///uid=* ,cn=config";)

This ACI allows client applications that have a uid in the cn=config entry of Server 1 to performany type of operation on the data below the ou=people,dc=example,dc=com suffix on serverthree.

2.4.4. Detecting LoopsAn LDAP control included with Directory Server prevents loops. When first attempting to chain, theserver sets this control to be the maximum number of hops, or chaining connections, allowed. Eachsubsequent server decrements the count. If a server receives a count of 0, it determines that a loophas been detected and notifies the client application.

The number of hops allowed is defined using the nsHopLimit attribute. If not specified, the defaultvalue is 10.

To use the control, add the following OID to the nsTransmittedControl attribute in thecn=config,cn=chaining database,cn=plugins,cn=config entry:

nsTransmittedControl: 1.3.6.1.4.1.1466.29539.12

If the control is not present in the configuration file of each database link, loop detection will not beimplemented.

Page 98: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

78

2.4.5. Summary of Cascading Chaining Configuration AttributesThe following table describes the attributes used to configure intermediate database links in acascading chain:

Attribute Description

nsFarmServerURL URL of the server containing the next databaselink in the cascading chain.

nsTransmittedControls Enter the following OIDs to the database linksinvolved in the cascading chain:

nsTransmittedControls: 2.16.840.1.113730.3.4.12 nsTransmittedControls: 1.3.6.1.4.1.1466.29539.12

The first OID corresponds to the ProxyAuthorization Control. The second OIDcorresponds to the Loop Detection Control.

aci This attribute must contain the following ACI:

aci: (targetattr = "*")(version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap:///cn=proxy admin,cn=config";)

nsCheckLocalACI To enable evaluation of local ACIs on alldatabase links involved in chaining, turn localACI evaluation on, as follows:

nsCheckLocalACI: on

Table 2.7. Cascading Chaining Configuration Attributes

2.4.6. Cascading Chaining Configuration ExampleTo create a cascading chain involving three servers as in the diagram below, the chaining componentsmust be configured on all three servers.

Page 99: Red Hat Directory Server 5.1

Cascading Chaining Configuration Example

79

• Section 2.4.6.1, “Configuring Server One”

• Section 2.4.6.2, “Configuring Server Two”

• Section 2.4.6.3, “Configuring Server Three”

2.4.6.1. Configuring Server One1. Run ldapmodify1:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Then specify the configuration information for the database link, DBLink1, on Server 1, as follows:

Page 100: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

80

dn: cn=DBLink1,cn=chaining database,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsBackendInstance nsslapd-suffix: c=africa,ou=people,dc=example,dc=comnsfarmserverurl: ldap://africa.example.com:389/ nsmultiplexorbinddn: cn=server1 proxy admin,cn=config nsmultiplexorcredentials: secret cn: DBLink1 nsCheckLocalACI:off

dn: cn="c=africa,ou=people,dc=example,dc=com",cn=mapping tree,cn=configobjectclass: nsMappingTreensslapd-state: backendnsslapd-backend: DBLink1nsslapd-parent-suffix: "ou=people,dc=example,dc=com"cn: "c=africa,ou=people,dc=example,dc=com"

The first section creates the entry associated with DBLink1. The second section creates a newsuffix, allowing the server to direct requests made to the database link to the correct server. ThensCheckLocalACI attribute does not need to be configured to check local ACIs, as this is onlyrequired on the database link, DBLink2, on Server 2.

3. To implement loop detection, to specify the OID of the loop detection control inthe nsTransmittedControl attribute stored in cn=config,cn=chainingdatabase,cn=plugins,cn=config entry on Server 1.

dn: cn=config,cn=chaining database,cn=plugins,cn=config changetype: modify add: nsTransmittedControl nsTransmittedControl: 1.3.6.1.4.1.1466.29539.12

As the nsTransmittedControl attribute is usually configured by default with the loop detectioncontrol OID 1.3.6.1.4.1.1466.29539.12 value, it is wise to check beforehand whether italready exists. If it does exist, this step is not necessary.

2.4.6.2. Configuring Server Two1. Create a proxy administrative user on Server 2. This administrative user will be used to allow

Server 1 to bind and authenticate to Server 2. It is useful to choose a proxy administrative username which is specific to Server 1, as it is the proxy administrative user which will allow serverone to bind to Server 2. Create the proxy administrative user, as follows:

dn: cn=server1 proxy admin,cn=configobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: server1 proxy adminsn: server1 proxy adminuserPassword: secretdescription: Entry for use by database links

Page 101: Red Hat Directory Server 5.1

Cascading Chaining Configuration Example

81

WARNINGDo not use the Directory Manager or Administrator ID user as the proxy administrativeuser on the remote server. This creates a security hole.

2. Configure the database link, DBLink2, on Server 2, using ldapmodify:

dn: cn=DBLink2,cn=chaining database,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsBackendInstance nsslapd-suffix: l=Zanzibar,c=africa,ou=people,dc=example,dc=comnsfarmserverurl: ldap://zanz.africa.example.com:389/ nsmultiplexorbinddn: cn=server2 proxy admin,cn=config nsmultiplexorcredentials: secret cn: DBLink2 nsCheckLocalACI:on

dn: cn="l=Zanzibar,c=africa,ou=people,dc=example,dc=com",cn=mapping tree,cn=config objectclass: top objectclass: extensibleObject objectclass: nsMappingTree nsslapd-state: backend nsslapd-backend: DBLink2 nsslapd-parent-suffix: "c=africa,ou=people,dc=example,dc=com"cn: "l=Zanzibar,c=africa,ou=people,dc=example,dc=com"

Since database link DBLink2 is the intermediate database link in the cascading chainingconfiguration, set the nsCheckLocalACI attribute to on to allow the server to check whether itshould allow the client and proxy administrative user access to the database link.

3. The database link on Server 2 must be configured to transmit the proxy authorization controland the loop detection control. To implement the proxy authorization control and the loopdetection control, specify both corresponding OIDs. Add the following information to thecn=config,cn=chaining database, cn=plugins,cn=config entry on Server 2:

dn: cn=config,cn=chaining database,cn=plugins,cn=config changetype: modify add: nsTransmittedControl nsTransmittedControl: 2.16.840.1.113730.3.4.12 nsTransmittedControl: 1.3.6.1.4.1.1466.29539.12

nsTransmittedControl: 2.16.840.1.113730.3.4.12 is the OID for the proxyauthorization control. nsTransmittedControl: 1.3.6.1.4.1.1466.29539.12 is the or theloop detection control.

Check beforehand whether the loop detection control is already configured, and adapt the abovecommand accordingly.

4. Configure the ACIs. On Server 2, ensure that a suffix exists above thel=Zanzibar,c=africa,ou=people,dc=example,dc=com suffix, so that the followingactions are possible:

• Add the database link suffix

Page 102: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

82

• Add a local proxy authorization ACI to allow Server 1 to connect using the proxy authorizationadministrative user created on Server 2

• Add a local client ACI so the client operation succeeds on Server 2, and it can be forwarded toserver three. This local ACI is needed because local ACI checking is turned on for the DBLink2database link.

Both ACIs will be placed on the database that contains thec=africa,ou=people,dc=example,dc=com suffix.

NOTETo create these ACIs, the database corresponding to thec=africa,ou=people,dc=example,dc=com suffix must already exist to hold theentry. This database needs to be associated with a suffix above the suffix specified inthe nsslapd-suffix attribute of each database link. That is, the suffix on the finaldestination server should be a sub suffix of the suffix specified on the intermediateserver.

a. Add the local proxy authorization ACI to the c=africa,ou=people,dc=example,dc=comentry:

aci:(targetattr="*")(target="l=Zanzibar,c=africa,ou=people,dc=example,dc=com") (version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap:///cn=server1 proxy admin,cn=config";)

b. Then add the local client ACI that will allow the client operation to succeedon Server 2, given that ACI checking is turned on. This ACI is the sameas the ACI created on the destination server to provide access to thel=Zanzibar,c=africa,ou=people,dc=example,dc=com branch. All users withinc=us,ou=people,dc=example,dc=com may need to have update access to the entries inl=Zanzibar,c=africa,ou=people,dc=example,dc=com on server three. Create thefollowing ACI on Server 2 on the c=africa,ou=people,dc=example,dc=com suffix toallow this:

aci:(targetattr="*")(target="l=Zanzibar,c=africa,ou=people,dc=example,dc=com") (version 3.0; acl "Client authorization for database links"; allow (all) userdn = "ldap:///uid=*,c=us,ou=people,dc=example,dc=com";)

This ACI allows clients that have a UID in c=us,ou=people,dc=example,dc=comon Server 1 to perform any type of operation on thel=Zanzibar,c=africa,ou=people,dc=example,dc=com suffix tree on server three. Ifthere are users on Server 2 under a different suffix that will require additional rights on serverthree, it may be necessary to add additional client ACIs on Server 2.

2.4.6.3. Configuring Server Three1. Create an administrative user on server three for Server 2 to use for proxy authorization:

dn: cn=server2 proxy admin,cn=configobjectclass: person

Page 103: Red Hat Directory Server 5.1

Using Referrals

83

objectclass: organizationalPersonobjectclass: inetOrgPersoncn: server2 proxy adminsn: server2 proxy adminuserPassword: secretdescription: Entry for use by database links

2. Then add the same local proxy authorization ACI to server three as on Server 2. Add the followingproxy authorization ACI to the l=Zanzibar,ou=people,dc=example,dc=com entry:

aci: (targetattr = "*")(version 3.0; acl "Proxied authorization for database links"; allow (proxy) userdn = "ldap:///cn=server2 proxy admin,cn=config";)

This ACI gives the Server 2 proxy admin read-only access to the data contained on the remoteserver, server three, within the l=Zanzibar,ou=people,dc=example,dc=com subtree only.

3. Create a local client ACI on the l=Zanzibar,ou=people,dc=example,dc=com subtree thatcorresponds to the original client application. Use the same ACI as the one created for the clienton Server 2:

aci: (targetattr ="*")(target="l=Zanzibar,c=africa,ou=people,dc=example,dc=com") (version 3.0; acl "Client authentication for database link users"; allow (all) userdn = "ldap:///uid=*,c=us,ou=people,dc=example,dc=com";)

The cascading chaining configuration is now set up. This cascadingconfiguration allows a user to bind to Server 1 and modify information in thel=Zanzibar,c=africa,ou=people,dc=example,dc=com branch on server three. Depending onyour security needs, it may be necessary to provide more detailed access control.

2.5. Using ReferralsReferrals tell client applications which server to contact for a specific piece of information. Thisredirection occurs when a client application requests a directory entry that does not exist on thelocal server or when a database has been taken off-line for maintenance. This section contains thefollowing information about referrals:

• Section 2.5.1, “Starting the Server in Referral Mode”

• Section 2.5.2, “Setting Default Referrals”

• Section 2.5.3, “Creating Smart Referrals”

• Section 2.5.4, “Creating Suffix Referrals”

For conceptual information on how to use referrals in the directory, see the Directory ServerDeployment Guide.

2.5.1. Starting the Server in Referral ModeReferrals are used to redirect client applications to another server while the current server isunavailable or when the client requests information that is not held on the current server.

Page 104: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

84

For example, starting Directory Server in referral mode while there are configuration changes beingmade to the Directory Server will refer all clients to another supplier while that server is unavailable.Starting the Directory Server in referral mode is done with the refer command.

Run nsslapd with the refer option.

/usr/sbin/ns-slapd refer -D /etc/dirsrv/slapd-instance_name [-p port] -r referral_url

• /etc/dirsrv/slapd-instance_name is the directory where the Directory Server configurationfiles are. This is the default location on Red Hat Enterprise Linux 5 (32-bit); for the location on otherplatforms, see Section 1.1, “Directory Server File Locations”.

• port is the optional port number of the Directory Server to start in referral mode.

• referral_url is the referral returned to clients. The format of an LDAP URL is covered in Appendix C,LDAP URLs.

2.5.2. Setting Default ReferralsDefault referrals are returned to client applications that submit operations on a DN not contained withinany of the suffixes maintained by the directory. The following procedures describes setting a defaultreferral for the directory using the console and the command-line utilities.

2.5.2.1. Setting a Default Referral Using the Console1. In the Directory Server Console, select the Configuration tab.

2. Select the top entry in the navigation tree in the left pane.

3. Select the Settings tab in the right pane.

4. Enter an LDAP URL for the referral.

Page 105: Red Hat Directory Server 5.1

Creating Smart Referrals

85

Enter multiple referral URLs separated by spaces and in quotes:

"ldap://dir1.example.com:389/dc=example,dc=com" "ldap://dir2.example.com/"

For more information about LDAP URLs, see Appendix C, LDAP URLs.

2.5.2.2. Setting a Default Referral from the Command Lineldapmodify can add a default referral to the cn=config entry in the directory's configuration file.For example, to add a new default referral from one Directory Server, dir1.example.com, to aserver named dir2.example.com, add a new line to the cn=config entry.

1. Run the ldapmodify utility:1

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

ldapmodify binds to the server and prepares it to change an entry in the configuration file.

2. Add the default referral to the dir2.example.com server:

dn: cn=configchangetype: modifyreplace: nsslapd-referralnsslapd-referral: ldap://dir2.example.com/

After adding the default referral to the cn=config entry of the directory, the directory will return thedefault referral in response to requests made by client applications. The Directory Server does notneed to be restarted.

2.5.3. Creating Smart ReferralsSmart referrals map a directory entry or directory tree to a specific LDAP URL. Using smart referrals,client applications can be referred to a specific server or a specific entry on a specific server.

For example, a client application requests the directory entryuid=jdoe,ou=people,dc=example,dc=com. A smart referral is returned to the client thatpoints to the entry cn=john doe,o=people,l=europe,dc=example,dc=com on the serverdirectory.europe.example.com.

The way the directory uses smart referrals conforms to the standard specified in RFC 2251 section4.1.11. The RFC can be downloaded at http://www.ietf.org/rfc/rfc2251.txt.

2.5.3.1. Creating Smart Referrals Using the Directory Server Console1. In the Directory Server Console, select the Directory tab.

2. Browse through the tree in the left navigation pane, and select the entry for which to add thereferral.

3. Right-click the entry, and select Set Smart Referrals.

Page 106: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

86

4. Select the Enable Smart Referral checkbox. (Unchecking the option removes all smart referralsfrom the entry and deletes the referral object class from the entry.)

Page 107: Red Hat Directory Server 5.1

Creating Smart Referrals

87

5. In the Enter a new Smart Referral field, enter a referral in the LDAP URL format, and then clickAdd. The LDAP URL must be in the following format:

ldap://hostname:portnumber/[optional_dn]

optional_dn is the explicit DN for the server to return to the requesting client application.

Page 108: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

88

Construct opens a wizard to direct the process of adding a referral.

The Smart Referral List lists the referrals currently in place for the selected entry. The entire listof referrals is returned to client applications in response to a request with the Return Referrals forAll Operations or Return Referrals for Update Operations options in the Suffix Settings tab,which is available under the Configuration tab.

To modify the list, click Edit to edit the selected referral or Delete to delete the selected referral.

6. To set the referral to use different authentication credentials, click Authentication, and specify theappropriate DN and password. This authentication remains valid only until the Console is closed;then it's reset to the same authentication used to log into the Console.

Page 109: Red Hat Directory Server 5.1

Creating Smart Referrals

89

2.5.3.2. Creating Smart Referrals from the Command LineUse the ldapmodify command-line utility1 to create smart referrals from the command line.

To create a smart referral, create the relevant directory entry, and add the referral object class.This object class allows a single attribute, ref. The ref attribute must contain an LDAP URL.

For example, add the following to return a smart referral for an existing entry, uid=jdoe:

dn: uid=jdoe,ou=people,dc=example,dc=com objectclass: referralref: ldap://directory.europe.example.com/cn=john%20doe,ou=people,l=europe,dc=example,dc=com

NOTEAny information after a space in an LDAP URL is ignored by the server. For this reason,use %20 instead of spaces in any LDAP URL used as a referral.

To add the entry uid=jdoe,ou=people,dc=example,dc=com with a referral todirectory.europe.example.com, include the following in the LDIF file before importing:

dn: uid=jdoe, ou=people,dc=example,dc=com objectclass: topobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersonobjectclass: referralcn: john doesn: doeuid: jdoeref: ldap://directory.europe.example.com/cn=john%20doe,ou=people, l=europe,dc=example,dc=com

Use the -M option with ldapmodify when there is already a referral in the DN path. For informationabout the ldapmodify utility, see the Directory Server Configuration, Command, and File Reference.

Page 110: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

90

2.5.4. Creating Suffix ReferralsThe following procedure describes creating a referral in a suffix. This means that the suffix processesoperations using a referral rather than a database or database link.

WARNINGWhen a suffix is configured to return referrals, the ACIs contained by the databaseassociated with the suffix are ignored.

2.5.4.1. Creating Suffix Referrals Using the ConsoleReferrals can be used to point a client application temporarily to a different server. For example,adding a referral to a suffix so that the suffix points to a different server allows the database associatedwith the suffix is taken off-line for maintenance without affecting the users of the Directory Serverdatabase.

To set referrals in a suffix:

1. In the Directory Server Console, select the Configuration tab.

2. Under Data in the left pane, select the suffix for which to add a referral.

3. Click the Suffix Settings tab, and select the Return Referrals for ... Operations radio button.

Selecting Return Referrals for Update Operations means that the directory redirects onlyupdate and write requests to a read-only database. For example, there may be a local copy ofdirectory data, and that data should be available for searches but not for updates, so it's replicatedacross several servers. Enabling referrals for that Directory Server only for update requests meansthat when a client asks to update an entry, the client is referred to the server that owns the data,where the modification request can proceed.

Page 111: Red Hat Directory Server 5.1

Creating Suffix Referrals

91

4. Click the Referrals tab. Enter an LDAP URL in the4 in the Enter a new referral field, or clickConstruct to create an LDAP URL.

5. Click Add to add the referral to the list.

You can enter multiple referrals. The directory returns the entire list of referrals in response torequests from client applications.

2.5.4.2. Creating Suffix Referrals from the Command LineAdd a suffix referral to the root or sub suffix entry in the directory configuration file under thecn=mapping tree,cn=config branch.

1. Run ldapmodify.1 For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add information to the configurationfile.

2. Add a suffix referral to the ou=people,dc=example,dc=com root suffix, as follows:

dn: cn=ou=people,dc=example,dc=com,cn=mapping tree,cn=configobjectclass: extensibleObject

Page 112: Red Hat Directory Server 5.1

Chapter 2. Configuring Directory Databases

92

objectclass: nsMappingTreensslapd-state: referralnsslapd-referral: ldap://zanzibar.com/

The nsslapd-state attribute is set to referral, meaning that a referral is returned forrequests made to this suffix. The nsslapd-referral attribute contains the LDAP URL of thereferral returned by the suffix, in this case a referral to the zanzibar.com server.

The nsslapd-state attribute can also be set to referral on update. This means that thedatabase is used for all operations except update requests. When a client application makes anupdate request to a suffix set to referral on update, the client receives a referral.

For more information about the suffix configuration attributes, refer to Table 2.1, “Suffix Attributes”.

Page 113: Red Hat Directory Server 5.1

Chapter 3.

93

Creating Directory EntriesThis chapter discusses how to use the Directory Server Console and the ldapmodify andldapdelete command-line utilities to modify the contents of your directory.

Entries stored in Active Directory can be added to the Directory Server through Windows Sync;see Chapter 9, Synchronizing Red Hat Directory Server with Microsoft Active Directory for moreinformation on adding or modifying synchronized entries through Windows User Sync.

3.1. Managing Entries from the Directory ConsoleYou can use the Directory tab and the Property Editor on the Directory Server Console to add,modify, or delete entries individually.

To add several entries simultaneously, use the command-line utilities described in Section 3.2,“Managing Entries from the Command Line”.

• Section 3.1.1, “Creating a Root Entry”

• Section 3.1.2, “Creating Directory Entries”

• Section 3.1.3, “Modifying Directory Entries”

• Section 3.1.4, “Deleting Directory Entries”

NOTEYou cannot modify your directory unless the appropriate access control rules have beenset. For information on creating access control rules for your directory, see Chapter 6,Managing Access Control.

3.1.1. Creating a Root EntryEach time a new database is created, it is associated with the suffix that will be stored in the database.The directory entry representing that suffix is not automatically created.

To create a root entry for a database:

1. In the Directory Server Console, select the Configuration tab.

2. Right-click on the Data entry in the left menu, and select New Root Suffix from the menu.

Page 114: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

94

3. Fill in the new suffix and database information.

4. In the Directory tab, right-click the top object representing the Directory Server, and choose NewRoot Object.

Page 115: Red Hat Directory Server 5.1

Creating a Root Entry

95

The secondary menu under New Root Object displays the new suffixes without a correspondingdirectory entry. Choose the suffix corresponding to the entry to create.

5. In the New Object window, select the object class corresponding to the new entry.

Page 116: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

96

The object class must contain the attribute used to name the suffix. For example, if theentry corresponds to the suffix ou=people,dc=example,dc=com, then choose theorganizationalUnit object class or another object class that allows the ou attribute.

6. Click OK in the New Object window.

The Property Editor for the new entry opens. You can either accept the current values by clicking OKor modify the entry, as explained in Section 3.1.3, “Modifying Directory Entries”.

3.1.2. Creating Directory EntriesDirectory Server Console offers predefined templates, with preset forms, for new directory entries.Table 3.1, “Entry Templates and Corresponding Object Classes” shows what type of object class isused for each template.

Template Object Class

User inetOrgPerson

Group groupOfUniqueNames

Organizational Unit organizationalUnit

Role nsRoleDefinition

Class of Service cosSuperDefinition

Table 3.1. Entry Templates and Corresponding Object Classes

Another type, Other allows any kind of entry to be created by allowing users to select the specificobject classes and attributes to apply.

1. In the Directory Server Console, select the Directory tab.

2. In the left pane, right-click the main entry to add the new entry, and select the type of entry: User,Group, Organizational Unit, Role, Class of Service, or Other.

Page 117: Red Hat Directory Server 5.1

Creating Directory Entries

97

3. If the new entry type was Other, then a list of object classes opens. Select an object class fromthe list to define the new entry.

4. Supply a value for all the listed attributes. Required attributes are marked with an asterisk (*).

Page 118: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

98

5. To display the full list of attributes available for the object class (entry type), click the Advancedbutton.

Page 119: Red Hat Directory Server 5.1

Creating Directory Entries

99

In the Property Editor, select any additional attributes, and fill in the attribute values.

6. Click OK to save the entry. The new entry is listed in the right pane.

Page 120: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

100

3.1.3. Modifying Directory EntriesModifying directory entries in Directory Server Console uses a dialog window called the PropertyEditor. The Property Editor contains the list of object classes and attributes belonging to an entryand can be used to edit the object classes and attributes belonging to that entry by adding andremoving object classes, attributes and attribute values, and attribute subtypes.

The Property Editor can be opened in several ways:

• From the Directory tab, by right-clicking an entry, and selecting Advanced Properties from thepop-up menu.

• From the Directory tab, by double-clicking an entry and clicking the Advanced button

• From the Create... new entry forms, by clicking the Advanced button

• From the New Object window, by clicking OK

3.1.3.1. Adding or Removing an Object Class to an EntryTo add an object class to an entry:

1. In the Directory tab of the Directory Server Console, right-click the entry to modify, and selectAdvanced from the pop-up menu.

Page 121: Red Hat Directory Server 5.1

Modifying Directory Entries

101

2. Select the object class field, and click Add Value.

The Add Object Class window opens. It shows a list of object classes that can be added to theentry.

3. Select the object class to add, and click OK.

Page 122: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

102

To remove an object class from an entry, click the text box for the object class to remove, and thenclick Delete Value.

3.1.3.2. Adding an Attribute to an EntryBefore you can add an attribute to an entry, the entry must contain an object class that either requiresor allows the attribute. See Section 3.1.3.1, “Adding or Removing an Object Class to an Entry” andChapter 10, Managing the Directory Schema for more information.

To add an attribute to an entry:

1. In the Directory tab of the Directory Server Console, right-click the entry to modify, and selectAdvanced from the pop-up menu.

Page 123: Red Hat Directory Server 5.1

Modifying Directory Entries

103

2. Click Add Attribute.

3. Select the attribute to add from the list, and click OK.

Page 124: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

104

NOTEIf the attribute you want to add is not listed, add the object class containing theattribute first, then add the attribute. See Section 3.1.3.1, “Adding or Removing anObject Class to an Entry” for instructions on adding an object class. If you do notknow which object class contains the attribute you need, look up the attribute in theDirectory Server Schema Reference, which lists the object classes which use thatattribute.

4. Type in the value for the new attribute in the field to the right of the attribute name.

Page 125: Red Hat Directory Server 5.1

Modifying Directory Entries

105

To remove the attribute and all its values from the entry, select Delete Attribute from the Edit menu.

3.1.3.3. Adding Very Large AttributesThe configuration attribute nsslapd-maxbersize sets the maximum size limit for LDAP requests.The default configuration of Directory Server sets this attribute at 2 megabytes. LDAP add or modifyoperations will fail when attempting to add very large attributes that result in a request that is largerthan 2 megabytes.

To add very large attributes, first change the setting for the nsslapd-maxbersize configurationattribute to a value larger than the largest LDAP request you will make.

When determining the value to set, consider all elements of the LDAP add and modify operations usedto add the attributes, not just the single attribute. There are a number of different factors to consider,including the following:

• The size of each attribute name in the request

• The size of the values of each of the attributes in the request

• The size of the DN in the request

• Some overhead, usually 10 kilobytes

One common issue that requires increasing the nsslapd-maxbersize setting is using attributeswhich hold CRL values, such as certificateRevocationList, authorityRevocationList,and deltaRevocationList.

For further information about the nsslapd-maxbersize attribute and for information about settingthis attribute, see the section "nsslapd-maxbersize (MaximumMessage Size)" in chapter 2, "CoreServer Configuration Reference," in Directory Server Configuration, Command, and File Reference.

3.1.3.4. Adding Attribute ValuesMulti-valued attributes allow multiple value for one attribute to be added to an entry.

1. In the Directory tab of the Directory Server Console, right-click the entry to modify, and selectAdvanced from the pop-up menu.

Page 126: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

106

2. Select the attribute to which to add a value, and then click Add Value.

3. Type in the new attribute value.

To remove an attribute value from an entry, click the text box of the attribute value to remove, and clickDelete Value.

3.1.3.5. Adding an Attribute SubtypeA subtype allows the same entry value to be represented in different ways, such as providing aforeign-characterset version. There three different kinds of subtypes to attributes which can be addedto an entry: language, binary, and pronunciation.

To add a subtype to an entry:

1. In the Directory tab of the Directory Server Console, right-click the entry to modify, and selectProperties from the pop-up menu.

2. Click Add Attribute, and select the attribute to add from the list.

3. Add a language subtype by selecting a value from the Language drop-down list. Add either abinary or pronunciation subtype by selecting a value from the Subtype drop-down list.

Page 127: Red Hat Directory Server 5.1

Modifying Directory Entries

107

Language SubtypeSometimes a user's name can be more accurately represented in characters of a language otherthan the default language. For example, a user, Noriko, has a name in Japanese and prefers that hername be represented by Japanese characters when possible. You can select Japanese as a languagesubtype for the givenname attribute so that other users can search for her name in Japanese as wellas English. For example:

givenname;lang-ja

To specify a language subtype for an attribute, add the subtype to the attribute name as follows:

attribute;lang-subtype:attribute value

attribute is the attribute being added to the entry and subtype is the two character abbreviation for thelanguage. The supported language subtypes are listed in Table D.2, “Supported Language Subtypes”.

Page 128: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

108

Only one language subtype can be added per attribute instance in an entry. To assign multiplelanguage subtypes, add another attribute instance to the entry, and then assign the new languagesubtype. For example, the following is illegal:

cn;lang-ja;lang-en-GB:value

Instead, use:

cn;lang-ja:ja-valuecn;lang-en-GB:value

Binary SubtypeAssigning the binary subtype to an attribute indicates that the attribute value is binary, such as usercertificates (usercertificate;binary).

Although you can store binary data within an attribute that does not contain the binary subtype (forexample, jpegphoto), the binary subtype indicates to clients that multiple variants of the attributetype may exist.

Pronunciation SubtypeAssigning the pronunciation subtype to an attribute indicates that the attribute value is a phoneticrepresentation. The subtype is added to the attribute name as attribute;phonetic. This subtypeis commonly used in combination with a language subtype for languages that have more than onealphabet, where one is a phonetic representation.

This subtype is useful with attributes that are expected to contain user names, such as cn orgivenname. For example, givenname;lang-ja;phonetic indicates that the attribute value is thephonetic version of the user's Japanese name.

3.1.4. Deleting Directory Entries1. In the Directory Server Console, select the Directory tab.

2. Right-click the entry to delete, and select Delete from the right-click menu.

Page 129: Red Hat Directory Server 5.1

Managing Entries from the Command Line

109

WARNINGThe server deletes the entry or entries immediately. There is no way to undo the deleteoperation.

3.2. Managing Entries from the Command LineThe command-line utilities allow you to manipulate the contents of your directory. They can be usefulto write scripts to perform bulk management of the directory or to test the Directory Server. Forexample, you might want to ensure that it returns the expected information after you have madechanges to access control information.

With command-line utilities, information can be provided directly from the command line or through anLDIF input file.

• Section 3.2.1, “Providing Input from the Command Line”

• Section 3.2.2, “Creating a Root Entry from the Command Line”

Page 130: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

110

• Section 3.2.3, “Adding Entries Using LDIF”

• Section 3.2.4, “Adding and Modifying Entries Using ldapmodify”

• Section 3.2.5, “Deleting Entries Using ldapdelete”

• Section 3.2.6, “Using Special Characters”

NOTEYou cannot modify your directory unless the appropriate access control rules have beenset. For information on creating access control rules for the directory, see Chapter 6,Managing Access Control.

3.2.1. Providing Input from the Command LineWhen you provide input to the ldapmodify and ldapdelete 1 utilities directly from the commandline, you must use LDIF statements. For detailed information on LDIF statements, see Section 3.4,“LDIF Update Statements”.

The ldapmodify and ldapdelete utilities read the statements that you enter in exactly the sameway as if they were read from a file. When all of the input has been entered, enter the character thatthe shell recognizes as the end of file (EOF) escape sequence. The utility then begins operationsbased on the supplied inputs.

While the EOF escape sequence depends on the type of machine, the EOF escape sequence almostalways control-D (^D).

For example, to input some LDIF update statements to ldapmodify, you would do the following:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: cn=Barry Nixon, ou=people, dc=example,dc=com changetype: modify delete: telephoneNumber - add: manager manager: cn=Harry Cruise, ou=people, dc=example,dc=com ^D

When adding an entry from the command line or from LDIF, make sure that an entry representing asubtree is created before new entries are created under that branch. For example, to place an entry ina People subtree, create an entry representing that subtree before creating entries within the subtree.For example:

dn: dc=example,dc=comdn: ou=People, dc=example,dc=com...People subtree entries. ...dn: ou=Group, dc=example,dc=com

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 131: Red Hat Directory Server 5.1

Creating a Root Entry from the Command Line

111

...Group subtree entries. ...

3.2.2. Creating a Root Entry from the Command LineThe ldapmodify command-line utility can be used to create a new root entry in a database. Forexample:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add an entry. The new root object canthen be added, as follows:

dn: Suffix_Nameobjectclass: newobjectclass

The DN corresponds to the DN of the root or sub-suffix contained by the database. Thenewobjectclass value depends upon the type of object class you are adding to the database. You mayneed to specify additional required attributes depending on the type of root object being added.

NOTEYou can use ldapmodify to add root objects only if you have one database per suffix. Ifyou create a suffix that is stored in several databases, you must use the ldif2db utilitywith the -noption parameter to specify the database that will hold the new entries. Forinformation, see Section 4.1.4, “Importing from the Command Line”.

3.2.3. Adding Entries Using LDIFYou can use an LDIF file to add multiple entries or to import an entire database. To add entries usingan LDIF file and the Directory Server Console:

1. Define the entries in an LDIF file.

LDIF files are described in Appendix A, LDAP Data Interchange Format.

2. Import the LDIF file from the Directory Server Console.

See Section 4.1.2, “Importing a Database from the Console” for information about LDIF fileformats. When you import the LDIF file, select Append to database in the Import dialog box sothat the server will only import entries that do not currently exist in the directory.

You can also add entries described in an LDIF file from the command line using the ldapmodifycommand with the -f option.

3.2.4. Adding and Modifying Entries Using ldapmodifyThe ldapmodify1 command can add and modify entries in an existing Directory Server database.The ldapmodify command opens a connection to the specified server using the supplieddistinguished name and password and modifies the entries based on LDIF update statementscontained in a specified file. Because ldapmodify uses LDIF update statements, ldapmodify cando everything that ldapdelete can do.

Page 132: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

112

Consider the following when using ldapmodify:

• If the server detects an attribute or object class in the entry that is not known to the server, thenthe modify operation will fail when it reaches the erroneous entry. All entries that were processedbefore the error was encountered will be successfully added or modified. If you run ldapmodifywith the -c option (do not stop on errors), all correct entries processed after the erroneous entry willbe successfully added or modified.

• If a required attribute is not present, the modify operation fails. This happens even if the offendingobject class or attribute is not being modified.

NOTETo create the root entry a database suffix (such as dc=example,dc=com) usingldapmodify, you must bind to the directory as the Directory Manager.

3.2.4.1. Adding Entries Using ldapmodifyTypically, to add the entries using ldapmodify, specify the DN and password to bind to the DirectoryServer, the port and host of the Directory Server, and the LDIF file to use. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com -f new.ldif

This ldapmodify example has the following values:

• The entries to be created are specified in the file new.ldif. (In this example, the LDIF statementsin the new.ldif file do not specify a change type. They follow the format defined in Section A.1,“About the LDIF File Format”.)

• The Directory Manager is a database administrator who has the authority to modify the entries, andits password is secret.

• The hostname is example.com.

• The server uses port number 389.

Table 3.2, “ldapmodify Parameters Used for Adding Entries” describes the ldapmodify parametersused in the example.

Parameter Name Description

-a Specifies that the modify operation will add newentries to the directory.

-D Specifies the distinguished name with which toauthenticate to the server. The value must bea DN recognized by the Directory Server, andit must also have the authority to modify theentries.

-w Specifies the password associated withthe distinguished name specified in the -Dparameter.

Page 133: Red Hat Directory Server 5.1

Adding and Modifying Entries Using ldapmodify

113

Parameter Name Description

-h Specifies the name of the host on which theserver is running.

-p Specifies the port number that the server uses.

-f Optional parameter that specifies the filecontaining the LDIF update statements used todefine the modifications. If you do not supplythis parameter, the update statements are readfrom stdin. For information on supplying LDIFupdate statements from the command line,see Section 3.2.1, “Providing Input from theCommand Line”.

Table 3.2. ldapmodify Parameters Used for Adding Entries

For full information on ldapmodify parameters, see the Directory Server Configuration, Command,and File Reference.

3.2.4.2. Modifying Entries Using ldapmodifyTypically, to edit entries using ldapmodify, specify the DN and password to bind to the DirectoryServer, the port and host of the Directory Server, and the LDIF file to use, as when adding entries withldapmodify. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com -f modify_statements

This ldapmodify example has the following values:

• The entries to modify are specified in the file modify_statements. Before the entries can bemodified, you must first create the modify_statements file with the appropriate LDIF updatestatements; LDIF update statements are described in Section 3.4, “LDIF Update Statements”.

• The bind DN is cn=Directory Manager, which has permissions to edit any entry in the database,and the password is secret.

• The hostname is example.com.

• The server uses port number 389.

Table 3.3, “ldapmodify Parameters Used for Modifying Entries” describes the ldapmodifyparameters used in the example.

Parameter Name Description

-D Specifies the distinguished name with which toauthenticate to the server. The value must bea DN recognized by the Directory Server, andit must also have the authority to modify theentries.

-w Specifies the password associated withthe distinguished name specified in the -Dparameter.

Page 134: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

114

Parameter Name Description

-h Specifies the name of the host on which theserver is running.

-p Specifies the port number that the server uses.

-f Optional parameter that specifies the filecontaining the LDIF update statements used todefine the modifications. If you do not supplythis parameter, the update statements are readfrom stdin. For information on supplying LDIFupdate statements from the command line,see Section 3.2.1, “Providing Input from theCommand Line”.

Table 3.3. ldapmodify Parameters Used for Modifying Entries

For full information on ldapmodify parameters, see the Directory Server Configuration, Command,and File Reference.

3.2.5. Deleting Entries Using ldapdeleteThe ldapdelete command-line utility opens a connection to the specified server using the provideddistinguished name and password and deletes the specified entry or entries.

NOTEYou can only delete entries at the end of a branch. You cannot delete entries that arebranch points in the directory tree.

For example, of the following three entries, only the last two entries can be deleted.

ou=People,dc=example,dc=comcn=Paula Simon,ou=People,dc=example,dc=comcn=Jerry O'Connor,ou=People,dc=example,dc=com

The entry that identifies the People subtree can be deleted only if there are not any entries belowit. To delete ou=People,dc=example,dc=com, you must first delete Paula Simon and JerryO'Connor's entries and all other entries in that subtree.

Like ldapmodify, running ldapdelete requires the DN and password to bind to the DirectoryServer, the port and host of the Directory Server, and the DNs of the entries to delete. For example:

ldapdelete -D "cn=Directory Manager" -w secret -h example.com -p 389 "cn=Robert Jenkins,ou=People,dc=example,dc=com" "cn=Lisa Jangles,ou=People,dc=example,dc=com"

This ldapdelete example has the following values:

• The entries to delete have the DNs cn=Robert Jenkins,ou=People,dc=example,dc=comand cn=Lisa Jangles, ou=People,dc=example,dc=com.

• The bind DN is the Directory Manager, which has permission to delete every entry in the database,and a password of secret.

Page 135: Red Hat Directory Server 5.1

Using Special Characters

115

• The hostname is example.com.

• The server uses port number 389.

Table 3.4, “ldapdelete Parameters Used for Deleting Entries” describes the ldapdelete parametersused in the example:

Parameter Name Description

-D Specifies the distinguished name with which toauthenticate to the server. The value must bea DN recognized by the Directory Server, andit must also have the authority to modify theentries.

-w Specifies the password associated withthe distinguished name specified in the -Dparameter.

-h Specifies the name of the host on which theserver is running.

-p Specifies the port number that the server uses.

Table 3.4. ldapdelete Parameters Used for Deleting Entries

For full information on ldapdelete parameters, see the Directory Server Configuration, Command,and File Reference.

3.2.6. Using Special CharactersWhen using the Directory Server command-line client tools, you may need to specify values thatcontain characters that have special meaning to the command-line interpreter, such as space ( ),asterisk (*), or backslash (\). When this situation occurs, enclose the value in quotation marks ("").For example:

-D "cn=Barbara Jensen,ou=Product Development,dc=example,dc=com"

Depending on the command-line utility, use either single or double quotation marks; see youroperating system documentation for more information.

Additionally, if a DN contains commas, you must escape the commas with a backslash (\). Forexample:

-D "cn=Patricia Fuentes,ou=people,o=example.com Bolivia\,S.A."

To delete user Patricia Fuentes from the example.com Bolivia, S.A. tree, use the followingcommand:

ldapdelete -D "cn=Directory Manager" -w secret -h example.com -p 389 "cn=Patricia Fuentes,ou=People,o=example.com Bolivia\,S.A."

3.3. Tracking Modifications to Directory EntriesYou can configure the server to maintain special attributes for newly created or modified entries:

Page 136: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

116

• creatorsName. The distinguished name of the person who initially created the entry.

• createTimestamp. The timestamp for when the entry was created in GMT (Greenwich Mean Time)format.

• modifiersName. The distinguished name of the person who last modified the entry.

• modifyTimestamp. The timestamp for when the entry was last modified in GMT format.

NOTEWhen a database link is used by a client application to create or modify entries, thecreatorsName and modifiersName attributes do not reflect the real creator or modifierof the entries. These attributes contain the name of the administrator who is granted proxyauthorization rights on the remote server. For information on proxy authorization, seeSection 2.3.1.2.2, “Providing Bind Credentials”.

Do the following to enable the Directory Server to track when entries are created or modified:

1. In the Directory Server Console, select the Configuration tab, and then select the top entry in thenavigation tree in the left pane.

2. Select the Settings tab in the right pane.

3. Select the Track Entry Modification Times checkbox.

The server adds the creatorsName, createTimestamp, modifiersName, andmodifyTimestamp attributes to every newly created or modified entry.

4. Open the Tasks tab, and click Restart Directory Server.

Page 137: Red Hat Directory Server 5.1

LDIF Update Statements

117

NOTEThe Directory Server must be restarted for the changes to take effect.

3.4. LDIF Update StatementsLDIF update statements define how ldapmodify changes the directory entry. In general, LDIFupdate statements contain the following information:

• The DN of the entry to be modified.

• A changetype that defines how a specific entry is to be modified (add, delete, modify, modrdn).

• A series of attributes and their changed values.

A change type is required unless ldapmodify is run with the -a parameter. If you specify the -aparameter, then an add operation (changetype: add) is assumed. However, any other change typeoverrides the -a parameter.

If you specify a modify operation (changetype: modify), a change operation is required thatindicates how the entry should be changed.

If you specify changetype: modrdn, change operations are required that specify how the relativedistinguished name (RDN) is to be modified. A distinguished name's RDN is the left-most value in theDN. For example, the distinguished name uid=ssarette,dc=example,dc=com has an RDN ofuid=ssarette.

The general format of LDIF update statements is as follows:

dn: distinguished_name changetype: changetype_identifier change_operation_identifier: list_of_attributes change_operation_identifier: list_of_attributes

Page 138: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

118

A dash (-) must be used to denote the end of a change operation if subsequent change operations arespecified. For example, the following statement adds the telephone number and manager attributes tothe entry:

dn: cn=Lisa Jangles,ou=People,dc=example,dc=comchangetype: modifyadd: telephoneNumbertelephoneNumber: (408) 555-2468-add: managermanager: cn=Harry Cruise,ou=People,dc=example,dc=com

In addition, the line continuation operator is a single space. Therefore, the following two statementsare identical:

dn: cn=Lisa Jangles,ou=People,dc=example,dc=com

dn: cn=Lisa Jangles, ou=People, dc=example,dc=com

The following sections describe the change types in detail.

3.4.1. Adding an Entry Using LDIFchangetype: add adds an entry to the directory. When you add an entry, make sure to create anentry representing a branch point before you try to create new entries under that branch. That is, toplace an entry in a People and a Groups subtree, then create the branch point for those subtreesbefore creating entries within the subtrees. For example:

dn: dc=example,dc=comchangetype: addobjectclass: topobjectclass: organizationo: example.com

dn: ou=People, dc=example,dc=comchangetype: addobjectclass: topobjectclass: organizationalUnitou: Peopleou: Marketing

dn: cn=Pete Minsky,ou=People,dc=example,dc=comchangetype: addobjectclass: topobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: Pete Minskygivenname: Petesn: Minskyou: Peopleou: Marketinguid: pminsky

dn: cn=Sue Jacobs,ou=People,dc=example,dc=comchangetype: add

Page 139: Red Hat Directory Server 5.1

Renaming an Entry Using LDIF

119

objectclass: topobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: Sue Jacobsgivenname: Suesn: Jacobsou: Peopleou: Marketinguid: sjacobs

dn: ou=Groups,dc=example,dc=comchangetype: addobjectclass: topobjectclass: organizationalUnitou: Groups

dn: cn=Administrators,ou=Groups,dc=example,dc=comchangetype: addobjectclass: topobjectclass: groupOfNamesmember: cn=Sue Jacobs,ou=People,dc=example,dc=commember: cn=Pete Minsky,ou=People,dc=example,dc=comcn: Administrators

dn: ou=example.com Bolivia\, S.A.,dc=example,dc=comchangetype: addobjectclass: topobjectclass: organizationalUnitou: example.com Bolivia\, S.A.

dn: cn=Carla Flores,ou=example.com Bolivia\,S.A.,dc=example,dc=comchangetype: addobjectclass: topobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: Carla Floresgivenname: Carlasn: Floresou: example.com Bolivia\, S.A.uid: cflores

3.4.2. Renaming an Entry Using LDIFchangetype: modrdn changes an entry's relative distinguished name (RDN). Anentry's RDN is the left-most element in the distinguished name. The RDN for cn=BarryNixon,ou=People,dc=example,dc=com is cn=Barry Nixon, and the RDN forou=People,dc=example,dc=com is ou=People. A changetype: modrdn operation changesthat left-most value in an entry's DN.

The modrdn change type only changes the RDN; it cannot change other parts of a DN. Forexample, the entry cn=Sue Jacobs,ou=People,dc=example,dc=com can be changed tocn=Susan Jacobs,ou=People,dc=example,dc=com, but it cannot be modified to be cn=SueJacobs,ou=old employees,dc=example,dc=com.

The following command renames Sue Jacobs to Susan Jacobs:

dn: cn=Sue Jacobs,ou=Marketing,dc=example,dc=comchangetype: modrdnnewrdn: cn=Susan Jacobs

Page 140: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

120

deleteoldrdn: 0

Because deleteoldrdn is 0, this example retains the existing RDN as a value in the new entry. Theresulting entry would therefore have a common name (cn) attribute set to both Sue Jacobs and SusanJacobs, in addition to all the other attributes included in the original entry. However, using the followingcommand causes the server to delete cn=Sue Jacobs, so that only cn=Susan Jacobs remains inthe entry:

dn: cn=Sue Jacobs,ou=Marketing,dc=example,dc=comchangetype: modrdnnewrdn: cn=Susan Jacobsdeleteoldrdn: 1

3.4.2.1. A Note on Renaming EntriesThe modrdn change type cannot move an entry to a completely different subtree. To move an entryto a completely different branch, you must create a new entry in the alternative subtree using the oldentry's attributes, and then delete the old entry.

Also, for the same reasons that you cannot delete an entry if it is a branch point, you cannot renamean entry if it has any children. Doing so would orphan the children in the tree, which is not allowedby the LDAP protocol. For example, of the following three entries, only the last two entries can berenamed:

ou=People,dc=example,dc=comcn=Paula Simon,ou=People,dc=example,dc=comcn=Jerry O'Connor,ou=People,dc=example,dc=com

The entry that identifies the People subtree can be renamed only if no other entries exist below it.

3.4.3. Modifying an Entry Using LDIFchangetype: modify can add, replace, or remove attributes or attribute values in an entry. Whenyou specify changetype: modify, you must also provide a change operation to indicate how theentry is to be modified. Change operations can be as follows:

• add: attribute

Adds the specified attribute or attribute value. If the attribute type does not currently exist forthe entry, then the attribute and its corresponding value are created. If the attribute type alreadyexists for the entry, then the specified attribute value is added to the existing value. If the particularattribute value already exists for the entry, then the operation fails, and the server returns an error.

• replace: attribute

The specified values are used to entirely replace the attribute's values. If the attribute does notalready exist, it is created. If no replacement value is specified for the attribute, the attribute isdeleted.

• delete: attribute

The specified attribute is deleted. If more than one value of an attribute exists for the entry, then allvalues of the attribute are deleted in the entry. To delete just one of many attribute values, specifythe attribute and associated value on the line following the delete change operation.

Page 141: Red Hat Directory Server 5.1

Modifying an Entry Using LDIF

121

This section contains the following topics:

• Section 3.4.3.1, “Adding Attributes to Existing Entries Using LDIF”

• Section 3.4.3.2, “Changing an Attribute Value Using LDIF”

• Section 3.4.3.3, “Deleting All Values of an Attribute Using LDIF”

• Section 3.4.3.4, “Deleting a Specific Attribute Value Using LDIF”

3.4.3.1. Adding Attributes to Existing Entries Using LDIFUsing changetype: modify with the add operation cam add an attribute and an attribute value toan entry. For example, the following LDIF update statement adds a telephone number to the entry:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyadd: telephoneNumbertelephoneNumber: 555-1212

The following example adds two telephone numbers to the entry:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyadd: telephoneNumbertelephoneNumber: 555-1212telephoneNumber: 555-6789

The following example adds two telephoneNumber attributes and a manager attribute to the entry:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyadd: telephoneNumbertelephoneNumber: 555-1212telephoneNumber: 555-6789-add: managermanager: cn=Sally Nixon,ou=People,dc=example,dc=com

The following example adds a jpeg photograph to the directory. In order to add this attribute to thedirectory, use the -b parameter, which indicates that ldapmodify should read the referenced file forbinary values if the attribute value begins with a slash:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyadd: jpegphotojpegphoto: /path/to/photo

You can also add a jpeg photograph to the directory using the following standard LDIF notation:

jpegphoto: < file:/path/to/photo

Using the standard notation means that the -b parameter does not need to be used withldapmodify.However, you must add version:1 to the beginning of the LDIF file or with LDIF update statements.For example:

Page 142: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

122

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com version: 1 dn: cn=Barney Fife,ou=People,dc=example,dc=com changetype: modify add: usercertificate usercertificate;binary:< file: BarneysCert

NOTEStandard LDIF notation can only be used with the ldapmodify command, not with othercommand-line utilities.

3.4.3.2. Changing an Attribute Value Using LDIFchangetype: modify with the replace operation changes all values of an attribute in an entry. Forexample, the following LDIF update statement changes Barney's manager from Sally Nixon to WallyHensford:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyreplace: managermanager: cn=Wally Hensford, ou=People, dc=example,dc=com

If the entry has multiple instances of the attribute, then to change one of the attribute values, you mustdelete the attribute value first and then add the replacement value. For example, this entry has twotelephone numbers:

cn=Barney Fife,ou=People,dc=example,dc=comobjectClass: inetOrgPersoncn: Barney Fifesn: FifetelephoneNumber: 555-1212telephoneNumber: 555-6789

To change the telephone number 555-1212 to 555-4321, use the following LDIF update statement:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifydelete: telephoneNumbertelephoneNumber: 555-1212-add: telephoneNumbertelephoneNumber: 555-4321

The entry is now as follows:

cn=Barney Fife,ou=People,dc=example,dc=comobjectClass: inetOrgPersoncn: Barney Fifesn: FifetelephoneNumber: 555-6789telephoneNumber: 555-4321

Page 143: Red Hat Directory Server 5.1

Deleting an Entry Using LDIF

123

3.4.3.3. Deleting All Values of an Attribute Using LDIFchangetype: modify with the delete operation deletes an attribute from an entry. If the entry hasmore than one instance of the attribute, you must indicate which of the attributes to delete.

For example, the following LDIF update statement deletes all instances of the telephoneNumberattribute from the entry, regardless of how many times it appears in the entry:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifydelete: telephoneNumber

To delete just a specific instance of the telephoneNumber attribute, simply delete that specificattribute value, as described in the next section.

3.4.3.4. Deleting a Specific Attribute Value Using LDIFRunning changetype: modify with the delete operation can delete a single value for an attributevalue from an entry, as well as deleting all instances of the attribute. For example, consider thefollowing entry:

cn=Barney Fife,ou=People,dc=example,dc=comobjectClass: inetOrgPersoncn: Barney Fifesn: FifetelephoneNumber: 555-1212telephoneNumber: 555-6789

To delete the 555-1212 telephone number from this entry, use the following LDIF update statement:

dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifydelete: telephoneNumbertelephoneNumber: 555-1212

Barney's entry then becomes:

cn=Barney Fife,ou=People,dc=example,dc=comobjectClass: inetOrgPersoncn: Barney Fifesn: FifetelephoneNumber: 555-6789

3.4.4. Deleting an Entry Using LDIFchangetype: delete is the change type which deletes an entire entry from the directory.

NOTEYou can only delete leaf entries. Therefore, when you delete an entry, make sure thatno other entries exist under that entry in the directory tree. That is, you cannot delete anorganizational unit entry unless you have first deleted all the entries that belong to theorganizational unit.

Page 144: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

124

For example, of the following three entries, only the last two entries can be deleted:

ou=People,dc=example,dc=comcn=Paula Simon,ou=People,dc=example,dc=comcn=Jerry O'Connor,ou=People,dc=example,dc=com

The entry that identifies the People subtree can be deleted only if no other entries exist below it.

The following LDIF update statements can be used to delete person entries:

dn: cn=Pete Minsky,ou=People,dc=example,dc=comchangetype: deletedn: cn=Sue Jacobs,ou=People,dc=example,dc=comchangetype: delete

WARNINGDo not delete the suffix o=NetscapeRoot. The Administration Server uses this suffix tostore information about installed Directory Servers. Deleting this suffix could force you toreinstall the Directory Server.

3.4.5. Modifying an Entry in an Internationalized DirectoryIf the attribute values in the directory are associated with languages other than English, the attributevalues are associated with language tags. When using the ldapmodify command-line utility tomodify an attribute that has an associated language tag, you must match the value and language tagexactly or the modify operation will fail.

For example, to modify an attribute value that has a language tag of lang-fr, include lang-fr in themodify operation, as follows:

dn: bjensen,dc=example,dc=comchangetype: modifyreplace: homePostalAddress;lang-frhomePostalAddress;lang-fr: 34 rue de Seine

3.5. Maintaining Referential IntegrityReferential integrity is a database mechanism that ensures relationships between related entries aremaintained. In the Directory Server, the referential integrity can be used to ensure that an update toone entry in the directory is correctly reflected in any other entries that may refer to the updated entry.

For example, if a user's entry is removed from the directory and referential integrity is enabled, theserver also removes the user from any groups of which the user is a member. If referential integrityis not enabled, the user remains a member of the group until manually removed by the administrator.This is an important feature if you are integrating the Directory Server with other products that rely onthe directory for user and group management.

3.5.1. How Referential Integrity WorksWhen the Referential Integrity Plug-in is enabled, it performs integrity updates on specified attributesimmediately after a delete or rename operation. By default, the Referential Integrity Plug-in is disabled.

Page 145: Red Hat Directory Server 5.1

Using Referential Integrity with Replication

125

NOTEThe Referential Integrity Plug-in should only be enabled on one supplier replica in a multi-master replication environment to avoid conflict resolution loops. When enabling the plug-in on servers issuing chaining requests, be sure to analyze performance resource andtime needs, as well as your integrity needs. Integrity checks can be time-consuming anddraining on memory and CPU.

Whenever a user or group entry is deleted or renamed in the directory, the operation is logged tothe referential integrity log file (/var/log/dirsrv/slapd-instance_name). After a specifiedtime, known as the update interval, the server performs a search on all attributes for which referentialintegrity is enabled and matches the entries resulting from that search with the DNs of deletedor modified entries present in the log file. If the log file shows that the entry was deleted, thecorresponding attribute is deleted. If the log file shows that the entry was changed, the correspondingattribute value is modified accordingly.

By default, when the Referential Integrity Plug-in is enabled, it performs integrity updates on themember, uniqueMember, owner, and seeAlso attributes immediately after a delete or renameoperation. However, the behavior of the Referential Integrity Plug-in can be configured to suit theneeds of the directory in several different ways:

• Record referential integrity updates in the replication changelog.

• Modify the update interval.

• Select the attributes to which to apply referential integrity.

• Disable referential integrity.

All attributes used in referential integrity must be indexed for presence and equality; not indexingthose attributes results poor server performance for modify and delete operations. See Section 11.2,“Creating Standard Indexes” for more information about checking and creating indexes.

3.5.2. Using Referential Integrity with ReplicationThere are certain limitations when using the Referential Integrity Plug-in in a replication environment:

• Never enable it on a dedicated consumer server (a server that contains only read-only replicas).

• Never enable it on a server that contains a combination of read-write and read-only replicas.

• It is possible to enable it on a supplier server that contains only read-write replicas.

• With multi-master replication, enable the plug-in on just one supplier.

If the replication environment satisfies the all of those condition, you can enable the ReferentialIntegrity Plug-in.

1. Enable the Referential Integrity Plug-in as described in Section 3.5.3, “Enabling and DisablingReferential Integrity”.

2. Configure the plug-in to record any integrity updates in the changelog.

3. Ensure that the Referential Integrity Plug-in is disabled on all consumer servers.

Page 146: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

126

NOTEBecause the supplier server sends any changes made by the Referential IntegrityPlug-in to consumer servers, it is unnecessary to run the Referential Integrity Plug-inon consumer servers.

3.5.3. Enabling and Disabling Referential Integrity

3.5.3.1. Enabling and Disabling Referential Integrity in the Console1. Select the Configuration tab, and expand the Plugins folder.

2. Select Referential Integrity Postoperation Plug-in from the list.

Page 147: Red Hat Directory Server 5.1

Enabling and Disabling Referential Integrity

127

3. Check the Enable plugin checkbox to enable the plug-in; clear it to disable it.

Page 148: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

128

4. Fill in the correct path to the plug-in by default; plug-ins are located in /usr/lib/dirsrv/plugins.

5. Restart the Directory Server to apply the changes. In the Tasks tab, select Restart the DirectoryServer.

3.5.3.2. Enabling and Disabling Referential Integrity from the CommandLineTo disable or enable the Referential Integrity Plug-in:

Page 149: Red Hat Directory Server 5.1

Modifying the Update Interval

129

1. Use ldapmodify to edit the value of the nsslapd-pluginEnabled attribute. For example: 2

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ACL Plugin,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginEnablednsslapd-pluginEnabled: on

2. Then restart the server.

service dirsrv restart

3.5.4. Modifying the Update IntervalBy default, the server makes referential integrity updates immediately after a delete or a modrdnoperation. To reduce the impact this operation has on your system, increase the amount of timebetween updates. Although there is no maximum update interval, the following intervals are commonlyused:

• Update immediately

• 90 seconds

• 3600 seconds (updates occur every hour)

• 10,800 seconds (updates occur every 3 hours)

• 28,800 seconds (updates occur every 8 hours)

• 86,400 seconds (updates occur once a day)

• 604,800 seconds (updates occur once a week)

3.5.4.1. Modifying the Update Interval from the Console1. Select the Configuration tab, and expand the Plugins folder. Select the Referential Integrity

Postoperation Plug-in.

2. In the arguments list, replace the value in the first text box with the appropriate time interval.

Page 150: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

130

3. Restart the Directory Server to apply the changes. In the Tasks tab, select Restart the DirectoryServer.

3.5.4.2. Modifying the Update Interval from the Command Line1. Use ldapmodify2 to edit the value of the nsslapd-pluginarg attribute. For example:

The first argument listed sets the update interval for referential integrity checks. To change theinterval, replace the nsslapd-pluginarg0 attribute.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=referential integrity postoperation,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginarg0nsslapd-pluginarg0: 600

2. Then restart the server.

service dirsrv restart

3.5.5. Modifying the Attribute List

3.5.5.1. Modifying the Attribute List from the ConsoleBy default, the Referential Integrity Plug-in is set up to check for and update the member,uniqueMember, owner, and seeAlso attributes. You can add or delete attributes to be updatedthrough the Directory Server Console, such as adding the nsroledn attribute if roles are being used.

NOTEKeep in mind that any attribute specified in the Referential Integrity Plug-in parameter listmust have equality indexing on all databases. Otherwise, the plug-in scans every entry ofthe databases for matching the deleted or modified DN, degrading performance severely.If you add an attribute, ensure that it is indexed in all the backends.

NOTEImprove the performance by removing any unused attributes from the list.

1. Select the Configuration tab, and expand the Plugins folder. Select the Referential IntegrityPostoperation Plug-in.

2. In the Arguments section, use the Add and Delete buttons to modify the attributes in the list.

Page 151: Red Hat Directory Server 5.1

Modifying the Attribute List

131

3. Restart the Directory Server to apply the changes. In the Tasks tab, select Restart the DirectoryServer.

NOTEAll attributes used in referential integrity must be indexed for presence and equality;not indexing those attributes results poor server performance for modify and deleteoperations. See Section 11.2, “Creating Standard Indexes” for more information aboutchecking and creating indexes.

3.5.5.2. Modifying the Attribute List from the Command LineBy default, the Referential Integrity Plug-in is set up to check for and update the member,uniqueMember, owner, and seeAlso attributes.

nsslapd-pluginarg3: membernsslapd-pluginarg4: uniqueMembernsslapd-pluginarg5: ownernsslapd-pluginarg6: seeAlso

To add another attribute to the list:

1. Use ldapmodify2 to add another attribute to the list by adding another nsslapd-pluginargattribute.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=referential integrity postoperation,cn=plugins,cn=configchangetype: modifyadd: nsslapd-pluginarg7nsslapd-pluginarg7: nsroledn

2. Then restart the server.

Page 152: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

132

service dirsrv restart

NOTEKeep in mind that any attribute specified in the Referential Integrity Plug-in parameter listmust have equality indexing on all databases. Otherwise, the plug-in scans every entry ofthe databases for matching the deleted or modified DN, degrading performance severely.If you add an attribute, ensure that it is indexed in all the backends.

3.6. Assigning and Managing Unique Numeric AttributeValuesSome entry attributes require having a unique number, such as uidNumber and gidNumber. TheDirectory Server can automatically generate and supply unique numbers for specified attributes usingthe Distributed Numeric Assignment (DNA) Plug-in.

3.6.1. Overview of Unique Number AssignmentsMany situations require a unique numeric attribute, such as UID/GID numbers or PIN numbers. Theserver uses DNA Plug-in instances to specify the attributes for which to generate the numbers, sowhenever that attribute is added to an entry, the unique value can be assigned.

NOTEAttribute uniqueness is not necessarily preserved with the DNA Plug-in. The plug-in onlyassigns non-overlapping ranges, but it does allow manually-assigned numbers for itsmanaged attributes, and it does not verify or require that the manually-assigned numbersare unique.

3.6.1.1. How the Directory Server Manages Unique NumbersThe issue with assigning unique numbers is not with generating the numbers but in effectivelymanaging numbers so that there are not any conflicts with other assigned numbers when entries arereplicated and that every server has a sufficient range of numbers to assign.

The DNA Plug-in for a server assigns a range of available numbers that that instance can issue. Therange definition is very simple and is set by two attributes: the server's next available number (thelow end of the range) and its maximum value (the top end of the range). The initial bottom range isset when the plug-in instance is configured. After that, the bottom value is updated by the plug-in. Bybreaking the available numbers into ranges, the servers can all continually assign numbers withoutoverlapping with each other.

The server performs a sorted search, internally, to see if the next specified range is already taken,requiring the managed attribute to have an equality index with the proper ordering matching rule (asdescribed in Section 11.2, “Creating Standard Indexes”).

For multi-master replication, each supplier can be configured with a threshold, so that when it beginsrunning out of numbers in its range, it can request additional ranges from other suppliers. Each

Page 153: Red Hat Directory Server 5.1

Overview of Unique Number Assignments

133

supplier keeps a track of its current range in a separate configuration entry. The configuration entry isreplicated to all of the other suppliers, so each supplier can check that configuration to find a server tocontact for a new range.

The range set on the individual servers and the range configuration entries are how the DirectoryServer distributes numbers efficiently for entries.

The DNA Plug-in is applied, always, to a specific area of the directory tree (the scope) and to specificentry types within that subtree (the filter).

For example, both the uidNumber and gidNumber attributes require unique numbers. However,since these are separate attributes, then they are considered separate ranges. A user can haveuidNumber:5 and another user can have gidNumber:5 in the entries without a conflict becausethe uidNumber and gidNumber attributes are in separate ranges. The attribute to which a range isapplied is set in the DNA filter, such as dnaFilter: uidNumber.

Frequently, entirely different users are stored in different branches of the directory tree. For example,a hosting service may have one clients' users in the ou=Example Corp. branch and another clients'users in the ou=Acme Company branch. In this case, the assigned numbers have to be uniquewithin the subtree but not necessarily across the entire directory. In this case, it is all right for BarbaraJensen in the ou=Example Corp. branch to have uidNumber:5 in her entry and for John Smithin the ou=Acme Company branch to have uidNumber:5 in his entry, because these are separateorganizations. Applying ranges to a specific subtree is set in the DNA scope, such as dnaScope:ou=people,dc=example,dc=com.

The unique number can also be distinguished between ranges by using a prefix to identify the differentkinds of user entries. For example, if the DNA prefix is set to acme, then the unique numbers in theAcme Company branch have acme in front of the number, like uid: acme5.

3.6.1.2. Using DNA to Assign Values to AttributesThere are several different ways that the Directory Server can handle generating attribute values.

In the simplest case, a user entry is added to the directory with an object class which requires theunique-number attribute, but without the attribute. Adding (or requiring) the managed attribute withouta value triggers the DNA Plug-in to assign a value. When an entry is added, the plug-in checkswhether the entry matches the defined range according to the scope and filter set for the plug-in. Ifthe entry matches the range and the attribute that DNA is managing for that range is missing from theentry being added, then the DNA Plug-in assigns the next value.

For example, the posixAccount object class requires the uidNumber attribute. If the uidNumberattribute is managed by the DNA Plug-in and a user entry is added without the uidNumber attributewithin the scope of the filter, then the server checks the new entry, sees that it needs the manageduidNumber attribute, and adds the attribute with an automatically assigned value.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: uid=jsmith, ou=people, dc=example,dc=com objectClass: top objectClass: person objectClass: posixAccount uid: jsmith cn: John Smith

Page 154: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

134

....

The plug-in processes the missing attribute, asks for the next available number from the server, andsupplies the value for the entry.

A similar and more manageable option is to use a magic number. This magic number is a templatevalue for the managed attribute, something outside the server's range, a number or even a word, thatthe plug-in recognizes it needs to replace with a new assigned value. When an entry is added withthat number, and the entry is within the scope and filter of the configured DNA Plug-in, then using themagic number automatically triggers the plug-in to generate a new value. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: uid=jsmith, ou=people, dc=example,dc=com objectClass: top objectClass: person objectClass: posixAccount uid: jsmith cn: John Smith uidNumber: magic ....

The magic number is very useful for importing entries from LDIF or for triggering the DNA Plug-in togenerate unique numbers for several different attributes.

The DNA Plug-in only generates new, unique values. If an entry is added or modified to use a specificvalue for an attribute controlled by the DNA Plug-in, the specified number is used; the DNA Plug-in willnot overwrite it.

NOTEAttribute uniqueness is not necessarily preserved with the DNA Plug-in. The plug-in onlyassigns non-overlapping ranges, but it does allow manually-assigned numbers for itsmanaged attributes, and it does not verify or require that the manually-assigned numbersare unique.

3.6.1.3. Using the DNA Plug-in with ReplicationWith multi-master replication, there are two entries referenced by the server:

• The managed ranges for the DNA Plug-in

• A shared configuration entry which stores the information about the server's available ranges

When the plug-in instance is created, then the DNA Plug-in automatically creates an entry beneath theshared configuration entry with the supplier configuration. For example:

dn: dnaHostname=ldap1.example.com+dnaPortNum=389, cn=Account UIDs, ou=Ranges, dc=example, dc=comobjectClass: extensibleObjectobjectClass: topdnahostname: ldap1.example.comdnaPortNum: 389

Page 155: Red Hat Directory Server 5.1

Looking at the DNA Plug-in Syntax

135

dnaSecurePortNum: 636dnaRemainingValues: 1000

When a server needs a new range of numbers, it searches the configuration entries under thecontainer entry. When it finds the server with the highest available range, it sends an extendedoperation request to have part of the range assigned to it. If the second server agrees, the secondserver sends the requesting server the new range assignment.

3.6.2. Looking at the DNA Plug-in SyntaxThe DNA Plug-in itself is a container entry, similar to the Password Storage Schemes Plug-in. EachDNA entry underneath the DNA Plug-in entry defines a new managed range for the DNA Plug-in.

To set new managed ranges for the DNA Plug-in, create entries beneath the container entry.

The most basic configuration is to set up distributed numeric assignments on a single server, meaningthe ranges will not be shared or transferred between servers. A basic DNA configuration entry definesfour things:

• The attribute that's value is being managed, set in the dnaType attribute

• The entry DN to use as the base to search for entries, set in the dnaScope attribute

• The search filter to use to identify entries to manage, set in the dnaFilter attribute

• The next available value to assign, set in the dnaNextValue attribute (after the entry is created,this is handled by the plug-in)

For example:

dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=configobjectClass: topobjectClass: extensibleObjectcn: Account UIDsdnatype: uidNumberdnafilter: (objectclass=posixAccount)dnascope: ou=people, dc=example,dc=comdnaNextValue: 1

If multiple suppliers are configured for distributed numeric assignments, then the entry must containthe required information to transfer ranges:

• The maximum number that the server can assign; this sets the upward bound for the range, whichis logically required when multiple servers are assigning numbers. This is set in the dnaMaxValueattribute.

• The threshold where the range is low enough to trigger a range transfer, set in the dnaThresholdattribute. If this is not set, the default value is 1.

• A timeout period so that the server does not hang waiting for a transfer, set in thednaRangeRequestTimeout attribute. If this is not set, the default value is 10, meaning 10seconds.

• A configuration entry DN which is shared among all supplier servers, which stores the rangeinformation for each supplier, set in the dnaSharedCfgDN attribute.

Page 156: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

136

The specific number range which could be assigned by the server is defined in the dnaNextRangeattribute. This shows the next available range for transfer and is managed automatically by the plug-in, as ranges are assigned or used by the server. This range is just "on deck." It has not yet beenassigned to another server and is still available for its local Directory Server to use.

dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=configobjectClass: topobjectClass: extensibleObjectcn: Account UIDsdnatype: uidNumberdnafilter: (objectclass=posixAccount)dnascope: ou=People, dc=example,dc=comdnanextvalue: 1dnaMaxValue: 1300dnasharedcfgdn: cn=Account UIDs,ou=Ranges,dc=example,dc=comdnathreshold: 100dnaRangeRequestTimeout: 60dnaNextRange: 1301-2301

The dnaNextRange attribute should be set explicitly only if a separate, specific range has to beassigned to other servers. Any range set in the dnaNextRange attribute must be unique from theavailable range for the other servers to avoid duplication. If there is no request from the other serversand the server where dnaNextRange is set explicitly has reached its set dnaMaxValue, the next setof values (part of the dnaNextRange) is allocated from this deck.

The dnaNextRange allocation is also limited by the dnaThreshold attribute that is set in the DNAconfiguration. Any range allocated to another server for dnaNextRange cannot violate the thresholdfor the server, even if the range is available on the deck of dnaNextRange.

NOTEIf the dnaNextRange attribute is handled internally if it is not set explicitly. When it ishandled automatically, the dnaMaxValue attribute serves as upper limit for the nextrange.

All of the attributes available for a DNA Plug-in instance are listed in Table 3.5, “DNA Entry Attributes”.

Plug-in Attribute Description

cn Gives a unique name for the plug-in instance.

dnaType Contains the name of the attribute for whichunique numbers are assigned.

dnaScope Sets the base DN to use to search for entries towhich to apply the managed ranges.

dnaFilter Gives an LDAP filter to use to specify the kindsof entries for the plug-in to manage.

dnaNextValue Gives the next available number to assign. Thisis initially set manually when the entry is created;afterward, it is managed by the plug-in.

dnaMaxValue Optionally, the upper limit of the range that theserver can assign. Defining the range is requiredwhen there are multiple servers assigning

Page 157: Red Hat Directory Server 5.1

Configuring Unique Number Assignments

137

Plug-in Attribute Descriptionnumbers to entries. The default value is -1,which is the same as the highest 64-bit integer.

dnaThreshold Sets a limit on the amount of remaining availablenumbers before the server requests a newrange.

dnaSharedCfgDN Specifies the DN of a container entry that eachsupplier server shares. The plug-in automaticallycreates an entry for the individual instancesunderneath this entry which contains theiravailable ranges. The plug-in can use thisinformation to request and transfer ranges asservers consume their available range.

dnaNextRange Shows the next range of numbers which areavailable to be transferred. This attribute can beset automatically by the plug-in according to thethreshold and shared configuration information;this can also be set manually for an administratorto specifically assign an additional range ofvalues to a server. This attribute is always limitedby the dnaThreshold settings.

dnaRangeRequestTimeout Sets a timeout period for a range request so thata server does not hang indefinitely waiting for atransfer.

dnaMagicRegen Sets a word or number (outside of the assignedrange) which automatically triggers the plug-in toassign a number to an attribute. This is a usefuldefault to use for importing entries.

dnaPrefix Sets a string to insert in front of whatevernumber is assigned. For example, if the prefixis user and the assigned number for theattribute is 1001, then the final assigned value isuser1001.

Table 3.5. DNA Entry Attributes

3.6.3. Configuring Unique Number AssignmentsThe unique number distribution is configured by creating different instances of the DNA Plug-in. TheseDNA Plug-in instances can only be created through the command line, but they can be edited throughthe Directory Server Console.

3.6.3.1. Configuring Unique Number Assignments

NOTEAny attribute which has a unique number assigned to it must have an equality index setfor it. The server must perform a sorted search, internally, to see if the dnaNextvalue

Page 158: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

138

is already taken, which requires an equality index on an integer attribute, with the properordering matching rule.

Creating indexes is described in Section 11.2, “Creating Standard Indexes”.

NOTESet up the DNA Plug-in on every supplier server, and be careful not to overlap the numberrange values.

1. Create the shared container entry in the replicated subtree. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: ou=Ranges, dc=example, dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: organizationalUnitou: Ranges

dn: cn=Account UIDs, ou=Ranges, dc=example, dc=comobjectclass: topobjectclass: extensibleObjectcn: Account UIDs

2. Enable the DNA Plug-in. By default, the plug-in entry (which is the container entry) is disabled.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginEnablednsslapd-pluginEnabled: on

3. Create the new DNA Plug-in instance beneath the container entry.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=configobjectClass: topobjectClass: extensibleObjectcn: Account UIDsdnatype: uidNumberdnafilter: (objectclass=posixAccount)dnascope: ou=People, dc=example,dc=comdnanextvalue: 1dnaMaxValue: 1300dnasharedcfgdn: cn=Account UIDs,ou=Ranges,dc=example,dc=comdnathreshold: 100dnaRangeRequestTimeout: 60dnaMagicRegen: magic

Page 159: Red Hat Directory Server 5.1

Configuring Unique Number Assignments

139

4. Restart the server to load the new plug-in instance.

service dirsrv restart instance_name

3.6.3.2. Editing the DNA Plug-in in the Console

NOTEAny attribute which has a unique number assigned to it must have an equality index setfor it. The server must perform a sorted search, internally, to see if the dnaNextvalueis already taken, which requires an equality index on an integer attribute, with the properordering matching rule.

Creating indexes is described in Section 11.2, “Creating Standard Indexes”.

The Directory Server Console can be used to edit the DNA Plug-in instances.

1. Click the Directory tab.

2. Open the config folder, and then expand the plugins folder.

3. Click the Distributed Numeric Assignment plug-in folder. All of the DNA Plug-in instances arelisted in the main window.

4. Highlight the DNA instance entry, and right-click on the Advanced link to open the property editor.

5. Edit the DNA-related attributes.

Page 160: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

140

3.7. Enforcing Attribute UniquenessAttribute uniqueness means that the Directory Server requires that all new or edited attributes alwayshave unique values. Attribute uniqueness is enforced through a plug-in. A new instance of the AttributeUniqueness Plug-in must be created for every attribute for which values must be unique.

3.7.1. Overview of Attribute UniquenessThe Attribute Uniqueness Plug-in is a preoperation plug-in. This means that the plug-in checks allupdate operations before the server performs an LDAP operation. The plug-in determines whether theoperation applies to an attribute and a suffix that it is configured to monitor.

If an update operation applies to an attribute and suffix monitored by the plug-in and it would causetwo entries to have the same attribute value, then the server terminates the operation and returns anLDAP_CONSTRAINT_VIOLATION error to the client.

Page 161: Red Hat Directory Server 5.1

Attribute Uniqueness Plug-in Syntax

141

Each instance of the Attribute Uniqueness Plug-in performs a check on a single attribute for one ormore subtrees. To check uniqueness of several attributes, a separate instance of the plug-in must becreated for each attribute to check.

The Attribute Uniqueness Plug-in can operate in specific, user-defined ways:

• It can check every entry in the specified subtrees.

For example, if a company, example.com, hosts the directories forexample_a.com and example_b.com, when an entry such asuid=jdoe,ou=people,o=example_a,dc=example,dc=com is added, uniqueness needs to beenforced only in the o=example_a,dc=example,dc=com subtree. This is done by listing the DNof the subtree explicitly in the Attribute Uniqueness Plug-in configuration.

• Specify an object class pertaining to an entry in the DN of the updated entry and perform theuniqueness check on all the entries beneath it.

This option is useful in hosted environments. For example, when adding an entry such asuid=jdoe,ou=people,o=example_a,dc=example,dc=com, enforce uniqueness underthe o=example_a,dc=example,dc=com subtree without listing this subtree explicitly in theconfiguration but, instead, by indicating a marker object class. If the marker object class is set toorganization, the uniqueness check algorithm locates the entry in the DN that has this objectclass (o=example_a) and performs the check on all entries beneath it.

Additionally, it is possible to check uniqueness only if the updated entry includes a specifiedobject class. For example, a check may be performed only if the updated entry includesobjectclass=inetorgperson.

Directory Server provides a default instance of the Attribute Uniqueness Plug-in for the uid attributewhen the Directory Server was first set up. This plug-in instance ensures that values given to the uidattribute are unique in the root suffix (the suffix corresponding to the userRoot database).

This plug-in is disabled by default because it affects the operation of multi-master replication. Forinformation on using the attribute uniqueness plug-in in a replicated environment, see Section 3.7.6,“Replication and the Attribute Uniqueness Plug-in”.

3.7.2. Attribute Uniqueness Plug-in SyntaxConfiguration information for the Attribute Uniqueness Plug-in is specified in an entry undercn=plugins,cn=config entry. There are two possible syntaxes for nsslapd-pluginargattributes.

NOTETo enforce uniqueness of another attribute than the ones in these example, copy andpaste the default Attribute Uniqueness Plug-in entry, and being care to change only theattributes described here.

Use the following syntax to perform the uniqueness check under a suffix or subtree:

dn: cn=descriptive_plugin_name,cn=plugins,cn=config ... nsslapd-pluginEnabled: state

Page 162: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

142

nsslapd-pluginarg0: attribute_name nsslapd-pluginarg1: dn1 nsslapd-pluginarg2: dn2 ...

• Any value can be given to the cn attribute to name the plug-in. The name should be descriptive.

• The cn attribute does not contain the name of the attribute which is checked for uniqueness.

• Only one attribute can be specified on which the uniqueness check will be performed.

• It is possible to specify several DNs of suffixes or subtrees in which to perform the uniquenesscheck by incrementing the nsslapd-pluginarg attribute suffix by one each time.

The variable components of the Attribute Uniqueness Plug-in syntax are described in Table 3.6,“Attribute Uniqueness Plug-in Variables”.

Use the following syntax to specify to perform the uniqueness check below an entry containing aspecified object class:

dn: cn=descriptive_plugin_name,cn=plugins,cn=config ... nsslapd-pluginEnabled: state nsslapd-pluginarg0: attribute=attribute_name nsslapd-pluginarg1: markerObjectClass=objectclass1 nsslapd-pluginarg2: requiredObjectClass=objectclass2 ...

• Any value can be given to the cn attribute to name the plug-in. The name should be descriptive.

• The cn attribute does not contain the name of the attribute which is checked for uniqueness.

• Only one attribute can be specified on which the uniqueness check will be performed.

• If the nsslapd-pluginarg0 attribute begins with attribute=attribute_name, then the serverexpects the nsslapd-pluginarg1 attribute to include a markerObjectClass value.

The variable components of the attribute uniqueness plug-in syntax are described in Table 3.6,“Attribute Uniqueness Plug-in Variables”.

Variable Definition

descriptive_plugin_name Specifies the name of this instance ofthe Attribute Uniqueness Plug-in. It is notrequired that the name of the attribute forwhich to ensure uniqueness be included,but it is advisable. For example, cn=mailuniqueness,cn=plugins,cn=config.

state Defines whether the plug-in is enabled ordisabled. Acceptable values are on or off.

attribute_name The name of the attribute for which to ensureunique values. Only one attribute can be named.

dn The DN of the suffix or subtree in which toensure attribute uniqueness. To specify severalsuffixes or subtrees, increment the suffix of the

Page 163: Red Hat Directory Server 5.1

Creating an Instance of the Attribute Uniqueness Plug-in

143

Variable Definitionnsslapd-pluginarg attribute by one for eachadditional suffix or subtree.

attribute= attribute_name The name of the attribute for which to ensureunique values. Only one attribute can be named.

markerObjectClass= objectclass1 Attribute uniqueness will be checked underthe entry belonging to the DN of the updatedentry that has the object class specified in themarkerObjectClass keyword. Do not includea space before or after the equals sign.

requiredObjectClass= objectclass2 Optional. When using the markerObjectClasskeyword to specify the scope of the uniquenesscheck instead of a DN, it is also possible tospecify to perform the check only if the updatedentry contains the objectclass specified in therequiredObjectClass keyword. Do notinclude a space before or after the equals sign.

Table 3.6. Attribute Uniqueness Plug-in Variables

3.7.3. Creating an Instance of the Attribute Uniqueness Plug-inTo ensure that a particular attribute in the directory always has unique values, create an instance ofthe Attribute Uniqueness Plug-in for the attribute to check. For example, to ensure that every entryin the directory that includes a mail attribute has a unique value for that attribute, create a mailuniqueness plug-in.

To create an instance of the Attribute Uniqueness Plug-in, modify the Directory Server configurationto add an entry for the new plug-in under the cn=plugins,cn=config entry. The format of the newentry must conform to the syntax described in Section 3.7.2, “Attribute Uniqueness Plug-in Syntax”.

NOTERed Hat strongly encourages you to copy and paste an existing Attribute UniquenessPlug-in entry and only modify the attributes listed below.

For example, to create an instance the Attribute Uniqueness Plug-in for the mail attribute:

1. Stop the Directory Server. Changes to the dse.ldif file are not saved if it is edited while theserver is running.

service dirsrv stop instance_name

2. In the dse.ldif file, locate the entry for the Attribute Uniqueness Plug-in, cn=attributeuniqueness,cn=plugins,cn=config.

3. Copy the entire entry. The entry ends in an empty line; copy the empty line, too.

4. Paste the copied Attribute Uniqueness Plug-in entry at the end of the file.

5. Modify the Attribute Uniqueness Plug-in entry attributes for the new attribute information:

Page 164: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

144

dn: cn=mail uniqueness,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: mailnsslapd-pluginarg1: dc=example,dc=com...

6. Restart the Directory Server.

service dirsrv start instance_name

In this example, the uniqueness check will be performed on every entry in the dc=example,dc=comentry that includes the mail attribute.

3.7.4. Configuring Attribute UniquenessThis section explains how to use Directory Server Console to view the plug-ins configured for thedirectory and how to modify the configuration of the Attribute Uniqueness Plug-ins.

3.7.4.1. Configuring Attribute Uniqueness Plug-ins from the DirectoryServer Console1. In the Directory Server Console, select the Configuration tab; then, in the navigation tree, expand

the Plug-ins folder, and select the Attribute Uniqueness Plug-in to modify.

The configuration parameters for the plug-in are displayed in the right pane.

2. To add a suffix or subtree, click Add, and type a DN in the blank text field.

To delete a suffix from the list, place the cursor in the text field to delete, and click Delete.

To avoid using a DN, enter the markerObjectClass keyword. With this syntax, it is possible toclick Add again to specify a requiredObjectClass, as described in Section 3.7.2, “AttributeUniqueness Plug-in Syntax”.

NOTEDo not add an attribute name to the list. To check the uniqueness of other attributes,create a new instance of the Attribute Uniqueness Plug-in for the attribute to check.For information, see Section 3.7.3, “Creating an Instance of the Attribute UniquenessPlug-in”.

3. Click Save.

3.7.4.2. Configuring Attribute Uniqueness Plug-ins from the CommandLineThis section provides information about configuring the plug-in from the command line.

• Section 3.7.4.2.1, “Specifying a Suffix or Subtree”

Page 165: Red Hat Directory Server 5.1

Configuring Attribute Uniqueness

145

• Section 3.7.4.2.2, “Using the markerObjectClass and requiredObjectClass Keywords”

3.7.4.2.1. Specifying a Suffix or SubtreeThe suffix or subtrees which the plug-in checks to ensure attribute uniqueness are defined using thensslapd-pluginarg attribute in the entry defining the plug-in.

To specify the subtree or subtrees, use ldapmodify to send LDIF update statements, similar to thisexample:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=mail uniqueness,cn=plugins,cn=configchangetype: modifyadd: nsslapd-pluginarg2 nsslapd-pluginarg3nsslapd-pluginarg2: ou=Engineering,dc=example,dc=comnsslapd-pluginarg3: ou=Sales,dc=example,dc=com

This example LDIF statement modified the Attribute Uniqueness Plug-in to checkthe uniqueness of the mail attribute under the subtrees dc=example,dc=com,ou=Engineering,dc=example,dc=com, and ou=Sales,dc=example,dc=com.

Use the ldapmodify command to import the LDIF file into the directory. For detailed information onthe ldapmodify command, see the Directory Server Configuration, Command, and File Reference.

Whenever this type of configuration change is made, restart the server.

service dirsrv restart instance_name

For information on restarting the server, see Section 1.3, “Starting and Stopping Servers”.

3.7.4.2.2. Using the markerObjectClass and requiredObjectClass KeywordsInstead of specifying a suffix or subtree in the configuration of an Attribute Uniqueness Plug-in,perform the check under the entry belonging to the DN of the updated entry that has the object classgiven in the markerObjectClass keyword.

To specify to perform the uniqueness check under the entry in the DN of the updated entry thatcontains the organizational unit (ou) object class, copy and paste an existing Attribute UniquenessPlug-in entry, and change the following attributes:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=mail uniqueness,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: attribute=mailnsslapd-pluginarg1: markerObjectClass=ou...

If the server should not check every entry in the organization unit, limit the scope by setting the checkto be performed only if the updated entry contains a specified object class.

For example, if the uniqueness of the mail attribute is checked, it is probably only necessary toperform the check when adding or modifying entries with the person or inetorgperson objectclass.

Page 166: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

146

Restrict the scope of the check by using the requiredObjectClass keyword, as shown in thefollowing example:

dn: cn=mail uniqueness,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: attribute=mailnsslapd-pluginarg1: markerObjectClass=ounsslapd-pluginarg2: requiredObjectClass=person...

The markerObjectClass or requiredObjectClass keywords cannot be repeated byincrementing the counter in the nsslapd-pluginarg attribute suffix. These keywords can only beused once per Attribute Uniqueness Plug-in instance.

NOTEThe nsslapd-pluginarg0 attribute always contains the name of the attribute for whichto ensure uniqueness.

3.7.5. Attribute Uniqueness Plug-in Syntax ExamplesThis section contains examples of Attribute Uniqueness Plug-in syntax in the dse.ldif file.

• Section 3.7.5.1, “Specifying One Attribute and One Subtree”

• Section 3.7.5.2, “Specifying One Attribute and Multiple Subtrees”

3.7.5.1. Specifying One Attribute and One SubtreeThis example configures the plug-in to ensure the uniqueness of the mail attribute under thedc=example,dc=com subtree.

dn: cn=mail uniqueness,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: mailnsslapd-pluginarg1: dc=example,dc=com...

3.7.5.2. Specifying One Attribute and Multiple SubtreesIt is possible use a single plug-in instance to check for the uniqueness of an attribute within multiplesubtrees, which means that the attribute value must be unique within each subtree but not uniqueacross all subtrees. This example configures the Attribute Uniqueness Plug-in to ensure theuniqueness of the mail attribute for separate subtrees, l=Chicago,dc=example,dc=com andl=Boston,dc=example,dc=com.

dn: cn=mail uniqueness,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: mailnsslapd-pluginarg1: l=Chicago,dc=example,dc=comnsslapd-pluginarg2: l=Boston,dc=example,dc=com

Page 167: Red Hat Directory Server 5.1

Replication and the Attribute Uniqueness Plug-in

147

...

NOTEThe nsslapd-pluginarg0 attribute always contains the name of the attribute for whichto ensure uniqueness. All other occurrences of the nsslapd-pluginarg, such asnsslapd-pluginarg1, contain DNs.

With this configuration, the plug-in allows an instance of a value for the mail attribute toexist once under the l=Chicago,dc=example,dc=com subtree and once under thel=Boston,dc=example,dc=com subtree. For example, the following two attribute-value settings areallowed:

mail=bjensen,l=Chicago,dc=example,dc=commail=bjensen,l=Boston,dc=example,dc=com

To ensure that only one instance of a value exists under both subtrees, configure the plug-in to ensureuniqueness for the entire dc=example,dc=com subtree.

3.7.6. Replication and the Attribute Uniqueness Plug-inWhen using the Attribute Uniqueness Plug-ins on Directory Servers involved in a replicationagreement, carefully consider how to configure the plug-in on each server.

Consider the following cases:

• Simple replication with one supplier and one or several consumers.

• Complex replication with multiple masters.

Attribute Uniqueness Plug-ins do not perform any checking on attribute values when an update isperformed as part of a replication operation.

3.7.6.1. Simple Replication ScenarioBecause all modifications by client applications are performed on the supplier server, the AttributeUniqueness Plug-in should be enabled on the supplier. It is unnecessary to enable it on the consumerserver.

Enabling the Attribute Uniqueness Plug-in on the consumer does not prevent Directory Server fromoperating correctly but is likely to cause a performance degradation.

3.7.6.2. Multi-Master Replication ScenarioIn a multi-master replication scenario, the masters act both as suppliers and consumers of the samereplica. Because multi-master replication uses a loosely consistent replication model, enabling anAttribute Uniqueness Plug-in on one of the servers is not sufficient to ensure that attribute values willbe unique across both supplier servers at any given time. Therefore, enabling an Attribute UniquenessPlug-in on one server can cause inconsistencies in the data held on each replica.

However, it is possible to use an Attribute Uniqueness Plug-in, providing both of the followingconditions are met:

Page 168: Red Hat Directory Server 5.1

Chapter 3. Creating Directory Entries

148

• The attribute on which the uniqueness check is performed is a naming attribute.

• The Attribute Uniqueness Plug-in is enabled on both supplier servers.

When these conditions are met, attribute uniqueness conflicts are reported as naming conflictsat replication time. Naming conflicts require manual resolution. For information on how to resolvereplication conflicts, see Section 8.19, “Solving Common Replication Conflicts”.

Page 169: Red Hat Directory Server 5.1

Chapter 4.

149

Populating Directory DatabasesDatabases contain the directory data managed by the Red Hat Directory Server.

4.1. Importing DataDirectory Server can populate a database with data in one of two ways: by importing data (eitherthrough the Directory Server Console or using the import tools) or by initializing a database forreplication.

Table 4.1, “Import Method Comparison” describes the differences between an import and initializingdatabases.

Action Import Initialize Database

Overwrites database No Yes

LDAP operations Add, modify, delete Add only

Performance More time-consuming Fast

Partition specialty Works on all partitions Local partitions only

Response to server failure Best effort (all changes madeup to the point of the failureremain)

Atomic (all changes are lostafter a failure)

LDIF file location Local to Console Local to Console or local toserver

Imports configurationinformation (cn=config)

Yes No

Table 4.1. Import Method Comparison

4.1.1. Importing Entries with Large AttributesThe nsslapd-cachememsize attribute defines the size allowed for the entry cache.

The import buffer is automatically set to 80% of the cache memory size setting. If the memory cache is1GB, for example, then the import buffer is 800MB.

When importing a very large database or entries with large attributes (often with values like binary datalike certificate chains, CRLs, or images), then set the nsslapd-cachememsize attribute high enoughso that the import buffer has enough memory to process the entries.

4.1.2. Importing a Database from the ConsoleWhen performing an import operation from the Directory Server Console, an ldapmodify operationis executed to append data, as well as to modify and delete entries. The operation is performed on allof the databases managed by the Directory Server and on remote databases to which the DirectoryServer has a configured database link.

You must be logged in as the Directory Manager in order to perform an import.

Page 170: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

150

NOTEThe LDIF files used for import operations must use UTF-8 character set encoding. Importoperations do not convert data from local character set encoding to UTF-8 charactersetencoding.

WARNINGAll imported LDIF files must also contain the root suffix.

To import data from the Directory Server Console:

1. Select the Tasks tab. Scroll to the bottom of the screen, and select Import Database.

Alternatively, open the Configuration tab and select Import from the Console menu.

2. In the Import Database dialog box, enter the full path to the LDIF file to import in the LDIF filefield, or click Browse to select the file to import.

If the Console is running on a machine remote to the directory, the field name appears as LDIFfile (on the machine running the Console). When browsing for a file, you are not browsingthe current directory for the Directory Server host, but the filesystem of the machine running theConsole.

3. In the Options box, select one or both of the following options:

Page 171: Red Hat Directory Server 5.1

Initializing a Database from the Console

151

• Add Only. The LDIF file may contain modify and delete instructions in addition to the default addinstructions. For the server to ignore operations other than add, select the Add only checkbox.

• Continue on Error. Select the Continue on error checkbox for the server to continue with theimport even if errors occur. For example, use this option to import an LDIF file that containssome entries that already exist in the database in addition to new ones. The server notesexisting entries in the rejects file while adding all new entries.

4. In the File for Rejects field, enter the full path to the file in which the server is to record all entriesit cannot import, or click Browse to select the file which will contain the rejects.

A reject is an entry which cannot be imported into the database; for example, the server cannotimport an entry that already exists in the database or an entry that has no parent object. TheConsole will write the error message sent by the server to the rejects file.

Leaving this field blank means the server will not record rejected entries.

The server performs the import and also creates indexes.

NOTETrailing spaces are dropped during a remote Console import but are preserved duringboth local Console or ldif2db import operations.

4.1.3. Initializing a Database from the ConsoleThe existing data in a database can be overwritten by initializing databases.

You must be logged in as the Directory Manager in order to initialize a database because an LDIFfile that contains a root entry cannot be imported into a database except as the Directory Manager(root DN). Only the Directory Manager has access to the root entry, such as dc=example,dc=com.

WARNINGWhen initializing databases from an LDIF file, be careful not to overwrite theo=NetscapeRoot suffix unless you are restoring data. Otherwise, initializing thedatabase deletes information and may require re-installing the Directory Server.

To initialize a database using the Directory Server Console:

1. Select the Configuration tab.

2. Expand the Data tree in the left navigation pane. Expand the suffix of the database to initialize,then click the database itself.

3. Right-click the database, and select Initialize Database.

Page 172: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

152

Alternatively, select Initialize Database from the Object menu.

4. In the LDIF file field, enter the full path to the LDIF file to import, or click Browse.

5. If the Console is running from a machine local to the file being imported, click OK and proceedwith the import immediately. If the Console is running from a machine remote to the servercontaining the LDIF file, select one of the following options, then click OK:

• From local machine. Indicates that the LDIF file is located on the local machine.

• From server machine. Indicates that the LDIF file is located on a remote server.

The default LDIF directory is /var/lib/dirsrv/slapd-instance_name/ldif. 1

Page 173: Red Hat Directory Server 5.1

Importing from the Command Line

153

4.1.4. Importing from the Command LineThere are four methods for importing data through the command line:

• Using ldif2db. This import method overwrites the contents of the database and requires the server tobe stopped; see Section 4.1.4.1, “Importing Using the ldif2db Command-Line Script”.

• Using ldif2db.pl. This import method overwrites the contents of the database while the server is stillrunning; see Section 4.1.4.2, “Importing Using the ldif2db.pl Perl Script”.

• Using ldif2ldap. This method appends the LDIF file through LDAP. This method is useful to appenddata to all of the databases; see Section 4.1.4.3, “Importing Using the ldif2ldap Command-LineScript”.

• Creating a cn=tasks entry. This method creates a temporary task entry which automatically launchesan import operation. This is functionally like running ldif2db. See Section 4.1.4.4, “Importingthrough the cn=tasks Entry”.

NOTEThe LDIF files used for import operations must use UTF-8 character set encoding. Importoperations do not convert data from local character set encoding to UTF-8 charactersetencoding.

WARNINGAll imported LDIF files must also contain the root suffix.

NOTETo import a database that has been encrypted, use the -E option with the script. SeeSection 2.2.3.5, “Exporting and Importing an Encrypted Database” for more information.

4.1.4.1. Importing Using the ldif2db Command-Line ScriptThe ldif2db script overwrites the data in the specified database. Also, the script requires that theDirectory Server be stopped when the import begins.

By default, the script first saves and then merges any existing o=NetscapeRoot configurationinformation with the o=NetscapeRoot configuration information in the files being imported.

WARNINGThis script overwrites the data in the database.

To import LDIF:

1. Stop the server. 2

Page 174: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

154

service dirsrv stop instance

2. Open the Directory Server instance directory.

cd /etc/dirsrv/slapd-instance_name

3. Run the ldif2db command-line script.

ldif2db -n Database1 -i /var/lib/dirsrv/slapd-instance_name/ldif/demo.ldif -i /var/lib/dirsrv/slapd-instance_name/ldif/demo2.ldif

For more information about using this script, see the Directory Server Configuration, Command,and File Reference.

WARNINGIf the database specified in the -n option does not correspond with the suffixcontained by the LDIF file, all of the data contained by the database is deleted, andthe import fails. Make sure that the database name is not misspelled.

Option Description

-i Specifies the full path name of the LDIF files tobe imported. This option is required. To importmore than one LDIF file at a time, use multiple -i arguments. When multiple files are imported,the server imports the LDIF files in the orderwhich they are specified from the command line.

-n Specifies the name of the database to which toimport the data.

Table 4.2. ldif2db Parameters

For more information about using this script, see the Directory Server Configuration, Command, andFile Reference.

4.1.4.2. Importing Using the ldif2db.pl Perl ScriptAs with the ldif2db script, the ldif2db.pl script overwrites the data in the specified database.This script requires the server to be running in order to perform the import.

WARNINGThis script overwrites the data in the database.

1. Open the Directory Server instance directory.

cd /etc/dirsrv/slapd-instance_name

Page 175: Red Hat Directory Server 5.1

Importing from the Command Line

155

2. Run the ldif2db script.

ldif2db -D "cn=Directory Manager" -w secret -i /var/lib/dirsrv/slapd-instance_name/ldif/demo.ldif -n Database1

For more information about using this script, see the Directory Server Configuration, Command,and File Reference.

NOTEYou do not need root privileges to run the script, but you must authenticate as theDirectory Manager.

Option Description

-D Specifies the DN of the administrative user.

-w Specifies the password of the administrativeuser.

-i Specifies the LDIF files to be imported. Thisoption is required. To important multiple LDIFfiles at a time, use multiple -i arguments. Whenmultiple files are imported, the server imports theLDIF files in the order they are specified in thecommand line.

-n Specifies the name of the database to which toimport the data.

Table 4.3. ldif2db Options

4.1.4.3. Importing Using the ldif2ldap Command-Line ScriptThe ldif2ldap script appends the LDIF file through LDAP. Using this script, data are importedto all directory databases at the same time. The server must be running in order to import usingldif2ldap.

To import LDIF using ldif2ldap:

1. Open the Directory Server instance directory:

cd /etc/dirsrv/slapd-instance_name

2. Run the ldif2ldap command-line script.

ldif2ldap "cn=Directory Manager" secretpwd /var/lib/dirsrv/slapd-instance_name/ldif/demo.ldif

The ldif2ldap script requires the DN of the administrative user, the password of theadministrative user, and the absolute path and filename of the LDIF files to be imported.

For more information about using this script, see the Directory Server Configuration, Command,and File Reference.

Page 176: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

156

4.1.4.4. Importing through the cn=tasks EntryThe cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=import, cn=tasks, cn=config to initiate an import operation.

As with the ldif2db and ldif2db.pl scripts, an import operation in cn=tasks overwrites all of theinformation in the database.

This task entry requires three attributes:

• A unique name (cn)

• The filename of the LDIF file to import (nsFilename)

• The name of the database into which to import the file (nsInstance)

It is also possible to supply the DNs of suffixes to include or exclude from the import, analogous to the-s and -x options, respectively, for the ldif2db and ldif2db.pl scripts.

The entry is simply added using ldapmodify, as described in Section 3.2.4, “Adding and ModifyingEntries Using ldapmodify”. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example import, cn=import, cn=tasks, cn=configobjectclass: extensibleObjectcn: example importnsFilename: /home/files/example.ldifnsInstance: userRootnsIncludeSuffix: ou=People,dc=example,dc=comnsExcludeSuffix: ou=Groups,dc=example,dc=com

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on theavailable attributes for running Directory Server import tasks under the cn=tasks entries.

4.2. Exporting DataLDAP Data Interchange Format (LDIF) files are used to export database entries from the DirectoryServer databases. LDIF is a standard format described in RFC 2849, The LDAP Data InterchangeFormat (LDIF) - Technical Specification.

Exporting data can be useful for the following:

• Backing up the data in the database.

• Copying data to another Directory Server.

• Exporting data to another application.

• Repopulating databases after a change to the directory topology.

For example, if a directory contains one database, and its contents are split into two databases, thenthe two new databases receive their data by exporting the contents of the old databases and importing

Page 177: Red Hat Directory Server 5.1

Exporting Data

157

it into the two new databases, as illustrated in Figure 4.1, “Splitting a Database Contents into TwoDatabases”.

NOTEThe export operations do not export the configuration information (cn=config), schemainformation (cn=schema), or monitoring information (cn=monitor).

Figure 4.1. Splitting a Database Contents into Two Databases

The Directory Server Console or command-line utilities can be used to export data.

• Section 4.2.1, “Exporting Directory Data to LDIF Using the Console”

• Section 4.2.2, “Exporting a Single Database to LDIF Using the Console”

• Section 4.2.3, “Exporting to LDIF from the Command Line”

WARNINGDo not stop the server during an export operation.

Page 178: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

158

4.2.1. Exporting Directory Data to LDIF Using the ConsoleSome or all of directory data can be exported to LDIF, depending upon the location of the finalexported file. When the LDIF file is on the server, only the data contained by the databases local to theserver can be exported. If the LDIF file is remote to the server, all of the databases and database linkscan be exported.

Export directory data to LDIF from the Directory Server Console while the server is running, and do thefollowing:

1. Select the Tasks tab. Scroll to the bottom of the screen, and click Export Database(s).

Alternatively, select the Configuration tab and click the Export from the Console menu.

2. Enter the full path and filename of the LDIF file in the LDIF File field, or click Browse to locate thefile.

Browse is not enabled if the Console is running on a remote server. When the Browsebutton is not enabled, the file is stored in the default directory, /var/lib/dirsrv/slapd-instance_name/ldif. 1

3. If the Console is running on a machine remote to the server, two radio buttons are displayedbeneath the LDIF File field.

• Select To local machine to export the data to an LDIF file on the machine from which theConsole is running.

• Select To server machine to export to an LDIF file located on the server's machine.

4. To export the whole directory, select the Entire database radio button.

To export only a single subtree of the suffix contained by the database, select the Subtree radiobutton, and then enter the name of the suffix in the Subtree text box. This option exports a subtreethat is contained by more than one database.

Alternatively, click Browse to select a suffix or subtree.

Page 179: Red Hat Directory Server 5.1

Exporting a Single Database to LDIF Using the Console

159

4.2.2. Exporting a Single Database to LDIF Using the ConsoleIt is also possible to export a single database to LDIF. Do the following while the server is running:

1. Select the Configuration tab.

2. Expand the Data tree in the left navigation pane. Expand the suffix, and select the database underthe suffix.

3. Right-click the database, and select Export Database.

Alternatively, select Export Database from the Object menu.

4. In the LDIF file field, enter the full path to the LDIF file, or click Browse.

When the Browse button is not enabled, the file is stored in the default directory, /var/lib/dirsrv/slapd-instance_name/ldif. 1

Page 180: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

160

4.2.3. Exporting to LDIF from the Command LineThere are three methods for exporting data through the command line:

• Using db2ldif. This method runs the command-line utility; unlike the import script, ldif2db, thisutility can be run while the server is running.

• Using db2ldif.pl. This Perl script behaves the same as the db2ldif command-line utility and takesthe same options.

• Creating a cn=tasks entry. This method creates a temporary task entry which automatically launchesan export operation. This is functionally like running db2ldif, with one exception: when runningdb2ldif or db2ldif.pl for a replica (with a -r option, the server must be stopped first. Thecn=tasks entry can be added and export replica information while the server is still running. SeeSection 4.2.3.2, “Exporting through the cn=tasks Entry”.

4.2.3.1. Exporting a Database Using db2ldif or db2ldif.plDatabases can be exported to LDIF using the db2ldif command-line script or the db2ldif.pl Perlscript. Both of these tools export all of the database contents or a part of their contents to LDIF whenthe server is running or stopped.

These script take the same options.

NOTEThe -E option is required to export a database that has been encrypted. SeeSection 2.2.3.5, “Exporting and Importing an Encrypted Database” for more information.

NOTEIf the database being exported is a replica, then the server must be stopped before theexport script is run and the export script must have the -r.

To export to LDIF from the command line:

1. Open the Directory Server instance directory:

cd /etc/dirsrv/slapd-instance_name

2. Run either the db2ldif command-line script or the db2ldif.pl Perl script. For example:

db2ldif -n database1 -a /export/output.ldif

This exports the database contents to /export/output.ldif. If the -a option is not specified,then the database information is exported to /var/lib/dirsrv/slapd-instance_name/ldif/instance_name-database1-date.ldif. For example:

db2ldif -n database1

It is also possible to specify which suffixes to export, using the -s option. For example:

Page 181: Red Hat Directory Server 5.1

Exporting to LDIF from the Command Line

161

db2ldif -s "dc=example,dc=com"

The LDIF file in this case would be /var/lib/dirsrv/slapd-instance_name/ldif/instance_name-example-2009_04_30_112718.ldif, using the name of the suffixrather than the database.

If the suffix specified is a root suffix, such as dc=example,dc=com, then it is not necessary tospecify the database or to use the -n option.

For more information about using these scripts, see the Directory Server Configuration, Command,and File Reference.

Option Description

-n Specifies the name of the database from whichthe file is being exported.

-s Specifies the suffix or suffixes to include inthe export. If the suffix is a root suffix, such asdc=example,dc=com, then the -n option is notrequired. There can be multiple -s arguments.

-a Defines the output file to which DirectoryServer exports the LDIF. This file must be anabsolute path. If the -a option is not given,the output ldif is stored in the the /var/lib/dirsrv/slapd-instance_name/ldifdirectory and is automatically named serverID-database-YYYY_MM_DD_hhmmxx.ldifwith the -n option or serverID-firstsuffixvalue-YYYY_MM_DD_hhmmxx.ldif with the -soption.

-r Specifies that the exported database is aconsumer replica. In this case, the appropriatesettings and entries are included with the LDIF toinitialize the replica when the LDIF is imported.

-E Decrypts an encrypted database so it can beexported.

Table 4.4. db2ldif Options

4.2.3.2. Exporting through the cn=tasks EntryThe cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=export, cn=tasks, cn=config to initiate an export operation.

The export task entry requires three attributes:

• A unique name (cn)

• The filename of the LDIF file to which to export the database (nsFilename)

Page 182: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

162

• The name of the database to export (nsInstance)

It is also possible to supply the DNs of suffixes to include or exclude from the export operation,analogous to the -s and -x options, respectively, for the db2ldif and db2ldif.pl scripts.Additionally, if the database is a replica, then the appropriate replica information can be includedto initialize the new consumer when the LDIF is imported; this is set in the nsExportReplica,corresponding to the -r option.

The entry is simply added using ldapmodify, as described in Section 3.2.4, “Adding and ModifyingEntries Using ldapmodify”. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example export, cn=export, cn=tasks, cn=configobjectclass: extensibleObjectcn: example exportnsInstance: userRootnsFilename: /home/files/example.ldifnsExportReplica: truensIncludeSuffix: ou=People,dc=example,dc=comnsExcludeSuffix: ou=Groups,dc=example,dc=com

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on theavailable attributes for running Directory Server export tasks under the cn=tasks entries.

4.3. Backing up and Restoring DataDatabases can be backed up and restored using the Directory Server Console or a command-linescript.

• Section 4.3.1, “Backing up All Databases”

• Section 4.3.2, “Backing up the dse.ldif Configuration File”

• Section 4.3.3, “Restoring All Databases”

• Section 4.3.4, “Restoring a Single Database”

• Section 4.3.5, “Restoring Databases That Include Replicated Entries”

• Section 4.3.6, “Restoring the dse.ldif Configuration File”

WARNINGDo not stop the server during a backup or restore operation.

4.3.1. Backing up All DatabasesThe following procedures describe backing up all of the databases in the directory using the DirectoryServer Console and from the command line.

Page 183: Red Hat Directory Server 5.1

Backing up All Databases

163

NOTEThese backup methods cannot be used to back up the data contained by databases on aremote server that are chained using database links.

4.3.1.1. Backing up All Databases from the ConsoleWhen backing up databases from the Directory Server Console, the server copies all of the databasecontents and associated index files to a backup location. A backup can be performed while the serveris running.

To back up databases from the Directory Server Console:

1. Select the Tasks tab.

2. Click Back Up Directory Server.

3. Enter the full path of the directory to store the backup file in the Directory text box, or click Usedefault, and the server provides a name for the backup directory.

If the Console is running on the same machine as the directory, click Browse to select a localdirectory.

With the default location, the backup files are placed in /var/lib/dirsrv/slapd-instance_name/bak. 1 By default, the backup directory name contains the nameof the server instance and the time and date the backup was created (instance_name-YYYY_MM_DD_hhmmss).

4.3.1.2. Backing up All Databases from the Command LineDatabases can be backed up from the command line using the db2bak command-line script. Thisscript works when the server is running or when the server is stopped.

Page 184: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

164

Configuration information cannot be backed up using this backup method. For information on backingup the configuration information, see Section 4.3.2, “Backing up the dse.ldif Configuration File”.

To back up the directory from the command line using the db2bak script:

1. Open the Directory Server instance directory:

cd /etc/dirsrv/slapd-instance_name

2. Run the db2bak command-line script.

db2bak /var/lib/dirsrv/slapd-instance_name/bak/instance_name-2009_04_30_16_27_56

For more information about using this script, see the Directory Server Configuration, Command, andFile Reference.

The backup directory where the server saves the backed up databases can be specified withthe script. If a directory is not specified, the backup file is stored in /var/lib/dirsrv/slapd-instance_name/bak. 1 By default, the backup directory is named with the Directory Serverinstance name and the date of the backup (serverID-YYYY_MM_DD_hhmmss).

4.3.1.3. Backing up the Database through the cn=tasks EntryThe cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=backup, cn=tasks, cn=config to initiate a backup operation.

The backup task entry requires three attributes:

• A unique name (cn).

• The directory to write the backup file to (nsArchiveDir). The backup file is named with theDirectory Server instance name and the date of the backup (serverID-YYYY_MM_DD_hhmmss).

• The type of database (nsDatabaseType); the only option is ldbm database.

The entry is simply added using ldapmodify, as described in Section 3.2.4, “Adding and ModifyingEntries Using ldapmodify”. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example backup, cn=backup, cn=tasks, cn=configobjectclass: extensibleObjectcn: example backupnsArchiveDir: /export/backups/nsDatabaseType: ldbm database

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on theavailable attributes for running tasks to back up databases under the cn=tasks entries.

Page 185: Red Hat Directory Server 5.1

Backing up the dse.ldif Configuration File

165

4.3.2. Backing up the dse.ldif Configuration FileDirectory Server automatically backs up the dse.ldif configuration file. When the DirectoryServer is started, the directory creates a backup of the dse.ldif file automatically in a file nameddse.ldif.startOK in the /etc/dirsrv/slapd-instance_name directory.

When the dse.ldif file is modified, the file is first backed up to a file called dse.ldif.bak in the /etc/dirsrv/slapd-instance_name directory before the directory writes the modifications to thedse.ldif file.

4.3.3. Restoring All DatabasesThe following procedures describe restoring all of the databases in the directory using the DirectoryServer Console and from the command line.

NOTEWhile restoring databases, the server must be running. However, the databases will beunavailable for processing operations during the restore.

4.3.3.1. Restoring All Databases from the ConsoleIf the databases become corrupted, restore data from a previously generated backup using theDirectory Server Console. This process consists of stopping the server and then copying thedatabases and associated index files from the backup location to the database directory.

WARNINGRestoring databases overwrites any existing database files.

To restore databases from a previously created backup:

1. In the Directory Server Console, select the Tasks tab.

2. Click Restore Directory Server.

3. Select the backup from the Available Backups list, or enter the full path to a valid backup in theDirectory text box.

Page 186: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

166

The Available Backups list shows all backups located in the default directory, /var/lib/dirsrv/slapd-instance_name/bak/backup_directory. 1 backup_directory is the directory ofthe most recent backup, in the form serverID-YYYY_MM_DD_hhmmss.

4.3.3.2. Restoring Your Database from the Command LineThere are three ways to restore databases from the command line:

• Using the bak2db command-line script. This script requires the server to be shut down.

• Using the bak2db.pl Perl script. This script works while the server is running.

• Creating a temporary entry under cn=restore, cn=tasks, cn=config. This method can alsobe run while the server is running.

4.3.3.2.1. Using the bak2db Command-Line Script1. If the Directory Server is running, stop it:2

service dirsrv stop instance

2. Open the Directory Server instance directory:

cd /etc/dirsrv/slapd-instance_name

3. Run the bak2db command-line script. The bak2db script requires the full path and name of theinput file.

bak2db /var/lib/dirsrv/slapd-instance_name/bak/instance_name-2009_04_30_11_48_30

For more information about using this script, see the Directory Server Configuration, Command,and File Reference.

4.3.3.2.2. Using bak2db.pl Perl Script1. Open the Directory Server instance directory:

cd /etc/dirsrv/slapd-instance_name

Page 187: Red Hat Directory Server 5.1

Restoring a Single Database

167

2. Run the bak2db.pl Perl script.

bak2db.pl -D "cn=Directory Manager" -w secret -a /var/lib/dirsrv/slapd-instance_name/bak/instance_name-2009_04_30_11_48_30

For more information on using this Perl script, see the Directory Server Configuration, Command,and File Reference.

Option Description

-a Defines the full path and name of the input file.

-D Specifies the DN of the administrative user.

-w Specifies the password of the administrativeuser.

4.3.3.2.3. Restoring the Database through the cn=tasks EntryThe cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=restore, cn=tasks, cn=config to initiate a restore operation.

The restore task entry requires three attributes, the same as the backup task:

• A unique name (cn).

• The directory from which to retrieve the backup file (nsArchiveDir).

• The type of database (nsDatabaseType); the only option is ldbm database.

The entry is simply added using ldapmodify, as described in Section 3.2.4, “Adding and ModifyingEntries Using ldapmodify”. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example restore, cn=restore, cn=tasks, cn=configobjectclass: extensibleObjectcn: example restorensArchiveDir: /export/backups/nsDatabaseType: ldbm database

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on theavailable attributes for running database restore tasks under the cn=tasks entries.

4.3.4. Restoring a Single DatabaseIt is possible to restore a single database through the command line, but not in the Directory ServerConsole. To restore a single database:

1. Stop the Directory Server if it is running.2

service dirsrv stop instance

Page 188: Red Hat Directory Server 5.1

Chapter 4. Populating Directory Databases

168

2. Restore the backend from the /var/lib/dirsrv/slapd-instance_name/bak archives withthe bak2db script, using the -n parameter to specify the database name. For example:

bak2db /var/lib/dirsrv/slapd-instance_name/bak/backup_file -n userRoot

3. Restart the Directory Server.

service dirsrv start instance

NOTEIf the Directory Server fails to start, remove the database transaction log files in /var/lib/dirsrv/slapd-instance_name/db/log.###, then retry starting theserver.

4.3.5. Restoring Databases That Include Replicated EntriesIf a database that supplies entries to other servers is restored, then you must reinitialize all of theservers that receive updates from the restored database (for example, consumer servers, hub servers,and, in multi-master replication environments, other supplier servers). The changelog associatedwith the restored database will be erased during the restore operation. A message will be logged tothe supplier servers' log files indicating that reinitialization is required. If a database containing datareceived from a supplier server is restored, then one of two situations can occur:

• Changelog entries have not yet expired on the supplier server.

If the supplier's changelog has not expired since the database backup was taken, then restorethe local consumer and continue with normal operations. This situation occurs only if the backupwas taken within a period of time that is shorter than the value set for the maximum changelogage attribute, nsslapd-changelogmaxage, in the cn=changelog5,cn=config entry. Formore information about this option, see the Directory Server Configuration, Command, and FileReference.

Directory Server automatically detects the compatibility between the replica and its changelog. If amismatch is detected, the server removes the old changelog file and creates a new, empty one.

• Changelog entries have expired on the supplier server since the time of the local backup.

If changelog entries have expired, reinitialize the consumer. For more information on reinitializingconsumers, refer to Section 8.10, “Initializing Consumers”.

For information on managing replication, see Chapter 8, Managing Replication.

4.3.6. Restoring the dse.ldif Configuration FileThe directory creates two backup copies of the dse.ldif file in the /etc/dirsrv/slapd-instance_name directory. The dse.ldif.startOK file records a copy of the dse.ldiffile at server start up. The dse.ldif.bak file contains a backup of the most recent changes to thedse.ldif file. Use the version with the most recent changes to restore the directory.

To restore the dse.ldif configuration file:

Page 189: Red Hat Directory Server 5.1

Restoring the dse.ldif Configuration File

169

1. Stop the server.2

service dirsrv stop instance

2. Restore the database as outlined in Section 4.3.4, “Restoring a Single Database” to copy thebackup copy of the dse.ldif file into the directory.

3. Restart the server.

service dirsrv restart instance

Page 190: Red Hat Directory Server 5.1

170

Page 191: Red Hat Directory Server 5.1

Chapter 5.

171

Organizing Entries with Roles, Class ofService, and ViewsEntries contained within the directory can be grouped in different ways to simplify the managementof user accounts. Red Hat Directory Server supports a variety of methods for grouping entries andsharing attributes between entries. To take full advantage of the features offered by roles and class ofservice, determine the directory topology when planning the directory deployment.

5.1. Using RolesRoles are an entry grouping mechanism that unify the static and dynamic groups described in theprevious sections. Roles are designed to be more efficient and easier to use for applications. Forexample, an application can get the list of roles of which an entry is a member by querying the entryitself, rather than selecting a group and browsing the members list of several groups.

This section contains the following topics:

• Section 5.1.1, “About Roles”

• Section 5.1.2, “Managing Roles Using the Console”

• Section 5.1.3, “Managing Roles Using the Command Line”

• Section 5.1.4, “Using Roles Securely”

5.1.1. About RolesRed Hat has two kinds of groups. Static groups have a finite and defined list of members. Dynamicgroups used filters to recognize which entries are members of the group, so the group membershipis constantly changed as the entries which match the group filter change. (Both kinds of groups aredescribed in Section 5.4, “Using Groups”).

Roles are a sort of hybrid group, behaving as both a static and a dynamic group. With a group, entriesare added to a group entry as members. With a role, the role attribute is added to an entry and thenthat attribute is used to identify members in the role entry automatically.

Roles effectively organize users in a number of different ways:

• Explicitly listing role members. Viewing the role will display the complete list of members for thatrole. The role itself can be queried to check membership (which is not possible with a dynamicgroup).

• Showing to what roles an entry belongs. Because role membership is determined by an attribute onan entry, simply viewing an entry will show all of the roles to which it belongs. This is similar to thememberOf attributes for groups.

• Assigning the appropriate roles. Role membership is assigned through the entry, not through therole, so the roles to which a user belongs can be easily assigned and removed by editing the entry,in a single step.

Managed roles can do everything that can normally be done with static groups. The role members canbe filtered using filtered roles, similarly to the filtering with dynamic groups. Roles are easier to usethan groups, more flexible in their implementation, and reduce client complexity.

Page 192: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

172

However, evaluating roles is more resource-intensive for the Directory Server than evaluating groupsbecause the server does the work for the client application. With roles, the client application can checkrole membership by searching the nsRole attribute. The nsRole attribute is a computed attribute,which identifies to which roles an entry belongs; the nsRole attribute is not stored with the entryitself. From the client application point of view, the method for checking membership is uniform and isperformed on the server side.

NOTEThe nsRole attribute is an operational attribute. In LDAP, operational attributes must berequested explicitly in the search attributes list; they are not returned by default with theregular attributes in the schema of the entry. For example, this ldapsearch commandreturns the list of roles of which uid=scarter is a member, in addition to the regularattributes for the entry:

ldapsearch ... args ... “(uid=scarter)” \* nsRole

Be sure to use the nsRole attribute, not the nsRoleDN attribute, to evaluate rolemembership.

The Console will automatically show the roles.

Role members are entries that possess the role. Members can be specified either explicitly ordynamically. How role membership is specified depends upon the type of role. Directory Serversupports three types of roles:

• Managed roles have an explicit enumerated list of members.

• Filtered roles are assigned entries to the role depending upon the attribute contained by each entry,specified in an LDAP filter. Entries that match the filter possess the role.

• Nested roles are roles that contain other roles.

For more information about how roles work, see the Directory Server Deployment Guide.

The concept of activating/inactivating roles allows entire groups of entries to be activated orinactivated in just one operation. That is, the members of a role can be temporarily disabled byinactivating the role to which they belong.

When a role is inactivated, it does not mean that the user cannot bind to the server using thatrole entry. The meaning of an inactivated role is that the user cannot bind to the server using anyof the entries that belong to that role; the entries that belong to an inactivated role will have thensAccountLock attribute set to true.

When a nested role is inactivated, a user cannot bind to the server if it is a member of any role withinthe nested role. All the entries that belong to a role that directly or indirectly are members of the nestedrole have nsAccountLock set to true. There can be several layers of nested roles, and inactivatinga nested role at any point in the nesting wil inactivate all roles and users beneath it.

NOTEThe nsAccountLock attribute is an operational attribute and must be explicitly requestedin the search command in the list of search attributes. For example:

Page 193: Red Hat Directory Server 5.1

Managing Roles Using the Console

173

ldapsearch ... args ... “(uid=scarter)” \* nsAccountLock

The Console will automatically show the active or inactive status of entries.

5.1.2. Managing Roles Using the ConsoleThis section contains the following procedures for creating and modifying roles:

• Section 5.1.2.1, “Creating a Managed Role”

• Section 5.1.2.2, “Creating a Filtered Role”

• Section 5.1.2.3, “Creating a Nested Role”

• Section 5.1.2.4, “Viewing and Editing an Entry's Roles”

• Section 5.1.2.5, “Modifying a Role Entry”

• Section 5.1.2.6, “Making a Role Inactive or Active”

• Section 5.1.2.7, “Deleting a Role”

When a role is created, determine whether a user can add themselves or remove themselves from therole. See Section 5.1.4, “Using Roles Securely” for more information about roles and access control.

5.1.2.1. Creating a Managed RoleManaged roles have an explicit enumerated list of members. Managed roles are added to entries byadding the nsRoleDN attribute to the entry.

To create and add members to a managed role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry for the new role.

3. Go to the Object menu, and select New > Role.

Page 194: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

174

Alternatively, right-click the entry and select New > Role.

4. Click General in the left pane. Type a name for the new role in the Role Name field. The rolename is required.

Page 195: Red Hat Directory Server 5.1

Managing Roles Using the Console

175

5. Enter a description of the new role in the Description field.

6. Click Members in the left pane.

7. In the right pane, select Managed Role. Click Add to add new entries to the list of members.

8. In the Search drop-down list, select Users from the Search drop-down list, then click Search.Select one of the entries returned, and click OK.

Page 196: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

176

9. After adding all of the entries, click OK.

NOTEThe nsRoleDN attribute is an operational attribute and must be explicitly requested in thesearch command in the list of search attributes. For example:

ldapsearch ... args ... “(uid=scarter)” \* nsRole nsRoleDN

The Console will automatically show the nsRoleDN attribute.

5.1.2.2. Creating a Filtered RoleEntries are assigned to a filtered role depending whether the entry possesses a specific attributedefined in the role. The role definition specifies an LDAP filter for the target attributes. Entries thatmatch the filter possess (are members of) the role.

To create and add members to a filtered role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry for the new role.

3. Go to the Object menu, and select New > Role.

Page 197: Red Hat Directory Server 5.1

Managing Roles Using the Console

177

Alternatively, right-click the entry and select New > Role.

4. Click General in the left pane. Type a name for the new role in the Role Name field. The rolename is required.

Page 198: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

178

5. Enter a description of the new role in the Description field.

6. Click Members in the left pane.

A search dialog box appears briefly.

7. In the right pane, select Filtered Role.

8. Enter an LDAP filter in the text field, or click Construct to be guided through the construction of anLDAP filter.

The Construct opens the standard LDAP URL construction dialog. Ignore the fields for LDAPServer Host, Port, Base DN, and Search (since the search scope cannot be set filtered roledefinitions).

Page 199: Red Hat Directory Server 5.1

Managing Roles Using the Console

179

• Select the types of entries to filter from the For drop-down list. The entries can be users, groups,or both.

• Select an attribute from the Where drop-down list. The two fields following it refine the searchby selecting one of the qualifiers from the drop-down list, such as contains, does notcontain, is, or is not. Enter an attribute value in the text box. To add additional filters, clickMore. To remove unnecessary filters, click Fewer.

9. Click Test to try the filter.

Page 200: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

180

10. Click OK.

NOTEThe nsRoleDN attribute is an operational attribute and must be explicitly requested in thesearch command in the list of search attributes. For example:

ldapsearch ... args ... “(uid=scarter)” \* nsRole nsRoleDN

Page 201: Red Hat Directory Server 5.1

Managing Roles Using the Console

181

The Directory Server Console automatically shows the nsRoleDN attribute.

5.1.2.3. Creating a Nested RoleNested roles are roles that contain other roles. Before it is possible to create a nested role, anotherrole must exist. When a nested role is created, the Console displays a list of the roles available fornesting. The roles nested within the nested role are specified using the nsRoleDN attribute.

To create and add members to a nested role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry for the new role.

3. Go to the Object menu, and select New > Role.

Alternatively, right-click the entry and select New > Role.

Page 202: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

182

4. Click General in the left pane. Type a name for the new role in the Role Name field. The rolename is required.

5. Click Members in the left pane.

6. In the right pane, select Nested Role.

7. Click Add to add roles to the list. The members of the nested role are members of other existingroles.

8. Select a role from the Available roles list, and click OK.

Page 203: Red Hat Directory Server 5.1

Managing Roles Using the Console

183

NOTEThe nsRoleDN attribute is an operational attribute and must be explicitly requested in thesearch command in the list of search attributes. For example:

ldapsearch ... args ... “(uid=scarter)” \* nsRole nsRoleDN

The Console will automatically show the nsRoleDN attribute.

5.1.2.4. Viewing and Editing an Entry's RolesTo view or edit a role associated with an entry:

1. In the Directory Server Console, select the Directory tab.

2. In the left navigation pane, browse the tree, and select the entry for which to view or edit a role.

3. Select Set Roles from the Object menu.

Page 204: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

184

4. Select the Managed Roles tab to display the managed roles to which this entry belongs.

To add a new managed role, click Add, and select an available role from the Role Selectorwindow.

To edit a managed role associated with an entry, click Edit. The Edit Entry dialog box opens.Make any changes to the general information or members.

5. Select the Other Roles tab to view the filtered or nested roles to which this entry belongs.

Page 205: Red Hat Directory Server 5.1

Managing Roles Using the Console

185

Click Edit to make changes to any filtered or nested roles associated with the entry. Click OK.

5.1.2.5. Modifying a Role EntryTo edit an existing role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the navigation tree in the left pane to locate the base DN for the role. Roles are listed inthe right pane with other entries.

3. Double-click the role.

4. Edit the different configurations for the role:

Page 206: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

186

• General to change the role name and description

• Members to change the members of managed and nested roles or to change the filter of afiltered role.

5.1.2.6. Making a Role Inactive or ActiveMembers of a role can be temporarily disabled by inactivating the role to which they belong.Inactivating a role inactivates the entries possessed by the role, not the role itself.

To temporarily disable the members of a role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the navigation tree in the left pane to locate the base DN for the role. Roles appear in theright pane with other entries.

3. Double-click the role, open the Account tab, and click the Inactivate button.

Page 207: Red Hat Directory Server 5.1

Managing Roles Using the Console

187

Alternatively, select the role. Right-click the role and select Inactivate from the menu.

The role is inactivated.

To see the inactivated entries, select Inactivation State from the View menu. Members of aninactivated role have a red slash through them. For example, John Smith is a member of the inactiveExample Role.

To reactivate a disabled role, re-open the role configuration or open the Object menu, and selectActivate. All of the members of the role are reenabled.

5.1.2.7. Deleting a RoleDeleting a role deletes the role only, not its members. To delete a role:

1. In the Directory Server Console, select the Directory tab.

2. Browse the navigation tree in the left pane to locate the base DN for the role. Roles appear in theright pane with other entries.

3. Right-click the role, and select Delete.

Page 208: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

188

A dialog box appears to confirm the deletion. Click Yes.

NOTEDeleting a role deletes the role entry but does not delete the nsRoleDN attribute foreach role member. To delete the nsRoleDN attribute for each role member, enable theReferential Integrity plug-in, and configure it to manage the nsRoleDN attribute. For moreinformation on the Referential Integrity plug-in, see Section 3.5, “Maintaining ReferentialIntegrity”.

Page 209: Red Hat Directory Server 5.1

Managing Roles Using the Command Line

189

5.1.3. Managing Roles Using the Command LineRoles inherit from the ldapsubentry object class, which is defined in the ITU X.509 standard. Inaddition, each type of role has two specific object classes that inherit from the nsRoleDefinitionobject class. Once a role is created, members are assigned to it as follows:

• Members of a managed role have the nsRoleDN attribute in their entry.

• Members of a filtered role are entries that match the filter specified in the nsRoleFilter attribute.

• Members of a nested role are members of the roles specified in the nsRoleDN attributes of thenested role definition entry.

Table 5.1, “Object Classes and Attributes for Roles” lists the object classes and attributes associatedwith each type of role.

Role Type Object Classes Attributes

Managed Role nsSimpleRoleDefinitionnsManagedRoleDefinition

description (optional)

Filtered Role nsComplexRoleDefinitionnsFilteredRoleDefinition

nsRoleFilterDescription (optional)

Nested Role nsComplexRoleDefinitionnsNestedRoleDefinition

nsRoleDNDescription (optional)

Table 5.1. Object Classes and Attributes for Roles

The attributes nsRole and nsRoleDN are operational attributes. This means that they are not presentin the schema of the entry and may be added to any entry, regardless of schema. This also meansthat these attributes must be explicitly requested in the search attributes list in search requests. Forexample, this ldapsearch command lists all of the roles (values of nsRole), all of the managedroles (values of nsRoleDN), and all of the regular attributes in the entry matched by uid=scarter.

ldapsearch ... args ... “(uid=scarter)” \* nsRole nsRoleDN

Similarly for the role definition entries, they are operational entries and are not returned by default withregular searches. This means that if roles are defined under the ou=People,dc=example,dc=comsubtree, for example, the following ldapsearch command will not return the role definitions for anyentry:

ldapsearch -s sub -b ou=People,dc=example,dc=com “(objectclass=*)”

To see the role definitions entries, use the special search filter"(objectclass=ldapSubEntry)"with ldapsearch. The special filter can be added to any othersearch filter, using OR (|):

ldapsearch -s sub -b ou=People,dc=example,dc=com “(|(objectclass=*)(objectclass=ldapSubEntry))”

This search shows all regular entries in addition to role definition entries in theou=People,dc=example,dc=com subtree. The Console automatically shows all of the role entries.

Page 210: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

190

NOTEIn some cases, the value of the nsRoleDNattribute must be protected with an ACI, asthe attribute is writable. For more information about security and roles, see Section 5.1.4,“Using Roles Securely”.

5.1.3.1. Example: Managed Role DefinitionThis example creates a role which can be assigned to the marketing department.

1. Use ldapmodify with the -a option to add the managed role entry. The new entry must containthe nsManagedRoleDefinition object class, which in turn inherits from the LdapSubEntry,nsRoleDefinition, and nsSimpleRoleDefinition object classes.

ldapmodify -a -D "cn=Directory Manager" -w secret -h host -p 389

dn: cn=Marketing,ou=people,dc=example,dc=comobjectclass: topobjectclass: LdapSubEntryobjectclass: nsRoleDefinitionobjectclass: nsSimpleRoleDefinitionobjectclass: nsManagedRoleDefinitioncn: Marketingdescription: managed role for marketing staff

2. Assign the role to the marketing staff members, one by one, using ldapmodify:

ldapmodify -D "cn=Directory Manager" -w secret -h host -p 389

dn: cn=Bob,ou=people,dc=example,dc=comchangetype: modify add: nsRoleDN nsRoleDN: cn=Marketing,ou=people,dc=example,dc=com

The nsRoleDN attribute in the entry indicates that the entry is a member of a managed role,cn=Marketing,ou=people,dc=example,dc=com.

5.1.3.2. Example: Filtered Role DefinitionThis example creates a filtered role which is applied to all sales managers.

1. Run ldapmodify with the -a option to add a new entry:

ldapmodify -a -D "cn=Directory Manager" -w secret -h host -p 389

2. Create the filtered role entry.

The role entry has the nsFilteredRoleDefinition object class, which inherits from theLdapSubEntry, nsRoleDefinition, and nsComplexRoleDefinition object classes.

The nsRoleFilter attribute sets a filter for o (organization) attributes that contain a value ofsales managers.

dn: cn=SalesManagerFilter,ou=people,dc=example,dc=com

Page 211: Red Hat Directory Server 5.1

Using Roles Securely

191

objectclass: topobjectclass: LDAPsubentryobjectclass: nsRoleDefinitionobjectclass: nsComplexRoleDefinitionobjectclass: nsFilteredRoleDefinitioncn: SalesManagerFilternsRoleFilter: o=sales managersDescription: filtered role for sales managers

The following entry matches the filter (possesses the o attribute with the value sales managers),and, therefore, it is a member of this filtered role automatically:

dn: cn=Pat Smith,ou=people,dc=example,dc=comobjectclass: personcn: Patsn: SmithuserPassword: secreto: sales managers

5.1.3.3. Example: Nested Role DefinitionThis example creates a single role out of the managed marketing role and filtered sales manager role.

1. Run ldapmodify with the -a option to add a new entry:

ldapmodify -a -D "cn=Directory Manager" -w secret -h host -p 389

2. Create the nested role entry. The nested role has four object classes:

• nsNestedRoleDefinition

• LDAPsubentry (inherited)

• nsRoleDefinition (inherited)

• nsComplexRoleDefinition (inherited)

The nsRoleDN attributes contain the DNs for both the marketing managed role and the salesmanagers filtered role.

dn: cn=MarketingSales,ou=people,dc=example,dc=comobjectclass: topobjectclass: LDAPsubentryobjectclass: nsRoleDefinitionobjectclass: nsComplexRoleDefinitionobjectclass: nsNestedRoleDefinitioncn: MarketingSalesnsRoleDN: cn=SalesManagerFilter,ou=people,dc=example,dc=comnsRoleDN: cn=Marketing,ou=people,dc=example,dc=com

Both of the users in the previous examples, Bob and Pat, are members of this new nested role.

5.1.4. Using Roles SecurelyNot every role is suitable for use in a security context. When creating a new role, consider how easilythe role can be assigned to and removed from an entry. Sometimes it is appropriate for users to be

Page 212: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

192

able to add or remove themselves easily from a role. For example, if there is an interest group rolecalled Mountain Biking, interested users should be able to add themselves or remove themselveseasily.

However, it is inappropriate to have such open roles for some security situations. One potentialsecurity risk is inactivating user accounts by inactivating roles. Inactive roles have special ACIsdefined for their suffix. If an administrator allows users to add and remove themselves from rolesfreely, then in some circumstance, they may be able to remove themselves from an inactive role toprevent their accounts from being locked.

For example, user A possesses the managed role, MR. The MR role has been locked using accountinactivation. This means that user A cannot bind to the server because the nsAccountLock attributeis computed as true for that user. However, if user A was already bound to Directory Server andnoticed that he is now locked through the MR role, the user can remove the nsRoleDN attribute fromhis entry and unlock himself if there are no ACIs preventing him.

To prevent users from removing the nsRoleDN attribute, use the following ACIs depending upon thetype of role being used.

• Managed roles. For entries that are members of a managed role, use the following ACI to preventusers from unlocking themselves by removing the appropriate nsRoleDN:

aci: (targetattr="nsRoleDN") (targattrfilters= add=nsRoleDN:(!(nsRoleDN=cn=AdministratorRole, dc=example,dc=com)), del=nsRoleDN:(!(nsRoleDN=cn=nsManagedDisabledRole,dc=example,dc=com))) (version3.0;aci allow mod of nsRoleDN by self but not to critical values; allow(write) userdn=ldap:///self;)

• Filtered roles. The attributes that are part of the filter should be protected so that the user cannotrelinquish the filtered role by modifying an attribute. The user should not be allowed to add, delete,or modify the attribute used by the filtered role. If the value of the filter attribute is computed, then allattributes that can modify the value of the filter attribute should be protected in the same way.

• Nested roles. A nested role is comprised of filtered and managed roles, so both ACIs should beconsidered for modifying the attributes (nsRoleDN or something else) of the roles that comprise thenested role.

For more information about account inactivation, see Section 7.2, “Inactivating Users and Roles”.

5.2. Assigning Class of ServiceA class of service definition (CoS) shares attributes between entries in a way that is transparent toapplications. CoS simplifies entry management and reduces storage requirements.

• Section 5.2.1, “About CoS”

• Section 5.2.2, “Managing CoS Using the Console”

• Section 5.2.3, “Managing CoS from the Command Line”

• Section 5.2.4, “Creating Role-Based Attributes”

• Section 5.2.5, “Access Control and CoS”

Page 213: Red Hat Directory Server 5.1

About CoS

193

5.2.1. About CoSClients of the Directory Server read the attributes in a user's entry. With CoS, some attribute valuesmay not be stored within the entry itself. Instead, these attribute values are generated by class ofservice logic as the entry is sent to the client application.

Each CoS is comprised of two types of entry in the directory:

• CoS definition entry. The CoS definition entry identifies the type of CoS used. Like the role definitionentry, it inherits from the LDAPsubentry object class. The CoS definition entry is below the branchat which it is effective.

• Template entry. The CoS template entry contains a list of the shared attribute values. Changes tothe template entry attribute values are automatically applied to all the entries within the scope of theCoS. A single CoS might have more than one template entry associated with it.

The CoS definition entry and template entry interact to provide attribute information to their targetentries, any entry within the scope of the CoS.

5.2.1.1. About the CoS Definition EntryThe CoS definition entry is an instance of the cosSuperDefinition object class. The CoS definitionentry also contains one of three object class that specifies the type of template entry it uses togenerate the entry. The target entries which interact with the CoS share the same parent as the CoSdefinition entry.

There are three types of CoS, defined using three types of CoS definition entries:

• Pointer CoS. A pointer CoS identifies the template entry using the template DN only.

• Indirect CoS. An indirect CoS identifies the template entry using the value of one of the target entry'sattributes. For example, an indirect CoS might specify the manager attribute of a target entry. Thevalue of the manager attribute is then used to identify the template entry.

The target entry's attribute must be single-valued and contain a DN.

• Classic CoS. A classic CoS identifies the template entry using a combination of the template entry'sbase DN and the value of one of the target entry's attributes.

For more information about the object classes and attributes associated with each type of CoS, referto Section 5.2.3, “Managing CoS from the Command Line”.

If the CoS logic detects that an entry contains an attribute for which the CoS is generating values, theCoS, by default, supplies the client application with the attribute value in the entry itself. However, theCoS definition entry can control this behavior.

5.2.1.2. About the CoS Template EntryThe CoS template entry contains the value or values of the attributes generated by the CoS logic. TheCoS template entry contains a general object class of cosTemplate. The CoS template entries for agiven CoS are stored in the directory tree along with the CoS definition.

The relative distinguished name (RDN) of the template entry is determined by one of the following:

• The DN of the template entry alone. This type of template is associated with a pointer CoSdefinition.

Page 214: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

194

• The value of one of the target entry's attributes. The attribute used to provide the relative DN to thetemplate entry is specified in the CoS definition entry using the cosIndirectSpecifier attribute.This type of template is associated with an indirect CoS definition.

• By a combination of the DN of the subtree where the CoS performs a one level search for templatesand the value of one of the target entry's attributes. This type of template is associated with a classicCoS definition.

5.2.1.3. How a Pointer CoS WorksAn administrator creates a pointer CoS that shares a common postal code with all of the entriesstored under dc=example,dc=com. The three entries for this CoS appear as illustrated in Figure 5.1,“Sample Pointer CoS”.

Figure 5.1. Sample Pointer CoS

In this example, the template entry is identified by its DN, cn=exampleUS,cn=data,in the CoS definition entry. Each time the postalCode attribute is queried on the entrycn=wholiday,ou=people,dc=example,dc=com, the Directory Server returns the value availablein the template entry cn=exampleUS,cn=data.

5.2.1.4. How an Indirect CoS WorksAn administrator creates an indirect CoS that uses the manager attribute of the target entry to identifythe template entry. The three CoS entries appear as illustrated in Figure 5.2, “Sample Indirect CoS”.

Page 215: Red Hat Directory Server 5.1

About CoS

195

Figure 5.2. Sample Indirect CoS

In this example, the target entry for William Holiday contains the indirect specifier, the managerattribute. William's manager is Carla Fuentes, so the manager attribute contains a pointer to the DN ofthe template entry, cn=Carla Fuentes,ou=people,dc=example,dc=com. The template entry inturn provides the departmentNumber attribute value of 318842.

5.2.1.5. How a Classic CoS WorksAn administrator creates a classic CoS that uses a combination of the template DN and a CoSspecifier to identify the template entry containing the postal code. The three CoS entries appear asillustrated in Figure 5.3, “Sample Classic CoS”:

Page 216: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

196

Figure 5.3. Sample Classic CoS

In this example, the CoS definition entry's cosSpecifier attribute specifies the employeeTypeattribute. This attribute, in combination with the template DN, identify the template entry ascn=sales,cn=exampleUS,cn=data. The template entry then provides the value of thepostalCode attribute to the target entry.

5.2.1.6. Searches for CoS-Specified AttributesCoS definitions provide values for attributes in entries. For example, a CoS can set the postalCodeattribute for every entry in a subtree. Searches against those CoS-defined attributes, however, do notbehave like searches against regular entries.

• If the CoS-defined attribute is indexed with any kind of index (including presence), then any attributewith a value set by the CoS is not returned with a search. For example:• The postalCode attribute for Ted Morris is defined by a CoS.

• The postalCode attribute for Barbara Jensen is set in her entry.

• The postalCode attribute is indexed.

If an ldapsearch command uses the filter (postalCode=*), then Barbara Jensen's entry isreturned, while Ted Morris's is not.

• If the CoS-defined attribute is not indexed, then every matching entry is returned in a search,regardless of whether the attribute value is set locally or with CoS. For example:• The postalCode attribute for Ted Morris is defined by a CoS.

• The postalCode attribute for Barbara Jensen is set in her entry.

• The postalCode attribute is not indexed.

Page 217: Red Hat Directory Server 5.1

Managing CoS Using the Console

197

If an ldapsearch command uses the filter (postalCode=*), then both Barbara Jensen's andTed Morris's entries are returned.

• CoS allows for an override, an identifier given to the cosAttribute attribute in the CoS entry,which means that local values for an attribute can override the CoS value. If an override is set onthe CoS, then an ldapsearch operation will return a value for an entry even if the attribute isindexed, as long as there is a local value for the entry. Other entries which possess the CoS but donot have a local value will still not be returned in the ldapsearch operation.

Because of the potential issues with running LDAP search requests on CoS-defined attributes, takecare when deciding which attributes to generate using a CoS.

5.2.2. Managing CoS Using the ConsoleThis section describes creating and editing CoS through the Directory Server Console:

• Section 5.2.2.1, “Creating a New CoS”

• Section 5.2.2.2, “Creating the CoS Template Entry”

• Section 5.2.2.3, “Deleting a CoS”

5.2.2.1. Creating a New CoS1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry for the new class ofservice.

3. Go to the Object menu, and select New > Class of Service.

Page 218: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

198

Alternatively, right-click the entry and select New > Class of Service.

4. Select General in the left pane. In the right pane, enter the name of the new class of service in theClass Name field. Enter a description of the class in the Description field.

Page 219: Red Hat Directory Server 5.1

Managing CoS Using the Console

199

5. Click Attributes in the left pane. The right pane displays a list of attributes generated on the targetentries.

Click Add to browse the list of possible attributes and add them to the list.

6. After an attribute is added to the list, a drop-down list appears in the Class of Service Behaviorcolumn.

Page 220: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

200

• Select Does not override target entry attribute to tell the directory to only return a generatedvalue if there is no corresponding attribute value stored with the entry.

• Select Overrides target entry attribute to make the value of the attribute generated by theCoS override the local value.

• Select Overrides target entry attribute and is operational to make the attribute override thelocal value and to make the attribute operational, so that it is not visible to client applicationsunless explicitly requested.

• Select Does not override target entry attribute and is operational to tell the directory toreturn a generated value only if there is no corresponding attribute value stored with the entryand to make the attribute operational (so that it is not visible to client applications unlessexplicitly requested).

NOTEAn attribute can only be made operational if it is also defined as operational in theschema. For example, if a CoS generates a value for the description attribute,you cannot select Overrides target entry attribute and is operational because thisattribute is not marked operational in the schema.

7. Click Template in the left pane. In the right pane, select how the template entry is identified.

Page 221: Red Hat Directory Server 5.1

Managing CoS Using the Console

201

• By its DN. To have the template entry identified by only its DN (a pointer CoS), enter the DN ofthe template in the Template DN field. Click Browse to locate the DN on the local server. Thiswill be an exact DN, such as cn=CoS template,ou=People,dc=example,dc=com.

• Using the value of one of the target entry's attribute. To have the template entry identified bythe value of one of the target entry's attributes (an indirect CoS), enter the attribute name inthe Attribute Name field. Click Change to select a different attribute from the list of availableattributes.

• Using both its DN and the value of one of the target entry's attributes. To have the templateentry identified by both its DN and the value of one of the target entry's attributes (a classicCoS), enter both a template DN and an attribute name. The template DN in a classic CoS ismore general than for a pointer CoS; it references the suffix or subsuffix where the templateentries will be. There can be more than one template for a classic CoS.

8. Click OK.

5.2.2.2. Creating the CoS Template EntryFor a pointer CoS or a classic CoS, there must be a template entry, according to the template DN setwhen the class of service was created. Although the template entries can be placed anywhere in thedirectory as long as the cosTemplateDn attribute reflects that DN, it is best to place the templateentries under the CoS itself.

• For a pointer CoS, make sure that this entry reflects the exact DN given when the CoS was created.

• For a classic CoS, the template DN should be recursive, pointing back to the CoS entry itself as thebase suffix for the template.

Page 222: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

202

1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry that contains the class ofservice.

The CoS appears in the right pane with other entries.

3. Right-click the CoS, and select New > Other.

Page 223: Red Hat Directory Server 5.1

Managing CoS Using the Console

203

Alternatively, select the CoS in the right pane, click Object in the menu at the top, and select New> Other.

4. Select cosTemplate from the list of object classes.

Page 224: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

204

NOTEThe LDAPsubentry object class can be added to a new template entry. Making theCoS template entry an instance of the LDAPsubentry object class allows ordinarysearches to be performed unhindered by the configuration entries. However, if thetemplate entry already exists and is used for something else (for example, if it isa user entry), the LDAPsubentry object class does not need to be added to thetemplate entry.

5. Select the object classes attribute, and click Add Value.

Page 225: Red Hat Directory Server 5.1

Managing CoS Using the Console

205

6. Add the extensibleObject object class. This makes it possible to add any attribute available inthe directory.

Page 226: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

206

7. Click the Add Attribute button.

Page 227: Red Hat Directory Server 5.1

Managing CoS Using the Console

207

8. Add the cn attribute, and give it a value that corresponds to the attribute value in the targetentry. For example, if the manager attribute is used to set the value for a classic CoS, give thecn a value of a manager's DN, such as uid=bparker,ou=people,dc=example,dc=com.Alternatively, set it to a role, such as cn=QA Role,dc=example,dc=com or a regular attributevalue. For example, if the employeeType attribute is selected, it can be full time ortemporary.

Page 228: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

208

9. Click the Change button in the lower right corner to change the naming attribute.

10. Use the cn of the entry as the naming attribute instead of cospriority.

Page 229: Red Hat Directory Server 5.1

Managing CoS Using the Console

209

11. Click the Add Attribute button, and add the attributes listed in the CoS. The values used here willbe used throughout the directory in the targeted entries.

12. Set the cospriority. There may be more than one CoS that applies to a given attribute inan entry; the cospriority attribute ranks the importance of that particular CoS. The highercospriority will take precedence in a conflict. The highest priority is 0.

Templates that contain no cosPriority attribute are considered the lowest priority. In the casewhere two or more templates could supply an attribute value and they have the same (or no)priority, a value is chosen arbitrarily.

NOTEThe behavior for negative cosPriority values is not defined in Directory Server; donot enter negative values.

Page 230: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

210

NOTEThe cosPriority attribute is not supported by indirect CoS.

The CoS is visible in the left navigation pane once there are entries beneath it. For classic CoS, therecan be multiple entries, according to the different potential values of the attribute specifier.

To edit the description or attributes generated on the target entry of an existing CoS, simply double-click the CoS entry listed in the Directory tab, and make the appropriate changes in the editor window.

5.2.2.3. Deleting a CoS1. In the Directory Server Console, select the Directory tab.

2. Browse the tree in the left navigation pane, and select the parent entry that contains the class ofservice.

The CoS appears in the right pane with other entries.

3. Right-click the CoS, and select Delete. Alternatively, click Edit in the top menu, and select Delete.

Page 231: Red Hat Directory Server 5.1

Managing CoS from the Command Line

211

4. A dialog box appears to confirm the deletion. Click Yes.

5.2.3. Managing CoS from the Command LineBecause all configuration information and template data is stored as entries in the directory, standardLDAP tools can be used for CoS configuration and management.

• Section 5.2.3.1, “Creating the CoS Definition Entry from the Command Line”

• Section 5.2.3.2, “Creating the CoS Template Entry from the Command Line”

Page 232: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

212

• Section 5.2.3.3, “Example of a Pointer CoS”

• Section 5.2.3.4, “Example of an Indirect CoS”

• Section 5.2.3.5, “Example of a Classic CoS”

• Section 5.2.3.8, “Searching for CoS Entries”

5.2.3.1. Creating the CoS Definition Entry from the Command LineEach type of CoS requires a particular object class to be specified in the definition entry. All CoSdefinition object classes inherit from the LDAPsubentry object class and the cosSuperDefinitionobject class.

A pointer CoS uses the cosPointerDefinition object class. This object class identifies thetemplate entry using an entry DN value specified in the cosTemplateDn attribute, as shown inExample 5.1, “An Example Pointer CoS Entry”.

dn: cn=pointerCoS,dc=example,dc=com objectclass: top objectclass: cosSuperDefinition objectclass: cosPointerDefinition cosTemplateDn:DN_string cosAttribute:list_of_attributes qualifier cn: pointerCoS

Example 5.1. An Example Pointer CoS Entry

An indirect CoS uses the cosIndirectDefinition object class. This type of CoS identifiesthe template entry based on the value of one of the target entry's attributes, as specified in thecosIndirectSpecifier attribute. This is illustrated in Example 5.2, “An Example Indirect CoSEntry”.

dn: cn=indirectCoS,dc=example,dc=com objectclass: top objectclass: cosSuperDefinition objectclass: cosIndirectDefinition cosIndirectSpecifier:attribute_name cosAttribute:list_of_attributes qualifier cn: indirectCoS

Example 5.2. An Example Indirect CoS Entry

A classic CoS uses the cosClassicDefinition object class. This identifies the template entryusing both the template entry's DN (set in the cosTemplateDn attribute) and the value of one of thetarget entry's attributes (set in the cosSpecifier attribute). This is illustrated in Example 5.3, “AnExample Classic CoS Entry”.

dn: cn=classicCoS,dc=example,dc=com objectclass: top objectclass: cosSuperDefinition objectclass: cosClassicDefinition cosTemplateDn:DN_string cosSpecifier:attribute_name

Page 233: Red Hat Directory Server 5.1

Managing CoS from the Command Line

213

cosAttribute:list_of_attributes qualifier cn: classicCoS

Example 5.3. An Example Classic CoS Entry

For a class of service, the object class defines the type of CoS, and the supporting attributes identifywhich directory entries are affected by defining the CoS template. Every CoS has one additionalattribute which can be defined for it: cosAttribute. The purpose of a CoS is to supply attributevalues across multiple entries; the cosAttribute attribute defines which attribute the CoS generatesvalues for.

5.2.3.2. Creating the CoS Template Entry from the Command LineEach template entry is an instance of the cosTemplate object class.

NOTEConsider adding the LDAPsubentry object class to a new template entry. Making theCoS template entry an instance of the LDAPsubentry object classes allows ordinarysearches to be performed unhindered by the configuration entries. However, if thetemplate entry already exists and is used for something else, such as a user entry, theLDAPsubentry object class does not need to be added to the template entry.

The CoS template entry also contains the attribute generated by the CoS (as specified in thecosAttribute attribute of the CoS definition entry) and the value for that attribute.

For example, a CoS template entry that provides a value for the postalCode attribute follows:

dn:cn=exampleUS,ou=data,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatepostalCode: 44438

The following sections provide examples of template entries along with examples of each type of CoSdefinition entry.

• Section 5.2.3.3, “Example of a Pointer CoS”

• Section 5.2.3.4, “Example of an Indirect CoS”

• Section 5.2.3.5, “Example of a Classic CoS”

5.2.3.3. Example of a Pointer CoSExample Corporation's administrator is creating a pointer CoS that shares a common postal code withall entries in the dc=example,dc=com tree.

1. Add a new pointer CoS definition entry to the dc=example,dc=com suffix using ldapmodify:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

Page 234: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

214

The ldapmodify utility binds to the server and prepares it to add information to the configurationfile.

2. Next, add the pointer CoS definition to the dc=example,dc=com root suffix.

dn: cn=pointerCoS,dc=example,dc=comobjectclass: topobjectclass: cosSuperDefinitionobjectclass: cosPointerDefinitioncosTemplateDn: cn=exampleUS,ou=data,dc=example,dc=comcosAttribute: postalCode

3. Create the template entry.

dn: cn=exampleUS,ou=data,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatepostalCode: 44438

The CoS template entry (cn=exampleUS,ou=data,dc=example,dc=com) supplies the valuestored in its postalCode attribute to any entries located under the dc=example,dc=com suffix.These entries are the target entries.

5.2.3.4. Example of an Indirect CoSThis indirect CoS uses the manager attribute of the target entry to identify the CoS template entry,which varies depending on the different values of the attribute.

1. Add a new indirect CoS definition entry to the dc=example,dc=com suffix, using ldapmodifyas follows:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add information to the configurationfile.

2. Add the indirect CoS definition to the dc=example,dc=com root suffix as follows:

dn: cn=indirectCoS,dc=example,dc=comobjectclass: topobjectclass: cosSuperDefinitionobjectclass: cosIndirectDefinitioncosIndirectSpecifier: managercosAttribute: departmentNumber

If the directory or modify the manager entries already contain the departmentNumber attribute,then no other attribute needs to be added to the manager entries. The definition entry looks in thetarget suffix (the entries under dc=example,dc=com) for entries containing the manager attributebecause this attribute is specified in the cosIndirectSpecifier attribute of the definition entry).It then checks the departmentNumber value in the manager entry that is listed. The value of thedepartmentNumber attribute will automatically be relayed to all of the manager's subordinates that

Page 235: Red Hat Directory Server 5.1

Managing CoS from the Command Line

215

have the manager attribute. The value of departmentNumber will vary depending on the departmentnumber listed in the different manager's entries.

5.2.3.5. Example of a Classic CoSThe Example Corporation administrator is creating a classic CoS that automatically generates postalcodes using a combination of the template DN and the attribute specified in the cosSpecifierattribute.

1. Add a new classic CoS definition entry to the dc=example,dc=com suffix, using ldapmodify.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add information to the configurationfile.

2. Add the indirect CoS definition to the dc=example,dc=com root suffix.

dn: cn=classicCoS,dc=example,dc=comobjectclass: topobjectclass: cosSuperDefinitionobjectclass: cosClassicDefinitioncosTemplateDn: cn=classicCoS,dc=example,dc=comcosSpecifier: businessCategorycosAttribute: postalCode override

3. Create the template entries for the sales and marketing departments. Add the CoS attributes tothe template entry. The cn of the template sets the value of the businessCategory attributein the target entry, and then the attributes are added or overwritten according to the value in thetemplate:

dn: cn=sales,cn=classicCoS,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatepostalCode: 44438

dn: cn=marketing,cn=classicCoS,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatepostalCode: 99111

The classic CoS definition entry applies to all entries under the dc=example,dc=com suffix.Depending upon the combination of the businessCategory attribute found in the entry and thecosTemplateDN, it can arrive at one of two templates. One, the sales template, provides a postalcode specific to employees in the sales department. The marketing template provides a postal codespecific to employees in the marketing department.

5.2.3.6. Handling Physical Attribute ValuesThe cosAttribute attribute contains the name of another attribute which is governed by the classof service. This attribute allows an override qualifier (after the attribute value) which sets how the CoShandles existing attribute values on entries when it generates attribute values.

Page 236: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

216

cosAttribute: attribute_name override

There are four override qualifiers.

Override Qualifier Description

default Only returns a generated value if there is nocorresponding attribute value stored with theentry.

override Always returns the value generated by the CoS,even when there is a value stored with the entry.

operational Returns a generated attribute only if it is explicitlyrequested in the search. Operational attributesdo not need to pass a schema check in order tobe returned. When operational is used, it alsooverrides any existing attribute values.

NOTEAn attribute can only be madeoperational if it is defined asoperational in the schema. Forexample, if the CoS generatesa value for the descriptionattribute, it is not possible to use theoperational qualifier because thisattribute is not marked operational inthe schema.

operational-default Only returns a generated value if there is nocorresponding attribute value stored with theentry and if it is explicitly requested in the search.

If no qualifier is set, default is assumed.

For example, this pointer CoS definition entry indicates that it is associated with a template entry,cn=exampleUS,ou=data,dc=example,dc=com, that generates the value of the postalCodeattribute. The override qualifier indicates that this value will take precedence over the value storedby the entries for the postalCode attribute:

dn: cn=pointerCoS,dc=example,dc=comobjectclass: topobjectclass: cosSuperDefinitionobjectclass: cosPointerDefinitioncosTemplateDn: cn=exampleUS,ou=data,dc=example,dc=comcosAttribute: postalCode override

NOTEIf an entry contains an attribute value generated by a CoS, the value of the attributecannot be manually updated if it is defined with the operational or override qualifiers.

Page 237: Red Hat Directory Server 5.1

Managing CoS from the Command Line

217

For more information about the CoS attributes, see the Directory Server Configuration, Command, andFile Reference.

5.2.3.7. Handling Multi-valued Attributes with CoSAny attribute can be generated using a class of service — including multi-valued attributes. Thatintroduces the potential for confusion. Which CoS supplies a value? Any of them or all of them? Howis the value selected from competing CoS templates? Does the generated attribute use a single valueor multiple values?

There way to resolve this is to set a priority to select one CoS value out of competing CoS definitions.This generates one single value for the target entry.

NOTEIndirect CoS don't support the cosPriority attribute.

If there are multiple CoS definitions available for an attribute, then the value is chosen arbitrarily. Thisis an unpredictable and unwieldy option. The way to control which CoS template to use is to set aranking on the template — a priority — and the highest prioritized CoS always "wins" and provides thevalue.

It is fairly common for there to be multiple templates completing to provide a value. For example, therecan be a multi-valued cosSpecifier attribute in the CoS definition entry. The template priority is setusing the cosPriority attribute. This attribute represents the global priority of a particular template.A priority of zero is the highest priority.

For example, a CoS template entry for generating a department number appears as follows:

dn: cn=data,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatedepartmentNumber: 71776cosPriority: 0

This template entry contains the value for the departmentNumber attribute. It has a priority of zero,meaning this template takes precedence over any other conflicting templates that define a differentdepartmentNumber value.

Templates that contain no cosPriority attribute are considered the lowest priority. Where two ormore templates are considered to supply an attribute value and they have the same (or no) priority, avalue is chosen arbitrarily.

NOTEThe behavior for negative cosPriority values is not defined in Directory Server; do notenter negative values.

Page 238: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

218

5.2.3.8. Searching for CoS EntriesCoS definition entries are operational entries and are not returned by default with regular searches.This means that if a CoS is defined under ou=People,dc=example,dc=com, for example, thefollowing ldapsearch command will not return them:

ldapsearch -s sub -b ou=People,dc=example,dc=com “(objectclass=*)”

To return the CoS definition entries, add the ldapSubEntry object class to the CoS definition entries.For example:

dn: cn=pointerCoS,ou=People,dc=example,dc=comobjectclass: top objectclass: cosSuperDefinition objectclass: cosPointerDefinition objectclass: ldapSubEntry cosTemplateDn: cn=exampleUS,ou=data,dc=example,dc=comcosAttribute: postalCode override

Then use a special search filter, (objectclass=ldapSubEntry), with the search. This filter can beadded to any other search filter using OR (|):

ldapsearch -s sub -b ou=People,dc=example,dc=com “(|(objectclass=*)(objectclass=ldapSubEntry))”

This search returns all regular entries in addition to CoS definition entries in theou=People,dc=example,dc=com subtree.

NOTEThe Console automatically shows CoS entries.

5.2.4. Creating Role-Based AttributesClassic CoS schemes generate attribute values for an entry based on the role possessed by the entry.For example, role-based attributes can be used to set the server look-through limit on an entry-by-entry basis.

To create a role-based attribute, use the nsRole attribute as the cosSpecifier in the CoS definitionentry of a classic CoS. Because the nsRole attribute can be multi-valued, CoS schemes can bedefined that have more than one possible template entry. To resolve the ambiguity of which templateentry to use, include the cosPriority attribute in the CoS template entry.

For example, this CoS allows members of the manager role to exceed the standard mailbox quota.The manager role entry is:

dn: cn=ManagerRole,ou=people,dc=example,dc=comobjectclass: topobjectclass: nsRoleDefinitionobjectclass: nsComplexRoleDefinitionobjectclass: nsFilteredRoleDefinitioncn: ManagerRolensRoleFilter: o=managersDescription: filtered role for managers

Page 239: Red Hat Directory Server 5.1

Access Control and CoS

219

The classic CoS definition entry looks like:

dn: cn=managerCOS,dc=example,dc=comobjectclass: topobjectclass: cosSuperDefinitionobjectclass: cosClassicDefinitioncosTemplateDn: cn=managerCOS,dc=example,dc=comcosSpecifier: nsRolecosAttribute: mailboxquota override

The cosTemplateDn attribute provides a value that, in combination with the attribute specified inthe cosSpecifier attribute (in the example, the nsRole attribute of the target entry), identifies theCoS template entry. The CoS template entry provides the value for the mailboxquota attribute.An additional qualifier of override tells the CoS to override any existing mailboxquota attributesvalues in the target entry.

The corresponding CoS template entry looks as follows:

dn:cn="cn=ManagerRole,ou=people,dc=example,dc=com",cn=managerCOS,dc=example,dc=comobjectclass: topobjectclass: extensibleObjectobjectclass: cosTemplatemailboxquota: 1000000

The template provides the value for the mailboxquota attribute, 1000000.

NOTEThe role entry and the CoS definition and template entries should be located at the samelevel in the directory tree.

5.2.5. Access Control and CoSThe server controls access to attributes generated by a CoS in exactly the same way as regular storedattributes. However, access control rules depending upon the value of attributes generated by CoS willnot work. This is the same restriction that applies to using CoS-generated attributes in search filters.

5.3. Using ViewsVirtual directory tree views, or views, create a virtual directory hierarchy, so it is easy to navigateentries, without having to make sure those entries physically exist in any particular place. The viewuses information about the entries to place them in the view hierarchy, similarly to members of afiltered role or a dynamic group. Views superimpose a DIT hierarchy over a set of entries, and to clientapplications, views appear as ordinary container hierarchies.

Views create a directory tree similar to the regular hierarchy, such as using organizational unitentries for subtrees, but views entries have an additional object class (nsview) and a filter attribute(nsviewfilter) that set up a filter for the entries which belong in that view. Once the view containerentry is added, all of the entries that match the view filter instantly populate the view. The targetentries only appear to exist in the view; their true location never changes. For example, a view maybe created as ou=Location Views, and a filter is set for l=Mountain View. Every entry, suchas cn=Jane Smith,l=Mountain View,ou=People,dc=example,dc=com, is immediately

Page 240: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

220

listed under the ou=Location Views entry, but the real cn=Jane Smith entry remains in theou=People,dc=example,dc=com subtree.

Figure 5.4. A Directory Tree with a Virtual DIT View hierarchy

Virtual DIT views behave like normal DITs in that a subtree or a one-level search can be performedwith the expected results being returned.

NOTEThere is a sample LDIF file with example views entries, Example-views.ldif, installedwith Directory Server. This file is in the /usr/share/dirsrv/data directory on Red HatEnterprise Linux 5 (32-bit) and the /opt/dirsrv/share/data directory on HP-UX.

The Directory Server Deployment Guide has more informaiton on how to integrate views with thedirectory tree hierarchy.

5.3.1. Creating Views in the Console1. Select the Directory tab.

2. In the left navigation tree, create an organizational unit suffix to hold the views. For instance,for views based on the locality (l) attribute, name this organizational unit Location Views.Creating sub suffixes is described in Section 2.1.1.2, “Creating a New Sub Suffix Using theConsole”.

3. Right-click ou=Location Views, and select New > Other.

Page 241: Red Hat Directory Server 5.1

Creating Views in the Console

221

4. Select nsview from the New Object menu, and click OK.

Page 242: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

222

5. In the Property Editor window, click the Add Value button, and add the organization unit objectclass.

Page 243: Red Hat Directory Server 5.1

Creating Views in the Console

223

6. Name the organization unit according to how to organize the views. For instance, ou=Sunnyvale.Make the ou attribute the naming attribute.

Page 244: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

224

7. Click the Add Attribute button, and add the nsviewfilter attribute.

Page 245: Red Hat Directory Server 5.1

Creating Views in the Console

225

8. Create a filter that reflects the views, such as (l=Sunnyvale).

Page 246: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

226

9. Click the Change button in the lower right corner to change the naming attribute.

Use the ou of the entry as the naming attribute instead of description.

10. Click OK to close the attributes box, and click OK again to save the new view entry.

Page 247: Red Hat Directory Server 5.1

Deleting Views from the Directory Server Console

227

The new view is immediately populated with any entries matching the search filter, and any newentries added to directory are automatically included in the view.

5.3.2. Deleting Views from the Directory Server Console1. Select the Directory tab.

2. Select the view to delete, such asou=Sunnyvale,ou=LocationViews,dc=example,dc=com. To delete all the views, delete theentire sub suffix, ou=LocationViews,dc=example,dc=com.

3. Right-click the entry, and select Delete from the drop-down menu.

4. A dialog box appears to confirm the deletion of the entry. Click Yes.

5.3.3. Creating Views from the Command Line1. Use the ldapmodify utility to bind to the server and prepare it to add the new view entry to the

configuration file.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

2. Add the new views container entry, in this example, under the dc=example,dc=com rootsuffix. This entry must have the nsview object class and the nsViewFilter attribute. ThensViewFilter attribute sets the attribute-value which identifies entries that belong in the view.

dn: ou=Example View,dc=example,dc=comobjectClass: topobjectClass: organizationalunit

Page 248: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

228

objectClass: nsviewou=Example ViewnsViewFilter: l=Mountain Viewdescription: Example View

5.3.4. Deleting Views from the Command LineTo delete a view from the command line:

1. Use the ldapdelete utility to bind to the server and prepare it to remove the view entry to theconfiguration file.

ldapdelete -D "cn=directory manager" -w secret -p 389 -h server.example.com "ou=Example View,dc=example,dc=com"

2. Remove the view entry. It is not necessary to remove any entries included in the view.

dn: ou=Example View,dc=example,dc=comobjectClass: topobjectClass: organizationalunitobjectClass: nsviewou=Example ViewnsViewFilter: l=Mountain Viewdescription: Example View

5.4. Using GroupsGroups are a mechanism for associating entries for ease of administration. Groups do not have theflexibility or utility of roles, CoS, and views. However, there are certain clients and applications wheregroups are useful. Groups also offer compatibility with older LDAP clients and directory services.

NOTEManaging groups is significantly easier by using the memberOf attribute to identify inuser entries to what groups a user belongs. The memberOf attribute is maintained by theDirectory Server and updated automatically on entries as group membership changes.See Section 5.4.4, “Using the memberOf Attribute to Manage Group MembershipInformation” for information on using the memberOf attribute.

5.4.1. Managing Static GroupsStatic groups organize entries by specifying the same group value in the DN attribute of any number ofusers.

NOTEIf a user has an entry on a remote Directory Server (for example, in a chained database),different from the Directory Server which has the entry that defines the static group, thenuse the Referential Integrity plug-in to ensure that deleted user entries are automaticallydeleted from the static group.

Page 249: Red Hat Directory Server 5.1

Managing Static Groups

229

There are some performance and access control considerations with the ReferentialIntegrity plug-in. For more information about using referential integrity with chaining, seeSection 2.3.2, “Configuring the Chaining Policy”.

1. In the Directory Server Console, select the Directory tab.

2. In the left pane, right-click the entry under which to add a new group, and select New > Group.

Alternatively, go to the Object menu, and select New > Group.

3. Click General in the left pane. Type a name for the new group in the Group Name field (the nameis required), and enter a description of the new group in the Description field.

Page 250: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

230

4. Click Members in the left pane. In the right pane, select the Static Group tab. Click Add to addnew members to the group.

5. In the Search drop-down list, select what sort of entries to search for (users, groups, or both) thenclick Search.

6. Select the members from the returned entries, and click OK.

Page 251: Red Hat Directory Server 5.1

Managing Static Groups

231

7. Click Languages in the left pane to add language-specific information for the group.

8. Click OK to create the new group. It appears in the right pane.

Page 252: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

232

To edit a static group, double-click the group entry, and make the changes in the editor window. Toview the changes, go to the View menu, and select Refresh.

NOTEThe Console for managing static groups may not display all possible selections duringa search operation if there is no VLV index for users' search. This problem occursonly when the number of users is 1000 or more and there is no VLV index for search.To work around the problem, create a VLV index for the users suffix with the filter(objectclass=person) and scope sub-tree.

5.4.2. Managing Dynamic GroupsDynamic groups filter users based on their DN and include them in a single group.

1. In the Directory Server Console, select the Directory tab.

2. In the left pane, right-click the entry under which to add a new group, and select New > Group.

Alternatively, go to the Object menu, and select New > Group.

3. Click General in the left pane. Type a name for the new group in the Group Name field (the nameis required), and enter a description of the new group in the Description field.

Page 253: Red Hat Directory Server 5.1

Managing Dynamic Groups

233

4. Click Members in the left pane. In the right pane, select the Dynamic Group tab. Click Add tocreate a LDAP URL for querying the database.

5. Enter an LDAP URL in the text field or select Construct to be guided through the construction ofan LDAP URL.

The results show the current entries (group members) which correspond to the filter.

Page 254: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

234

6. Click Languages in the left pane to add language-specific information for the group.

Page 255: Red Hat Directory Server 5.1

Creating and Managing Groups in the Command Line

235

7. Click OK. The new group appears in the right pane.

To edit a dynamic group, double-click the group entry to open the editor window, and make whateverchanges to the dynamic group. To view the changes to the group, go to the View menu, and selectRefresh.

NOTEThe Console for managing dynamic groups may not display all possible selectionsduring a search operation if there is no VLV index for users' search. This problem canoccur when the number of users is 1000 or more and there is no VLV index for search.To work around the problem, create a VLV index for the users suffix with the filter(objectclass=person) and scope sub-tree.

5.4.3. Creating and Managing Groups in the Command LineCreating both static and dynamic groups from the command line is a similar process. A group entrycontains the group name, the type of group, and a members attribute.

There are several different options for the type of group; these are described in more detail in theSchema Reference. The type of group in this case refers to the type of defining member attribute ithas:

• groupOfNames is a simple group, that allows any entry to be added. The attribute used todetermine members for this is member.

• groupOfUniqueNames, like groupOfNames, simply lists user DNs as members, but the membersmust be unique. This prevents users being added more than once as a group member, which is oneway of preventing self-referential group memberships. The attribute used to determine members forthis is uniqueMember.

• groupOfURLs uses a list of LDAP URLs to filter and generate its membership list. This objectclass is required for any dynamic group and can be used in conjunction with groupOfNames andgroupOfUniqueNames.

• groupOfCertificates is similar to groupOfURLs in that it uses an LDAP filter to search for andidentify certificates (or, really, certificate names) to identify group members. This is useful for group-based access control, since the group can be given special access permissions. The attribute usedto determine members for this is memberCertificate.

Table 5.2, “Dynamic and Static Group Schema” lists the default attributes for groups as they arecreated from the command line.

Type of Group Group Object Classes Member Attributes

Static groupOfUniqueNames uniqueMember

Dynamic groupOfUniqueNamesgroupOfURLs

memberURL

Table 5.2. Dynamic and Static Group Schema

A static group entry lists the specific members of the group. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

Page 256: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

236

dn: cn=static group,ou=Groups, dc=example, dc=comobjectClass: topobjectClass: groupofuniquenamescn: static groupdescription: Example static group.uniqueMember: uid=mwhite, ou=People, dc=example,dc=comuniqueMember: uid=awhite, ou=People, dc=example,dc=com

A dynamic group uses at least one LDAP URL to identify entries belonging to the group and canspecify multiple LDAP URLs or, if used with another group object class like groupOfUniqueNames,can explicitly list some group members along with the dynamic LDAP URL.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=dynamic group,ou=Groups, dc=example, dc=comobjectClass: topobjectClass: groupofuniquenamesobjectClass: groupofurlscn: dynamic groupdescription: Example dynamic group.memberURL: ldap:///dc=example, dc=com??sub?(&(objectclass=person)(cn=*sen*))

5.4.4. Using the memberOf Attribute to Manage Group MembershipInformationThe entries which belong to a group are defined, in some way, in the group entry itself. This makesit very easy to look at a group and see its members and to manage group membership centrally.However, there is no good way to find out what groups a single user belongs to. There is nothing in auser entry which indicates its memberships, as there are with roles.

The MemberOf Plug-in correlates group membership lists to the corresponding user entries. Aninstance of the MemberOf Plug-in analyzes the member attribute (by default, member) in a group entryand automatically writes a corresponding memberOf attributes in the member's entry. As membershipchanges, the plug-in updates the memberOf attributes on the user entries. The MemberOf Plug-inprovides a way to view the groups to which a user belongs simply by looking at the entry, includingnested group membership. It can be very difficult to backtrack memberships through nested groups,but the MemberOf Plug-in shows memberships for all groups, direct and indirect.

IMPORTANTThe memberOf attributes for user entries should not be replicated. Make sure thatthe memberOf attribute is excluded from replication in the replication agreement.(Fractional replication is described in Section 8.1.7, “Replicating Attributes with FractionalReplication”.)

Each server must maintain its own MemberOf Plug-in independently. To make sure thatthe memberOf attributes for entries are the same across servers, simply configure theMemberOf Plug-in the same on all servers.

The MemberOf Plug-in manages member attributes for static groups, not dynamic groups or circulargroups.

Page 257: Red Hat Directory Server 5.1

Using the memberOf Attribute to Manage Group Membership Information

237

5.4.4.1. The MemberOf Plug-in SyntaxThe MemberOf Plug-in instance defines two attributes, one for the group member attribute to poll(memberofgroupattr) and the other for the attribute to create and manage in the member's userentry (memberofattr).

The plug-in instance also gives the plug-in path and function to identify the MemberOf Plug-in andcontains a state setting to enable the plug-in, both of which are required for all plug-ins. The defaultMemberOf Plug-in is shown in Example 5.4, “Default MemberOf Plug-in Entry” and the differentparameters are described in Table 5.3, “MemberOf Syntax”.

dn: cn=MemberOf Plugin,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: MemberOf Plugin nsslapd-pluginPath: libmemberof-plugin nsslapd-pluginInitfunc: memberof_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database memberofgroupattr: member memberofattr: memberOf nsslapd-pluginId: memberof nsslapd-pluginVersion: 8.1.4 nsslapd-pluginVendor: Red Hat, Inc. nsslapd-pluginDescription: memberof plugin

Example 5.4. Default MemberOf Plug-in Entry

Plug-in Attribute Description

cn Gives a unique name for the plug-in instance.

memberofgroupattr Gives the attribute in the group entry to pollto identify member DNs. By default, this is themember attribute, but it can be any attributeused to identify group members, such asuniqueMember or memberURL.

memberofattr Gives the attribute for the plug-in to create andmanage on the user entry. By default, this is thememberOf attribute.

nsslapd-pluginEnabled Sets whether the plug-in instance is enabled(active) or disabled. The default MemberOf Plug-in instance is disabled by default.

nsslapd-pluginPath Gives the name of the specific plug-in to load.This must be libmemberof-plugin.

nsslapd-pluginInitfunc Gives the name of the function to callto initialize the plug-in. This must bememberof_postop_init.

Table 5.3. MemberOf Syntax

Page 258: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

238

5.4.4.2. Configuring an Instance of the MemberOf Plug-in from theCommand LineThe attributes defined in the MemberOf Plug-in can be changed, depending on the types of groupsused in the directory.

5.4.4.2.1. Editing the MemberOf Plug-in from the Console1. Select the Configuration tab, and expand to the Plugins folder.

2. Scroll to the Memberof Plugin entry.

3. Make sure that the plug-in is enabled. This is disabled by default.

4. Click the Advanced button to opent the Advanced Properties Editor.

Page 259: Red Hat Directory Server 5.1

Using the memberOf Attribute to Manage Group Membership Information

239

5. The memberofgroupattr attribute sets the attribute in the group entry which the server uses toidentify member entries. The memberofattr attribute sets the attribute which the plug-in createsand manages on user entries.

6. Save the changes.

7. Restart the server to update the plug-in. For example, open the Tasks tab and click the Restartserver task.

5.4.4.2.2. Editing the MemberOf Plug-in from the Command Line1. Enable the MemberOf Plug-in.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=MemberOf Plugin,cn=plugins,cn=configchangetype: replacereplace: nsslapd-pluginEnablednsslapd-pluginEnabled: on-

2. Set the attribute to use for the group member entry attribute. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=MemberOf Plugin,cn=plugins,cn=configchangetype: replacereplace: memberofgroupattrmemberofgroupattr: uniqueMember-

3. Set the attribute to set on the user entries to show group membership. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=MemberOf Plugin,cn=plugins,cn=configchangetype: replacereplace: memberofattr

Page 260: Red Hat Directory Server 5.1

Chapter 5. Organizing Entries with Roles, Class of Service, and Views

240

memberofattr: memberOf-

4. Restart the Directory Server to load the modified new plug-in instance.

service dirsrv restart instance_name

5.4.4.3. Synchronizing memberOf ValuesThe MemberOf Plug-in automatically manages the memberOf attribute on group member entries,based on the configuration in the group entry itself. However, the memberOf attribute can be editedon a user entry directly (which is improper) or new entries can be imported or replicated over to theserver that have a memberOf attribute already set. These situations create inconsistencies betweenthe memberOf configuration managed by the server plug-in and the actual memberships defined foran entry.

Directory Server has a memberOf repair task which manually runs the plug-in to make sure theappropriate memberOf attributes are set on entries. There are three ways to trigger this task:

• In the Directory Server Console

• Using the fixup-memberof.pl script

• Running a cn=memberof task, cn=tasks, cn=config tasks entry

NOTEThe memberOf regeneration tasks are run locally, even if the entries themselves arereplicated. This means that the memberOf attributes for the entries on other servers arenot updated until the updated entry is replicated.

5.4.4.3.1. Initializing and Regenerating memberOf Attributes Using fixup-memberof.plThe fixup-memberof.pl script launches a special task to regenerate all of the memberOf attributeson user entries based on the member attributes in the group entries. This is a clean-up task whichsynchronizes the membership defined in group entries and the corresponding user entries andoverwrites any accidental or improper edits on the user entries.

1. Open the tool directory for the Directory Server instance, /usr/lib/dirsrv/slapd-instance_name/.

2. Run the script, binding as the Directory Manager.

./fixup-memberof.pl -D "cn=Directory Manager" -w password

The fixup-memberof.pl is described in more detail in the Configuration, Command, and FileReference1.

1 ../cli/Configuration_Command_File_Reference-Command_Line_Scripts-Perl_Scripts.html#fixup-memberof.pl

Page 261: Red Hat Directory Server 5.1

Using the memberOf Attribute to Manage Group Membership Information

241

5.4.4.3.2. Initializing and Regenerating memberOf Attributes Using ldapmodifyRegenerating memberOf attributes is one of the tasks which can be managed through a special taskconfiguration entry. Task entries occur under the cn=tasks configuration entry in the dse.ldif file,so it is also possible to initiate a task by adding the entry using ldapmodify. As soon as the task iscomplete, the entry is removed from the directory.

The fixup-memberof.pl script creates a special task entry in a Directory Server instance whichregenerates the memberOf attributes.

To initiate a memberOf fixup task, add an entry under the cn=memberof task, cn=tasks,cn=config entry. The only required attribute is the cn for the specific task.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example memberof,cn=memberof task, cn=tasks, cn=configcn:example memberof

As soon as the task is completed, the entry is deleted from the dse.ldif configuration, so it ispossible to reuse the same task entry continually.

The cn=memberof task configuration is described in more detail in the Configuration, Command,and File Reference2.

2 ../cli/Configuration_Command_File_Reference-Core_Server_Configuration_Reference-Core_Server_Configuration_Attributes_Reference.html#cn-memberof-task

Page 262: Red Hat Directory Server 5.1

242

Page 263: Red Hat Directory Server 5.1

Chapter 6.

243

Managing Access ControlRed Hat Directory Server allows you to control access to your directory. This chapter describes thehow to implement access control. To take full advantage of the power and flexibility of access control,while you are in the planning phase for your directory deployment, define an access control strategyas an integral part of your overall security policy.

6.1. Access Control PrinciplesThe mechanism which defines user access is called access control. When the server receivesa request, it uses the authentication information provided by the user in the bind operation andthe access control instructions (ACIs) defined in the server to allow or deny access to directoryinformation. The server can allow or deny permissions for actions on entries like read, write, search,and compare. The permission level granted to a user may depend on the authentication informationprovided.

Access control in Directory Server is flexible enough to provide very precise rules on when the ACIsare applicable:

• For the entire directory, a subtree of the directory, specific entries in the directory (including entriesdefining configuration tasks), or a specific set of entry attributes.

• For a specific user, all users belonging to a specific group or role, or all users of the directory.

• For a specific location such as an IP address or a DNS name.

6.1.1. ACI StructureAccess control instructions are stored in the directory as attributes of entries. The aci attribute is anoperational attribute; it is available for use on every entry in the directory, regardless of whether it isdefined for the object class of the entry. It is used by the Directory Server to evaluate what rights aregranted or denied when it receives an LDAP request from a client. The aci attribute is returned in anldapsearch operation if specifically requested.

The three main parts of an ACI statement are:

• Target

• Permission

• Bind Rule

The permission and bind rule portions of the ACI are set as a pair, also called an access control rule(ACR). The specified permission is granted or denied depending on whether the accompanying rule isevaluated to be true.

6.1.2. ACI PlacementIf an entry containing an ACI does not have any child entries, the ACI applies to that entry only.If the entry has child entries, the ACI applies to the entry itself and all entries below it. As a directconsequence, when the server evaluates access permissions to any given entry, it verifies the ACIs forevery entry between the one requested and the directory suffix, as well as the ACIs on the entry itself.

Page 264: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

244

The aci attribute is multi-valued, which means that you can define several ACIs for the same entry orsubtree.

An ACI created on an entry can be set so it does not apply directly to that entry but to some or all ofthe entries in the subtree below it. The advantage of this is that general ACIs can be placed at a highlevel in the directory tree that effectively apply to entries more likely to be located lower in the tree. Forexample, an ACI that targets entries that include the inetorgperson object class can be created atthe level of an organizationalUnit entry or a locality entry.

Minimize the number of ACIs in the directory tree by placing general rules at high level branch points.To limit the scope of more specific rules, place them as close as possible to leaf entries.

NOTEACIs placed in the root DSE entry apply only to that entry.

6.1.3. ACI EvaluationTo evaluate the access rights to a particular entry, the server compiles a list of the ACIs present on theentry itself and on the parent entries back up to the top level entry stored on the Directory Server. ACIsare evaluated across all of the databases for a particular Directory Server but not across all DirectoryServer instances.

The evaluation of this list of ACIs is done based on the semantics of the ACIs, not on their placementin the directory tree. This means that ACIs that are close to the root of the directory tree do not takeprecedence over ACIs that are closer to the leaves of the directory tree.

For Directory Server ACIs, the precedence rule is that ACIs that deny access take precedence overACIs that allow access. Between ACIs that allow access, union semantics apply, so there is noprecedence.

For example, if you deny write permission at the directory's root level, then none of the users can writeto the directory, regardless of the specific permissions you grant them. To grant a specific user writepermissions to the directory, you have to restrict the scope of the original denial for write permission sothat it does not include the user.

6.1.4. ACI LimitationsWhen creating an access control policy for your directory service, you need to be aware of thefollowing restrictions:

• If your directory tree is distributed over several servers using the chaining feature, some restrictionsapply to the keywords you can use in access control statements:• ACIs that depend on group entries (groupdn keyword) must be located on the same server as

the group entry. If the group is dynamic, then all members of the group must have an entry on theserver, too. If the group is static, the members' entries can be located on remote servers.

• ACIs that depend on role definitions (roledn keyword) must be located on the same server asthe role definition entry. Every entry that is intended to have the role must also be located on thesame server.

Page 265: Red Hat Directory Server 5.1

Default ACIs

245

However, you can match values stored in the target entry with values stored in the entry of the binduser; for example, using the userattr keyword. Access is evaluated normally even if the bind userdoes not have an entry on the server that holds the ACI.

For more information on how to chain access control evaluation, see Section 2.3.6, “Database Linksand Access Control Evaluation”.

• Attributes generated by class of service (CoS) cannot be used in all ACI keywords. Specifically, youshould not use attributes generated by CoS with the following keywords:

• targetfilter (Section 6.3.2.4, “Targeting Entries or Attributes Using LDAP Filters”)

• targattrfilters (Section 6.3.2.2, “Targeting Attributes”)

• userattr (Section 6.4.5.1, “Using the userattr Keyword”)

If you create target filters or bind rules that depend on the value of attributes generated by CoS, theaccess control rule will not work. For more information on CoS, see Chapter 5, Organizing Entrieswith Roles, Class of Service, and Views.

• Access control rules are always evaluated on the local server. Therefore, it is not necessary tospecify the hostname or port number of the server in LDAP URLs used in ACI keywords. If youdo, the LDAP URL is not taken into account at all. For more information on LDAP URLs, seeAppendix C, LDAP URLs.

6.2. Default ACIsWhen the Administration Server is set up, the following default ACIs apply to the directory informationstored in the userRoot database:

• Users can modify a list of common attributes in their own entries, including the mail,telephoneNumber, userPassword, and seeAlso attributes. Operational and most of thesecurity attributes, such as aci, nsroledn, and passwordExpirationTime, cannot be modifiedby users.

• Users have anonymous access to the directory for search, compare, and read operations.

• The administrator (by default uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot) has all rights except proxy rights.

• All members of the Configuration Administrators group have all rights except proxy rights.

• All members of the Directory Administrators group have all rights except proxy rights.

• Server Instance Entry (SIE) group.

The NetscapeRoot subtree has its own set of default ACIs:

• All members of the Configuration Administrators group have all rights on theNetscapeRoot subtree except proxy rights.

• Users have anonymous access to the NetscapeRoot subtree for search and read operations.

• All authenticated users have search, compare, and read rights to configuration attributes thatidentify the Administration Server.

Page 266: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

246

• Group expansion.

The following sections explain how to modify these default settings.

6.3. Creating ACIs ManuallyYou can create access control instructions manually using LDIF statements and add them to yourdirectory tree using the ldapmodify utility, similar to the instructions in Section 3.4, “LDIF UpdateStatements”. The following sections explain in detail how to create the LDIF statements.

NOTELDIF ACI statements can be very complex. However, if you are setting access control fora large number of directory entries, using LDIF is the preferred because it is faster thanusing the Console. To familiarize yourself with LDIF ACI statements, however, you maywant to use the Directory Server Console to set the ACI and then click the Edit Manuallybutton on the Access Control Editor. This shows you the correct LDIF syntax. If youroperating system allows it, you can even copy the LDIF from the Access Control Editorand paste it into your LDIF file.

6.3.1. The ACI SyntaxThe aci attribute uses the following syntax:

aci: (target)(version 3.0;acl "name";permissionbind_rules;)

• target specifies the entry, attributes, or set of entries and attributes for which to control access. Thetarget can be a distinguished name, one or more attributes, or a single LDAP filter. The target is anoptional part of the ACI.

• version 3.0 is a required string that identifies the ACI version.

• name is a name for the ACI. The name can be any string that identifies the ACI. The ACI name isrequired.

• permission specifically outlines what rights are being allowed or denied; for example, read or searchrights.

• bind_rules specify the credentials and bind parameters that a user has to provide to be grantedaccess. Bind rules can also specifically deny access to certain users or groups of users.

You can have multiple permission-bind rule pairs for each target. This allows you to set multipleaccess controls for a given target efficiently. For example:

target(permissionbind_rule)(permissionbind_rule)...

If you have several ACRs in one ACI statement, the syntax is in the following form:

aci: (target)(version 3.0;acl "name";permissionbind_rule; permissionbind_rule; ... permissionbind_rule;)

Page 267: Red Hat Directory Server 5.1

Defining Targets

247

The following is an example of a complete LDIF ACI:

aci: (target="ldap:///uid=bjensen,dc=example,dc=com")(targetattr=*)(version 3.0;acl "aci1";allow (write) userdn="ldap:///self";)

In this example, the ACI states that the user bjensen has rights to modify all attributes in her owndirectory entry.

6.3.2. Defining TargetsThe target identifies to what the ACI applies. If the target is not specified, the ACI applies to the entrycontaining the aci attribute and to the entries below it. A target can be any of the following:

• A directory entry or all of the entries in a subtree, as described in Section 6.3.2.1, “Targeting aDirectory Entry”.

• Attributes of an entry, as described in Section 6.3.2.2, “Targeting Attributes”.

• A set of entries or attributes that match a specified LDAP filter, as described in Section 6.3.2.4,“Targeting Entries or Attributes Using LDAP Filters”.

• An attribute value, or a combination of values, that match a specified LDAP filter, as described inSection 6.3.2.5, “Targeting Attribute Values Using LDAP Filters”.

The general syntax for a target is as follows:

(keyword = "expression")(keyword != "expression")

• keyword indicates the type of target.

• equal (=) indicates that the target is the object specified in the expression, and not equal (!=)indicates the target is not the object specified in the expression.

• expression identifies the target.

The quotation marks ("") around expression are required. What you use for expression is dependentupon the keyword that you supply.

Table 6.1, “LDIF Target Keywords” lists each keyword and the associated expressions.

Keyword Valid Expressions Wildcard Allowed

target ldap:///distinguished_name Yes

targetattr attribute Yes

targetfilter LDAP_filter Yes

targetattrfilters LDAP_operation:LDAP_filter Yes

Table 6.1. LDIF Target Keywords

In all cases, you must keep in mind that when you place an ACI on an entry, if it is not aleaf entry, the ACI also applies to all entries below it. For example, if you target the entry

Page 268: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

248

ou=accounting,dc=example,dc=com, the permissions you set apply to all entries in theaccounting branch of the example.com tree.

As a counter example, if you place an ACI on the ou=accounting,dc=example,dc=com entry, youcannot target the uid=sarette,ou=people,dc=example,dc=com entry because it is not locatedunder the accounting tree.

Be wary of using != when specifying an attribute to deny. ACLs are treated as a logical OR, whichmeans that if you created two ACLs as shown below, the result allows all values of the target attribute.

acl1: ( target=...)( targetattr!=a )(version 3.0; acl "name";allow (...)..acl2: ( target=...)( targetattr!=b )(version 3.0; acl "name";allow (...)..

The first ACL (acl1) allows b and the second ACL (acl2) allows a. The result of these two ACLs isthe same as the one resulting from using an ACL of the following form:

acl3: ( targetattr="*" ) allow (...) ...

In the second example, nothing is denied, which could give rise to security problems.

When you want to deny access to a particular attribute, use deny in the permissions clause ratherthan using allow with ( targetattr != value ). For example, usages such as these arerecommended:

acl1: ( target=...)( targetattr=a )(version 3.0; acl "name";deny (...).. acl2: ( target=...)( targetattr=b )(version 3.0; acl "name";deny (...)..

6.3.2.1. Targeting a Directory EntryTo target a directory entry (and the entries below it), you must use the target keyword. The targetkeyword can accept a value of the following format:

target="ldap:///distinguished_name

This identifies the distinguished name of the entry to which the access control rule applies. Forexample:

(target = "ldap:///uid=bjensen,dc=example,dc=com")

NOTEIf the DN of the entry to which the access control rule applies contains a comma,escape the comma with a single backslash (\), such as (target="ldap:///uid=lfuentes,dc=example.com Bolivia\,S.A.").

Wildcards can be used when targeting a distinguished name using the target keyword. The wildcardindicates that any character or string or substring is a match for the wildcard. Pattern matching isbased on any other strings that have been specified with the wildcard.

The following are legal examples of wildcard usage:

Page 269: Red Hat Directory Server 5.1

Defining Targets

249

• (target="ldap:///uid=*,dc=example,dc=com") — Matches every entry in the entireexample.com tree that has the uid attribute in the entry's RDN.

• (target="ldap:///uid=*Anderson,dc=example,dc=com") — Matches every entry directlyunder the example.com node with a uid ending in Anderson.

• (target="ldap:///uid=C*A,dc=example,dc=com") — Matches every entry directly underthe example.com node with a uid beginning with C and ending with A.

• (target="ldap:///uid=*,dc=example,dc=com") — Matches every entry in the entireexample.com tree that has the uid attribute in the entry's RDN.

• (target="ldap:///uid=*,ou=*,dc=example,dc=com") — Matches everyentry in the example.com tree whose distinguished name contains the uid andou attributes. Thus, uid=fchen,ou=Engineering,dc=example,dc=com oruid=claire,ou=Engineering,ou=people,dc=example,dc=com would match, butuid=bjensen,dc=example,dc=com ou=Engineering,dc=example,dc=com would not.

Depending on the position of the wildcard, it can apply to the full DN, not only to attributevalues. Therefore, the wildcard can be used as a substitute for portions of the DN. For example,uid=andy*,dc=example,dc=com targets all the directory entries in the entire example.comtree with a matching uid attribute and not just the entries that are immediately below thedc=example,dc=com node. In other words, this target matches with longer expressions such asuid=andy,ou=eng,dc=example,dc=com or uid=andy,ou=marketing,dc=example,dc=com.

NOTEYou cannot use wildcards in the suffix part of a distinguished name. That is, if yourdirectory uses the suffixes c=US and c=GB, then you cannot use (target="ldap:///dc=example,c=*") as a target to reference both suffixes. Neither can you use a targetsuch as uid=bjensen,dc=*.com.

6.3.2.2. Targeting AttributesIn addition to targeting directory entries, you can also target one or more attributes included in thetargeted entries. This is useful to deny or allow access to partial information about an entry. Forexample, you could allow access to only the common name, surname, and telephone numberattributes of a given entry while denying access to sensitive information such as passwords.

You can specify that the target is equal or is not equal to a specific attribute. The attributes you supplydo not need to be defined in the schema. This absence of schema checking makes it possible toimplement an access control policy when you set up your directory service for the first time, even if theACLs you create do not apply to the current directory content.

To target attributes, use the targetattr keyword. The keyword uses the following syntax:

(targetattr = "attribute")

You can target multiple attributes by using the targetattr keyword with the following syntax:

(targetattr = "attribute1 || attribute2 ...|| attributen")

Page 270: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

250

attributeX is the name of the targeted attribute. For example, this targets the common name (cn)attribute:

(targetattr = "cn")

To target an entry's common name, surname, and UID attributes, use the following:

(targetattr = "cn || sn || uid")

The attributes specified in the targetattr keyword apply to the entry that the ACI istargeting and to all the entries below it. If you target the password attribute on the entryuid=bjensen,ou=Marketing,dc=example,dc=com, only the password attribute on the bjensenentry is affected by the ACI because it is a leaf entry.

If, however, you target the tree's branch point ou=Marketing,dc=example,dc=com, then all theentries beneath the branch point that can contain a password attribute are affected by the ACI.

6.3.2.3. Targeting Both an Entry and AttributesBy default, the entry targeted by an ACI containing a targetattr keyword is the entry onwhich the ACI is placed. That is, putting an ACI such as aci: (targetattr = "uid")(access_control_rules;) on the ou=Marketing,dc=example,dc=com entry means that the ACIapplies to the entire Marketing subtree. However, you can also explicitly specify a target using thetarget keyword:

aci: (target="ldap:///ou=Marketing,dc=example,dc=com")(targetattr="uid")(access_control_rules;)

The order in which you specify the target and the targetattr keywords is not important.

6.3.2.4. Targeting Entries or Attributes Using LDAP FiltersYou can use LDAP filters to target a group of entries that match certain criteria. To do this, you mustuse the targetfilter keyword with an LDAP filter. The syntax of the targetfilter keyword is asfollows:

(targetfilter = "LDAP_filter")

LDAP_filter is a standard LDAP search filter. For more information on the syntax of LDAP searchfilters, see Appendix B, Finding Directory Entries.

For example, suppose that all entries in the accounting department include the attribute-valuepair ou=accounting, and all entries in the engineering department include the attribute-valuepair ou=engineering subtree. The following filter targets all the entries in the accounting andengineering branches of the directory tree:

(targetfilter = "(|(ou=accounting)(ou=engineering))")

This type of filter targets whole entries. You can associate the targetfilter and the targetattrkeywords to create ACIs that apply to a subset of attributes in the targeted entries.

Page 271: Red Hat Directory Server 5.1

Defining Targets

251

The following LDIF example allows members of the Engineering Admins group to modify thedepartmentNumber and manager attributes of all entries in the Engineering business category.This example uses LDAP filtering to select all entries with businessCategory attributes set toEngineering:

dn: dc=example,dc=comobjectClass: topobjectClass: organizationaci: (targetattr="departmentNumber || manager") (targetfilter="(businessCategory=Engineering)") (version 3.0; acl "eng-admins-write"; allow (write) groupdn ="ldap:///cn=Engineering Admins, dc=example,dc=com";)

NOTEAlthough using LDAP filters can be useful when you are targeting entries and attributesthat are spread across the directory, the results are sometimes unpredictable becausefilters do not directly name the object for which you are managing access. The set ofentries targeted by a filtered ACI is likely to change as attributes are added or deleted.Therefore, if you use LDAP filters in ACIs, you should verify that they target the correctentries and attributes by using the same filter in an ldapsearch operation.

6.3.2.5. Targeting Attribute Values Using LDAP FiltersYou can use access control to target specific attribute values. This means that you can grant or denypermissions on an attribute if that attribute's value meets the criteria defined in the ACI. An ACI thatgrants or denies access based on an attribute's value is called a value-based ACI.

For example, you might grant all users in your organization permission to modify the nsrolednattribute in their own entry. However, you would also want to ensure that they do not give themselvescertain key roles, such as Top Level Administrator. LDAP filters are used to check that theconditions on attribute values are satisfied.

To create a value-based ACI, you must use the targattrfilters keyword with the followingsyntax:

(targattrfilters="add=attr1:F1 && attr2:F2... && attrn:Fn,del=attr1:F1 && attr2:F2 ... && attrn:Fn")

• add represents the operation of creating an attribute.

• del represents the operation of deleting an attribute.

• attrx represents the target attributes.

• Fx represents filters that apply only to the associated attribute.

When creating an entry, if a filter applies to an attribute in the new entry, then each instance of thatattribute must satisfy the filter. When deleting an entry, if a filter applies to an attribute in the entry, theneach instance of that attribute must also satisfy the filter.

When modifying an entry, if the operation adds an attribute, then the add filter that applies to thatattribute must be satisfied; if the operation deletes an attribute, then the delete filter that applies to that

Page 272: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

252

attribute must be satisfied. If individual values of an attribute already present in the entry are replaced,then both the add and delete filters must be satisfied.

For example, consider the following attribute filter:

(targattrfilters="add=nsroledn:(!(nsroledn=cn=superAdmin)) && telephoneNumber:(telephoneNumber=123*)")

This filter can be used to allow users to add any role (nsroledn attribute) to their own entry, exceptthe superAdmin role. It also allows users to add a telephone number with a 123 prefix.

NOTEYou cannot create value-based ACIs from the Directory Server Console.

6.3.2.6. Targeting a Single Directory EntryTargeting a single directory entry is not straightforward because it goes against the design philosophyof the access control mechanism. However, it can be done in either of two ways:

• By creating a bind rule that matches user input in the bind request with an attribute value stored inthe targeted entry. For more details, see Section 6.4.5, “Defining Access Based on Value Matching”.

• By using the targetattr and targetfilter keywords.

You can use the targetattr keyword to specify an attribute that is only present in the entry youwant to target, and not in any of the entries below your target. For example, if you want to targetou=people,dc=example,dc=com, and there are not any organizational units (ou) defined belowthat node, you could specify an ACI that contains targetattr=ou.

A safer method is to use the targetfilter keyword and to specify explicitly an attribute value thatappears in the entry alone. For example, during the installation of the Directory Server, the followingACI is created:

aci: (targetattr="*")(targetfilter=(o=NetscapeRoot))(version 3.0; acl "Default anonymous access"; allow (read, search) userdn="ldap:///anyone";)

This ACI can apply only to the o=NetscapeRoot entry.

The risk associated with these method is that your directory tree might change in the future, and youwould have to remember to modify this ACI.

6.3.3. Defining PermissionsPermissions specify the type of access you are allowing or denying. You can either allow or denypermission to perform specific operations in the directory. The various operations that can be assignedare known as rights.

There are two parts to setting permissions:

• Allowing or denying access

Page 273: Red Hat Directory Server 5.1

Defining Permissions

253

• Assigning rights

6.3.3.1. Allowing or Denying AccessYou can either explicitly allow or deny access permissions to the directory tree.

NOTEFrom the Directory Server Console, you cannot explicitly deny access, only grantpermissions.

6.3.3.2. Assigning RightsRights detail the specific operations a user can perform on directory data. You can allow or deny allrights, or you can assign one or more of the following rights:

Right Description

Read Indicates whether users can read directorydata. This permission applies only to the searchoperation.

Write Indicates whether users can modify an entry byadding, modifying, or deleting attributes. Thispermission applies to the modify and modrdnoperations.

Add Indicates whether users can create an entry.This permission applies only to the addoperation.

Delete Indicates whether users can delete an entry.This permission applies only to the deleteoperation.

Search Indicates whether users can search for thedirectory data. Users must have Search andRead rights in order to view the data returned aspart of a search result. This permission appliesonly to the search operation.

Compare Indicates whether the users can compare datathey supply with data stored in the directory. Withcompare rights, the directory returns a successor failure message in response to an inquiry,but the user cannot see the value of the entryor attribute. This permission applies only to thecompare operation.

Selfwrite Indicates whether users can add or delete theirown DN from a group. This right is used only forgroup management.

Proxy Indicates whether the specified DN can accessthe target with the rights of another entry.

Page 274: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

254

Right Description

All Indicates that the specified DN has all rights(read, write, search, delete, compare, andselfwrite) to the targeted entry, excludingproxy rights.

Table 6.2. User Rights

Rights are granted independently of one another. This means, for example, that a user who is grantedadd rights can create an entry but cannot delete it if delete rights have not been specifically granted.Therefore, when planning the access control policy for your directory, you must ensure that you grantrights in a way that makes sense for users. For example, it does not usually make sense to grant writepermission without granting read and search permissions.

NOTEThe proxy mechanism is very powerful and must be used sparingly. Proxy rights aregranted within the scope of the ACL, and there is no way to restrict who an entry thathas the proxy right can impersonate; that is, when you grant a user proxy rights, thatuser has the ability to proxy for any user under the target; there is no way to restrictthe proxy rights to only certain users. For example, if an entity has proxy rights to thedc=example,dc=com tree, that entity can do anything. Make sure you set the proxy ACIat the lowest possible level of the DIT; see Section 6.9.11, “Proxied Authorization ACIExample”.

6.3.3.3. Rights Required for LDAP OperationsThis section describes the rights you need to grant to users depending on the type of LDAP operationyou want to authorize them to perform.

• Adding an entry:

• Grant add permission on the entry being added.

• Grant write permission on the value of each attribute in the entry. This right is granted by defaultbut could be restricted using the targattrfilters keyword.

• Deleting an entry:

• Grant delete permission on the entry to be deleted.

• Grant write permission on the value of each attribute in the entry. This right is granted by defaultbut could be restricted using the targattrfilters keyword.

• Modifying an attribute in an entry:

• Grant write permission on the attribute type.

• Grant write permission on the value of each attribute type. This right is granted by default butcould be restricted using the targattrfilters keyword.

• Modifying the RDN of an entry:

• Grant write permission on the entry.

Page 275: Red Hat Directory Server 5.1

Defining Permissions

255

• Grant write permission on the attribute type used in the new RDN.

• Grant write permission on the attribute type used in the old RDN, if you want to grant the right todelete the old RDN.

• Grant write permission on the value of attribute type used in the new RDN. This right is granted bydefault but could be restricted using the targattrfilters keyword.

• Comparing the value of an attribute:

• Grant compare permission on the attribute type.

• Searching for entries:

• Grant search permission on each attribute type used in the search filter.

• Grant read permission on attribute types used in the entry.

The permissions granted on individual attributes or entries can affect a broad range of actions; forexample, there are several different permissions users must have to search the directory like thefollowing ldapsearch operation:

ldapsearch -h host -s base -b "uid=bkolics,dc=example,dc=com" objectclass=* mail

The following ACI is used to determine whether user bkolics can be granted access:

aci: (targetattr = "mail")(version 3.0; acl "self access to mail"; allow (read, search) userdn = "ldap:///self";)

The search result list is empty because this ACI does not grant access to the objectclass attribute.If you want the search operation described above to be successful, modify the ACI to allow read andsearch access for the mail and objectclass attributes.

aci: (targetattr = "mail || objectclass")(version 3.0; acl "self access to mail"; allow (read, search) userdn = "ldap:///self";)

6.3.3.4. Permissions SyntaxIn an ACI statement, the syntax for permissions is allow|deny (rights). rights is a list of 1 to 8comma-separated keywords enclosed within parentheses. Valid keywords are read, write, add,delete, search, compare, selfwrite, proxy, or all.

In the following example, read, search, and compare access is allowed, provided the bind rule isevaluated to be true:

aci: (target="ldap:///dc=example,dc=com") (version 3.0;acl "example"; allow (read, search, compare) bind_rule;)

6.3.3.5. Access Control and the modrdn OperationTo explicitly deny modrdn rights using ACIs, target the relevant entries but omit the targetattrkeyword. For example, to prevent the cn=helpDeskGroup,ou=groups,o=example.com group

Page 276: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

256

from renaming any entries in the set specified by the pattern cn=*,ou=people,o=example.com,add the following ACI:

aci: (target="ldap:///cn=*,ou=people,o=example.com") (version 3.0; acl "Deny modrdn rights to the helpDeskGroup"; deny(write) groupdn="ldap:///cn=helpDeskGroup,ou=groups,o=example.com";)

6.4. Bind RulesDepending on the ACIs defined for the directory, for certain operations, you need to bind to thedirectory. Binding means logging in or authenticating yourself to the directory by providing credentials(a bind DN and password for SASL or a client certificate for SSL). The credentials provided in the bindoperation and the circumstances of the bind determine whether access to the directory is allowed ordenied.

Every permission set in an ACI has a corresponding bind rule that details the required credentials andbind parameters.

Bind rules can be simple, such as stating that the person accessing the directory must belong to aspecific group. Bind rules can also be more complex, such as requiring that a person must belong toa specific group, must log in from a machine with a specific IP address, and is restricted to accessbetween 8 a.m. and 5 p.m.

Bind rules define who can access the directory, when, and from where by defining any of the following:

• Users, groups, and roles that are granted access.

• Locations from which an entity must bind.

• Times or days on which binding must occur.

• Types of authentication that must be in use during binding.

Additionally, bind rules can be complex constructions that combine these criteria by using Booleanoperators. See Section 6.4.10, “Using Boolean Bind Rules” for more information.

6.4.1. Bind Rule SyntaxWhether access is allowed or denied depends on whether an ACI's bind rule is evaluated to be true.Bind rules use one of the two following patterns:

keyword = "expression"; or keyword != "expression";

Equal (=) indicates that keyword and expression must match in order for the bind rule to be true, andnot equal (!=) indicates that keyword and expression must not match in order for the bind rule to betrue.

NOTEThe timeofday keyword also supports the inequality expressions (<, <=, >,>=). This isthe only keyword that supports these expressions.

Page 277: Red Hat Directory Server 5.1

Defining User Access - userdn Keyword

257

The quotation marks ("") around expression and the delimiting semicolon (;) are required. Theexpressions you can use depend on the associated keyword.

Table 6.3, “LDIF Bind Rule Keywords” lists each keyword and the associated expressions andindicates whether wildcard characters are allowed in the expression.

Keyword Valid Expressions Wildcard Allowed

userdn ldap:///distinguished_nameldap:///allldap:///anyoneldap:///selfldap:///parentldap:///suffix??scope?(filter)

Yes, in DN only

groupdn ldap:///DN|| DNldap:///suffix??scope?(filter)

No

roledn ldap:///DN|| DN No

userattr attribute#bindTypeorattribute#value

No

ip IP_address Yes

dns DNS_host_name Yes

dayofweek sun mon tue wed thu fri sat No

timeofday 0 - 2359 No

authmethod nonesimplesslsasl sasl_mechanism

No

Table 6.3. LDIF Bind Rule Keywords

6.4.2. Defining User Access - userdn KeywordUser access is defined using the userdn keyword. The userdn keyword requires one or more validdistinguished names in the following format:

userdn = "ldap:///dn [|| ldap:///dn]...[||ldap:///dn]"

dn can be a DN or one of the expressions anyone, all, self, or parent:

userdn = "ldap:///anyone" Defines anonymous accessuserdn = "ldap:///all" Defines general accessuserdn =ldap:///self" Defines self accessuserdn =ldap:///parent" Defines access for the parent entry

The userdn keyword can also be expressed as an LDAP filter:

ldap:///suffix??scope?(filter)

Page 278: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

258

NOTEIf a DN contains a comma, the comma must be preceded by a backslash (\) escapecharacter.

6.4.2.1. Anonymous Access (anyone Keyword)Granting anonymous access to the directory means that anyone can access it without providing a bindDN or password and regardless of the circumstances of the bind. You can limit anonymous accessto specific types of access (for example, read or search access) or to specific subtrees or individualentries within the directory.

From the Directory Server Console, you define anonymous access through the Access ControlEditor. See Section 6.5, “Creating ACIs from the Console”.

6.4.2.2. General Access (all Keyword)You can use bind rules to indicate that a permission applies to anyone who has successfully bound tothe directory; that is, all authenticated users. This allows general access while preventing anonymousaccess.

From the Directory Server Console, you define general access on the Access Control Editor. Formore information, see Section 6.5, “Creating ACIs from the Console”.

6.4.2.3. Self Access (self Keyword)Specifies that users are granted or denied access to their own entries. In this case, access is grantedor denied if the bind DN matches the DN of the targeted entry.

Self access can be configured in the Access Control Editor in the Directory Server Console. Formore information, see Section 6.5, “Creating ACIs from the Console”.

6.4.2.4. Parent Access (parent Keyword)Specifies that users are granted or denied access to the entry only if their bind DN is the parent of thetargeted entry.

You cannot set up parent access control using the Directory Server Console.

6.4.2.5. LDAP URLsYou can dynamically target users in ACIs using a URL with an LDAP filter:

userdn = "ldap:///suffix??scope?(filter)"

For example, all users in the accounting and engineering branches of the example.com tree wouldbe granted or denied access to the targeted resource dynamically based on the following URL:

userdn = "ldap:///dc=example,dc=com??sub?(|(ou=engineering)(ou=accounting))"

Page 279: Red Hat Directory Server 5.1

Defining User Access - userdn Keyword

259

NOTEDo not specify a hostname or port number within the LDAP URL. LDAP URLs alwaysapply to the local server.

It is possible to string multiple LDAP URLs together so that the bind user must match both filter A andfilter B. This is done by using multiple userdn keyword definitions. For example:

userdn="ldap:///dc=example,dc=com??sub?(ou=engineering)" and userdn="ldap:///dc=example,dc=com??sub?(manager="uid=bjensen,ou=managers,dc=example,dc=com")"

Using a connector such as && is not allowed. For example, this is not an acceptable bind rule:

groupdn="ldap:///dc=example,dc=com??sub?(ou=engineering) && ldap:///dc=example,dc=com??sub?(manager="uid=bjensen,ou=managers,dc=example,dc=com")"

For more information about LDAP URLs, see Appendix C, LDAP URLs.

6.4.2.6. WildcardsYou can also specify a set of users by using the wildcard character (*). For example, specifying a userDN of uid=u*,dc=example,dc=com indicates that only users with a bind DN beginning with theletter u are allowed or denied access based on the permissions you set.

From the Directory Server Console, you set user access from the Access Control Editor. For moreinformation, see Section 6.5, “Creating ACIs from the Console”.

6.4.2.7. Examples

Scenario Example Description

Userdn keyword containing an LDAP URL userdn = "ldap:///uid=*,dc=example,dc=com"; The bind rule is evaluated to be true if the user binds tothe directory using any distinguished name of the specifiedpattern. For example, both of the following bind DNs would beevaluated to be true:uid=ssarette,dc=example,dc=comuid=tjaz,ou=Accounting,dc=example,dc=com

This bind DN would be evaluated to be false:cn=Babs Jensen,dc=example,dc=com

Userdn keyword containing logical OR of LDAP URLs userdn="ldap:///uid=bj,dc=example,dc=com ||ldap:///uid=kc,dc=example,dc=com";

The bind rule is evaluated to be true if the client binds as eitherof the two supplied distinguished names.

Userdn keyword excluding a specific LDAP URL userdn != "ldap:///uid=*,ou=Accounting,dc=example,dc=com";

The bind rule is evaluated to be true if the client is not bindingas a UID-based distinguished name in the accounting subtree.This bind rule only makes sense if the targeted entry is notunder the accounting branch of the directory tree.

Userdn keyword containing self keyword userdn = "ldap:///self"; The bind rule is evaluated to be true if the user isaccessing the entry represented by the DN with whichthe user bound to the directory. That is, if the user hasbound as uid=ssarette, dc=example,dc=com

Page 280: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

260

Scenario Example Descriptionand the user is attempting an operation on theuid=ssarette,dc=example,dc=com entry, then the bindrule is true.

If you want to grant all users in the example.com tree writeaccess to their userPassword attribute, you would create thefollowing ACI on the dc=example,dc=com node.

aci: (targetattr = "userPassword") (version 3.0; acl "write-self";allow (write) userdn = "ldap:///self";)

Userdn keyword containing the all keyword userdn = "ldap:///all"; The bind rule is evaluated to be true for any valid bind DN. Tobe true, a valid distinguished name must be presented by theuser for a successful bind operation.

For example, if you want to grant read access to the entire treeto all authenticated users, you would create the following ACIon the dc=example,dc=com node:

aci:(version 3.0; acl "all-read"; allow (read) userdn="ldap:///all";)

Userdn keyword containing the anyone keyword userdn = "ldap:///anyone"; The bind rule is evaluated to be true for anyone; use thiskeyword to provide anonymous access to your directory.

For example, if you want to allow anonymous read and searchaccess to the entire example.com tree, you would create thefollowing ACI on the dc=example,dc=com node:

aci: (version 3.0; acl "anonymous-read-search"; allow(read,search) userdn = "ldap:///anyone";)

Userdn keyword containing the parent keyword userdn = "ldap:///parent"; The bind rule is evaluated to be true if the bind DN is theparent of the targeted entry.

For example, if you want to grant write access to every user'schild entries, you would create the following ACI on thedc=example,dc=com node:

aci:(version 3.0; acl "parent access"; allow (write)userdn="ldap:///parent";)

Table 6.4. userdn Keyword Examples

6.4.3. Defining Group Access - groupdn KeywordMembers of a specific group can access a targeted resource. This is known as group access. Groupaccess is defined using the groupdn keyword to specify that access to a targeted entry is granted ordenied if the user binds using a DN that belongs to a specific group.

Group membership can be determined based on the user's DN or by using an LDAP filter to search forgroup members.

The groupdn keyword requires one or more valid distinguished names in the following format:

groupdn="ldap:///dn [|| ldap:///dn]...[|| ldap:///dn]"

Page 281: Red Hat Directory Server 5.1

Defining Group Access - groupdn Keyword

261

The bind rule is evaluated to be true if the bind DN belongs to the named group.

NOTEIf a DN contains a comma, the comma must be escaped by a backslash (\).

The groupdn keyword can also be expressed with an LDAP filter:

groupdn="ldap:///suffix??scope?(filter)

With more complex groupdn syntax, the value of the groupdn expression is a single LDAP URL.Multiple groupdns can be grouped together within parentheses and use or or and connectors todefine additional conditions on the group membership. For example:

(groupdn = "ldap:///ou=Groups, dc=example,dc=com??sub?(cn=*s_0)" or groupdn = "ldap:///ou=Groups,dc=example,dc=com??sub?(cn=*s_1)") and groupdn = "ldap:///ou=Groups, dc=example,dc=com??sub?(cn=*s_2)"

When stringing multiple groupdn URLs together, the keyword supports pipes to separate the URLs:

groupdn = "LDAPURI0 || LDAPURL1 || LDAPURL2"

However, it is not permissible to use ampersands (&), like groupdn = "LDAPURI0 && LDAPURL1",or double quotes.

For example, to use two groupdn keywords so that the bind user must belong to both anAdministrators group and a Managers group:

groupdn="ldap:///dc=example,dc=com??sub?(cn=*Administrators)" and groupdn="ldap:///dc=example,dc=com??sub?(cn=*Managers)"

For more information about LDAP URLs, see Appendix C, LDAP URLs.

The Directory Server Console defines specific groups through the Access Control Editor. For moreinformation, see Section 6.5, “Creating ACIs from the Console”.

Scenario Example Description

Groupdn keyword containing an LDAP URL groupdn = "ldap:///cn=Administrators,dc=example,dc=com";

The bind rule is evaluated to be true if the bind DN belongsto the Administrators group. If you wanted to grant theAdministrators group permission to write to the entiredirectory tree, you would create the following ACI on thedc=example,dc=com node:aci: (targetattr=*)(version 3.0; acl "Administrators-write"; allow (write) groupdn="ldap:///cn=Administrators,dc=example,dc=com";)

Groupdn keyword containing an LDAP URL with a filter groupdn = "ldap:///dc=example,dc=com??sub?(cn=*Administrators)";

The bind rule is evaluated to be true if the bind DN belongs toany of the groups which are returned, meaning they match thefilter.

Groupdn keyword containing logical OR of LDAP URLs groupdn = "ldap:///cn=Administrators,dc=example,dc=com"

The bind rule is evaluated to be true if the bind DN belongs toeither the Administrators or the Mail Administratorsgroup.

Page 282: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

262

Scenario Example Description|| "ldap:///cn=MailAdministrators,dc=example,dc=com";

Table 6.5. groupdn Examples

6.4.4. Defining Role Access - roledn KeywordMembers of a specific role can access a targeted resource. This is known as role access. Role accessis defined using the roledn keyword to specify that access to a targeted entry is granted or denied ifthe user binds using a DN that belongs to a specific role.

The roledn keyword requires one or more valid distinguished names in the following format:

roledn = "ldap:///dn [|| ldap:///dn]... [|| ldap:///dn]"

The bind rule is evaluated to be true if the bind DN belongs to the specified role.

NOTEIf a DN contains a comma, the comma must be escaped by a backslash (\).

The roledn keyword has the same syntax and is used in the same way as the groupdn keyword,with the exception of the LDAP filter, which is not implemented for role membership.

6.4.5. Defining Access Based on Value MatchingYou can set bind rules to specify that an attribute value of the entry used to bind to the directory mustmatch an attribute value of the targeted entry.

For example, you can specify that the bind DN must match the DN in the manager attribute of a userentry in order for the ACI to apply. In this case, only the user's manager would have access to theentry.

This example is based on DN matching. However, you can match any attribute of the entry used inthe bind with the targeted entry. For example, you could create an ACI that allowed any user whosefavoriteDrink attribute is beer to read all the entries of other users that have the same value forfavoriteDrink.

6.4.5.1. Using the userattr KeywordThe userattr keyword can be used to specify which attribute values must match between the entryused to bind and the targeted entry. You can specify any of the following:

• A user DN

• A group DN

• A role DN

• An LDAP filter, in an LDAP URL

• Any attribute type

Page 283: Red Hat Directory Server 5.1

Defining Access Based on Value Matching

263

The LDIF syntax of the userattr keyword is as follows:

userattr = "attrName#bindType

Using an attribute type that requires a value other than a user DN, group DN, role DN, or an LDAPfilter has the following format:

userattr = "attrName#attrValue

• attrName is the name of the attribute used for value matching.

• bindType is either USERDN, GROUPDN, or LDAPURL.

• attrValue is any string representing an attribute value.

6.4.5.1.1. Example with USERDN Bind TypeThe following associates the userattr keyword with a bind based on the user DN:

userattr = "manager#USERDN"

The bind rule is evaluated to be true if the bind DN matches the value of the manager attribute inthe targeted entry. You can use this to allow a user's manager to modify employees' attributes. Thismechanism only works if the manager attribute in the targeted entry is expressed as a full DN.

The following example grants a manager full access to his or her employees' entries:

aci: (target="ldap:///dc=example,dc=com")(targetattr=*) (version 3.0; acl "manager-write"; allow (all) userattr = "manager#USERDN";)

6.4.5.1.2. Example with GROUPDN Bind TypeThe following associates the userattr keyword with a bind based on a group DN:

userattr = "owner#GROUPDN"

The bind rule is evaluated to be true if the bind DN is a member of the group specified in the ownerattribute of the targeted entry. For example, you can use this mechanism to allow a group to manageemployees' status information. You can use an attribute other than owner as long as the attribute youuse contains the DN of a group entry.

The group you point to can be a dynamic group, and the DN of the group can be under any suffix inthe database. However, the evaluation of this type of ACI by the server is very resource intensive.

If you are using static groups that are under the same suffix as the targeted entry, you can use thefollowing expression:

userattr = "ldap:///dc=example,dc=com?owner#GROUPDN"

In this example, the group entry is under the dc=example,dc=com suffix. The server can processthis type of syntax more quickly than the previous example.

(By default, owner is not an allowed entry in a user's entry. You would have to extend your schema toallow this attribute in a person object.)

Page 284: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

264

6.4.5.1.3. Example with ROLEDN Bind TypeThe following associates the userattr keyword with a bind based on a role DN:

userattr = "exampleEmployeeReportsTo#ROLEDN"

The bind rule is evaluated to be true if the bind DN belongs to the role specified in theexampleEmployeeReportsTo attribute of the targeted entry. For example, if you create a nestedrole for all managers in your company, you can use this mechanism to grant managers at all levelsaccess to information about employees that are at a lower grade than themselves.

NOTEThis example assumes that you have added theexampleEmployeeReportsToattribute to the schema and that all employee entriescontain this attribute. It also assumes that the value of this attribute is the DN of a roleentry. For information on adding attributes to the schema, see Section 10.4.2, “CreatingAttributes”.

The DN of the role can be under any suffix in the database. If you are also using filtered roles, theevaluation of this type of ACI uses a lot of resources on the server.

If you are using a static role definition and the role entry is under the same suffix as the targeted entry,you can use the following expression:

userattr = "ldap:///dc=example,dc=com?employeeReportsTo#ROLEDN"

In this example, the role entry is under the dc=example,dc=com suffix. The server can process thistype of syntax more quickly than the previous example.

6.4.5.1.4. Example with LDAPURL Bind TypeThe following associates the userattr keyword with a bind based on an LDAP filter:

userattr = "myfilter#LDAPURL

The bind rule is evaluated to be true if the bind DN matches the filter specified in the myfilter attributeof the targeted entry. The myfilter attribute can be replaced by any attribute that contains an LDAPfilter.

6.4.5.1.5. Example with Any Attribute ValueThe following associates the userattr keyword with a bind based on any attribute value:

userattr = "favoriteDrink#Beer"

The bind rule is evaluated to be true if the bind DN and the target DN include the favoriteDrinkattribute with a value of Beer.

6.4.5.1.6. Using the userattr Keyword with InheritanceWhen you use the userattr keyword to associate the entry used to bind with the target entry, theACI applies only to the target specified and not to the entries below it. In some circumstances, youmight want to extend the application of the ACI several levels below the targeted entry. This is possible

Page 285: Red Hat Directory Server 5.1

Defining Access Based on Value Matching

265

by using the parent keyword and specifying the number of levels below the target that should inheritthe ACI.

When you use the userattr keyword in association with the parent keyword, the syntax is asfollows:

userattr = "parent[inheritance_level].attrName#bindType

Using an attribute type that requires a value other than a user DN, group DN, role DN, or an LDAPfilter, the syntax is as follows:

userattr = "parent[inheritance_level].attrName#attrValue

• inheritance_level is a comma-separated list that indicates how many levels below the target inheritsthe ACI. You can include five levels (0, 1, 2, 3, 4) below the targeted entry; zero (0) indicates thetargeted entry.

• attribute is the attribute targeted by the userattr or groupattr keyword.

• bindType can be one of USERDN, GROUPDN, or LDAPURL.

For example:

userattr = "parent[0,1].manager#USERDN"

This bind rule is evaluated to be true if the bind DN matches the manager attribute of the targetedentry. The permissions granted when the bind rule is evaluated to be true apply to the target entry andto all entries immediately below it.

The example in Figure 6.1, “Using Inheritance With the userattr Keyword” indicates that user bjensenis allowed to read and search the cn=Profiles entry as well as the first level of child entries whichincludes cn=mail and cn=news, thus allowing her to search through her own mail and news IDs.

Figure 6.1. Using Inheritance With the userattr Keyword

In this example, if you did not use inheritance, you would have to do one of the following to achievethe same result:

• Explicitly set read and search access for user bjensen on the cn=Profiles, cn=mail, andcn=news entries in the directory.

• Add the owner attribute with a value of bjensen to the cn=mail and cn=news entries, and thenadd the following ACI to the cn=mail and cn=news entries.

Page 286: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

266

aci: (targetattr="*") (version 3.0; acl "profiles access"; allow (read,search) userattr="owner#USERDN";)

6.4.5.1.7. Granting Add Permission Using the userattr KeywordUsing the userattr keyword in conjunction with all or add permissions does not behave asone would typically expect. Typically, when a new entry is created in the directory, Directory Serverevaluates access rights on the entry being created and not on the parent entry. However, in the caseof ACIs using the userattr keyword, this behavior could create a security hole, and the server'snormal behavior is modified to avoid it.

Consider the following example:

aci: (target="ldap:///dc=example,dc=com")(targetattr=*) (version 3.0; acl "manager-write"; allow (all) userattr = "manager#USERDN";)

This ACI grants managers all rights on the entries of employees that report to them. However,because access rights are evaluated on the entry being created, this type of ACI would also allowany employee to create an entry in which the manager attribute is set to their own DN. For example,disgruntled employee Joe (cn=Joe,ou=eng,dc=example,dc=com) might want to create an entryin the Human Resources branch of the tree to use (or misuse) the privileges granted to HumanResources employees.

He could do this by creating the following entry:

dn: cn= Trojan Horse,ou=Human Resources,dc=example,dc=comobjectclass: top...cn: Trojan Horsemanager: cn=Joe,ou=eng,dc=example,dc=com

To avoid this type of security threat, the ACI evaluation process does not grant add permission at level0, to the entry itself. You can, however, use the parent keyword to grant add rights below existingentries. You must specify the number of levels below the parent for add rights. For example, thefollowing ACI allows child entries to be added to any entry in the dc=example,dc=com that has amanager attribute that matches the bind DN:

aci: (target="ldap:///dc=example,dc=com")(targetattr=*) (version 3.0; acl "parent-access"; allow (add) userattr = "parent[0,1].manager#USERDN";)

This ACI ensures that add permission is granted only to users whose bind DN matches the managerattribute of the parent entry.

6.4.6. Defining Access from a Specific IP Address

NOTEDirectory Server supports both IPv4 and IPv6 IP addresses.

Page 287: Red Hat Directory Server 5.1

Defining Access from a Specific Domain

267

Using bind rules, you can indicate that the bind operation must originate from a specific IP address.This is often used to force all directory updates to occur from a given machine or network domain.

The LDIF syntax for setting a bind rule based on an IP address is as follows:

ip = "IP_address" or ip != "IP_address"

The IP address must be expressed in dot notation. You can use the wildcard character (*) to includemultiple machines. For example, the following string is valid:

ip = "12.123.1.*";

The bind rule is evaluated to be true if the client accessing the directory is located at the named IPaddress. This can be useful for allowing certain kinds of directory access only from a specific subnet ormachine.

For example, use a wildcard IP address such as 12.3.45.* to specify a specific subnetwork or123.45.6.*+255.255.255.115 to specify a subnetwork mask.

From the Directory Server Console, you can define specific machines to which the ACI applies throughthe Access Control Editor. For more information, see Section 6.5, “Creating ACIs from the Console”.

6.4.7. Defining Access from a Specific DomainA bind rule can specify that the bind operation must originate from a particular domain or hostmachine. This is often used to force all directory updates to occur from a given machine or networkdomain.

The LDIF syntax for setting a bind rule based on the DNS hostname is as follows:

dns = "DNS_Hostname or dns != "DNS_Hostname

WARNINGThe dns keyword requires that the naming service used on your machine is DNS. If thename service is not DNS, use the ip keyword instead.

The dns keyword requires a fully qualified DNS domain name. Granting access to a host withoutspecifying the domain creates a potential security threat. For example, the following expression isallowed but not recommended:

dns = "legend.eng";

Instead, use a fully qualified name:

dns = "legend.eng.example.com";

The dns keyword allows wildcards. For example:

dns = "*.example.com";

Page 288: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

268

The bind rule is evaluated to be true if the client accessing the directory is located in the nameddomain. This can be useful for allowing access only from a specific domain. Wildcards will not work ifyour system uses a naming service other than DNS. In such a case, if you want to restrict access to aparticular domain, use the ip keyword, as described in Section 6.4.6, “Defining Access from a SpecificIP Address”.

6.4.8. Defining Access at a Specific Time of Day or Day of WeekYou can use bind rules to specify that binding can only occur at a certain time of day or on a certainday of the week. For example, you can set a rule that allows access only if it is between the hours of8 a.m. and 5 p.m. Monday through Friday. The time used to evaluate access rights is the time on theDirectory Server, not the time on the client.

The LDIF syntax for setting a bind rule based on the time of day is as follows:

timeofday operator time

operator can be one of the following symbols:

equal to (=)not equal to (!=)greater than (>)greater than or equal to (>=)less than (<)less than or equal to (<=)

The timeofday keyword requires a time of day expressed in hours and minutes in the 24 hour clock(0 to 2359).

NOTEThe time on the Directory Server is used for the evaluation, not the time on the client.

The LDIF syntax for setting a bind rule based on the day in the week is as follows:

dayofweek = "day1, day2 ...

The possible values for the dayofweek keyword are the English three-letter abbreviations for thedays of the week: sun, mon, tue, wed, thu, fri, sat.

6.4.8.1. ExamplesThe following are examples of the timeofday and dayofweek syntax:

• The bind rule is evaluated to be true if the client is accessing the directory at noon.

timeofday = "1200";

• The bind rule is evaluated to be true if the client is accessing the directory at any time other than 1a.m.

Page 289: Red Hat Directory Server 5.1

Defining Access Based on Authentication Method

269

timeofday != "0100";

• The bind rule is evaluated to be true if the client is accessing the directory at any time after 8 a.m.

timeofday > "0800";

• The bind rule is evaluated to be true if the client is accessing the directory at any time before 6 p.m.

timeofday < "1800";

• The bind rule is evaluated to be true if the client is accessing the directory at 8 a.m. or later.

timeofday >= "0800";

• The bind rule is evaluated to be true if the client is accessing the directory at 6 p.m. or earlier.

timeofday <= "1800";

• The bind rule is evaluated to be true if the client is accessing the directory on Sunday, Monday, orTuesday.

dayofweek = "Sun, Mon, Tue";

6.4.9. Defining Access Based on Authentication MethodThe authmethod keyword sets the specific method that a client uses to bind to the directory. Thereare four available authentication methods:

• None. Authentication is not required. This is the default. It represents anonymous access.

• Simple. The client must provide a user name and password to bind to the directory.

• SSL. The client must bind to the directory using some kind of PKI credentials, meaning a client mustpresent an SSL certificate either in a database or on a smart card, token, or some other device.

Certificate-based authentication, as one method, is described in Section 12.8, “Using Certificate-Based Authentication”.

• SASL. The client must bind to the directory over a Simple Authentication and Security Layer (SASL)connection. Directory Server supports three SASL mechanisms: EXTERNAL, CRAM-MD5, DIGEST-MD5 (for Kerberos systems), and GSS-API (for Kerberos systems). For information on setting upSASL, see Chapter 13, Managing SASL.

NOTEYou cannot set up authentication-based bind rules through the Access Control Editor.

The LDIF syntax for setting a bind rule based on an authentication method is as follows:

Page 290: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

270

authmethod = "sasl_mechanism

sasl_mechanism can be none, simple, ssl, or "sasl sasl_mechanism".

6.4.9.1. ExamplesThe following are examples of the authmethod keyword:

• Authentication is not checked during bind rule evaluation.

authmethod = "none";

• The bind rule is evaluated to be true if the client is accessing the directory using a username andpassword.

authmethod = "simple";

• The bind rule is evaluated to be true if the client authenticates to the directory using a certificateover LDAPS. This is not evaluated to be true if the client authenticates using simple authentication(bind DN and password) over LDAPS. The authmethod = "ssl" means that a certificate mustbe presented to authenticate to the server. This does not configure a required connection type, eventhough SSL has to be used with certificate-based authentication.

authmethod = "ssl";

• The bind rule is evaluated to be true if the client is accessing the directory using the SASL DIGEST-MD5 mechanism.

authmethod = "sasl DIGEST-MD5";

6.4.10. Using Boolean Bind RulesBind rules can be complex expressions that use the Boolean expressions AND, OR, and NOT to setvery precise access rules. You cannot use the Directory Server Console to create Boolean bind rules.You must create an LDIF statement.

The LDIF syntax for a Boolean bind rule is as follows:

bind_rule [boolean][bind_rule][boolean][bind_rule]...;)

For example, this bind rule is evaluated to be true if the bind DN is a member of either theadministrator's group or the Mail Administrator's group and if the client is running from within theexample.com domain:

(groupdn = "ldap:///cn=administrators,dc=example,dc=com" or groupdn = "ldap:///cn=mail administrators,dc=example,dc=com" and dns = "*.example.com";)

The trailing semicolon (;) is a required delimiter that must appear after the final bind rule.

Page 291: Red Hat Directory Server 5.1

Creating ACIs from the Console

271

Boolean expressions are evaluated in the following order:

• Innermost to outermost parenthetical expressions first.

• All expressions from left to right.

• NOT before AND or OR operators.

• OR and AND operators have no order of precedence.

Consider the following Boolean bind rules:

(bind_rule_A) OR (bind_rule_B)(bind_rule_B) OR (bind_rule_A)

Because Boolean expressions are evaluated from left to right, in the first case, bind rule A is evaluatedbefore bind rule B, and, in the second case, bind rule B is evaluated before bind rule A.

However, the Boolean NOT is evaluated before the Boolean OR and Boolean AND. Thus, in thefollowing example, bind rule B is evaluated before bind rule A despite the left-to-right rule.

(bind_rule_A) AND NOT (bind_rule_B)

6.5. Creating ACIs from the ConsoleYou can use the Directory Server Console to view, create, edit, and delete access control instructionsfor your directory:

• Section 6.5.1, “Displaying the Access Control Editor”

• Section 6.5.2, “Creating a New ACI”

• Section 6.5.3, “Editing an ACI”

• Section 6.5.4, “Deleting an ACI”

See Section 6.9, “Access Control Usage Examples” for a collection of access control rules commonlyused in Directory Server security policies, along with step-by-step instructions for using the DirectoryServer Console to create them.

The Access Control Editor prevents creating more complex ACIs in visual editing mode, especiallyACIs with any of these characteristics:

• Deny access (Section 6.3.3.4, “Permissions Syntax”).

• Create value-based ACIs (Section 6.3.2.2, “Targeting Attributes”).

• Define parent access (Section 6.4.2.4, “Parent Access (parent Keyword)”).

• Create ACIs that contain Boolean bind rules (Section 6.4.10, “Using Boolean Bind Rules”).

• Create ACIs that use the roledn, userattr, authmethod keywords.

Page 292: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

272

NOTEIn the Access Control Editor, click the Edit Manually button at any time to check theLDIF representation of the ACI changes made through the graphical interface.

6.5.1. Displaying the Access Control Editor1. Start the Directory Server Console. Log in using the bind DN and password of a privileged user,

such as the Directory Manager, who has write access to the ACIs configured for the directory.

redhat-idm-console

2. Select the Directory tab.

3. Right-click the entry in the navigation tree for which to set access control, and select Set AccessPermissions from the pop-up menu.

Alternatively, highlight the entry, and select Set Access Permissions from the Object menu.

4. Click New to open the Access Control Editor.

Page 293: Red Hat Directory Server 5.1

Creating a New ACI

273

Figure 6.2. Access Control Editor Window

6.5.2. Creating a New ACITo create a new ACI in the Directory Server Console, do the following:

1. Open the Access Control Editor, as described in Section 6.5.1, “Displaying the Access ControlEditor”.

If the view displayed is different from Figure 6.2, “Access Control Editor Window”, click the EditVisually button.

2. Type the ACI name in the ACI Name field.

The name can be any unique string to identify the ACI. If you do not enter a name, the server usesunnamed ACI.

3. In the Users/Groups tab, select the users to whom you are granting access by highlighting AllUsers or clicking the Add button to search the directory for the users to add.

Page 294: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

274

a. Select a search area from the drop-down list, enter a search string in the Search field,and click the Search button. You can use wildcards (an asterisk, *) to search for partialusernames. The search results are displayed in the list below.

b. Highlight the entries you want in the search result list, and click the Add button to add them tothe list of entries which have access permission.

c. Click OK to dismiss the Add Users and Groups window.

The selected entries are now listed on the Users/Groups tab in the ACI editor.

4. In the Access Control Editor, click the Rights tab, and use the checkboxes to select the rights togrant.

Page 295: Red Hat Directory Server 5.1

Creating a New ACI

275

5. Click the Targets tab. Click This Entry to display the current node as the target for the ACI or clickBrowse to select a different suffix.

Page 296: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

276

NOTEYou can change the value of the target DN, but the new DN must be a direct orindirect child of the selected entry.

If you do not want every entry in the subtree under this node to be targeted by the ACI, enter afilter in the Filter for Sub-entries field. The filter applies to every entry below the target entry;for example, setting a filter of ou=Sales means that only entries with ou=Sales in their DN arereturned.

Additionally, you can restrict the scope of the ACI to only certain attributes by selecting theattributes to target in the attribute list.

6. Click the Hosts tab, then the Add button to open the Add Host Filter dialog box.

Page 297: Red Hat Directory Server 5.1

Creating a New ACI

277

You can specify a hostname or an IP address. With an IP address, you can use an asterisk (*) asa wildcard.

NOTEDirectory Server supports both IPv4 and IPv6 IP addresses.

7. Click the Times tab to display the table showing at what times access is allowed.

By default, access is allowed at all times. You can change the access times by clicking anddragging the cursor over the table. You cannot select discrete blocks of time, only continuous timeranges.

Page 298: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

278

8. When you have finished editing the ACI, click OK.

The Access Control Editor closes, and the new ACI is listed in the Access Control Managerwindow.

NOTEFor any point of creating the ACI, you can click the Edit Manually button to display theLDIF statement corresponding to the wizard input. You can modify this statement, but yourchanges may not be visible in the graphical interface.

6.5.3. Editing an ACITo edit an ACI, do the following:

1. In the Directory tab, right-click the top entry in the subtree, and choose Set Access Permissionsfrom the pop-up menu.

The Access Control Manager window opens, listing the ACIs belonging to the entry.

2. In the Access Control Manager window, highlight the ACI to edit, and click Edit.

Page 299: Red Hat Directory Server 5.1

Deleting an ACI

279

3. Make the edits to the ACI in the Access Control Editor; the different screens are described morein Section 6.5.2, “Creating a New ACI” and in the online help.

4. When you have finished editing the ACI, click OK.

The Access Control Editor windows closes, and the modified ACI is listed in the Access ControlManager.

6.5.4. Deleting an ACITo delete an ACI, do the following:

1. In the Directory tab, right-click the top entry in the subtree, and choose Set Access Permissionsfrom the pop-up menu.

The Access Control Manager window opens with a list of ACIs belonging to the entry.

2. In the Access Control Manager window, select the ACI to delete.

3. Click Remove.

The ACI is no longer listed in the Access Control Manager window.

6.6. Viewing ACIsAll the ACIs under a single suffix in the directory can be viewed from the command line by using thefollowing ldapsearch command: 1

ldapsearch -h host -p port -b baseDN -D rootDN -w rootPassword (aci=*) aci

See the Directory Server Configuration, Command, and File Reference for information on using theldapsearch utility.

From the Directory Server Console, all of the ACIs that apply to a particular entry can be viewedthrough the Access Control Manager.

1. Start the Directory Server Console. See Section 1.4.1, “Starting the Directory Server Console”.

2. In the Directory tab, right-click the entry in the navigation tree, and select Set AccessPermissions.

The Access Control Manager opens with a list of the ACIs belonging to the selected entry.

3. Check the Show Inherited ACIs checkbox to display all ACIs created on entries above theselected entry that also apply.

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 300: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

280

6.7. Checking Access Rights on Entries (Get EffectiveRights)Finding the access rights that a user has on attributes within a specific entry offers a convenient wayfor administrators to find and control the access rights.

Get effective rights is a way to extend directory searches to display what access rights — such asread, search, write and self-write, add, and delete — a user has to a specified entry.

In Directory Server, regular users can check their rights over entries which they can view and cancheck other people's access to their personal entries. The Directory Manager can check rights thatone user has over another user.

There are two common situations where checking the effective rights on an entry are useful:

• An administrator can use the get effective rights command in order to better organize access controlinstructions for the directory. It is frequently necessary to restrict what one group of users can viewor edit versus another group. For instance, members of the QA Managers group may have the rightto search and read attributes like manager and salary but only HR Group members have therights to modify or delete them. Checking the effective rights for a user or group is one way to verifythat the appropriate access controls are in place.

• A user can run the get effective rights command to see what attributes he can view ormodify on his personal entry. For instance, a user should have access to attributes such ashomePostalAddress and cn but may only have read access to manager and salary attributes.

There are three people involved in a get effective rights search. The first is the person running thesearch command, the requester. The rights are checked (with a variety of permutations) to see whatrights Person A has over Entry B. The person whose rights are being checked (Person A) is the GERsubject; as in, their rights are the subject of the search. The entry or entries to which the person hasrights (Entry B) is the target of the search or the search base.

6.7.1. Rights Shown with a Get Effective Rights SearchAny get effective rights search, both when viewing an entry in the Directory Server Console andsearching for it in the command line, shows the rights that User A has to User B's entry.

There are two kinds of access rights that can be allowed to any entry. The first are upper-level rights,rights on the entry itself, which means that kinds of operations that the User A can perform on User B'sentry as a whole. The second level of access rights are more granular, show what rights for a givenattribute User A has. In this case, User A may have different kinds of access permissions for differentattributes in the same entry. Whatever access controls are allowed for a user are the effective rightsover that entry.

For example:

entryLevelRights: vadnattributeLevelRights: givenName:rscWO, sn:rscW, objectClass:rsc, uid:rsc, cn:rscW

Table 6.6, “Entry Rights” and Table 6.7, “Attribute Rights” show the access rights to entries andattributes, respectively, that are returned by a get effective rights search.

Permission Description

a Add an entry.

Page 301: Red Hat Directory Server 5.1

The Format of a Get Effective Rights Search

281

Permission Description

d Delete this entry.

n Rename the DN.

v View the entry.

Table 6.6. Entry Rights

Permission Description

r Read.

s Search.

w Write (mod-add).

o Obliterate(mod-del). Analogous to delete.

c Compare.

W Self-write.

O Self-delete.

Table 6.7. Attribute Rights

6.7.2. The Format of a Get Effective Rights SearchGet effective rights (sometimes called GER) is an extended directory search; the GER parameters aredefined with the -J option with the ldapsearch command. (If an ldapsearch is run without the -Joption, then, naturally, the entry is returned as normal, without any get effective rights information.)

ldapsearch -p port -h host -D bindDN -w bindPassword -b searchBase -J 1.3.6.1.4.1.42.2.27.9.5.2:criticality:dn:GER_subject (searchFilter) attributeList

• -b searchBase is the base DN of the subtree or entry used to search for the GER subject.

If the search base is a specific entry DN or if only one entry is returned, then the results show therights the requester has over that specific entry. If multiple entries beneath the search base matchthe filter, then the search returns every matching entry, with the rights for the requester over eachentry.

• 1.3.6.1.4.1.42.2.27.9.5.2 is the OID for the get effective rights control.

• criticality specifies whether the search operation should return an error if the server does not supportthis control (true) or if it should be ignored and let the search return as normal (false).

• The GER_subject is the person whose rights are being checked. If the GER_subject is left blank(dn:), than the rights of an anonymous user are returned.

• An optional attributeList limits the get effective rights results to the specified attribute or object class.As with a regular ldapsearch, this can give specific attributes, like mail. If no attributes are listed,then every present attribute for the entry is returned. Using an asterisk (*) returns the rights forevery possible attribute for the entry, both existing attribute and non-existent attributes. Using anplus sign (+) returns operational attributes for the entry. Examples for checking rights for specificattributes are given in Section 6.7.2.2, “Examples of Get Effective Rights Searches for Non-ExistentAttributes” and Section 6.7.2.3, “Examples of Get Effective Rights Searches for Specific Attributes orObject Classes”.

Page 302: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

282

The crux of a get effective rights search is the ability to check what rights the GER subject (-J) hasto the targets of the search (-b). The get effective rights search is a regular ldapsearch, in thatit simply looks for entries that match the search parameters and returns their information. The geteffective rights option adds extra information to those search results, showing what rights a specificuser has over those results. That GER subject user can be the requester himself (-D is the same as -J) or someone else.

If the requester is a regular user (not the Directory Manager), then the requester can only see theeffective that a GER subject has on the requester's own entry. That is, if John Smith runs a request tosee what effective rights Babs Jensen has, then he can only get the effective rights that Babs Jensenhas on his own entry. All of the other entries return an insufficient access error for the effective rights.

There are three general scenarios for a regular user when running a get effective rights search:

• User A checks the rights that he has over other directory entries.

• User A checks the rights that he has to his personal entry.

• User A checks the rights that User B has to User A's entry.

The get effective rights search has a number of flexible different ways that it can check rights onattributes.

NOTEAll of the searches in these examples assume that the ldapsearch command is run onRed Hat Enterprise Linux 5 (32-bit) using the Mozilla LDAP tools.

6.7.2.1. General Examples on Checking Access RightsOne common scenario for effective rights searches is for a regular user to determine what changes hecan make to his personal entry.

For example, Ted Morris wants to check the rights he has to his entry. Both the -D and -J options givehis entry as the requester. Since he is checking his personal entry, the -b option also contains his DN.

/usr/lib/mozldap/ldapsearch -p 389 -h localhost -D "uid=tmorris,ou=people,dc=example,dc=com" -w secret -b "uid=tmorris,ou=people,dc=example,dc=com" -J "1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=tmorris,ou=people,dc=example,dc=com" "(objectClass=*)"

dn: uid=tmorris, ou=People, dc=example,dc=com givenName: Ted sn: Morris ou: IT ou: People l: Santa Clara manager: uid=jsmith, ou=People, dc=example,dc=com roomNumber: 4117 mail: [email protected] facsimileTelephoneNumber: +1 408 555 5409 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson uid: tmorris cn: Ted Morris

Page 303: Red Hat Directory Server 5.1

The Format of a Get Effective Rights Search

283

userPassword: {SSHA}bz0uCmHZM5b357zwrCUCJs1IOHtMD6yqPyhxBA== entryLevelRights: v attributeLevelRights: givenName:rsc, sn:rsc, ou:rsc, l:rsc, manager:rsc, roomNumber:rscwo, mail:rscwo, facsimileTelephoneNumber:rscwo, objectClass:rsc, uid:rsc, cn:rsc, userPassword:wo

Example 6.1. Checking Personal Rights (User A to User A)

Ted Morris may, for example, be a manager or work in a department where he has to edit other user'sentries, such as IT or human resources. In this case, he may want to check what rights he has toanother user's entry, as in Example 6.2, “Personally Checking the Rights of One User over Another(User A to User B)”, where Ted (-D) checks his rights (-J) to Dave Miller's entry (-b):

/usr/lib/mozldap/ldapsearch -p 389 -h localhost -D "uid=tmorris,ou=people,dc=example,dc=com" -w secret -b "uid=dmiller,ou=people,dc=example,dc=com" -J "1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=tmorris,ou=people,dc=example,dc=com" "(objectClass=*)"

dn: uid=dmiller, ou=People, dc=example,dc=com... snip ...entryLevelRights: vadattributeLevelRights: givenName:rscwo, sn:rscwo, ou:rscwo, l:rscwo, manager:rsc, roomNumber:rscwo, mail:rscwo, facsimileTelephoneNumber:rscwo, objectClass:rscwo, uid:rscwo, cn:rscwo, userPassword:rswo

Example 6.2. Personally Checking the Rights of One User over Another (User A to User B)

For all attributes, Ted Morris has read, search, compare, modify, and delete permissions to DaveMiller's entry. These results are different than the ones returned in checking Ted Morris's access to hisown entry, since he personally had only read, search, and compare rights to most of these attributes.

The Directory Manager has the ability to check the rights that one user has over another user's entry.In Example 6.3, “The Directory Manager's Checking the Rights of One User over Another (User A toUser B)”, the Directory Manager is checking the rights that a manager, Jane Smith (-J), has over hersubordinate, Ted Morris (-b):

/usr/lib/mozldap/ldapsearch -p 389 -h localhost -D "cn=directory manager" -w secret -b "uid=tmorris,ou=people,dc=example,dc=com" -J "1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=jsmith,ou=people,dc=example,dc=com" "(objectClass=*)"

dn: uid=tmorris, ou=People, dc=example,dc=com... snip ...entryLevelRights: vadnattributeLevelRights: givenName:rscwo, sn:rscwo, ou:rscwo, l:rscwo, manager:rscwo, roomNumber:rscwo, mail:rscwo, facsimileTelephoneNumber:rscwo, objectClass:rscwo, uid:rscwo, cn:rscwo, userPassword:rscwo

Example 6.3. The Directory Manager's Checking the Rights of One User over Another (User A to UserB)

Only an administrator can retrieve the effective rights that a different user has on an entry. If TedMorris tried to determine Dave Miller's rights to Dave Miller's entry, then he would receive aninsufficient access error:

/usr/lib/mozldap/ldapsearch -p 389 -h localhost -D "uid=dmiller,ou=people,dc=example,dc=com" -w secret -b "uid=tmorris,ou=people,dc=example,dc=com" -J "1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=tmorris,ou=people,dc=example,dc=com" "(objectClass=*)"

Page 304: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

284

ldap_search: Insufficient accessldap_search: additional info: get-effective-rights: requester has no g permission on the entry

However, a regular user can run a get effective rights search to see what rights another user has tohis personal entry. In Example 6.4, “Checking the Rights Someone Else Has to a Personal Entry”, TedMorris checks what rights Dave Miller has on Ted Morris's entry.

/usr/lib/mozldap/ldapsearch -p 389 -h localhost -D "uid=tmorris,ou=people,dc=example,dc=com" -w secret -b "uid=tmorris,ou=people,dc=example,dc=com" -J "1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=dmiller,ou=people,dc=example,dc=com" "(objectClass=*)"

dn: uid=tmorris,ou=people,dc=example,dc=com... snip ...entryLevelRights: vattributeLevelRights: givenName:rsc, sn:rsc, ou:rsc, l:rsc,manager:rsc, roomNumber:rsc, mail:rsc, facsimileTelephoneNumber:rsc, objectClass:rsc, uid:rsc, cn:rsc, userPassword:none

Example 6.4. Checking the Rights Someone Else Has to a Personal Entry

In this case, Dave Miller has the right to view the DN of the entry and to read, search, and comparethe ou, givenName, l, and other attributes, and no rights to the userPassword attribute.

6.7.2.2. Examples of Get Effective Rights Searches for Non-ExistentAttributesBy default, information is not given for attributes in an entry that do not have a value; for example, ifthe userPassword value is removed, then a future effective rights search on the entry above wouldnot return any effective rights for userPassword, even though self-write and self-delete rights couldbe allowed.

Using an asterisk (*) with the get effective rights search returns every attribute available for the entry,including attributes not set on the entry. For example:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "uid=scarter,ou=people,dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" "*"

dn: uid=scarter, ou=People, dc=example,dc=comgivenName: SamtelephoneNumber: +1 408 555 4798sn: Carterou: Accountingou: Peoplel: Sunnyvalemanager: uid=dmiller, ou=People, dc=example,dc=comroomNumber: 4612mail: [email protected]: +1 408 555 9700objectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersonuid: scartercn: Sam CarteruserPassword: {SSHA}Xd9Jt8g1UsHC8enNDrEmxj3iJPKQLItlDYdD9A==entryLevelRights: vadn

Page 305: Red Hat Directory Server 5.1

The Format of a Get Effective Rights Search

285

attributeLevelRights: objectClass:rscwo, aci:rscwo, sn:rscwo, cn:rscwo, description:rscwo, seeAlso:rscwo, telephoneNumber:rscwo, userPassword:rscwo, destinationIndicator:rscwo, facsimileTelephoneNumber:rscwo, internationaliSDNNumber:rscwo, l:rscwo, ou:rscwo, physicalDeliveryOfficeName:rscwo, postOfficeBox:rscwo, postalAddress:rscwo, postalCode:rscwo, preferredDeliveryMethod:rscwo, registeredAddress:rscwo, st:rscwo, street:rscwo, teletexTerminalIdentifier:rscwo, telexNumber:rscwo, title:rscwo, x121Address:rscwo, audio:rscwo, businessCategory:rscwo, carLicense:rscwo, departmentNumber:rscwo, displayName:rscwo, employeeType:rscwo, employeeNumber:rscwo, givenName:rscwo, homePhone:rscwo, homePostalAddress:rscwo, initials:rscwo, jpegPhoto:rscwo, labeledUri:rscwo, manager:rscwo, mobile:rscwo, pager:rscwo, photo:rscwo, preferredLanguage:rscwo, mail:rscwo, o:rscwo, roomNumber:rscwo, secretary:rscwo, uid:rscwo,x500UniqueIdentifier:rscwo, userCertificate:rscwo, userSMIMECertificate:rscwo, userPKCS12:rscwo

Example 6.5. Returning Effective Rights for Non-Existent Attributes

All of the attributes available for the entry, such as secretary, are listed, even though that attribute isnon-existent.

6.7.2.3. Examples of Get Effective Rights Searches for Specific Attributesor Object ClassesTaking the attribute-related GER searches further, it is possible to search for the rights to a specificattribute and set of attributes and to list all of the attributes available for one of the object classes seton the entry.

One of the options listed in the formatting example in Section 6.7.2, “The Format of a Get EffectiveRights Search” is attributeList. To return the effective rights for only specific attributes, list theattributes, separated by spaces, at the end of the search command. For example:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "uid=scarter,ou=people,dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" cn mail initials

dn: uid=scarter, ou=People, dc=example,dc=comcn: Sam Cartermail: [email protected]: vadnattributeLevelRights: cn:rscwo, mail:rscwo, initials:rscwo

Example 6.6. Get Effective Rights Results for Specific Attributes

It is possible to specify a non-existent attribute in the attributeList, as with the initials attributein Example 6.6, “Get Effective Rights Results for Specific Attributes”, to see the rights which areavailable, similar to using an asterisk to list all attributes.

The Directory Manager can also list the rights for all of the attributes available to a specific objectclass. This option has the format attribute@objectClass. This returns two entries; the first for thespecified GER subject and the second for a template entry for the object class. For example:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "uid=scarter,ou=people,dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" uidNumber@posixAccount

... snip ...

Page 306: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

286

dn: cn=template_posixaccount_objectclass,uid=scarter,ou=people,dc=example,dc=comuidnumber: (template_attribute)entryLevelRights: vattributeLevelRights: uidNumber:rsc

Example 6.7. Get Effective Rights Results for an Attribute within an Object Class

NOTEUsing the search format attribute@objectClass is only available if the requester (-D) is theDirectory Manager.

If a regular user, rather than Directory Manager, tried to run the same command, the result wouldsimply be blank.

$ /usr/lib/mozldap/ldapsearch -D "uid=scarter,ou=people,dc=example,dc=com" -w secret12 -b "dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" "*@person"

$

Example 6.8. Get Effective Rights Results with No ACL Set (Regular User)

Using an asterisk (*) instead of a specific attribute returns all of the attributes (present and non-existent) for the specified GER subject and the full list of attributes for the object class template. Forexample:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "uid=scarter,ou=people,dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" *@posixaccount

... snip ...

dn: cn=template_posixaccount_objectclass,uid=scarter,ou=people,dc=example,dc=com objectClass: posixaccount objectClass: top homeDirectory: (template_attribute) gidNumber: (template_attribute) uidNumber: (template_attribute) uid: (template_attribute) cn: (template_attribute) entryLevelRights: v attributeLevelRights: cn:rsc, uid:rsc, uidNumber:rsc, gidNumber:rsc, homeDirectory:rsc, objectClass:rsc, userPassword:none, loginShell:rsc, gecos:rsc, description:rsc, aci:rsc

Example 6.9. Get Effective Rights Results for All Attribute for an Object Class

6.7.2.4. Examples of Get Effective Rights Searches for OperationalAttributesOperational attributes are not returned in regular ldapsearches, including get effective rightssearches. To return the information for the operational attributes, use the plus sign (+). This returnsonly the operational attributes that can be used in the entry. For example:

Page 307: Red Hat Directory Server 5.1

The Format of a Get Effective Rights Search

287

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "uid=scarter,ou=people,dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" "+"

dn: uid=scarter, ou=People, dc=example,dc=comentryLevelRights: vadnattributeLevelRights: nsICQStatusText:rscwo, passwordGraceUserTime:rscwo, pwdGraceUserTime:rscwo, nsYIMStatusText:rscwo, modifyTimestamp:rscwo, passwordExpWarned:rscwo, pwdExpirationWarned:rscwo, entrydn:rscwo, aci:rscwo, nsSizeLimit:rscwo, nsAccountLock:rscwo, passwordExpirationTime:rscwo, entryid:rscwo, nsSchemaCSN:rscwo, nsRole:rscwo, retryCountResetTime:rscwo, ldapSchemas:rscwo, nsAIMStatusText:rscwo, copiedFrom:rscwo, nsICQStatusGraphic:rscwo, nsUniqueId:rscwo, creatorsName:rscwo, passwordRetryCount:rscwo, dncomp:rscwo, nsTimeLimit:rscwo, passwordHistory:rscwo, pwdHistory:rscwo, nscpEntryDN:rscwo, subschemaSubentry:rscwo, nsYIMStatusGraphic:rscwo, hasSubordinates:rscwo, pwdpolicysubentry:rscwo, nsAIMStatusGraphic:rscwo, nsRoleDN:rscwo, createTimestamp:rscwo, accountUnlockTime:rscwo, copyingFrom:rscwo, nsLookThroughLimit:rscwo, nsds5ReplConflict:rscwo, modifiersName:rscwo, parentid:rscwo, passwordAllowChangeTime:rscwo, nsBackendSuffix:rscwo, nsIdleTimeout:rscwo, ldapSyntaxes:rscwo, numSubordinates:rscwo

Example 6.10. Get Effective Rights Results for Operational Attributes

6.7.2.5. Examples of Get Effective Rights Results and Access ControlRulesGet effective rights are returned according to to whatever ACLs are in effect for the GER subject entry.

For example, this ACL is set and, for the purposes of this example, it is the only ACL set:

dn: dc=example,dc=comobjectClass: topobjectClass: domaindc: exampleaci: (target=ldap:///ou=Accounting,dc=example,dc=com)(targetattr="*")(version 3.0; acl "test acl"; allow (read,search,compare) (userdn = "ldap:///anyone") ;)

dn: ou=Accounting, dc=example,dc=comobjectClass: topobjectClass: organizationalUnitou: Accounting

Because the ACL does not include the dc=example,dc=com subtree, the get effective rights searchshows that the user does not have any rights to the dc=example,dc=com entry:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret12 -b "dc=example,dc=com" -J 1.3.6.1.4.1.42.2.27.9.5.2:true:dn:uid=scarter,ou=people,dc=example,dc=com "(objectclass=*)" "*@person"

dn: cn=template_person_objectclass,uid=scarter,ou=people,dc=example,dc=comobjectClass: personobjectClass: topcn: (template_attribute)sn: (template_attribute)description: (template_attribute)seeAlso: (template_attribute)telephoneNumber: (template_attribute)userPassword: (template_attribute)entryLevelRights: none

Page 308: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

288

attributeLevelRights: sn:none, cn:none, objectClass:none, description:none, seeAlso:none, telephoneNumber:none, userPassword:none, aci:none

Example 6.11. Get Effective Rights Results with No ACL Set (Directory Manager)

6.7.3. Using Get Effective Rights from the ConsoleTo view effective rights from the Console, do the following:

1. Open the Directory tab, and right-click the entry of which to check the rights.

2. Select Advanced Properties from the drop-down menu.

3. Check the Show effective rights checkbox.

4. Beside each attribute, the attribute-level get effective rights are displayed. The entry-level rightsare shown beneath the entry's DN.

Page 309: Red Hat Directory Server 5.1

Get Effective Rights Return Codes

289

The attribute-level effective rights (r, s, c, w, o) appear next to the attributes. The entry-level rights(v, a, d, n) appear under the full DN for the entry in the lower left-hand corner of the PropertyEditor.

If you check the Show all allowed attributes checkbox, then the effective rights for those attributesappear next to the additional attributes, even though they do not have values.

6.7.4. Get Effective Rights Return CodesIf the criticality is set to false for a get effective rights search and an error occurs, theregular entry information is returned, but, in place of rights for entryLevelRights andattributeLevelRights, an error code is returned. This code can give information on the

Page 310: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

290

configuration of the entry that was queried. Table 6.8, “Returned Result Codes” summarizes the errorcodes and the potential configuration information they can relay.

Code Description

0 Successfully completed.

1 Operation error.

12 The critical extension is unavailable. If thecriticality expression is set to true and effectiverights do not exist on the entry being queried,then this error is returned.

16 No such attribute. If an attribute is specificallyqueried for access rights but that attribute doesnot exist in the schema, this error is returned.

17 Undefined attribute type.

21 Invalid attribute syntax.

50 Insufficient rights.

52 Unavailable.

53 Unwilling to perform.

80 Other.

Table 6.8. Returned Result Codes

6.8. Logging Access Control InformationTo obtain information on access control in the error logs, you must set the appropriate log level. To setthe error log level from the Console:

1. In the Console, click the Directory tab, right-click the config node, and choose Properties fromthe pop-up menu.

This displays the Property Editor for the cn=config entry.

2. Scroll down the list of attribute value pairs to locate the nsslapd-errorlog-level attribute.

3. Add 128 to the value already displayed in the nsslapd-errorlog-level value field.

For example, if the value already displayed is 8192 (replication debugging), change the valueto 8320. For complete information on error log levels, see the Directory Server Configuration,Command, and File Reference.

4. Click OK to dismiss the Property Editor.

6.9. Access Control Usage ExamplesThe examples provided in this section illustrate how an imaginary ISP company, example.com, wouldimplement its access control policy. All the examples explain how to perform a given task from theConsole and using an LDIF file.

example.com's business is to offer a web hosting service and Internet access. Part ofexample.com's web hosting service is to host the directories of client companies. example.com

Page 311: Red Hat Directory Server 5.1

Granting Anonymous Access

291

actually hosts and partially manages the directories of two medium-sized companies,HostedCompany1 and HostedCompany2. It also provides Internet access to a number of individualsubscribers.

These are the access control rules that example.com wants to put in place:

• Grant anonymous access for read, search, and compare to the entire example.com tree forexample.com employees (Section 6.9.1, “Granting Anonymous Access”).

• Grant write access to example.com employees for personal information, such as homePhone andhomePostalAddress (Section 6.9.2, “Granting Write Access to Personal Entries”).

• Grant example.com employees the right to add any role to their entry, except certain critical roles(Section 6.9.3, “Restricting Access to Key Roles”).

• Grant the example.com Human Resources group all rights on the entries in the People branch(Section 6.9.4, “Granting a Group Full Access to a Suffix”).

• Grant all example.com employees the right to create group entries under the Social Committeebranch of the directory and to delete group entries that they own (Section 6.9.5, “Granting Rights toAdd and Delete Group Entries”).

• Grant all example.com employees the right to add themselves to group entries under the SocialCommittee branch of the directory (Section 6.9.9, “Allowing Users to Add or Remove Themselvesfrom a Group”).

• Grant access to the directory administrator (role) of HostedCompany1 and HostedCompany2 ontheir respective branches of the directory tree, with certain conditions such as SSL authentication,time and date restrictions, and specified location (Section 6.9.6, “Granting Conditional Access to aGroup or Role”).

• Deny individual subscribers access to the billing information in their own entries (Section 6.9.7,“Denying Access”).

• Grant anonymous access to the world to the individual subscribers subtree, except for subscriberswho have specifically requested to be unlisted. (This part of the directory could be a consumerserver outside of the firewall and be updated once a day.) See Section 6.9.1, “Granting AnonymousAccess” and Section 6.9.8, “Setting a Target Using Filtering”.

6.9.1. Granting Anonymous AccessMost directories are run such that you can anonymously access at least one suffix for read, search,or compare. For example, you might want to set these permissions if you are running a corporatepersonnel directory that you want employees to be able to search, such as a phonebook. Thisis the case at example.com internally and is illustrated in Section 6.9.1.1, “ACI "Anonymousexample.com"”.

As an ISP, example.com also wants to advertise the contact information of all of its subscribersby creating a public phonebook accessible to the world. This is illustrated in Section 6.9.1.2, “ACI"Anonymous World"”.

6.9.1.1. ACI "Anonymous example.com"In LDIF, to grant read, search, and compare permissions to the entire example.com tree toexample.com employees, write the following statement:

Page 312: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

292

aci: (targetattr !="userPassword")(version 3.0; acl "Anonymous Example"; allow (read, search, compare) userdn= "ldap:///anyone" and dns="*.example.com";)

This example assumes that the aci attribute is added to the dc=example,dc=com entry. TheuserPassword attribute is excluded from the scope of the ACI.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the example.com node in the left navigation tree, and choose SetAccess Permissions from the pop-up menu to display the Access Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab in the ACI name field, type Anonymous example.com. Check that AllUsers opens in the list of users granted access permission.

4. In the Rights tab, select the checkboxes for read, compare, and search rights. Make sure theother checkboxes are clear.

5. In the Targets tab, click This Entry to display the dc=example,dc=com suffix in the Targetdirectory entry field. In the attribute table, locate the userPassword attribute, and clear thecorresponding checkbox.

All other checkboxes should be selected. This task is made easier if you click the Name header toorganize the list of attributes alphabetically.

6. In the Hosts tab, click Add, and in the DNS host filter field, type *.example.com. Click OK todismiss the dialog box.

7. Click OK in the Access Control Editor window.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.1.2. ACI "Anonymous World"In LDIF, to grant read and search access of the individual subscribers subtree to the world, whiledenying access to information on unlisted subscribers, write the following statement:

aci: (targetfilter= "(!(unlistedSubscriber=yes))") (targetattr="homePostalAddress || homePhone || mail") (version 3.0; acl "Anonymous World"; allow (read, search) userdn="ldap:///anyone";)

This example assumes that the ACI is added to the ou=subscribers,dc=example,dc=com entry.It also assumes that every subscriber entry has an unlistedSubscriber attribute which is set toyes or no. The target definition filters out the unlisted subscribers based on the value of this attribute.For details on the filter definition, see Section 6.9.8, “Setting a Target Using Filtering”.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the Subscribers entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

Page 313: Red Hat Directory Server 5.1

Granting Write Access to Personal Entries

293

3. In the Users/Groups tab, in the ACI name field, type Anonymous World. Check that AllUsers opens in the list of users granted access permission.

4. In the Rights tab, select the checkboxes for read and search rights. Make sure the othercheckboxes are clear.

5. In the Targets tab, click This Entry to display the ou=subscribers, dc=example,dc=comsuffix in the Target directory entry field.

6. In the Filter for subentries field, type the following filter:

(!(unlistedSubscriber=yes))

7. In the attribute table, select the checkboxes for the homePhone, homePostalAddress, andmail attributes.

All other checkboxes should be clear; if it is easier, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

8. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.2. Granting Write Access to Personal EntriesMany directory administrators want to allow internal users to change some but not all of the attributesin their own entry. The directory administrators at example.com want to allow users to change theirown password, home telephone number, and home address, but nothing else. This is illustrated inSection 6.9.2.1, “ACI "Write example.com"”.

It is also example.com's policy to let their subscribers update their own personal information in theexample.com tree, provided that they establish an SSL connection to the directory. This is illustratedin Section 6.9.2.2, “ACI "Write Subscribers"”.

6.9.2.1. ACI "Write example.com"

NOTEBy setting this permission, you are also granting users the right to delete attribute values.

Granting example.com employees the right to update their password, home telephone number, andhome address has the following statement in LDIF:

aci: (targetattr="userPassword || homePhone || homePostalAddress") (version 3.0; acl "Write example.com"; allow (write) userdn= "ldap:///self" and dns="*.example.com";)

This example assumes that the ACI is added to the ou=example-people,dc=example,dc=comentry.

From the Console, set this permission by doing the following:

Page 314: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

294

1. In the Directory tab, right-click the example-people entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Write example.com. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area to Special Rights, and select Self from the search results list.

c. Click the Add button to list Self in the list of users who are granted access permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for write right. Make sure the other checkboxes are clear.

5. In the Targets tab, click This Entry to display the ou=example-people,dc=example,dc=comsuffix in the Target directory entry field. In the attribute table, select the checkboxes for thehomePhone, homePostalAddress, and userPassword attributes.

All other checkboxes should be clear; if it is easier, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

6. In the Hosts tab, click Add to display the Add Host Filter dialog box. In the DNS host filter field,type *.example.com. Click OK to dismiss the dialog box.

7. Click OK in the Access Control Editor window.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.2.2. ACI "Write Subscribers"

NOTEBy setting this permission, you are also granting users the right to delete attribute values.

In LDIF, to grant example.com subscribers the right to update their password and home telephonenumber, write the following statement:

aci: (targetattr="userPassword || homePhone") (version 3.0; acl "Write Subscribers"; allow (write) userdn= "ldap://self" and authmethod="ssl";)

This example assumes that the aci is added to the ou=subscribers, dc=example,dc=comentry.

Page 315: Red Hat Directory Server 5.1

Granting Write Access to Personal Entries

295

example.com subscribers do not have write access to their home address because they might deletethe attribute, and example.com needs that information for billing. Therefore, the home address isbusiness-critical information.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the Subscribers entry under the example.com node in the leftnavigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Write Subscribers. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area to Special Rights, and select Self from the search results list.

c. Click the Add button to list Self in the list of users who are granted access permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for write. Make sure the other checkboxes are clear.

5. In the Targets tab, click This Entry to display the ou=subscribers, dc=example,dc=comsuffix in the Target directory entry field.

a. In the Filter for subentries field, type the following filter:

(!(unlistedSubscriber=yes))

b. In the attribute table, select the checkboxes for the homePhone, homePostalAddress, andmail attributes.

All other checkboxes should be clear; if necessary, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

c. Optionally, to require users to authenticate using SSL, switch to manual editing by clicking theEdit Manually button, and add authmethod=ssl to the LDIF statement so that it reads asfollows:

(targetattr="homePostalAddress || homePhone || mail") (version 3.0; acl "Write Subscribers"; allow (write) (userdn= "ldap:///self") and authmethod="ssl";)

6. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

Page 316: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

296

6.9.3. Restricting Access to Key RolesYou can use role definitions in the directory to identify functions that are critical to your business, theadministration of your network and directory, or another purpose.

For example, you might create a superAdmin role by identifying a subset of your systemadministrators that are available at a particular time of day and day of the week at corporate sitesworldwide, or you might want to create a First Aid role that includes all members of staff ona particular site that have done first aid training. For information on creating role definitions, seeSection 5.1, “Using Roles”.

When a role gives any sort of privileged user rights over critical corporate or business functions,consider restricting access to that role. For example, at example.com, employees can add any role totheir own entry except the superAdmin role. This is illustrated in Section 6.9.3.1, “ACI "Roles"”.

6.9.3.1. ACI "Roles"In LDIF, to grant example.com employees the right to add any role to their own entry except thesuperAdmin role, write the following statement:

aci: (targetattr = "nsroledn") (targattrfilters="add=nsroledn:(nsroledn != "cn=superAdmin,dc=example,dc=com")") (version 3.0; acl "Roles"; allow (write) userdn= "ldap:///self" and dns="*.example.com";)

This example assumes that the ACI is added to the ou=example-people,dc=example,dc=comentry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the example-people entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Roles. In the list of users granted accesspermission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area in the Add Users and Groups dialog box to Special Rights, andselect Self from the search results list.

c. Click the Add button to list Self in the list of users who are granted access permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for write. Make sure the other checkboxes are clear.

5. In the Targets tab, click This Entry to use the ou=example-people,dc=example,dc=comsuffix in the Target directory entry field.

6. In the Hosts tab, click Add to display the Add Host Filter dialog box. In the DNS host filter field,type *.example.com. Click OK to dismiss the dialog box.

Page 317: Red Hat Directory Server 5.1

Granting a Group Full Access to a Suffix

297

7. To create the value-based filter for roles, switch to manual editing by clicking the Edit Manuallybutton. Add the following to the beginning of the LDIF statement:

(targattrfilters="add=nsroledn:(nsroledn != "cn=superAdmin, dc=example,dc=com")")

The LDIF statement should read as follows:

(targattrfilters="add=nsroledn:(nsroledn != "cn=superAdmin, dc=example,dc=com")") (targetattr = "*") (target = "ldap:/// ou=example-people,dc=example,dc=com") (version 3.0; acl "Roles"; allow (write) (userdn = "ldap:///self") and (dns="*.example.com");)

8. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.4. Granting a Group Full Access to a SuffixMost directories have a group that is used to identify certain corporate functions. These groups canbe given full access to all or part of the directory. By applying the access rights to the group, you canavoid setting the access rights for each member individually. Instead, you grant users these accessrights simply by adding them to the group.

For example, when the Directory Server is set up with a typical process, an administrators group withfull access to the directory is created by default.

At example.com, the Human Resources group is allowed full access to the ou=example-people branch of the directory so that they can update the employee database. This is illustrated inSection 6.9.4.1, “ACI "HR"”.

6.9.4.1. ACI "HR"In LDIF, to grant the HR group all rights on the employee branch of the directory, use the followingstatement:

aci: (version 3.0; acl "HR"; allow (all) userdn= "ldap:///cn=HRgroup,ou=example-people,dc=example,dc=com";)

This example assumes that the ACI is added to the ou=example-people,dc=example,dc=comentry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the example-people entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type HR. In the list of users granted accesspermission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

Page 318: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

298

b. Set the Search area to Users and Groups, and type HRgroup in the Search for field.

This example assumes that you have created an HR group or role. For more information ongroups and roles, see Chapter 5, Organizing Entries with Roles, Class of Service, and Views.

c. Click the Add button to list the HR group in the list of users who are granted accesspermission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, click the Check All button.

All checkboxes are selected, except for proxy rights.

5. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.5. Granting Rights to Add and Delete Group EntriesSome organizations want to allow employees to create entries in the tree if it can increase theirefficiency or if it can contribute to the corporate dynamics.

At example.com, there is an active social committee that is organized into various clubs, such astennis, swimming, and skiing. Any example.com employee can create a group entry representing anew club. This is illustrated in Section 6.9.5.1, “ACI "Create Group"”. Any example.com employeecan become a member of one of these groups. This is illustrated in Section 6.9.9.1, “ACI "GroupMembers"” under Section 6.9.9, “Allowing Users to Add or Remove Themselves from a Group”. Onlythe group owner can modify or delete a group entry. This is illustrated in Section 6.9.5.2, “ACI "DeleteGroup"”.

6.9.5.1. ACI "Create Group"In LDIF, to grant example.com employees the right to create a group entry under the ou=SocialCommittee branch, write the following statement:

aci: (target="ldap:///ou=social committee,dc=example,dc=com) (targattrfilters="add=objectClass:(objectClass=groupOfNames)") (version 3.0; acl "Create Group"; allow (add) (userdn= "ldap:///uid=*,ou=example-people,dc=example,dc=com") and dns="*.example.com";)

NOTEThis ACI does not grant write permission, which means that the entry creator cannotmodify the entry.

This example assumes that the ACI is added to the ou=social committee,dc=example,dc=com entry.

From the Console, set this permission by doing the following:

Page 319: Red Hat Directory Server 5.1

Granting Rights to Add and Delete Group Entries

299

1. In the Directory tab, right-click the Social Committee entry under the example.com node inthe left navigation tree, and choose Set Access Permissions from the pop-up menu to displaythe Access Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Create Group. In the list of users grantedaccess permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area to Special Rights, and select All Authenticated Users from thesearch results list.

c. Click the Add button to list All Authenticated Users in the list of users who are grantedaccess permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for add. Make sure the other checkboxes are clear.

5. In the Targets tab, click This Entry to display the ou=social committee,dc=example,dc=com suffix in the Target directory entry field.

6. In the Hosts tab, click Add to display the Add Host Filter dialog box. In the DNS host filter field,type *.example.com. Click OK to dismiss the dialog box.

7. To create the value-based filter that allows employees to add only group entries to this subtree,click the Edit Manually button. Add the following to the beginning of the LDIF statement:

(targattrfilters="add=objectClass:(objectClass=groupOfNames)")

The LDIF statement should read as follows:

(targattrfilters="add=objectClass:(objectClass=groupOfNames)") (targetattr = "*") (target="ldap:///ou=social committee,dc=example,dc=com) (version 3.0; acl "Create Group"; allow (read,search,add) (userdn= "ldap:///all") and (dns="*.example.com"); )

8. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.5.2. ACI "Delete Group"In LDIF, to grant example.com employees the right to modify or delete a group entry which they ownunder the ou=Social Committee branch, write the following statement:

aci: (target="ou=social committee,dc=example,dc=com) (targattrfilters="del=objectClass:(objectClass=groupOfNames)") (version 3.0; acl "Delete Group"; allow (delete) userattr= "owner#GROUPDN";)

Page 320: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

300

This example assumes that the aci is added to the ou=social committee,dc=example,dc=com entry.

NOTEUsing the Console is not an effective way of creating this ACI because it requiresmanually editing the ACI to create the target filter and to check group ownership.

6.9.6. Granting Conditional Access to a Group or RoleIn many cases, when you grant a group or role privileged access to the directory, you want toensure that those privileges are protected from intruders trying to impersonate your privileged users.Therefore, in many cases, access control rules that grant critical access to a group or role are oftenassociated with a number of conditions.

example.com has created a directory administrator role for each of its hosted companies,HostedCompany1 and HostedCompany2. It wants these companies to be able to manage theirown data and implement their own access control rules while securing it against intruders. For thisreason, HostedCompany1 and HostedCompany2 have full rights on their respective branches of thedirectory tree, provided the following conditions are fulfilled:

• Connection authenticated using SSL

• Access requested between 8 a.m. and 6 p.m., Monday through Thursday

• Access requested from a specified IP address for each company

These conditions are illustrated in a single ACI for each company, HostedCompany1 andHostedCompany2. Because the content of these ACIs is the same, the examples below illustrate theHostedCompany1 ACI only.

6.9.6.1. ACI "HostedCompany1"In LDIF, to grant HostedCompany1 full access to their own branch of the directory under theconditions stated above, write the following statement:

aci:(target="ou=HostedCompany1,ou=corporate-clients,dc=example,dc=com") (targetattr= "*") (version 3.0; acl "HostedCompany1";allow (all) (roledn="ldap:///cn=DirectoryAdmin,ou=HostedCompany1, ou=corporate-clients, dc=example,dc=com") and (authmethod="ssl") and (dayofweek="Mon,Tues,Wed,Thu") and (timeofday >= "0800" and timeofday <= "1800") and (ip="255.255.123.234"); )

This example assumes that the ACI is added to the ou=HostedCompany1, ou=corporate-clients,dc=example,dc=com entry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the HostedCompany1 entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

Page 321: Red Hat Directory Server 5.1

Granting Conditional Access to a Group or Role

301

3. In the Users/Groups tab, type HostedCompany1 in the ACI name field. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area to Users and Groups, and type DirectoryAdmin in the Search Forfield.

This example assumes that you have created an administrators role with a cn ofDirectoryAdmin.

c. Click the Add button to list the administrators role in the list of users who are granted accesspermission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, click the Check All button.

5. In the Targets tab, click This Entry to display the ou=HostedCompany1,ou=corporate-clients,dc=example,dc=com suffix in the Target directory entry field.

6. In the Hosts tab, click Add to display the Add Host Filter dialog box. In the IP address hostfilter field, type 255.255.123.234. Click OK.

The IP address must be a valid IP address for the host machine that the HostedCompany1administrators use to connect to the example.com directory.

NOTEDirectory Server supports both IPv4 and IPv6 IP addresses.

7. In the Times tab, select the block time corresponding to Monday through Thursday and 8 a.m. to 6p.m.

A message appears below the table that specifies the selected time block.

8. To enforce SSL authentication from HostedCompany1 administrators, switch to manual editing byclicking the Edit Manually button. Add the following to the end of the LDIF statement:

and (authmethod="ssl")

The LDIF statement should be similar to the following:

aci: (targetattr = "*") (target="ou=HostedCompany1,ou=corporate-clients,dc=example,dc=com") (version 3.0; acl "HostedCompany1"; allow (all) (roledn= "ldap:///cn=DirectoryAdmin,ou=HostedCompany1,ou=corporate-clients, dc=example,dc=com") and (dayofweek="Mon,Tues,Wed,Thu") and (timeofday >= "0800" and timeofday <= "1800") and (ip="255.255.123.234") and (authmethod="ssl"); )

Page 322: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

302

9. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.7. Denying AccessIf your directory holds business-critical information, it may be necessary to specifically deny access toit.

For example, example.com wants all subscribers to be able to read billing information such asconnection time or account balance under their own entries but explicitly wants to deny write accessto that information. This is illustrated in Section 6.9.7.1, “ACI "Billing Info Read"” and Section 6.9.7.2,“ACI "Billing Info Deny"”, respectively.

6.9.7.1. ACI "Billing Info Read"In LDIF, to grant subscribers permission to read billing information in their own entry, write thefollowing statement:

aci: (targetattr="connectionTime || accountBalance") (version 3.0; acl "Billing Info Read"; allow (search,read) userdn= "ldap:///self";)

This example assumes that the relevant attributes have been created in the schema and that the ACIis added to the ou=subscribers,dc=example,dc=com entry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the Subscribers entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Billing Info Read. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area in the Add Users and Groups dialog box to Special Rights, andselect Self from the search results list.

c. Click the Add button to list Self in the list of users who are granted access permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkboxes for search and read rights. Make sure the othercheckboxes are clear.

5. In the Targets tab, click This Entry to display the ou=subscribers, dc=example,dc=comsuffix in the Target directory entry field. In the attribute table, select the checkboxes for theconnectionTime and accountBalance attributes.

Page 323: Red Hat Directory Server 5.1

Denying Access

303

All other checkboxes should be clear; if it is made easier, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

This example assumes that you have added the connectionTime and accountBalanceattributes to the schema.

6. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.7.2. ACI "Billing Info Deny"In LDIF, to deny subscribers permission to modify billing information in their own entry, write thefollowing statement:

aci: (targetattr="connectionTime || accountBalance") (version 3.0; acl "Billing Info Deny"; deny (write) userdn="ldap:///self";)

This example assumes that the relevant attributes have been created in the schema and that the ACIis added to the ou=subscribers,dc=example,dc=com entry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the Subscribers entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Billing Info Deny. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area in the Add Users and Groups dialog box to Special Rights, andselect Self from the search results list.

c. Click the Add button to list Self in the list of users who are granted access permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for write. Make sure the other checkboxes are clear.

5. Click the Edit Manually button, and, in the LDIF statement that opens, change the word allow todeny.

6. In the Targets tab, click This Entry to display the ou=subscribers, dc=example,dc=comsuffix in the Target directory entry field. In the attribute table, select the checkboxes for theconnectionTime and accountBalance attributes.

Page 324: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

304

All other checkboxes should be clear; if it is easier, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

This example assumes that the connectionTime and accountBalance attributes were addedto the schema.

7. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.8. Setting a Target Using FilteringTo set access controls that allow access to a number of entries that are spread across the directory,consider using a filter to set the target.

NOTEBecause search filters do not directly name the object for which you are managing access,it is easy to allow or deny access to the wrong objects unintentionally, especially as yourdirectory becomes more complex. Additionally, filters can make it difficult to troubleshootaccess control problems within your directory.

For example, the following ACI grants user bjensen write access to the department number, homephone number, home postal address, and manager attributes for all members of the accountingorganization.

aci: (targetattr="departmentNumber || homePhone || homePostalAddress || manager") (targetfilter="(uid=bjensen)") (version 3.0; acl "Filtered ACL"; allow (write) userdn ="ldap:///cn=*,ou=accounting, dc=example,dc=com";)

Before you can set these permissions, you must create the accounting branch pointou=accounting,dc=example,dc=com). You can create organizational unit branch points in theDirectory tab on the Directory Server Console.

6.9.9. Allowing Users to Add or Remove Themselves from a GroupMany directories set ACIs that allow users to add or remove themselves from groups. This is useful,for example, for allowing users to add and remove themselves from mailing lists.

At example.com, employees can add themselves to any group entry under the ou=socialcommittee subtree. This is illustrated in Section 6.9.9.1, “ACI "Group Members"”.

6.9.9.1. ACI "Group Members"In LDIF, to grant example.com employees the right to add or delete themselves from a group, writethe following statement:

aci: (targettattr="member")(version 3.0; acl "Group Members"; allow (selfwrite) (userdn= "ldap:///uid=*,ou=example-people,dc=example,dc=com") ;)

Page 325: Red Hat Directory Server 5.1

Defining Permissions for DNs That Contain a Comma

305

This example assumes that the ACI is added to the ou=social committee,dc=example,dc=com entry.

From the Console, set this permission by doing the following:

1. In the Directory tab, right-click the example-people entry under the example.com node in theleft navigation tree, and choose Set Access Permissions from the pop-up menu to display theAccess Control Manager.

2. Click New to display the Access Control Editor.

3. In the Users/Groups tab, in the ACI name field, type Group Members. In the list of usersgranted access permission, do the following:

a. Select and remove All Users, then click Add.

The Add Users and Groups dialog box opens.

b. Set the Search area in the Add Users and Groups dialog box to Special Rights, andselect All Authenticated Users from the search results list.

c. Click the Add button to list All Authenticated Users in the list of users who are grantedaccess permission.

d. Click OK to dismiss the Add Users and Groups dialog box.

4. In the Rights tab, select the checkbox for selfwrite. Make sure the other checkboxes are clear.

5. In the Targets tab, type dc=example,dc=com suffix in the Target directory entry field. In theattribute table, select the checkbox for the member attribute.

All other checkboxes should be clear; if it is easier, click the Check None button to clearthe checkboxes for all attributes in the table, then click the Name header to organize themalphabetically, and select the appropriate ones.

6. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

6.9.10. Defining Permissions for DNs That Contain a CommaDNs that contain commas require special treatment within your LDIF ACI statements. In the targetand bind rule portions of the ACI statement, commas must be escaped by a single backslash (\). Forexample:

dn: dc=example.com Bolivia\, S.A.,dc=comobjectClass: topobjectClass: organizationaci: (target="ldap:///dc=example.com Bolivia\,S.A.,dc=com")(targetattr=*) (version 3.0; acl "aci 2"; allow (all) groupdn = "ldap:///cn=Directory Administrators,dc=example.com Bolivia\, S.A.,dc=com";)

Page 326: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

306

6.9.11. Proxied Authorization ACI ExampleProxied authorization allows one user to bind and perform operation as another user. For example,example.com has an accounting program which must be able to bind to the directory as anaccounting administrator in order to write data. This authorization assumes three things:

• The client application's bind DN is "uid=MoneyWizAcctSoftware,ou=Applications,dc=example,dc=com".

• The targeted subtree to which the client application is requesting access isou=Accounting,dc=example,dc=com.

• An accounting administrator with access permissions to theou=Accounting,dc=example,dc=com subtree exists in the directory.

In order for the client application to gain access to the accounting subtree, using the same accesspermissions as the accounting administrator, two ACIs must be set:

• The accounting administrator must have access permissions to theou=Accounting,dc=example,dc=com subtree, so the following ACI grants all rights to theaccounting administrator entry:

aci: (target="ldap:///ou=Accounting,dc=example,dc=com") (targetattr="*") (version 3.0; acl "allowAll-AcctAdmin"; allow (all) userdn="ldap://uid=AcctAdministrator,ou=Administrators,dc=example,dc=com")

• There must be an ACI granting proxy rights to the client application in the directory:

aci: (target="ldap:///ou=Accounting,dc=example,dc=com") (targetattr="*") (version 3.0; acl "allow proxy-accounting software"; allow (proxy) userdn="ldap://uid=MoneyWizAcctSoftware,ou=Applications,dc=example,dc=com")

With this ACI in place, the MoneyWizAcctSoftware client application can bind to the directory andsend an LDAP command such as ldapsearch or ldapmodify that requires the access rights of theproxy DN.

If the client performs an ldapsearch command, the command must include the following controls:

ldapmodify -D "uid=MoneyWizAcctSoftware,ou=Applications,dc=example,dc=com" -w secret -y "uid=AcctAdministrator,ou=Administrators,dc=example,dc=com"

The client or application (MoneyWizAcctSoftware) binds as itself but is granted the privileges of theproxy entry (AcctAdministrator). The client does not need the password of the proxy entry.

NOTEThere are some restrictions on binding with proxy authorization. You cannot use theDirectory Manager's DN (root DN) as a proxy DN. Additionally, if Directory Server receivesmore than one proxied authentication control, an error is returned to the client application,and the bind attempt is unsuccessful.

Page 327: Red Hat Directory Server 5.1

Advanced Access Control: Using Macro ACIs

307

6.10. Advanced Access Control: Using Macro ACIsIn organizations that use repeating directory tree structures, it is possible to optimize the number ofACIs used in the directory by using macros. Reducing the number of ACIs in your directory tree makesit easier to manage your access control policy and improves the efficiency of ACI memory usage.

Macros are placeholders that are used to represent a DN, or a portion of a DN, in an ACI. You canuse a macro to represent a DN in the target portion of the ACI or in the bind rule portion, or both.In practice, when Directory Server gets an incoming LDAP operation, the ACI macros are matchedagainst the resource targeted by the LDAP operation. If there is a match, the macro is replaced by thevalue of the DN of the targeted resource. Directory Server then evaluates the ACI normally.

6.10.1. Macro ACI ExampleFigure 6.3, “Example Directory Tree for Macro ACIs” shows a directory tree which uses macroACIs to effectively reduce the overall number of ACIs. This illustration uses repeating pattern ofsubdomains with the same tree structure (ou=groups, ou=people). This pattern is also repeatedacross the tree because the example.com directory tree stores the suffixes dc=hostedCompany2,dc=example,dc=com and dc=hostedCompany3,dc=example,dc=com.

The ACIs that apply in the directory tree also have a repeating pattern. For example, the following ACIis located on the dc=hostedCompany1,dc=example,dc=com node:

aci: (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=hostedCompany1,dc=example,dc=com";)

This ACI grants read and search rights to the DomainAdmins group to any entry in thedc=hostedCompany1,dc=example,dc=com tree.

Figure 6.3. Example Directory Tree for Macro ACIs

The following ACI is located on the dc=hostedCompany1,dc=example,dc=com node:

Page 328: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

308

aci: (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=hostedCompany1,dc=example,dc=com";)

The following ACI is located on the dc=subdomain1,dc=hostedCompany1,dc=example,dc=com node:

aci: (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=subdomain1,dc=hostedCompany1,dc=example,dc=com";)

The following ACI is located on the dc=hostedCompany2,dc=example,dc=com node:

aci: (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=hostedCompany2,dc=example,dc=com";)

The following ACI is located on the dc=subdomain1,dc=hostedCompany2,dc=example,dc=com node:

aci: (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups, dc=subdomain1,dc=hostedCompany2,dc=example,dc=com";)

In the four ACIs shown above, the only differentiator is the DN specified in the groupdn keyword. Byusing a macro for the DN, it is possible to replace these ACIs by a single ACI at the root of the tree, onthe dc=example,dc=com node. This ACI reads as follows:

aci: (target="ldap:///ou=Groups,($dn),dc=example,dc=com") (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com";)

The target keyword, which was not previously used, is utilized in the new ACI.

In this example, the number of ACIs is reduced from four to one. The real benefit is a factor of howmany repeating patterns you have down and across your directory tree.

6.10.2. Macro ACI SyntaxMacro ACIs include the following types of expressions to replace a DN or part of a DN:

• ($dn)

• [$dn]

• ($attr.attrName), where attrName represents an attribute contained in the target entry

In this section, the ACI keywords used to provide bind credentials, such as userdn, roledn,groupdn, and userattr, are collectively called the subject, as opposed to the target, of the ACI.Macro ACIs can be used in the target part or the subject part of an ACI.

Table 6.9, “Macros in ACI Keywords” shows in what parts of the ACI you can use DN macros:

Page 329: Red Hat Directory Server 5.1

Macro ACI Syntax

309

Macro ACI Keyword

($dn) target, targetfilter, userdn, roledn, groupdn,userattr

[$dn] targetfilter, userdn, roledn, groupdn, userattr

($attr.attrName) userdn, roledn, groupdn, userattr

Table 6.9. Macros in ACI Keywords

The following restrictions apply:

• If you use ($dn) in targetfilter, userdn, roledn, groupdn, userattr, you must define atarget that contains ($dn).

• If you use [$dn] in targetfilter, userdn, roledn, groupdn, userattr, you must define atarget that contains ($dn).

NOTEWhen using any macro, you always need a target definition that contains the ($dn)macro.

You can combine the ($dn) macro and the ($attr.attrName) macro.

6.10.2.1. Macro Matching for ($dn)The ($dn) macro is replaced by the matching part of the resource targeted in anLDAP request. For example, you have an LDAP request targeted at the cn=all,ou=groups,dc=subdomain1,dc=hostedCompany1,dc=example,dc=com entry and an ACI thatdefines the target as follows:

(target="ldap:///ou=Groups,($dn),dc=example,dc=com")

The ($dn) macro matches with dc=subdomain1, dc=hostedCompany1.

When the subject of the ACI also uses ($dn), the substring that matches the target is used to expandthe subject. For example:

aci: (target="ldap:///ou=*,($dn),dc=example,dc=com") (targetattr = "*") (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,($dn),dc=example,dc=com";)

In this case, if the string matching ($dn) in the target is dc=subdomain1, dc=hostedCompany1,then the same string is used in the subject. The ACI is then expanded as follows:

aci: (target="ldap:///ou=Groups,dc=subdomain1,dc=hostedCompany1, dc=example,dc=com") (targetattr = "*") (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups, dc=subdomain1,dc=hostedCompany1,dc=example,dc=com";)

Once the macro has been expanded, Directory Server evaluates the ACI following the normal processto determine whether access is granted.

Page 330: Red Hat Directory Server 5.1

Chapter 6. Managing Access Control

310

6.10.2.2. Macro Matching for [$dn]The matching mechanism for [$dn] is slightly different than for ($dn). The DN of the targetedresource is examined several times, each time dropping the left-most RDN component, until a matchis found.

For example, you have an LDAP request targeted at the cn=all,ou=groups,dc=subdomain1,dc=hostedCompany1,dc=example,dc=com subtree and the following ACI:

aci: (target="ldap:///ou=Groups,($dn),dc=example,dc=com") (targetattr = "*") (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com";)

The steps for expanding this ACI are as follows:

1. ($dn) in the target matches dc=subdomain1,dc=hostedCompany1.

2. [$dn] in the subject is replaces with dc=subdomain1,dc=hostedCompany1.

The result is groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=subdomain1,dc=hostedCompany1,dc=example,dc=com". If the bind DN is a member ofthat group, the matching process stops, and the ACI is evaluated. If it does not match, the processcontinues.

3. [$dn] in the subject is replaced with dc=hostedCompany1.

The result is groupdn="ldap:///cn=DomainAdmins,ou=Groups,dc=hostedCompany1,dc=example,dc=com". In this case, if the bind DN is not a member ofthat group, the ACI is not evaluated. If it is a member, the ACI is evaluated.

The advantage of the [$dn] macro is that it provides a flexible way of granting access to domain-level administrators to all the subdomains in the directory tree. Therefore, it is useful for expressing ahierarchical relationship between domains.

For example, consider the following ACI:

aci: (target="ldap:///ou=*, ($dn),dc=example,dc=com") (targetattr="*")(targetfilter=(objectClass=nsManagedDomain)) (version 3.0; acl "Domain access"; allow (read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com";)

It grants access to the members of cn=DomainAdmins,ou=Groups,dc=hostedCompany1,dc=example,dc=com to all of the subdomains underdc=hostedCompany1, so an administrator belonging to that group could access a subtree likeou=people, dc=subdomain1.1, dc=subdomain1.

However, at the same time, members of cn=DomainAdmins,ou=Groups,dc=subdomain1.1 would be denied access to the ou=people,dc=hostedCompany1 andou=people,dc=hostedCompany1 nodes.

6.10.2.3. Macro Matching for ($attr.attrName)The ($attr.attrName) macro is always used in the subject part of a DN. For example, define thefollowing roledn:

roledn = "ldap:///cn=DomainAdmins,($attr.ou)"

Page 331: Red Hat Directory Server 5.1

Access Control and Replication

311

Now, assume the server receives an LDAP operation targeted at the following entry:

dn: cn=Jane Doe, ou=People, dc=HostedCompany1, dc=example,dc=comcn: Jane Doesn: Doeou: Engineering, dc=HostedCompany1, dc=example,dc=com...

In order to evaluate the roledn part of the ACI, the server looks at the ou attribute stored in thetargeted entry and uses the value of this attribute to expand the macro. Therefore, in the example, theroledn is expanded as follows:

roledn = "ldap:///cn=DomainAdmins,ou=Engineering,dc=HostedCompany1,dc=example,dc=com"

The Directory Server then evaluates the ACI according to the normal ACI evaluation algorithm.

When an attribute is multi-valued, each value is used to expand the macro, and the first one thatprovides a successful match is used. For example:

dn: cn=Jane Doe,ou=People,dc=HostedCompany1,dc=example,dc=com cn: Jane Doe sn: Doe ou: Engineering, dc=HostedCompany1,dc=example,dc=comou: People, dc=HostedCompany1,dc=example,dc=com...

In this case, when the Directory Server evaluates the ACI, it performs a logical OR on the followingexpanded expressions:

roledn = "ldap:///cn=DomainAdmins,ou=Engineering,dc=HostedCompany1,dc=example,dc=com"

roledn = "ldap:///cn=DomainAdmins,ou=People,dc=HostedCompany1,dc=example,dc=com"

6.11. Access Control and ReplicationACIs are stored as attributes of entries;therefore, if an entry containing ACIs is part of a replicateddatabase, the ACIs are replicated like any other attribute.

ACIs are always evaluated on the Directory Server that services the incoming LDAP requests. Thismeans that when a consumer server receives an update request, it returns a referral to the supplierserver before evaluating whether the request can be serviced on the supplier.

6.12. Compatibility with Earlier ReleasesSome ACI keywords that were used in earlier releases of Directory Server have been deprecated.However, for reasons of backward compatibility, the following keywords are still supported:

• userdnattr

• groupdnattr

Therefore, if you have set up a replication agreement between a legacy supplier server and a version8.1 consumer, there should not be any problems in the replication of ACIs.

Page 332: Red Hat Directory Server 5.1

312

Page 333: Red Hat Directory Server 5.1

Chapter 7.

313

Managing User AuthenticationWhen a user connects to the Red Hat Directory Server, first the user is authenticated. Then, thedirectory grants access rights and resource limits to the user depending upon the identity establishedduring authentication.

This chapter describes tasks for managing users, including configuring the password and accountlockout policy for the directory, denying groups of users access to the directory, and limiting systemresources available to users depending upon their bind DNs.

7.1. Managing the Password PolicyA password policy minimizes the risks of using passwords by enforcing the following:

• Users must change their passwords according to a schedule.

• Users must provide non-trivial passwords.

• The password syntax must meet certain complexity requirements.

After establishing a password policy, which can be for the entire directory or for specific subtreesor users, user passwords can be protected from potential threats by configuring an account lockoutpolicy. Account lockout protects against hackers who try to break into the directory by repeatedlyguessing a user's password.

For an overview on password policy, see "Designing a Password Policy" in chapter 7, "Designing aSecure Directory," in the Deployment Guide.

This section provides information about configuring password and account lockout policies:

• Section 7.1.1, “Configuring the Password Policy”

• Section 7.1.2, “Setting User Passwords”

• Section 7.1.3, “Password Change Extended Operation”

• Section 7.1.4, “Configuring the Account Lockout Policy”

• Section 7.1.5, “Managing the Password Policy in a Replicated Environment”

• Section 7.1.6, “Synchronizing Passwords”

7.1.1. Configuring the Password PolicyDirectory Server supports fine-grained password policy, so password policies can be applied to theentire directory (global password policy), a particular subtree (subtree level or local password policy),or a particular user (user level or local password policy).

Essentially, the password policy is comprised of the following information:

• The type or level of password policy checks. This information indicates whether the server shouldcheck for and enforce a global password policy or local (subtree/user level) password policies.

• Password add and modify information. The password information includes password syntax andpassword history details.

Page 334: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

314

• Bind information. The bind information includes the number of grace logins permitted, passwordaging attributes, and tracking bind failures.

The sections that follow describe the procedures for configuring the password policy:

• Section 7.1.1.1, “Configuring a Global Password Policy Using the Console”

• Section 7.1.1.2, “Configuring a Subtree/User Password Policy Using the Console”

• Section 7.1.1.3, “Configuring a Global Password Policy Using the Command Line”

• Section 7.1.1.4, “Configuring Subtree/User Password Policy Using the Command Line”

NOTEAfter configuring the password policy, we recommend configuring an account lockoutpolicy. For details, see Section 7.1.4, “Configuring the Account Lockout Policy”.

7.1.1.1. Configuring a Global Password Policy Using the ConsoleTo set up or modify the password policy for an entire directory:

1. In the Directory Server Console, select the Configuration tab and then the Data node.

2. In the right pane, select the Passwords tab.

This tab contains the password policy for the entire Directory Server.

3. Check the Enable fine-grained password policy checkbox. Enabling the password policy makesthe other sections on the screen active.

4. To require users to change their password the first time they log on, select the User must changepassword after reset checkbox. If this checkbox is selected, only the Directory Manager isauthorized to reset the user's password. A regular administrative user cannot force the users toupdate their password.

5. To allow users to change their own passwords, select the User may change password checkbox.

6. To prevent users from changing their password for a specific duration, enter the number of days inthe Allow changes in X day(s) text box.

7. For the server to maintain a history list of passwords used by each user, select the Keeppassword history checkbox. Enter the number of passwords for the server to keep for each userin the Remember X passwords text box.

8. If user passwords should not expire, select the Password never expires radio button.

9. To require users to change their passwords periodically, select the Password expires after Xdays radio button, and then enter the number of days that a user password is valid.

The maximum value for the password age is derived by subtracting January 18, 2038, fromtoday's date. The entered value must not be set to the maximum value or too close to themaximum value. Setting the value to the maximum value can cause the Directory Server to failto start because the number of seconds will go past the epoch date. In such an event, the error

Page 335: Red Hat Directory Server 5.1

Configuring the Password Policy

315

log will indicate that the password maximum age is invalid. To resolve this problem, correct thepasswordMaxAge attribute value in the dse.ldif file.

A common policy is to have passwords expire every 30 to 90 days. By default, the passwordmaximum age is set to 8640000 seconds (100 days).

10. If the Password expire after X days radio button is selected, specify how long before thepassword expires to send a warning to the user. In the Send Warning X Days Before PasswordExpires text enter the number of days before password expiration to send a warning.

NOTEIt is not necessary to configure the Directory Server to send a warning to users. TheDirectory Server automatically issues a warning the next time the user attempts to loginto the Directory Server Console that the password will soon expire or has expired.This is analogous to an operating system warning that reads "Warning: passwordwill expire in 7 days" when a user logs in.

11. For the server to check the syntax of a user password to make sure it meets the minimumrequirements set by the password policy, select the Check Password Syntax checkbox. Then,specify required password complexity, such as the minimum length and required number ofnumeric and special characters. The password syntax requirements are described more inTable 7.1, “Password Policy Attributes”.

12. From the Password Encryption pull-down menu, select the encryption method for the server touse when storing passwords.

For detailed information about the encryption methods, refer to the passwordStorageSchemeattribute in Table 7.1, “Password Policy Attributes”.

The Password Encryption menu might contain other encryption methods, as the directorydynamically creates the menu depending upon the existing encryption methods it finds in thedirectory.

13. Click Save.

7.1.1.2. Configuring a Subtree/User Password Policy Using the Console1. Enable fine-grained password policy globally.

a. Select the Configuration tab, then click the Data node.

b. In the right pane, select the Passwords tab.

c. Check the Enable fine-grained password policy checkbox.

d. Click Save.

Page 336: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

316

NOTEThe password policy must be enabled globally before it will be applied locally. Noother global password policy features must be set, and the global password policy willnot override the local policy if they differ.

2. Create the local password policy for the subtree or user.

a. Select the Directory tab.

b. In the navigation pane, select the subtree or user entry for which to set up the passwordpolicy.

c. From the Object menu, select the Manage Password Policy option, and then select the Foruser or For subtree.

Either the User Password Policy or Subtree Password Policy window appears.

d. In the Passwords tab, select the Create subtree/user level password policy checkbox toadd the required attributes, fill in the appropriate values, and click Save.

e. In the Account Lockout tab, specify the appropriate information, and click Save.

7.1.1.3. Configuring a Global Password Policy Using the Command LineTo set up the password policy for a subtree or user, add the required entries and attributes at thesubtree or user level, set the appropriate values to the password policy attributes, and enable fine-grained password policy checking.

This section describes the attributes to create a password policy for the entire server (globally) usingldapmodify to change these attributes in the cn=config entry.

Table 7.1, “Password Policy Attributes” describes the attributes available to configure the passwordpolicy.

Attribute Name Definition

passwordGraceLimit This attribute indicates the number of gracelogins permitted when a user's password isexpired. When set to a positive number, the userwill be allowed to bind with the expired passwordfor that many times. For the global passwordpolicy, the attribute is defined under cn=config.By default, this attribute is set to 0, which meansgrace logins are not permitted.

passwordMustChange When on, this attribute requires users to changetheir passwords when they first login to thedirectory or after the password is reset by theDirectory Manager. The user is required tochange their password even if user-definedpasswords are disabled. If this attribute is setto off, passwords assigned by the Directory

Page 337: Red Hat Directory Server 5.1

Configuring the Password Policy

317

Attribute Name DefinitionManager should not follow any obviousconvention and should be difficult to discover.This attribute is off by default.

passwordChange When on, this attribute indicates that users maychange their own password. Allowing users toset their own passwords runs the risk of userschoosing passwords that are easy to remember.However, setting good passwords for the userrequires a significant administrative effort. Inaddition, providing passwords to users that arenot meaningful to them runs the risk that userswill write the password down somewhere thatcan be discovered. This attribute is on by default.

passwordExp When on, this attribute indicates that the user'spassword will expire after an interval given by thepasswordMaxAge attribute. Making passwordsexpire helps protect the directory data becausethe longer a password is in use, the more likelyit is to be discovered. This attribute is off bydefault.

passwordMaxAge This attribute indicates the number of secondsafter which user passwords expire. To use thisattribute, enable password expiration usingthe passwordExp attribute. This attribute is adynamic parameter in that its maximum valueis derived by subtracting January 18, 2038,from today's date. The attribute value must notbe set to the maximum value or too close tothe maximum value. If the value is set to themaximum value, Directory Server may fail tostart because the number of seconds will gopast the epoch date. In such an event, the errorlog will indicate that the password maximumage is invalid. To resolve this problem, correctthe passwordMaxAge attribute value in thedse.ldif file. A common policy is to havepasswords expire every 30 to 90 days. Bydefault, the password maximum age is set to8640000 seconds (100 days).

passwordWarning This attribute indicates the number of secondsbefore a warning message is sent to userswhose password is about to expire. Dependingon the LDAP client application, users may beprompted to change their password when thewarning is sent. By default, the directory sendsthe warning 86400 seconds (1 day) beforethe password is about to expire. However,a password never expires until the warning

Page 338: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

318

Attribute Name Definitionmessage has been sent. Therefore, if users don'tbind to the Directory Server for longer than thepasswordMaxAge, they will still get the warningmessage in time to change their password.

passwordMinAge This attribute indicates the number of secondsthat must pass before a user can change theirpassword. Use this attribute in conjunctionwith the passwordInHistory attribute todiscourage users from reusing old passwords.For example, setting the minimum passwordage to 2 days prevents users from repeatedlychanging their passwords during a single sessionto cycle through the password history and reusean old password once it has been removed fromthe history list. The minimum age can be from 0to 2147472000 seconds (24,855 days). A valueof zero indicates that the user can change thepassword immediately. The default value of thisattribute is 0.

passwordHistory This attribute indicates whether the directorystores a password history. When set to on,the directory stores the number of passwordsspecified in the passwordInHistory attributein a history. If a user attempts to reuse one of thepasswords, the password will be rejected. Whenthis attribute is set to off, any passwords storedin the history remain there. When this attributeis set back to on, users will not be able to reusethe passwords recorded in the history before theattribute was disabled. This attribute is off bydefault, meaning users can reuse old passwords.

passwordInHistory This attribute indicates the number of passwordsthe directory stores in the history. Therecan be 2 to 24 passwords stored in thehistory. This feature is not enabled unless thepasswordHistory attribute is set to on. Thisattribute is set to 6 by default.

passwordCheckSyntax When on, this attribute indicates that thepassword syntax is checked by the serverbefore the password is saved. Password syntaxchecking ensures that the password stringmeets or exceeds the length and complexityrequirements and that the string does not containany trivial words. A trivial word is any valuestored in the uid, cn, sn, givenname, ou, ormail attributes of the user's entry. This attributeis off by default.

Page 339: Red Hat Directory Server 5.1

Configuring the Password Policy

319

Attribute Name Definition

passwordMinLength This attribute specifies the minimum numberof characters that must be used in passwords.Shorter passwords are easier to crack.Passwords can be two (2) to 512 characterslong. Generally, a length of eight characters islong enough to be difficult to crack but shortenough for users to remember without writing itdown. This attribute is set to 8 by default.

passwordMaxRepeats This attribute set the maximum number of timesthat the same character can be used in row, suchas aaaaa. Setting the attribute to 0 means thatthere is no limit on how many time a charactercan be repeated. This attribute is set to 0 bydefault.

passwordMinAlphas This attribute sets the minimum number ofalphabetic characters that must be usedin the password. This setting does notset any requirements for the letter case;requirements for the minimum number oflowercase and uppercase letters are set in thepasswordMinLower and passwordMinUpperattributes, respectively. By default, this attributeis set to 0, meaning there is no requiredminimum.

passwordMinDigits This attribute sets the minimum number ofnumeric characters (0 through 9) which must beused in the password. By default, this attribute isset to 0, meaning there is no required minimum.

passwordMinSpecials This attribute sets the minimum number ofspecial ASCII characters, such as !@#$., whichmust be used in the password. By default, thisattribute is set to 0, meaning there is no requiredminimum.

passwordMinLowers This attribute sets the minimum number oflower case alphabetic characters, a to z, whichmust be used in the password. By default, thisattribute is set to 0, meaning there is no requiredminimum.

passwordMinCategories This attribute sets the minimum number ofcategories which must be used in the password.There are eight categories available:Uppercase letters (A to Z)Lowercase letters (a to z)Numbers (0 through 9)Special ASCII characters, such as $ASCII alphabetic characters, regardless of case(a to z and A to Z)

Page 340: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

320

Attribute Name Definition8-bit charactersRepeated characters, such as aaaaaa

This attribute is set to 3 by default.

passwordMinUppers This attribute sets the minimum number ofupper case alphabetic characters, A to Z, whichmust be used in the password. By default, thisattribute is set to 0, meaning there is no requiredminimum.

passwordTokenLength This attribute sets the minimum length for anytokens used with Directory Server. The tokenlength can be from 1 to 64 characters. Thisattribute is set to 3 by default.

passwordMin8bit This attribute sets the minimum number of 8-bitcharacters used in the password. The defaultnumber is 0, meaning none are required.

passwordStorageScheme This attribute specifies the type of encryptionused to store Directory Server passwords. Thefollowing encryption types are supported byDirectory Server:SSHA (Salted Secure Hash Algorithm). Thismethod is recommended as it is the most secure.The Directory Server supports SSHA, SSHA-256,SSHA-384, and SSHA-512. SSHA is the defaultmethod.SHA (Secure Hash Algorithm). A one-way hashalgorithm; it is supported only for backwardscompatibility with Directory Server 4.x andshould not be used otherwise. This includessupport for SHA, SHA-256, SHA-384, andSHA-512 algorithms, which protects againstsome insecurities in the SHA-1 algorithm.MD5. MD5 is not as secure as SSHA but isavailable for legacy applications require it.crypt. The UNIX crypt algorithm, provided forcompatibility with UNIX passwords.clear. This encryption type indicates that thepassword will appear in plain text.

The only password storage scheme that canbe used with SASL DIGEST-MD5 is CLEAR.Passwords stored using crypt, SHA, or SSHAformats cannot be used for secure login throughSASL Digest MD5. To provide a customizedstorage scheme, consult Red Hat professionalservices.

Table 7.1. Password Policy Attributes

Page 341: Red Hat Directory Server 5.1

Configuring the Password Policy

321

7.1.1.4. Configuring Subtree/User Password Policy Using the CommandLineTo configure a subtree or user level password policy:

1. Add the required attributes to the subtree or user entries by running the ns-newpwpolicy.plscript.

The command syntax for the script is as follows:

ns-newpwpolicy.pl [-D rootDN] -w password | -w - | -j filename [-p port] [-h host] -U userDN -S suffixDN

For updating a subtree entry, use the -S option. For updating a user entry, use the -U option. Thens-newpwpolicy.pl script accepts only one user or subtree entry at a time. It can, however,accept both user and suffix entries at the same time. For details about the script, see the DirectoryServer Configuration, Command, and File Reference.

2. The script adds the required attributes depending on whether the target entry is a subtree or userentry.

For a subtree (for example, ou=people, dc=example, dc=com), the following entries areadded:

• A container entry (nsPwPolicyContainer)at the subtree level for holding various passwordpolicy-related entries for the subtree and all its children. For example:

dn: cn=nsPwPolicyContainer,ou=people,dc=example,dc=com objectClass: top objectClass: nsContainer cn: nsPwPolicyContainer

• The actual password policy specification entry (nsPwPolicyEntry) for holding all thepassword policy attributes that are specific to the subtree. For example:

dn: cn="cn=nsPwPolicyEntry,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com objectclass: top objectclass: extensibleObject objectclass: ldapsubentry objectclass: passwordpolicy

• The CoS template entry (nsPwTemplateEntry) that has the pwdpolicysubentry valuepointing to the above (nsPwPolicyEntry) entry. For example:

dn: cn="cn=nsPwTemplateEntry,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com objectclass: top objectclass: extensibleObject objectclass: costemplate objectclass: ldapsubentry cosPriority: 1 pwdpolicysubentry: cn="cn=nsPwPolicyEntry,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com

Page 342: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

322

• The CoS specification entry at the subtree level. For example:

dn: cn=newpwdpolicy_cos,ou=people,dc=example,dc=com objectclass: top objectclass: LDAPsubentry objectclass: cosSuperDefinition objectclass: cosPointerDefinition cosTemplateDn: cn="cn=nsPwTemplateEntry,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com cosAttribute: pwdpolicysubentry default operational

For a user (for example, uid=jdoe, ou=people, dc=example, dc=com), the followingentries are added:

• A container entry (nsPwPolicyContainer) at the parent level for holding various passwordpolicy related entries for the user and all its children. For example:

dn: cn=nsPwPolicyContainer, ou=people, dc=example, dc=com objectClass: top objectClass: nsContainer cn: nsPwPolicyContainer

• The actual password policy specification entry (nsPwPolicyEntry) for holding the passwordpolicy attributes that are specific to the user. For example:

dn: cn="cn=nsPwPolicyEntry,uid=jdoe,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com objectclass: top objectclass: extensibleObject objectclass: ldapsubentry objectclass: passwordpolicy

3. Assign the value of the above entry DN to the pwdpolicysubentry attribute of the target entry.For example, this assigns the password policy to the user entry:

dn: uid=jdoe,ou=people,dc=example,dc=com changetype: modify replace: pwdpolicysubentry pwdpolicysubentry: "cn=nsPwPolicyEntry,uid=jdoe,ou=people,dc=example,dc=com", cn=nsPwPolicyContainer,ou=people,dc=example,dc=com

4. Set the password policy attributes for the subtree or user entry with the appropriate values.

Table 7.1, “Password Policy Attributes” describes the attributes available to configure thepassword policy. The ldapmodify utility can be used to change these attributes in the subtree oruser entry which contains the nsPwPolicyEntry object class.

NOTEThe nsslapd-pwpolicy-local attribute of the cn=config entry controls the typeof password policy the server enforces. By default, this attribute is disabled (off).When the attribute is disabled, the server only checks for and enforces the globalpassword policy; the subtree and user level password policies are ignored. Whenthe ns-newpwpolicy.pl script runs, it first checks for the specified subtree and

Page 343: Red Hat Directory Server 5.1

Configuring the Password Policy

323

user entries and, if they exist, modifies them. After updating the entries successfully,the script sets the nsslapd-pwpolicy-local configuration parameter to on. Ifthe subtree and user level password policy should not be enabled, be sure to setnsslapd-pwpolicy-local to off after running the script.

To turn off user and subtree level password policy checks, set the nsslapd-pwpolicy-localattribute to off by modifying the cn=config entry. For example: 1

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=config changetype: modify replace: nsslapd-pwpolicy-local: on nsslapd-pwpolicy-local: off

This attribute can also be disabled by modifying it directly in the configuration file (dse.ldif).

1. Stop the server. 2

service dirsrv stop instance

2. Open the dse.ldif file in a text editor.

3. Set the value of nsslapd-pwpolicy-local to off, and save.

nsslapd-pwpolicy-local: off

4. Start the server.

service dirsrv start instance

7.1.1.5. Manually Setting Default Password Syntax Checking for LocalPassword PoliciesThe settings for the global password policy should be in effect for any local password policies, if thoseattributes are not explicitly set. If the password policy attribute is not set in either the global or the localpolicy, then the default values should be assumed.

However, there is a bug in Directory Server, so that if a password policy attribute is set in the globalpassword policy but not in the local password policy, then neither the global setting nor the defaultsettings is enforced by the local password policy. To work around this, set the password attributesexplicitly in the local password policy.

1. Enable global syntax checking, as in Section 7.1.1.1, “Configuring a Global Password Policy Usingthe Console”, and save the policy.

2. Edit the local password policy to contain all password syntax

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 344: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

324

3. Enable fine-grained password checking, as in Section 7.1.1.2, “Configuring a Subtree/UserPassword Policy Using the Console”, and save the policy.

4. Edit the local password policy to contain all password syntax attributes. Set the values tosomething other than the default settings, as listed in the Configuration, Command, and FileReference.

5. Re-edit the local password policy with the desired values, even if they are the defaults.

7.1.2. Setting User PasswordsAn entry can be used to bind to the directory only if it has a userPassword attribute and if it has notbeen inactivated. Because user passwords are stored in the directory, the user passwords can be setor reset with any LDAP operation, like ldapmodify.1

For information on creating and modifying directory entries, see Chapter 3, Creating Directory Entries.For information on inactivating user accounts, refer to Section 7.2, “Inactivating Users and Roles”.

Passwords can also be set and reset in the Users and Groups area of the Red Hat AdministrationServer or Directory Server Console. For information on how to use the Users and Groups area inthe Administration Server Console, see the online help that is available in the Red Hat AdministrationServer.

7.1.3. Password Change Extended OperationWhile most passwords can be changed through the Console and other Directory Server featuresor through the ldapmodify operation, there are some passwords that cannot be changed throughregular LDAP operations. These passwords may be stored outside the Directory Server, such aspasswords stored in a SASL application. These passwords can be modified through the passwordchange extended operation.

Directory Server supports the password change extended operation as defined in RFC 3062, sousers can change their passwords, using a suitable client, in a standards-compliant way. DirectoryServer does not include a client application for the password change extended operation. However,the ldappasswd utility can be used as follows:

ldappasswd -h hostname -p secure_port -Z -P /path/to/cert8.db -D bindDN -w bindPassword [-a oldPassword] -s newPassworduser

Parameter Description

-h Gives the hostname of the Directory Server.

-p Gives the port number of the Directory Server.Since SSL is required for password changeoperations, this is usually give the TLS/SSL portof the Directory Server. With the -ZZ or -ZZZ forStart TLS, this can be the standard port.

-Z Requires SSL for the connection. A secureconnection is required for the password changeoperation.

Page 345: Red Hat Directory Server 5.1

Configuring the Account Lockout Policy

325

Parameter Description

NOTEldappasswd also supports StartTLS encryption (-ZZ[Z]).

-P Gives the full path to the certificate databasewhich contains the CA certificate of the CA thatissued the Directory Server client certificate.If the ldappasswd command is run on thesame machine that the Directory Server isinstalled on, this can be /etc/dirsrv/slapd-instance_name/cert8.db. If this isnot given, the default is the current directory.

-D Gives the bind DN.

-w Gives the password for the bind DN.

-a Optional. Gives the old password, which is beingchanged.

-s Sets the new password.

Table 7.2. ldappasswd Options

To use Start TLS, which runs the command on a non-secure port, run ldappasswd with the -ZZoption and the standard LDAP port number. The password extended change operation has thefollowing format:

ldappasswd -h hostname -p standard_port -ZZ -P /path/to/cert8.db -D bindDN -w bindPassword -s newPassworduser [-a oldPassword]

Use the -ZZZ for additional certificate hostname validation.

To modify an entry's password, run ldappasswd like any other LDAP operation. It is not necessary tospecify a user if the account is the same as that given in the bind DN. For example:

ldappasswd -h ldap.example.com -p 389 -ZZ -D "uid=jsmith,ou=People,dc=example,dc=com" -w secret -s newpassword

To change the password on an entry other than the one specified in the bind credentials, runldappasswd as shown below, adding the user DN to the operation and providing separatecredentials, as follows:

ldappasswd -h server.example.com -p 389 -ZZ -D "cn=Directory Manager" -w secret -s newpassword "uid=jsmith,ou=People,dc=example,dc=com"

Access control is enforced for the password change operation. If the bind DN does not have rights tochange the specified password, the operation will fail with an Insufficient rights error.

7.1.4. Configuring the Account Lockout PolicyThe lockout policy works in conjunction with the password policy to provide further security. Theaccount lockout feature protects against hackers who try to break into the directory by repeatedly

Page 346: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

326

trying to guess a user's password. The password policy can be set so that a specific user is locked outof the directory after a given number of failed attempts to bind.

Configuring the account lockout policy is described in the following sections:

• Section 7.1.4.1, “Configuring the Account Lockout Policy Using the Console”

• Section 7.1.4.2, “Configuring the Account Lockout Policy Using the Command Line”

7.1.4.1. Configuring the Account Lockout Policy Using the ConsoleTo set up or modify the account lockout policy for the Directory Server:

1. Select the Configuration tab and then the Data node.

2. In the right pane, select the Account Lockout tab.

3. To enable account lockout, select the Accounts may be locked out checkbox.

4. Enter the maximum number of allowed bind failures in the Lockout account after X loginfailures text box. The server locks out users who exceed the limit specified here.

5. In the Reset failure counter after X minutes text box, enter the number of minutes for the serverto wait before resetting the bind failure counter to zero.

6. Set the interval for users to be locked out of the directory.

• Select the Lockout Forever radio button to lock users out until their passwords have been resetby the administrator.

• Set a specific lockout period by selecting the Lockout Duration radio button and entering thetime (in minutes) in the text box.

7. Click Save.

7.1.4.2. Configuring the Account Lockout Policy Using the CommandLineThis section describes the attributes to create an account lockout policy to protect the passwordsstored in the server. Use ldapmodify to change these attributes in the cn=config entry.

Table 7.3, “Account Lockout Policy Attributes” describes the attributes available to configure theaccount lockout policy.

Attribute Name Definition

passwordLockout This attribute indicates whether users are lockedout of the directory after a given number of failedbind attempts. Set the number of failed bindattempts after which the user will be locked outusing the passwordMaxFailure attribute.Users can be locked out for a specific time oruntil an administrator resets the password. Thisattribute is set to off by default, meaning thatusers will not be locked out of the directory.

Page 347: Red Hat Directory Server 5.1

Managing the Password Policy in a Replicated Environment

327

Attribute Name Definition

passwordMaxFailure This attribute indicates the number of failed bindattempts after which a user will be locked out ofthe directory. This attribute takes affect only if thepasswordLockout attribute is set to on. Thisattribute is set to 3 bind failures by default.

passwordUnlock This attribute sets whether a user can log backinto the server without administrator intervation.The default is for this attribute to be on, meaningthat the user can log back into the server after acertain lockout period has passed. If this attributeis turned off, then the user cannot log back inusing that account until it is manually unlockedby an administrator.

passwordLockoutDuration This attribute indicates the time, in seconds,that users will be locked out of the directory.The passwordUnlock attribute specifies if auser is locked out until the password is reset byan administrator (which means that the user islocked out indefinitely). If the passwordUnlockattribute is set to on, then the use can log inagain as soon as the lockout duration time isreached. By default, the user is locked out for3600 seconds.

passwordResetFailureCount This attribute specifies the time, in seconds, afterwhich the password failure counter will be reset.Each time an invalid password is sent from theuser's account, the password failure counteris incremented. If the passwordLockoutattribute is set to on, users will be locked outof the directory when the counter reachesthe number of failures specified by thepasswordMaxFailure attribute. The accountis locked out for the interval specified in thepasswordLockoutDuration attribute, afterwhich time the failure counter is reset to zero(0). Because the counter's purpose is to gagewhen a hacker is trying to gain access to thesystem, the counter must continue for a periodlong enough to detect a hacker. However, ifthe counter were to increment indefinitely overdays and weeks, valid users might be locked outinadvertently. The reset password failure countattribute is set 600 seconds by default.

Table 7.3. Account Lockout Policy Attributes

7.1.5. Managing the Password Policy in a Replicated EnvironmentPassword and account lockout policies are enforced in a replicated environment as follows:

Page 348: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

328

• Password policies are enforced on the data master.

• Account lockout is enforced on all servers participating in replication.

Some of the password policy information in the directory is replicated:

• passwordMinAge and passwordMaxAge

• passwordExp

• passwordWarning

However, the configuration information is kept locally and is not replicated. This information includesthe password syntax and the history of password modifications. Account lockout counters and tiers arenot replicated, either.

When configuring a password policy in a replicated environment, consider the following points:

• Warnings from the server of an impending password expiration will be issued by all replicas. Thisinformation is kept locally on each server, so if a user binds to several replicas in turn, they will beissued the same warning several times. In addition, if the user changes the password, it may taketime for this information to filter to the replicas. If a user changes a password and then immediatelyrebinds, he may find that the bind fails until the replica registers the changes.

• The same bind behavior should occur on all servers, including suppliers and replicas. Make sure tocreate the same password policy configuration information on each server.

• Account lockout counters may not work as expected in a multi-mastered environment.

• Entries that are created for replication (for example, the server identities) need to have passwordsthat never expire. To make sure that these special users have passwords that do not expire, add thepasswordExpirationTime attribute to the entry, and give it a value of 20380119031407Z (thetop of the valid range).

7.1.6. Synchronizing PasswordsPassword changes in a Directory Server entry can be synchronized to password attributes in ActiveDirectory entries by using the Password Sync utility.

When passwords are synchronized, password policies are enforced on each sync peer locally. Thesyntax or minimum length requirements on the Directory Server apply when the password is changedin the Directory Server. When the changed password is synced over to the Windows server, theWindows password policy is enforced. The password policies themselves are not synchronized.

Configuration information is kept locally and cannot be synchronized, including the password changehistory and the account lockout counters.

When configuring a password policy for synchronization, consider the following points:

• The Password Sync utility must be installed locally on the Windows machine that will besynchronized with a Directory Server.

• Password Sync can only link the Windows machine to a single Directory Server; to sync changeswith multiple Directory Server instances, configure the Directory Server for multi-master replication.

Page 349: Red Hat Directory Server 5.1

Inactivating Users and Roles

329

• Password expiration warnings and times, failed bind attempts, and other password-relatedinformation is enforced locally per server and is not synchronized between sync peer servers.

• The same bind behavior should occur on all servers. Make sure to create the same or similarpassword policies on both Directory Server and Active Directory servers.

• Entries that are created for synchronization (for example, the server identities) need to havepasswords that never expire. To make sure that these special users have passwords that do notexpire, add the passwordExpirationTime attribute to the Directory Server entry, and give it avalue of 20380119031407Z (the top of the valid range).

See Chapter 9, Synchronizing Red Hat Directory Server with Microsoft Active Directory for moreinformation on synchronizing Directory Server and Windows users and passwords.

7.2. Inactivating Users and RolesA single user account or set of accounts can be temporarily inactivated. Once an account isinactivated, a user cannot bind to the directory. The authentication operation will fail.

Users and roles are inactivated using the operational attribute nsAccountLock. When an entrycontains the nsAccountLock attribute with a value of true, the server rejects the bind.

The same procedures are used to inactivate users and roles. However, when a role is inactivated,the members of the role are inactivated, not the role entry itself. For more information about roles ingeneral and how roles interact with access control in particular, see Chapter 5, Organizing Entries withRoles, Class of Service, and Views.

• Section 7.2.1, “Inactivating User and Roles Using the Console”

• Section 7.2.2, “Inactivating User and Roles Using the Command Line”

• Section 7.2.3, “Activating User and Roles Using the Console”

• Section 7.2.4, “Activating User and Roles Using the Command Line”

WARNINGThe root entry (the entry corresponding to the root or sub suffix) on a database cannot beinactivated. Chapter 3, Creating Directory Entries has information on creating the entry fora root or sub suffix, and Chapter 2, Configuring Directory Databases has information oncreating root and sub suffixes.

7.2.1. Inactivating User and Roles Using the ConsoleThe following procedure describes inactivating a user or a role using the Console:

1. Select the Directory tab.

2. Browse the navigation tree in the left navigation pane, and double-click the user or role toinactivate.

The Edit Entry dialog box appears.

Alternatively, select Inactivate from the Object menu.

Page 350: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

330

3. Click Account in the left pane. The right pane states that the role or user is activate. Click theInactivate to inactivate the user or role.

4. Click OK.

Once inactivated, the state of the object can be viewed by selecting Inactivation State from theView > Display menu. The icon of the object then appears in the right pane of the Console with ared slash through it.

7.2.2. Inactivating User and Roles Using the Command LineTo inactivate a user account, use the ns-inactivate.pl script. The following example describesusing the ns-inactivate.pl script to inactivate Joe Frasier's user account:

ns-inactivate.pl -D Directory Manager -w secret -p 389 -h example.com -I "uid=jfrasier,ou=people,dc=example,dc=com"

The following table describes the ns-inactivate.pl options used in the example:

Option Name Description

-D The DN of the directory administrator.

-w The password of the directory administrator.

-p Port used by the server.

-h Name of the server on which the directoryresides.

-I DN of the user account or role to inactivate.

For more information about running the ns-inactivate.pl script, refer to the Directory ServerConfiguration, Command, and File Reference.

7.2.3. Activating User and Roles Using the ConsoleThe following procedure describes activating a user or a role using the Console:

1. Select the Directory tab.

2. Browse the navigation tree in the left navigation pane, and double-click the user or role to activate.

Alternatively, select Activate from the Object menu.

The Edit Entry dialog box appears.

3. Click Account in the left pane. The right pane states that the role or user is inactivated. Click theActivate to activate the user or role.

4. If the user or role is a member of another inactivated role, the Console displays an option forviewing the inactivated roles. Click Show Inactivated Roles to view the list of roles to which theuser or role belongs.

5. Click OK.

Page 351: Red Hat Directory Server 5.1

Activating User and Roles Using the Command Line

331

Once reactivated, the state of the object can be viewed by selecting Inactivation State from the Viewmenu. The icon of the role or user in the right pane of the Console appears as normal. The red slashthrough the icon indicating it was inactive disappears.

7.2.4. Activating User and Roles Using the Command LineTo activate a user account, use the ns-activate.pl script. The following example describes usingthe ns-activate.pl script to activate Joe Frasier's user account:

ns-activate.pl -D Directory Manager -w secret -p 389 -h example.com -I "uid=jfrasier,ou=people,dc=example,dc=com"

The following table describes the ns-inactivate.pl options used in the example:

Option Name Description

-D The DN of the directory administrator.

-w The password of the directory administrator.

-p Port used by the server.

-h Name of the server on which the directoryresides.

-I DN of the user account or role to activate.

For more information about running the ns-activate.pl script, refer to the Directory ServerConfiguration, Command, and File Reference.

7.3. Setting Resource Limits Based on the Bind DNServer limits for search operations are controlled using special operational attribute values on theclient application binding to the directory. You can set the following search operation limits:

• Look through limit. Specifies how many entries can be examined for a search operation.

• Size limit. Specifies the maximum number of entries the server returns to a client application inresponse to a search operation.

• Time limit. Specifies the maximum time the server spends processing a search operation.

• Idle timeout. Specifies the time a connection to the server can be idle before the connection isdropped.

The resource limits set for the client application take precedence over the default resource limits setfor in the global server configuration.

NOTEThe Directory Manager receives unlimited resources by default.

• Section 7.3.1, “Setting Resource Limits Using the Console”

• Section 7.3.2, “Setting Resource Limits Using the Command Line”

Page 352: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

332

7.3.1. Setting Resource Limits Using the ConsoleThe following procedure describes setting resource limits for a user or a role using the DirectoryServer Console:

1. Select the Directory tab.

2. Browse the navigation tree in the left navigation pane, and double-click the user or role for whichto set resource limits.

The Edit Entry dialog box appears.

3. Click Account in the left pane. The right pane contains the four limits that can be set in theResource Limits section.

Entering a value of -1 indicates no limit.

4. Click OK.

7.3.2. Setting Resource Limits Using the Command LineThe following operational attributes can be set for each entry using the command line. Useldapmodify to add the following attributes to the entry:

Attribute Description

nsLookThroughLimit Specifies how many entries are examined for asearch operation. Giving this attribute a value of-1 indicates that there is no limit.

nsSizeLimit Specifies the maximum number of entries theserver returns to a client application in responseto a search operation. Giving this attribute avalue of -1 indicates that there is no limit.

nsTimeLimit Specifies the maximum time the server spendsprocessing a search operation. Giving thisattribute a value of -1 indicates that there is notime limit.

nsIdleTimeout Specifies the time a connection to the server canbe idle before the connection is dropped. Thevalue is given in seconds. Giving this attribute avalue of -1 indicates that there is no limit.

For example, this sets the size limit for Barbara Jensen by using ldapmodify1 to modify her entry:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: uid=bjensen,ou=people,dc=example,dc=comchangetype: modifyadd:nsSizeLimitnsSizeLimit: 500

The ldapmodify statement adds the nsSizeLimit attribute to Babs Jensen's entry and gives it asearch return size limit of 500 entries.

Page 353: Red Hat Directory Server 5.1

Using Pass-through Authentication

333

7.4. Using Pass-through AuthenticationPass-through authentication (PTA) is a mechanism which allows one Red Hat Directory Serverinstance to consult another to authenticate bind requests. Pass-through authentication is implementthrough the PTA Plug-in; when enabled, the plug-in lets a Directory Server instance accept simple bindoperations (password-based) for entries not stored in its local database.

Directory Server uses PTA to administer the user and configuration directories on separate instancesof Directory Server.

7.4.1. How Directory Server Uses PTAIf the configuration directory and the user directory are installed on separate instances of DirectoryServer, the setup program automatically sets up PTA to allow the Configuration Administrator user(usually admin) to perform administrative duties.

PTA is required in this case because the admin user entry is stored under o=NetscapeRoot suffix inthe configuration directory. Therefore, attempts to bind to the user directory as admin would normallyfail. PTA allows the user directory to transmit the credentials to the configuration directory, whichverifies them. The user directory then allows the admin user to bind.

The user directory in this example acts as the PTA Directory Server, the server that passes throughbind requests to another Directory Server. The configuration directory acts as the authenticatingdirectory, the server that contains the entry and verifies the bind credentials of the requestingclient.

The pass-through subtree is the subtree not present on the PTA directory. When a user's bind DNcontains this subtree, the user's credentials are passed on to the authenticating directory.

NOTEThe PTA Plug-in may not be listed in the Directory Server Console the same serverinstance is used for the user directory and the configuration directory.

Here's how pass-through authentication works:

1. The configuration Directory Server (authenticating directory) is installed on machine A. Theconfiguration directory always contains the configuration database and suffix, o=NetscapeRoot.In this example, the server name is configdir.example.com.

2. The user Directory Server (PTA directory) is then installed on machine B. The user directorystores the root suffix, such as dc=example,dc=com. In this example, the server name isuserdir.example.com.

3. When the user directory is set up on machine B, the setup script prompts for the LDAP URL of theconfiguration directory on machine A.

4. The setup program enables the PTA Plug-in and configures it to use the configuration directoryLDAP URL.

This entry contains the LDAP URL for the configuration directory. For example:

dn: cn=Pass Through Authentication,cn=plugins,

Page 354: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

334

...nsslapd-pluginEnabled: onnsslapd-pluginarg0: ldap://configdir.example.com/o=NetscapeRoot...

The user directory is now configured to send all bind requests for entries with a DN containingo=NetscapeRoot to the configuration directory configdir.example.com.

5. When installation is complete, the admin user attempts to connect to the user directory to beginadding users.

6. The setup program adds the admin user's entry to the directory as uid=admin,ou=TopologyManagement,o=NetscapeRoot. So the user directory passes the bind requestthrough to the configuration directory as defined by the PTA Plug-in configuration.

7. The configuration directory authenticates the user's credentials and sends the information back tothe user directory.

8. The user directory allows the admin user to bind.

7.4.2. PTA Plug-in SyntaxPTA Plug-in configuration information is specified in the cn=Pass Through Authentication,cn=plugins,cn=config entry on the PTA directory (the user directory configured to pass throughbind requests to the authenticating directory) using the required PTA syntax. There are only twoattributes in this entry that are significant:

• nsslapd-pluginEnabled, which sets whether the plug-in is enabled or disabled. The value for thisattribute can be on or off.

• nsslapd-pluginarg0, which points to the configuration directory. The value for this attribute is theLDAP URL of the server and suffix to which to pass the bind requests, along with the optionalparameters, maxconns, maxops, timeout, ldver, connlifetime, startTLS.

The variable components of the PTA plug-in syntax are described in Table 7.4, “PTA Plug-inParameters”.

NOTEThe LDAP URL (ldap|ldaps://authDS/subtree) must be separated from the optionalparameters (maxconns, maxops, timeout, ldver, connlifetime, startTLS) by a single space.If any of the optional parameters are defined, all of them must be defined, even if only thedefault values are used.

Several authenticating directories or subtrees can be specified by incrementing thensslapd-pluginarg attribute suffix by one each time, as in Section 7.4.4.2, “SpecifyingMultiple Authenticating Directory Servers”. For example:

nsslapd-pluginarg0: LDAP URL for the first servernsslapd-pluginarg1: LDAP URL for the second servernsslapd-pluginarg2: LDAP URL for the third server...

Page 355: Red Hat Directory Server 5.1

PTA Plug-in Syntax

335

The optional parameters are described in the following table in the order in which they appear in thesyntax.

Variable Definition

state Defines whether the plug-in is enabled ordisabled. Acceptable values are on or off.

ldap|ldaps Defines whether SSL is used for communicationbetween the two Directory Servers. SeeSection 7.4.3.1, “Configuring the Servers to Usea Secure Connection” for more information.

authDS The authenticating directory hostname.The port number of the Directory Servercan be given by adding a colon and thenthe port number. For example, ldap://dirserver.example.com:389/. If the portnumber is not specified, the PTA server attemptsto connect using either of the standard ports:Port 389 if ldap:// is specified in the URL.Port 636 if ldaps:// is specified in the URL.

See Section 7.4.3.2, “Specifying theAuthenticating Directory Server” for moreinformation.

subtree The pass-through subtree. The PTA DirectoryServer passes through bind requests to theauthenticating Directory Server from all clientswhose DN is in this subtree. See Section 7.4.3.3,“Specifying the Pass-through Subtree” formore information. This subtree must not existon this server. To pass the bind requests foro=NetscapeRoot to the configuration directory,the subtree o=NetscapeRoot must not exist onthe server.

maxconns Optional. The maximum number of connectionsthe PTA directory can simultaneously open tothe authenticating directory. The default is 3.See Section 7.4.3.4, “Configuring the OptionalParameters” for more information.

maxops Optional. The maximum number of simultaneousoperations (usually bind requests) the PTAdirectory can send to the authenticating directorywithin a single connection. The default is 5.See Section 7.4.3.4, “Configuring the OptionalParameters” for more information.

timeout Optional. The time limit, in seconds, that thePTA directory waits for a response from theauthenticating Directory Server. If this timeoutis exceeded, the server returns an error to theclient. The default is 300 seconds (five minutes).

Page 356: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

336

Variable DefinitionSpecify zero (0) to indicate no time limit shouldbe enforced. See Section 7.4.3.4, “Configuringthe Optional Parameters” for more information.

ldver Optional. The version of the LDAP protocolused to connect to the authenticating directory.Directory Server supports LDAP version 2 and3. The default is version 3, and Red Hat stronglyrecommends against using LDAPv2, which isold and will be deprecated. See Section 7.4.3.4,“Configuring the Optional Parameters” for moreinformation.

connlifetime Optional. The time limit, in seconds, within whicha connection may be used. If a bind request isinitiated by a client after this time has expired,the server closes the connection and opens anew connection to the authenticating directory.The server will not close the connection unlessa bind request is initiated and the directorydetermines the connection lifetime has beenexceeded. If this option is not specified, or ifonly one host is listed, no connection lifetimewill be enforced. If two or more hosts are listed,the default is 300 seconds (five minutes). SeeSection 7.4.3.4, “Configuring the OptionalParameters” for more information.

startTLS Optional. A flag of whether to use Start TLS forthe connection to the authenticating directory.Start TLS establishes a secure connection overthe standard port, so it is useful for connectingusing LDAP instead of LDAPS. The SSL serverand CA certificates need to be available on bothof the servers.

The default is 0, which is off. To enable StartTLS, set it to 1. To use Start TLS, the LDAP URLmust use ldap:, not ldaps:.

See Section 7.4.3.4, “Configuring the OptionalParameters” for more information.

Table 7.4. PTA Plug-in Parameters

7.4.3. Configuring the PTA Plug-inThe only method for configuring the PTA plug-in is to modify the entry cn=Pass ThroughAuthentication, cn=plugins,cn=config. To modify the PTA configuration, do the following:

1. Use the ldapmodify command to modify cn=Pass Through Authentication,cn=plugins,cn=config.

2. Restart Directory Server. 3

Page 357: Red Hat Directory Server 5.1

Configuring the PTA Plug-in

337

Before configuring any of the PTA Plug-in parameters, the PTA Plug-in entry must be present in theDirectory Server. If this entry does not exist, create it with the appropriate syntax, as described inSection 7.4.2, “PTA Plug-in Syntax”.

NOTEIf the user and configuration directories are installed on different instances of the directory,the PTA Plug-in entry is automatically added to the user directory's configuration andenabled.

This section provides information about configuring the plug-in in the following sections:

• Section 7.4.3.1, “Configuring the Servers to Use a Secure Connection”

• Section 7.4.3.2, “Specifying the Authenticating Directory Server”

• Section 7.4.3.3, “Specifying the Pass-through Subtree”

• Section 7.4.3.4, “Configuring the Optional Parameters”

7.4.3.1. Configuring the Servers to Use a Secure ConnectionThe PTA directory can be configured to communicate with the authenticating directory over SSL byspecifying LDAPS in the LDAP URL of the PTA directory. For example:

nsslapd-pluginarg0: ldaps://ldap.example.com:636/o=NetscapeRoot

7.4.3.2. Specifying the Authenticating Directory ServerThe authenticating directory contains the bind credentials for the entry with which the client isattempting to bind. The PTA directory passes the bind request to the host defines as the authenticatingdirectory. To specify the authenticating Directory Server, replace authDS in the LDAP URL of thePTA directory with the authenticating directory's hostname, as described in Table 7.4, “PTA Plug-inParameters”.

1. Use ldapmodify edit the PTA Plug-in entry.

ldapmodify -p 389 -D "cn=Directory Manager" -w secret -h example

dn: cn=Pass Through Authentication,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginarg0nsslapd-pluginarg0: ldap://dirserver.example.com/o=NetscapeRoot

Optionally, include the port number. If the port number is not given, the PTA Directory Serverattempts to connect using either the standard port (389) for ldap:// or the secure port (636) forldaps://.

If the connection between the PTA Directory Server and the authenticating Directory Server isbroken or the connection cannot be opened, the PTA Directory Server sends the request to thenext server specified, if any. There can be multiple authenticating Directory Servers specified, asrequired, to provide failover if the first Directory Server is unavailable. All of the authenticationDirectory Server are set in the nsslapd-pluginarg0 attribute.

Page 358: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

338

Multiple authenticating Directory Servers are listed in a space-separate list of host:port pairs, withthis format:

ldap|ldaps://host1:port1 host2:port2/subtree

2. Restart the server. 3

service dirsrv restart instance_name

7.4.3.3. Specifying the Pass-through SubtreeThe PTA directory passes through bind requests to the authenticating directory from all clients with aDN defined in the pass-through subtree. The subtree is specified by replacing the subtree parameterin the LDAP URL of the PTA directory.

The pass-through subtree must not exist in the PTA directory. If it does, the PTA directory attempts toresolve bind requests using its own directory contents and the binds fail.

1. Use the ldapmodify command to import the LDIF file into the directory.

ldapmodify -p 389 -D "cn=Directory Manager" -w secret -h example

dn: cn=Pass Through Authentication,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginarg0nsslapd-pluginarg0: ldap://dirserver.example.com/o=NetscapeRoot

For information on the variable components in this syntax, see Table 7.4, “PTA Plug-inParameters”.

2. Restart the server. 3

service dirsrv restart instance_name

7.4.3.4. Configuring the Optional ParametersAdditional parameters the control the PTA connection can be set with the LDAP URL.

ldap|ldaps://authDS/subtree maxconns, maxops, timeout, ldver, connlifetime, startTLS

• The maximum number of connections the PTA Directory Server can open simultaneously to theauthenticating directory, represented by maxconns in the PTA syntax. The default value is 3.

• The maximum number of bind requests the PTA Directory Server can send simultaneously to theauthenticating Directory Server within a single connection. In the PTA syntax, this parameter ismaxops. The default is value is 5.

• The time limit for the PTA Directory Server to wait for a response from the authenticating DirectoryServer. In the PTA syntax, this parameter is timeout. The default value is 300 seconds (fiveminutes).

Page 359: Red Hat Directory Server 5.1

PTA Plug-in Syntax Examples

339

• The version of the LDAP protocol for the PTA Directory Server to use to connect to theauthenticating Directory Server. In the PTA syntax, this parameter is ldver. The default is LDAPv3.

• The time limit in seconds within which a connection may be used. If a bind request is initiated by aclient after this time has expired, the server closes the connection and opens a new connection tothe authenticating Directory Server. The server will not close the connection unless a bind requestis initiated and the server determines the timeout has been exceeded. If this option is not specifiedor if only one authenticating Directory Server is listed in the authDS parameter, no time limit willbe enforced. If two or more hosts are listed, the default is 300 seconds (five minutes). In the PTAsyntax, this parameter is connlifetime.

• Whether to use Start TLS for the connection. Start TLS creates a secure connection over a standardLDAP port. For Start TLS, the servers must have their server and CA certificates installed, but theydo not need to be running in SSL.

The default is 0, which means Start TLS is off. To enable Start TLS, set it to 1. To use Start TLS, theLDAP URL must use ldap:, not ldaps:.

1. Use ldapmodify to edit the plug-in entry.

ldapmodify -p 389 -D "cn=Directory Manager" -w secret -h example

dn: cn=Pass Through Authentication,cn=plugins,cn=configchangetype: modifyreplace: nsslapd-pluginarg0nsslapd-pluginarg0: ldap://dirserver.example.com/o=NetscapeRoot 3,5,300,3,300,0

(In this example, each of the optional parameters is set to its default value.) Make sure there is aspace between the subtree parameter, and the optional parameters.

NOTEAlthough these parameters are optional, if any one of them is defined, they all must bedefined, even if they use the default values.

2. Restart the server. 3

service dirsrv restart instance_name

7.4.4. PTA Plug-in Syntax ExamplesThis section contains the following examples of PTA Plug-in syntax in the dse.ldif file:

• Section 7.4.4.1, “Specifying One Authenticating Directory Server and One Subtree”

• Section 7.4.4.2, “Specifying Multiple Authenticating Directory Servers”

• Section 7.4.4.3, “Specifying One Authenticating Directory Server and Multiple Subtrees”

• Section 7.4.4.4, “Using Non-Default Parameter Values”

• Section 7.4.4.5, “Specifying Different Optional Parameters and Subtrees for Different AuthenticatingDirectory Servers”

Page 360: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

340

7.4.4.1. Specifying One Authenticating Directory Server and One SubtreeThis example configures the PTA Plug-in to accept all defaults for the optional variables. Thisconfiguration causes the PTA Directory Server to connect to the authenticating Directory Server for allbind requests to the o=NetscapeRoot subtree. The hostname of the authenticating Directory Serveris configdir.example.com.

dn: cn=Pass Through Authentication,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0: ldap://configdir.example.com/o=NetscapeRoot...

7.4.4.2. Specifying Multiple Authenticating Directory ServersIf the connection between the PTA Directory Server and the authenticating Directory Server is brokenor the connection cannot be opened, the PTA Directory Server sends the request to the next serverspecified, if any. There can be multiple authenticating Directory Servers specified, as required, toprovide failover if the first Directory Server is unavailable. All of the authentication Directory Server areset in the nsslapd-pluginarg0 attribute. Multiple authenticating Directory Servers are listed in aspace-separate list of host:port pairs. For example:

dn: cn=Pass Through Authentication,cn=plugins,cn=config... nsslapd-pluginEnabled: onnsslapd-pluginarg0: ldap://configdir.example.com:389 config2dir.example.com:1389/o=NetscapeRoot ...

NOTEThe nsslapd-pluginarg0 attribute sets the authentication Directory Server; additionalnsslapd-pluginargN attributes can set additional suffixes for the PTA Plug-in to use,but not additional hosts.

7.4.4.3. Specifying One Authenticating Directory Server and MultipleSubtreesThe following example configures the PTA Directory Server to pass through bind requests for morethan one subtree (using parameter defaults):

dn: cn=Pass Through Authentication,cn=plugins,cn=config... nsslapd-pluginEnabled: onnsslapd-pluginarg0: ldap://configdir.example.com/o=NetscapeRootnsslapd-pluginarg1: ldap://configdir.example.com/dc=example,dc=com...

7.4.4.4. Using Non-Default Parameter ValuesThis example uses a non-default value (10) only for the maximum number of connections parametermaxconns. Each of the other parameters is set to its default value. However, because one parameteris specified, all parameters must be defined explicitly in the syntax.

Page 361: Red Hat Directory Server 5.1

Configuring Autobind

341

dn: cn=Pass Through Authentication,cn=plugins,cn=config... nsslapd-pluginEnabled: onnsslapd-pluginarg0: ldap://configdir.example.com/o=NetscapeRoot 10,5,300,3,300,1...

7.4.4.5. Specifying Different Optional Parameters and Subtrees forDifferent Authenticating Directory ServersTo specify a different pass-through subtree and optional parameter values for each authenticatingDirectory Server, set more than one LDAP URL/optional parameters pair. Separate the LDAP URL/optional parameter pairs with a single space as follows.

dn: cn=Pass Through Authentication,cn=plugins,cn=config...nsslapd-pluginEnabled: onnsslapd-pluginarg0:ldap://configdir.example.com/o=NetscapeRoot 10,15,30,3,600,0nsslapd-pluginarg1:ldap://config2dir.example.com/dc=example,dc=com 7,7,300,3,300,1...

7.5. Configuring AutobindAutobind is a way to connect to the Directory Server based on local UNIX credentials, which aremapped to an identity stored in the directory itself. Autobind is configured in two parts:

Before configuring autobind, first make sure that LDAPI is enabled (in Section 1.5, “Enabling LDAPI”).Then, configure the autobind mappings (in Section 7.5.2, “Configuring Autobind”).

7.5.1. Overview of Autobind and LDAPIInter-process communication (IPC) is a way for separate processes on a Unix machine or a networkto communicate directly with each other. LDAPI is a way to run LDAP connections over these IPCconnections, meaning that LDAP operations can run over Unix sockets. These connections are muchfaster and more secure than regular LDAP connections.

The Directory Server uses these LDAPI connections to allow users to bind immediately to theDirectory Server or to access the Directory Server using tools which support connections over Unixsockets. Autobind uses the uid:gid of the Unix user and maps that user to an entry in the DirectoryServer, then allows access for that user.

Autobind allows mappings to three directory entries:

• User entries, if the Unix user matches one user entry

• Directory Manager (or the super user defined in nsslapd-ldapimaprootdn), if the Unix user isroot

Page 362: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

342

Figure 7.1. Autobind Connection Path

The special autobind users are entries beneath a special autobind suffix (outside the regular usersubtree). The entries underneath are identified by their user and group ID numbers:

gidNumber=gid+uidNumberuid, autobindsuffix

If autobind is not enabled but LDAPI is, then Unix users are anonymously bound to the DirectoryServer, unless they provide other bind credentials.

NOTEAutobind allows a client to send a request to the Directory Server without supplying a bindusername and password or using other SASL authentication mechanism. According to theLDAP standard, if bind information is not given with the request, the server processes therequest as an anonymous bind. To be compliant with the standard, which requires somekind of bind information, any client that uses autobind should send the request with SASL/EXTERNAL.

Page 363: Red Hat Directory Server 5.1

Configuring Autobind

343

For more information on configuring SASL, see Chapter 13, Managing SASL.

7.5.2. Configuring AutobindConfiguring autobind alone allows anonymous access to the Directory Server. It is possible to enablemapping Unix users to entries and also to map root to Directory Manager.

1. Run ldapmodify to update the Directory Server configuration.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=configchangetype: modify

2. Enable autobind.

replace: nsslapd-ldapiautobindnsslapd-ldapiautobind: on

3. To map user entries, add four attributes:

• nsslapd-ldapimaptoentries to enable entry mapping

• nsslapd-ldapiuidnumbertype to set the Directory Server attribute to map to the Unix UIDnumber

• nsslapd-ldapigidnumbertype to set the Directory Server attribute to map to the Unixgroup ID number

• nsslapd-ldapientrysearchbase to set the search base to use to find Directory Serveruser entries

add: nsslapd-ldapimaptoentriesnsslapd-ldapimaptoentries: on-add: nsslapd-ldapiuidnumbertypensslapd-ldapiuidnumbertype: uidNumber-add: nsslapd-ldapigidnumbertypensslapd-ldapigidnumbertype: gidNumber-add: nsslapd-ldapientrysearchbasensslapd-ldapientrysearchbase: ou=people, dc=example, dc=com

4. To map the root entry to Directory Manager, add the nsslapd-ldapimaprootdn attribute:

add: nsslapd-ldapimaprootdnnsslapd-ldapimaprootdn: cn=Directory Manager

5. Restart the server to apply the new configuration.

service dirsrv restart example

Page 364: Red Hat Directory Server 5.1

Chapter 7. Managing User Authentication

344

7.6. Allowing Unauthenticated BindsAn unauthenticated bind is a bind where the user supplies a username but not a password. Forexample, running an ldapsearch without supplying a password option:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -b "dc=example,dc=com" -s sub "(objectclass=*)"

When unauthenticated binds are allowed, the bind attempt goes through as an anonymous bind.

Unauthenticated binds are less secure than authenticated binds, and in some directories can beused to circumvent ACIs or performs denial-of-service attacks. This is why in Directory Serverunauthenticated binds are disabled by default. If a user tries to bind without a password, the attemptfails:

ldap_simple_bind: DSA is unwilling to performldap_simple_bind: additional info: Unauthenticated binds are not allowed

Unauthenticated binds only apply to bind attempts where a password is not given but a bind identity is.If the wrong password is given, the operation fails with an invalid credentials error:

ldap_simple_bind: Invalid credentials

If no bind ID or password is given, then the directory returns whatever information is allowed for ananonymous bind.

The nsslapd-allow-unauthenticated-binds attribute sets whether to allow an unauthenticatedbind to succeed as an anonymous bind. Setting this parameter to on allows unauthenticated binds. Bydefault, this parameter is off.

To configure unauthenticated binds, edit the Directory Server dse.ldif file:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=configchangetype:replacereplace: nsslapd-allow-unauthenticated-bindsnsslapd-allow-unauthenticated-binds: on

Page 365: Red Hat Directory Server 5.1

Chapter 8.

345

Managing ReplicationReplication is the mechanism by which directory data is automatically copied from one Red HatDirectory Server instance to another; it is an important mechanism for extending the directory servicebeyond a single server configuration. This chapter describes the tasks to be performed on the masterand consumer servers to set up single-master replication, multi-master replication, and cascadingreplication.

8.1. Replication OverviewReplication is the mechanism by which directory data is automatically copied from one DirectoryServer to another. Updates of any kind — entry additions, modifications, or even deletions — areautomatically mirrored to other Directory Servers using replication.

• Section 8.1.1, “What Directory Units Are Replicated”

• Section 8.1.2, “Read-Write and Read-Only Replicas”

• Section 8.1.3, “Suppliers and Consumers”

• Section 8.1.4, “Changelog”

• Section 8.1.5, “Replication Identity”

• Section 8.1.6, “Replication Agreement”

• Section 8.1.8, “Compatibility with Earlier Versions of Directory Server”

8.1.1. What Directory Units Are ReplicatedThe smallest unit of of the directory which can be replicated is a database. This means that onecan replicate an entire database but not a subtree within a database. Therefore, when creating thedirectory tree, consider any replication plans as part of determining how to distribute information.

Replication also requires that one database correspond to one suffix. This means that a suffix (ornamespace) that is distributed over two or more databases using custom distribution logic cannot bereplicated. For more information on this topic, see Section 2.2, “Creating and Maintaining Databases”.

8.1.2. Read-Write and Read-Only ReplicasA database that participates in replication is called a replica. There are two kinds of replicas: read-write or read-only. A read-write replica contains master copies of directory information and can beupdated. A read-only replica services read, search, and compare requests, but refers all updateoperations to read-write replicas. A server can hold any number of read-only or read-write replicas.

8.1.3. Suppliers and ConsumersA server that holds a replica that is copied to a replica on a different server is called a supplier for thatreplica. A server that holds a replica that is copied from a different server is called a consumer forthat replica. Generally, the replica on the supplier server is a read-write replica, and the one on theconsumer server is a read-only replica, with two exceptions:

Page 366: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

346

• In the case of cascading replication, the hub server holds a read-only replica that it supplies toconsumers. Section 8.2.3, “Cascading Replication” has more information.

• In the case of multi-master replication, the masters are both suppliers and consumers for the sameinformation. For more information, see Section 8.2.2, “Multi-Master Replication”.

Replication is always initiated by the supplier server, never by the consumer (supplier-initiatedreplication). Supplier-initiated replication allows a supplier server to be configured to push data tomultiple consumer servers.

8.1.4. ChangelogEvery supplier server maintains a changelog, a record of all changes that a supplier or hub needs tosend to its consumers. A changelog is a special kind of database that describes the modifications thathave occurred on a replica. The supplier server then replays these modifications to the replicas storedon consumer servers or to other suppliers, in the case of multi-master replication.

When an entry is modified, a change record describing the LDAP operation that was performed isrecorded in the changelog.

In Directory Server, the changelog is only intended for internal use by the server. For otherapplications to read the changelog, use the Retro Changelog Plug-in, as described in Section 8.17,“Using the Retro Changelog Plug-in”.

8.1.5. Replication IdentityWhen replication occurs between two servers, the replication process uses a special entry, calledthe replication manager entry, to identify replication protocol exchanges and to control access to thedirectory data. The replication manager entry, or any entry used during replication, must meet thefollowing criteria:

• It is created on the consumer server (or hub) and not on the supplier server.

• Create this entry on every server that receives updates from another server, meaning on every hubor dedicated consumer.

• When a replica is configured as a consumer or hub (a replica which receives updates from anotherserver), this entry must be specified as the one authorized to perform replication updates.

• The replication agreement is created on the supplier server, the DN of this entry must be specified inthe replication agreement.

• The supplier bind DN entry must not be part of the replicated database for security reasons.

• This entry, with its special user profile, bypasses all access control rules defined on the consumerserver for the database involved in that replication agreement.

NOTEIn the Directory Server Console, this replication manager entry is referred to as thesupplier bind DN, which may be misleading because the entry does not actually exist

Page 367: Red Hat Directory Server 5.1

Replication Agreement

347

on the supplier server. It is called the supplier bind DN because it is the entry which thesupplier uses to bind to the consumer. This entry actually exists, then, on the consumer.

For more information on creating the replication manager entry, see Section 8.3, “Creating theSupplier Bind DN Entry”.

8.1.6. Replication AgreementDirectory Servers use replication agreements to define their replication configuration. A replicationagreement describes replication between one supplier and one consumer only. The agreement isconfigured on the supplier server and must specify all required replication information:

• The database to be replicated.

• The consumer server to which the data is pushed.

• The days and times during which replication can occur.

• The DN and credentials that the supplier server must use to bind (the replication manager entry orsupplier bind DN).

• How the connection is secured (SSL, client authentication).

• Any attributes that will not be replicated (fractional replication).

8.1.7. Replicating Attributes with Fractional ReplicationFractional replication sets a specific subset of attributes that will not be transmitted from a supplierto the consumer (or another supplier). Administrators can therefore replicate a database withoutreplicating all the information that it contains or all of the information in every entry.

Fractional replication is enabled and configured per replication agreement. Excluding attributes fromreplication is applied equally to all entries within the replication agreement's scope.

As far as the consumer server is concerned, the excluded attributes always have no value. Therefore,a client performing a search against the consumer server will never see the excluded attributes.Similarly, should it perform a search that specifies those attributes in its filter, no entries will match.

8.1.8. Compatibility with Earlier Versions of Directory ServerThe replication mechanism in Directory Server 8.1 is different from the mechanism used in 4.x ofDirectory Server. Compatibility is provided through two Directory Server plug-ins:

• Legacy Replication Plug-in. The Legacy Replication Plug-in makes a Directory Server 8.1 instancebehave as a 4.x Directory Server in a consumer role. For information on how to implement legacyreplication using this plug-in, see Section 8.16, “Replication with Earlier Releases”.

• Retro Changelog Plug-in. The Retro Changelog Plug-in can be used for a Directory Server supplierto maintain a 4.x-style changelog. This is sometimes necessary for legacy applications that havea dependency on the Directory Server 4.x changelog format because they read information fromthe changelog. For more information on the Retro Changelog Plug-in, see Section 8.17, “Using theRetro Changelog Plug-in”.

Page 368: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

348

8.2. Replication Scenarios• Section 8.2.1, “Single-Master Replication”

• Section 8.2.2, “Multi-Master Replication”

• Section 8.2.3, “Cascading Replication”

These basic strategies can be combined in a variety of ways to create the best replicationenvironment.

NOTEWhatever replication scenario is implemented, consider schema replication. To avoidconflict resolution loops, the Referential Integrity Plug-in should only be enabled on onesupplier replica in a multi-master replication environment. The plug-in is off by default.

8.2.1. Single-Master ReplicationIn the simplest replication scenario, the master copy of directory data is held in a single read-writereplica on one server called the supplier server. The supplier server also maintains changelog for thisreplica. On another server, called the consumer server, there can be multiple read-only replicas. Suchscenarios are called single-master configurations. Figure 8.1, “Single-Master Replication” shows anexample of single-master replication.

Page 369: Red Hat Directory Server 5.1

Multi-Master Replication

349

Figure 8.1. Single-Master Replication

In this particular configuration, the ou=people,dc=example,dc=com suffix receives a large numberof search requests. Therefore, to distribute the load, this tree, which is mastered on Server A, isreplicated to two read-only replicas located on Server B and Server C.

For information on setting up a single-master replication environment, see Section 8.4, “ConfiguringSingle-Master Replication”.

8.2.2. Multi-Master ReplicationDirectory Server also supports complex replication scenarios in which the same suffix (database) canbe mastered on many servers. This suffix is held in a read-write replica on each server. This meansthat each server maintains a changelog for the read-write replica.

This type of configuration can work with any number of consumer servers. Each consumer serverholds a read-only replica. The consumers can receive updates from all the suppliers. The consumersalso have referrals defined for all the suppliers to forward any update requests that the consumersreceive. Such scenarios are called multi-master configurations.

Figure 8.2, “Multi-Master Replication (Two Masters)” shows an example of multi-master replicationscenario with two supplier servers and two consumer servers.

Page 370: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

350

Figure 8.2. Multi-Master Replication (Two Masters)

Figure 8.3, “Multi-Master Replication (Four Masters)” shows a sample of multi-master replicationscenario with four supplier servers and eight consumer servers. In this sample setup, each supplierserver is configured with ten replication agreements to feed data to two other supplier servers and alleight consumer servers.

Page 371: Red Hat Directory Server 5.1

Cascading Replication

351

Figure 8.3. Multi-Master Replication (Four Masters)

Multi-master configurations have the following advantages:

• Automatic write failover when one supplier is inaccessible.

• Updates are made on a local supplier in a geographically distributed environment.

NOTEThe speed that replication proceeds depends on the speed of the network. Plan changesand directory configuration accordingly, and realize that changes to one directory may notbe quickly replicated to other directories over slow links, such as wide-area networks, ingeographically-distributed environments.

For the procedure to set up multi-master replication, see Section 8.5, “Configuring Multi-MasterReplication”.

8.2.3. Cascading ReplicationIn a cascading replication scenario, one server, a hub, acts both as a consumer and a supplier. It holdsa read-only replica and maintains a changelog, so it receives updates from the supplier server thatholds the master copy of the data and, in turn, supplies those updates to the consumer. Cascading

Page 372: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

352

replication is very useful for balancing heavy traffic loads or to keep master servers based locally ingeographically-distributed environments.

Figure 8.4, “Cascading Replication” shows an example of a simple cascading replication scenario,though it is possible to create more complex scenarios with several hub servers.

Figure 8.4. Cascading Replication

For information on setting up cascading replication, see Section 8.6, “Configuring CascadingReplication”.

NOTEMulti-master and cascading replication can be combined. For example, in the multi-masterscenario illustrated in Figure 8.2, “Multi-Master Replication (Two Masters)”, Server C andServer D could be hub servers that would replicate to any number of consumer servers.

Page 373: Red Hat Directory Server 5.1

Creating the Supplier Bind DN Entry

353

8.3. Creating the Supplier Bind DN EntryA critical part of setting up replication is to create the entry, called the replication manager or supplierbind DN entry, that the suppliers use to bind to the consumer servers to perform replication updates.

The supplier bind DN must meet the following criteria:

• It must be unique.

• It must be created on the consumer server (or hub) and not on the supplier server.

• It must correspond to an actual entry on the consumer server.

• It must be created on every server that receives updates from another server.

• It must not be part of the replicated database for security reasons.

• It must be defined in the replication agreement on the supplier server.

For example, the entry cn=Replication Manager,cn=config can be created under thecn=config tree on the consumer server. This would be the supplier bind DN that all supplier serverswould use to bind to the consumer to perform replication operations.

NOTEAvoid creating simple entries under the cn=config entry in the dse.ldif file. Thecn=cn=config entry in the simple, flat dse.ldif configuration file is not stored inthe same highly scalable database as regular entries. As a result, if many entries, andparticularly entries that are likely to be updated frequently, are stored under cn=config,performance will suffer. However, although Red Hat recommends not storing simple userentries under cn=config for performance reasons, it can be useful to store special userentries such as the Directory Manager entry or replication manager (supplier bind DN)entry under cn=config since this centralizes configuration information.

On each server that acts as a consumer in replication agreements, create a special entry that thesupplier will use to bind to the consumers. Make sure to create the entry with the attributes required bythe authentication method specified in the replication agreement.

1. Stop the Directory Server. If the server is not stopped, the changes to the dse.ldif file will notbe saved. See Section 1.3, “Starting and Stopping Servers” for more information on stopping theserver.

2. Create a new entry, such as cn=replication manager,cn=config, in the dse.ldif file.

3. Specify a userPassword attribute-value pair.

4. If password expiration policy is enabled or ever will be enabled, disable it on the replicationmanager entry to prevent replication from failing due to passwords expiring. To disable thepassword expiration policy on the userPassword attribute, add the passwordExpirationTimeattribute with a value of 20380119031407Z, which means that the password will never expire.

5. Restart the Directory Server. See Section 1.3, “Starting and Stopping Servers” for moreinformation on starting the server.

The final entry should resemble Example 8.1, “Example Supplier Bind DN Entry”.

Page 374: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

354

dn: cn=replication manager,cn=config objectClass: inetorgperson objectClass: person objectClass: top cn: replication manager sn: RM userPassword: password passwordExpirationTime: 20380119031407Z

Example 8.1. Example Supplier Bind DN Entry

When configuring a replica as a consumer, use the DN of this entry to define the supplier bind DN.

8.4. Configuring Single-Master ReplicationTo set up single-master replication such as the configuration shown in Figure 8.1, “Single-MasterReplication”, between supplier Server A, which holds a read-write replica, and the two consumersServer B and Server C, which each hold a read-only replica, there are two major steps:

• Section 8.4.1, “Configuring the Read-Write Replica on the Supplier Server”

• Section 8.4.2, “Configuring the Read-Only Replica on the Consumer”

• Section 8.4.3, “Create the Replication Agreement”

8.4.1. Configuring the Read-Write Replica on the Supplier Server1. Specify the supplier settings for the server.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, select the Replication folder.

c. In the right-hand side of the window, select the Supplier Settings tab.

Page 375: Red Hat Directory Server 5.1

Configuring the Read-Write Replica on the Supplier Server

355

d. Check the Enable Changelog checkbox.

This activates all of the fields in the pane below that were previously grayed out.

e. Specify a changelog by clicking the Use default button, or click the Browse button to displaya file selector.

f. Set the changelog parameters for the number and age of the log files.

Clear the unlimited checkboxes to specify different values.

g. Click Save.

2. Specify the replication settings required for a read-write replica.

a. In the navigation tree on the Configuration tab, expand the Replication node, and highlightthe database to replicate.

The Replica Settings tab opens in the right-hand side of the window.

b. Check the Enable Replica checkbox.

c. In the Replica Role section, select the Single Master radio button.

d. In the Common Settings section, specify a Replica ID, which is an integer between 1 and65534, inclusive.

The replica ID must be unique for a given suffix, different from any other ID used for read-writereplicas on this server and on other servers.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

Page 376: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

356

The purge delay is how often the state information stored for the replicated entries is deleted.

f. Click Save.

8.4.2. Configuring the Read-Only Replica on the Consumer1. Create the database for the read-only replica if it does not exist. See Section 2.1.1, “Creating

Suffixes” for instructions on creating suffixes.

2. Create the entry for the supplier bind DN on the consumer server if it does not exist. The supplierbind DN is the special entry that the supplier will use to bind to the consumer. This is described inSection 8.3, “Creating the Supplier Bind DN Entry”.

3. Specify the replication settings required for a read-only replica.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, expand the Replication folder, and highlight the replica database.

The Replica Settings tab for that database opens in the right-hand side of the window.

c. Check the Enable Replica checkbox.

Page 377: Red Hat Directory Server 5.1

Configuring the Read-Only Replica on the Consumer

357

d. In the Replica Role section, select the Dedicated Consumer radio button.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

This option indicates how often the state information stored for the replicated entries ispurged.

f. In the Update Settings section, specify the bind DN that the supplier will use to bind to thereplica. Enter the supplier bind DN in the Enter a new Supplier DN field, and click Add. Thesupplier bind DN appears in the Current Supplier DNs list.

Page 378: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

358

The supplier bind DN should be the entry created in step 2. The supplier bind DN is aprivileged user because it is not subject to access control.

NOTEThere can be multiple supplier bind DNs per consumer but only one supplier DNper replication agreement.

g. Specify the URL for any supplier servers to which to refer updates.

By default, all updates are first referred to the supplier servers that are specified here. If nosuppliers are set here, updates are referred to the supplier servers that have a replicationagreement that includes the current replica.

Automatic referrals assume that clients bind over a regular connection; this has a URL in theform ldap://hostname:port. For clients to bind to the supplier using SSL, use this field tospecify a referral of the form ldaps://hostname:port, where the s in ldaps indicates asecure connection.

4. Click Save.

Repeat these steps for every consumer server in the replication configuration.

8.4.3. Create the Replication AgreementCreate one replication agreement for each read-only replica. For example, in the scenario illustratedin Figure 8.1, “Single-Master Replication”, Server A has two replication agreements, one for Server Band one for Server C.

1. In the navigation tree of the Configuration tab, right-click the database to replicate, and selectNew Replication Agreement.

Page 379: Red Hat Directory Server 5.1

Create the Replication Agreement

359

Alternatively, highlight the database, and select New Replication Agreement from the Objectmenu to start the Replication Agreement Wizard.

2. In the first screen, fill in a name and description for the replication agreement, and hit Next.

3. In the Source and Destination screen, fill in the URL for the consumer and the supplier bindDN and password on that consumer. If the target server is not available, hit in other to fill in theinformation manually.

Page 380: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

360

• Unless there is more than one instance of Directory Server configured, by default, there are noconsumers available in the drop-down menu.

• The port listed is the non-SSL port, even if the Directory Server instance is configured to runover SSL. This port number is used only for identification of the Directory Server instance in theConsole; it does not specify the actual port number or protocol that is used for replication.

• If SSL is enabled on the servers, it is possible to select the Using encrypted SSL connectionradio button for SSL client authentication. Otherwise, fill in the supplier bind DN and password.

NOTEIf attribute encryption is enabled, a secure connection must be used for theencrypted attributes to be replicated.

4. Select the connection type. There are three options:

• Use LDAP. This sets either a standard, unencrypted connection or allows SASL encryption,since Directory Server supports SASL over standard LDAP but not SSL.

• Use TLS/SSL. This uses a secure connection over the server's secure LDAPS port, such as636. This setting is required to use TLS/SSL, but it cannot be set if the authentication will beperformed with SASL.

• Use Start TLS. This uses Start TLS to establish a secure connection over the server's standardport.

5. Select the appropriate authentication method and supply the required information. This givesthe information that the supplier uses to authenticate and bind to the consumer server to sendupdates.

• Simple means that the server connects over the standard port with no encryption. The onlyrequired information is the bind DN and password for the Replication Manager (which must existon the consumer server).

• Server TLS/SSL Certificate uses the supplier's SSL certificate to authenticate to the consumerserver. A certificate must be installed on the supplier for certificate-based authentication, and theconsumer server must have certificate mapping configured so that it can map the subject DN inthe supplier's certificate to its Replication Manager entry.

Configuring SSL and certificate mapping is described in Chapter 12, Managing SSL.

• SASL/DIGEST-MD5 requires the standard port to connect to the server. Like simpleauthentication, this requires only the bind DN and password to authenticate.

• SASL/GSSAPI also requires the standard LDAP connection because the Directory Server doesnot support using GSS-API over SSL/TLS.

The supplier server must have a Kerberos keytab (as in Section 13.1.4.2, “About the KDCServer and Keytabs”), and the consumer server must have a SASL mapping to map thesupplier's principal to the real replication manager entry (as in Section 13.2.1, “ConfiguringSASL Identity Mapping from the Console”).

Page 381: Red Hat Directory Server 5.1

Create the Replication Agreement

361

6. Fractional replication controls which entry attributes are replicated between servers. By default,all attributes are replicated. To select attributes that will not be replicated to the consumer, checkthe Enable Fractional Replication checkbox. Then, highlight the attribute (or attributes) in theIncluded column on the right, and click Remove. All attributes that will not be replicated arelisted in the Excluded column on the left, as well as in the summary the replication agreement iscomplete.

7. Set the schedule for when replication runs. By default, replication runs continually.

Page 382: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

362

NOTEThe replication schedule cannot cross midnight (0000). So, it is possible to set aschedule that begins at 0001 and ends at 2359 on the same day, but it is not possibleto set one that begins at 2359 on one day and ends at 0001 on the next.

Hit Next.

8. Set when the consumer is initialized. Initializing a consumer manually copies all data over from thesupplier to the consumer. The default is to create an initialization file (an LDIF of all supplier data)so that the consumer can be initialized later. It is also possible to initialize the consumer as soonas the replication agreement is completed or not at all. For information on initializing consumers,see Section 8.10, “Initializing Consumers”.

Page 383: Red Hat Directory Server 5.1

Create the Replication Agreement

363

NOTEReplication will not begin until the consumer is initialized.

Hit Next.

9. The final screen shows the settings for the replication agreement, as it will be included in thedse.ldif file. Hit Done to save the agreement.

Page 384: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

364

The replication agreement is set up.

NOTEAfter creating a replication agreement, the connection type (SSL or non-SSL) cannotbe changed because LDAP and LDAPS connections use different ports. To change theconnection type, re-create the replication agreement.

8.5. Configuring Multi-Master ReplicationIn a multi-master configuration, many suppliers can accept updates, synchronize with each other, andupdate all consumers. The consumers can send referrals for updates to all masters.

Directory Server supports 4-way multi-master replication. To set up multi-master replication suchas the configuration shown in Figure 8.3, “Multi-Master Replication (Four Masters)”, set up all of theconsumers first, then set up the suppliers, and last, initialize all of the databases:

• Section 8.5.1, “Configuring the Read-Write Replicas on the Supplier Servers”

Page 385: Red Hat Directory Server 5.1

Configuring the Read-Write Replicas on the Supplier Servers

365

• Section 8.5.2, “Configuring the Read-Only Replicas on the Consumer Servers”

• Section 8.5.3, “Setting up the Replication Agreements”

• Section 8.5.4, “Preventing Monopolization of the Consumer in Multi-Master Replication”

NOTEMore than 10 databases running with replication or more than 20 replication agreementson a supplier can cause performance degradation. To support that many consumers,introduce hub replicas between the suppliers and consumers. See Section 8.6,“Configuring Cascading Replication”.

8.5.1. Configuring the Read-Write Replicas on the Supplier ServersSet up each supplier server. The first supplier configured should be used to initialize the othersuppliers in the multi-master replication environment.

1. Specify the supplier settings for the server.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, select the Replication folder.

c. In the right-hand side of the window, select the Supplier Settings tab.

d. Check the Enable Changelog checkbox.

This activates all of the fields in the pane below that were previously grayed out.

Page 386: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

366

e. Specify a changelog by clicking the Use default button, or click the Browse button to displaya file selector.

f. Set the changelog parameters for the number and age of the log files.

Clear the unlimited checkboxes to specify different values.

g. Click Save.

2. Create the entry for the supplier bind DN on the consumer server if it does not exist. This is thespecial entry that the other suppliers will use to bind to this supplier, as in other supplier-consumerrelationships. This is described in Section 8.3, “Creating the Supplier Bind DN Entry”.

NOTEFor multi-master replication, it is necessary to create this supplier bind DN onthe supplier servers as well as the consumers because the suppliers act as bothconsumer and supplier to the other supplier servers.

3. Specify the replication settings for the multi-mastered read-write replica.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, expand the Replication folder, and highlight the replica database.

The Replica Settings tab for that database opens in the right-hand side of the window.

c. Check the Enable Replica checkbox.

d. In the Replica Role section, select the Multiple Master radio button.

e. In the Common Settings section, specify a Replica ID, which is an integer between 1 and65534, inclusive.

Page 387: Red Hat Directory Server 5.1

Configuring the Read-Only Replicas on the Consumer Servers

367

The replica ID must be unique for a given suffix, different from any other ID used for read-writereplicas on this server and on other servers.

f. In the Common Settings section, specify a purge delay in the Purge delay field.

The purge delay is how often the state information stored for the replicated entries is deleted.

g. In the Update Settings section, specify the bind DN that the supplier will use to bind to thereplica. Enter the supplier bind DN in the Enter a new Supplier DN field, and click Add. Thesupplier bind DN appears in the Current Supplier DNs list.

The supplier bind DN should be the entry created in step 2. The supplier bind DN is aprivileged user because it is not subject to access control in the replicated database.

NOTEThere can be multiple supplier bind DNs per consumer but only one supplier DNper replication agreement.

h. Specify the URL for any supplier servers to which to refer updates, such as the other suppliersin the multi-master replication set. Only specify the URL for the supplier server.

For clients to bind using SSL, specify a URL beginning with ldaps://.

i. Click Save.

8.5.2. Configuring the Read-Only Replicas on the Consumer ServersFirst, configure every consumer.

1. Create the database for the read-only replica if it does not exist. See Section 2.1.1, “CreatingSuffixes” for instructions on creating suffixes.

2. Create the entry for the supplier bind DN on the consumer server if it does not exist. The supplierbind DN is the special entry that the supplier will use to bind to the consumer. This is described inSection 8.3, “Creating the Supplier Bind DN Entry”.

3. Specify the replication settings required for a read-only replica.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, expand the Replication folder, and highlight the replica database.

The Replica Settings tab for that database opens in the right-hand side of the window.

Page 388: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

368

c. Check the Enable Replica checkbox.

d. In the Replica Role section, select the Dedicated Consumer radio button.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

This option indicates how often the state information stored for the replicated entries ispurged.

f. In the Update Settings section, specify the bind DN that the supplier will use to bind to thereplica. Enter the supplier bind DN in the Enter a new Supplier DN field, and click Add. Thesupplier bind DN appears in the Current Supplier DNs list.

The supplier bind DN should be the entry created in step 2. The supplier bind DN is aprivileged user because it is not subject to access control in the replicated database.

NOTEThere can be multiple supplier bind DNs per consumer but only one supplier DNper replication agreement.

g. Specify the URL for any supplier servers to which to refer updates.

By default, all updates are first referred to the supplier servers that are specified here. If nosuppliers are set here, updates are referred to the supplier servers that have a replicationagreement that includes the current replica.

Automatic referrals assume that clients bind over a regular connection; this has a URL in theform ldap://hostname:port. For clients to bind to the supplier using SSL, use this field tospecify a referral of the form ldaps://hostname:port, where the s in ldaps indicates asecure connection.

4. Click Save.

Repeat these steps for every consumer server in the replication configuration.

Page 389: Red Hat Directory Server 5.1

Setting up the Replication Agreements

369

8.5.3. Setting up the Replication Agreements

NOTE1. First set up replication agreements on a single supplier, the data master, between the

other multi-master suppliers, and initialize all of the other suppliers.

2. Then create replication agreements for all other suppliers in the multi-masterreplication set, but do not reinitialize any of the suppliers.

3. Then create replication agreements for all of the consumers from the single datamaster, and initialize the consumers.

4. Then create replication agreements for all of the consumers from for all of the othersuppliers, but do not reinitialize any of the consumers.

1. In the navigation tree of the Configuration tab, right-click the database to replicate, and selectNew Replication Agreement.

Alternatively, highlight the database, and select New Replication Agreement from the Objectmenu to start the Replication Agreement Wizard.

2. In the first screen, fill in a name and description for the replication agreement, and hit Next.

3. In the Source and Destination screen, fill in the URL for the consumer and the supplier bindDN and password on that consumer. If the target server is not available, hit in other to fill in theinformation manually.

Page 390: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

370

• Unless there is more than one instance of Directory Server configured, by default, there are noconsumers available in the drop-down menu.

• The port listed is the non-SSL port, even if the Directory Server instance is configured to runover SSL. This port number is used only for identification of the Directory Server instance in theConsole; it does not specify the actual port number or protocol that is used for replication.

• If SSL is enabled on the servers, it is possible to select the Using encrypted SSL connectionradio button for SSL client authentication. Otherwise, fill in the supplier bind DN and password.

Page 391: Red Hat Directory Server 5.1

Setting up the Replication Agreements

371

NOTEIf attribute encryption is enabled, a secure connection is required for the encryptedattributes to be replicated.

4. Select the connection type. There are three options:

• Use LDAP. This sets either a standard, unencrypted connection or allows SASL encryption,since Directory Server supports SASL over standard LDAP but not SSL.

• Use TLS/SSL. This uses a secure connection over the server's secure LDAPS port, such as636. This setting is required to use TLS/SSL, but it cannot be set if the authentication will beperformed with SASL.

• Use Start TLS. This uses Start TLS to establish a secure connection over the server's standardport.

5. Select the appropriate authentication method and supply the required information. This givesthe information that the supplier uses to authenticate and bind to the consumer server to sendupdates.

• Simple means that the server connects over the standard port with no encryption. The onlyrequired information is the bind DN and password for the Replication Manager (which must existon the consumer server).

• Server TLS/SSL Certificate uses the supplier's SSL certificate to authenticate to the consumerserver. A certificate must be installed on the supplier for certificate-based authentication, and theconsumer server must have certificate mapping configured so that it can map the subject DN inthe supplier's certificate to its Replication Manager entry.

Configuring SSL and certificate mapping is described in Chapter 12, Managing SSL.

• SASL/DIGEST-MD5 requires the standard port to connect to the server. Like simpleauthentication, this requires only the bind DN and password to authenticate.

• SASL/GSSAPI also requires the standard LDAP connection because the Directory Server doesnot support using GSS-API over SSL/TLS.

The supplier server must have a Kerberos keytab (as in Section 13.1.4.2, “About the KDCServer and Keytabs”), and the consumer server must have a SASL mapping to map thesupplier's principal to the real replication manager entry (as in Section 13.2.1, “ConfiguringSASL Identity Mapping from the Console”).

6. Hit Next.

7. Fractional replication controls which entry attributes are replicated between servers. By default,all attributes are replicated. To select attributes that will not be replicated to the consumer, checkthe Enable Fractional Replication checkbox. Then, highlight the attribute (or attributes) in theIncluded column on the right, and click Remove. All attributes that will not be replicated arelisted in the Excluded column on the left, as well as in the summary the replication agreement iscomplete.

Page 392: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

372

8. Set the schedule for when replication runs. By default, replication runs continually.

Page 393: Red Hat Directory Server 5.1

Setting up the Replication Agreements

373

NOTEThe replication schedule cannot cross midnight (0000). So, it is possible to set aschedule that begins at 0001 and ends at 2359 on the same day, but it is not possibleto set one that begins at 2359 on one day and ends at 0001 on the next.

Hit Next.

9. Set when the consumer is initialized. Initializing a consumer manually copies all data over from thesupplier to the consumer. The default is to create an initialization file (an LDIF of all supplier data)so that the consumer can be initialized later. It is also possible to initialize the consumer as soonas the replication agreement is completed or not at all. For information on initializing consumers,see Section 8.10, “Initializing Consumers”. For multi-master replication, consider the following:

• Ensure one supplier has the complete set of data to replicate to the other suppliers. Use thisone supplier to initialize the replica on all other suppliers in the multi-master replication set.

• Initialize the replicas on the consumer servers from any of the multi-master suppliers.

• Do not try to reinitialize the servers when the replication agreements are set up. For example,do not initialize server1 from server2 if server2 has already been initialized from server1. In thiscase, select Do not initialize consumer.

Page 394: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

374

NOTEReplication will not begin until the consumer is initialized.

Hit Next.

10. The final screen shows the settings for the replication agreement, as it will be included in thedse.ldif file. Hit Done to save the agreement.

Page 395: Red Hat Directory Server 5.1

Setting up the Replication Agreements

375

The replication agreement is set up.

NOTEAt the end of this procedure, all supplier servers will have mutual replication agreements,which means that they can accept updates from each other.

NOTEAfter creating a replication agreement, the connection type (SSL or non-SSL) cannotbe changed because LDAP and LDAPS connections use different ports. To change theconnection type, re-create the replication agreement.

Page 396: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

376

8.5.4. Preventing Monopolization of the Consumer in Multi-MasterReplicationOne of the features of multi-master replication is that a supplier acquires exclusive access to theconsumer for the replicated area. During this time, other suppliers are locked out of direct contact withthe consumer. If a supplier attempts to acquire access while locked out, the consumer sends back abusy response, and the supplier sleeps for several seconds before making another attempt. Normally,this is all right; the supplier simply sends its update to another consumer while the first consumer islocked and then send updates when the first consumer is free again.

A problem can arise if the locking supplier is under a heavy update load or has a lot of pendingupdates in the changelog. If the locking supplier finishes sending updates and then has more pendingchanges to send, it will immediately attempt to reacquire the consumer and will most likely succeed,since the other suppliers usually will be sleeping. This can cause a single supplier to monopolize aconsumer for several hours or longer.

Two attributes address this issue, nsds5ReplicaBusyWaitTime andnsds5ReplicaSessionPauseTime.

• nsds5ReplicaBusyWaitTime. The nsds5ReplicaBusyWaitTime attribute sets the amount of timein seconds a supplier should wait after a consumer sends back a busy response before makinganother attempt to acquire access. The default is 3 seconds.

• nsds5ReplicaSessionPauseTime. The nsds5ReplicaSessionPauseTime attribute sets theamount of time in seconds a supplier should wait between update sessions. Set this interval sothat it is at least one second longer than the interval specified for nsds5ReplicaBusyWaitTime.Increase the interval as needed until there is an acceptable distribution of consumer access amongthe suppliers. The default is 0.

These two attributes may be present in the nsds5ReplicationAgreement object class,which is used to describe replication agreements. Set the attributes at any time by usingchangetype:modify with the replace operation. The change takes effect for the next updatesession if one is already in progress.

NOTEIf either attribute is set to a negative value, Directory Server sends the client a messageand an LDAP_UNWILLING_TO_PERFORM error code.

The two attributes are designed so that the nsds5ReplicaSessionPauseTime interval will alwaysbe at least one second longer than the interval specified for nsds5ReplicaBusyWaitTime. Thelonger interval gives waiting suppliers a better chance to gain consumer access before the previoussupplier can re-access the consumer.

• If either attribute is specified but not both, nsds5ReplicaSessionPauseTime is set automaticallyto 1 second more than nsds5ReplicaBusyWaitTime.

• If both attributes are specified, but nsds5ReplicaSessionPauseTime is less than or equal tonsds5ReplicaBusyWaitTime, nsds5ReplicaSessionPauseTime is set automatically to 1second more than nsds5ReplicaBusyWaitTime.

Page 397: Red Hat Directory Server 5.1

Configuring Cascading Replication

377

If Directory Server has to automatically reset the value of nsds5ReplicaSessionPauseTime,the value is changed internally only. The change is not visible to clients, and it not saved to theconfiguration file. From an external viewpoint, the attribute value appears as originally set.

Replica busy errors are not logged by default because they are usually benign. To see the errors,turn on the replication error logging, log level 8192. The log levels are described in more detail in theDirectory Server Configuration, Command, and File Reference.

8.6. Configuring Cascading ReplicationSetting up cascading replication, as shown in Figure 8.4, “Cascading Replication”, has three majorsteps, for each server in the scenario, the supplier on Server A, which holds a read-write replica; theconsumer/supplier on hub Server B, which holds a read-only replica; and the consumer on Server C,which holds a read-only replica:

• Section 8.6.1, “Configuring the Read-Write Replica on the Supplier Server”

• Section 8.6.2, “Configuring the Read-Only Replica on the Consumer Server”

• Section 8.6.3, “Configuring the Read-Only Replica on the Hub”

• Section 8.6.4, “Setting up the Replication Agreements”

8.6.1. Configuring the Read-Write Replica on the Supplier ServerNext, configure the supplier server, which holds the original copy of the database:

1. Specify the supplier settings for the server.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, select the Replication folder.

c. In the right-hand side of the window, select the Supplier Settings tab.

Page 398: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

378

d. Check the Enable Changelog checkbox.

This activates all of the fields in the pane below that were previously grayed out.

e. Specify a changelog by clicking the Use default button, or click the Browse button to displaya file selector.

f. Set the changelog parameters for the number and age of the log files.

Clear the unlimited checkboxes to specify different values.

g. Click Save.

2. Specify the replication settings required for a read-write replica.

a. In the navigation tree on the Configuration tab, expand the Replication node, and highlightthe database to replicate.

The Replica Settings tab opens in the right-hand side of the window.

b. Check the Enable Replica checkbox.

c. In the Replica Role section, select the Single Master radio button.

d. In the Common Settings section, specify a Replica ID, which is an integer between 1 and65534, inclusive.

The replica ID must be unique for a given suffix, different from any other ID used for read-writereplicas on this server and on other servers.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

Page 399: Red Hat Directory Server 5.1

Configuring the Read-Only Replica on the Consumer Server

379

The purge delay is how often the state information stored for the replicated entries is deleted.

f. Click Save.

After setting up the supplier replica, begin configuring the replication agreements.

8.6.2. Configuring the Read-Only Replica on the Consumer Server1. Create the database for the read-only replica if it does not exist. See Section 2.1.1, “Creating

Suffixes” for instructions on creating suffixes.

2. Create the entry for the supplier bind DN on the consumer server if it does not exist. The supplierbind DN is the special entry that the supplier will use to bind to the consumer. This is described inSection 8.3, “Creating the Supplier Bind DN Entry”.

3. Specify the replication settings required for a read-only replica.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, expand the Replication folder, and highlight the replica database.

The Replica Settings tab for that database opens in the right-hand side of the window.

c. Check the Enable Replica checkbox.

d. In the Replica Role section, select the Dedicated Consumer radio button.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

This option indicates how often the state information stored for the replicated entries ispurged.

f. In the Update Settings section, specify the bind DN that the supplier will use to bind to thereplica. Enter the supplier bind DN in the Enter a new Supplier DN field, and click Add. Thesupplier bind DN appears in the Current Supplier DNs list.

The supplier bind DN should be the entry created in step 2. The supplier bind DN is aprivileged user because it is not subject to access control in the replicated database.

Page 400: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

380

NOTEThere can be multiple supplier bind DNs per consumer but only one supplier DNper replication agreement.

g. Specify the URL for any supplier servers to which to refer updates.

By default, all updates are first referred to the supplier servers that are specified here. If nosuppliers are set here, updates are referred to the supplier servers that have a replicationagreement that includes the current replica.

In cascading replication, referrals are automatically sent to the hub server, which in turn refersthe request to the original supplier. Therefore, set a referral to the original supplier to replacethe automatically generated referral.

4. Click Save.

Repeat these steps for every consumer server in the replication configuration, then configure the hubreplica.

8.6.3. Configuring the Read-Only Replica on the HubDo this to set up a hub, which receives replication updates from the supplier and propagates them toconsumers:

1. Create the database for the read-only replica if it does not exist. See Section 2.1.1, “CreatingSuffixes” for instructions on creating suffixes.

2. Create the entry for the supplier bind DN on the consumer server if it does not exist. The supplierbind DN is the special entry that the supplier will use to bind to the consumer. This is described inSection 8.3, “Creating the Supplier Bind DN Entry”.

3. Create the changelog for the hub server.

The hub must maintain a changelog even though it does not accept update operations because itrecords the changes sent from the supplier server.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, select the Replication folder.

c. In the right-hand side of the window, select the Supplier Settings tab.

Page 401: Red Hat Directory Server 5.1

Configuring the Read-Only Replica on the Hub

381

d. Check the Enable Changelog checkbox.

This activates all of the fields in the pane below that were previously grayed out.

e. Specify a changelog by clicking the Use default button, or click the Browse button to displaya file selector.

f. Set the changelog parameters for the number and age of the log files.

Clear the unlimited checkboxes to specify different values.

g. Click Save.

4. Specify the required hub replica settings.

a. In the Directory Server Console, select the Configuration tab.

b. In the navigation tree, expand the Replication folder, and highlight the replica database.

Page 402: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

382

The Replica Settings tab for that database opens in the right-hand side of the window.

c. Check the Enable Replica checkbox.

d. In the Replica Role section, select the Hub radio button.

e. In the Common Settings section, specify a purge delay in the Purge delay field.

This option sets how often the state information stored for the replicated entries is purged.

Page 403: Red Hat Directory Server 5.1

Setting up the Replication Agreements

383

f. In the Update Settings section, specify the bind DN that the supplier will use to bind to thereplica. Enter the supplier bind DN in the Enter a new Supplier DN field, and click Add. Thesupplier bind DN appears in the Current Supplier DNs list.

The supplier bind DN should be the entry created in step 2. The supplier bind DN is aprivileged user because it is not subject to access control in the replicated database.

NOTEThere can be multiple supplier bind DNs per consumer but only one supplier DNper replication agreement.

g. Specify the URL for any supplier servers to which to refer updates.

By default, all updates are first referred to the supplier servers that are specified here. If nosuppliers are set here, updates are referred to the supplier servers that have a replicationagreement that includes the current replica.

Automatic referrals assume that clients bind over a regular connection; this has a URL in theform ldap://hostname:port. For clients to bind to the supplier using SSL, use this field tospecify a referral of the form ldaps://hostname:port, where the s in ldaps indicates asecure connection.

5. Click Save.

When all the hubs are configured, then configure the supplier replica.

8.6.4. Setting up the Replication AgreementsCascading replication requires two sets of replication agreements, the first between the supplier andthe hub and the second between the hub and the consumer. To set up the replication agreements:

Page 404: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

384

1. Create the replication agreement on the supplier for the hub, then use the supplier server toinitialize the replica on the hub server.

2. Then create the replication agreement on the hub for each consumer, and initialize the consumerreplicas from the hub.

To set up a replication agreement:

1. In the navigation tree of the Configuration tab, right-click the database to replicate, and selectNew Replication Agreement.

Alternatively, highlight the database, and select New Replication Agreement from the Objectmenu to start the Replication Agreement Wizard.

2. In the first screen, fill in a name and description for the replication agreement, and hit Next.

3. In the Source and Destination screen, fill in the URL for the consumer and the supplier bindDN and password on that consumer. If the target server is not available, hit in other to fill in theinformation manually.

Page 405: Red Hat Directory Server 5.1

Setting up the Replication Agreements

385

• Unless there is more than one instance of Directory Server configured, by default, there are noconsumers available in the drop-down menu.

• The port listed is the non-SSL port, even if the Directory Server instance is configured to runover SSL. This port number is used only for identification of the Directory Server instance in theConsole; it does not specify the actual port number or protocol that is used for replication.

• If SSL is enabled on the servers, it is possible to select the Using encrypted SSL connectionradio button for SSL client authentication. Otherwise, fill in the supplier bind DN and password.

Page 406: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

386

NOTEIf attribute encryption is enabled, a secure connection must be used for theencrypted attributes to be replicated.

4. Select the connection type. There are three options:

• Use LDAP. This sets either a standard, unencrypted connection or allows SASL encryption,since Directory Server supports SASL over standard LDAP but not SSL.

• Use TLS/SSL. This uses a secure connection over the server's secure LDAPS port, such as636. This setting is required to use TLS/SSL, but it cannot be set if the authentication will beperformed with SASL.

• Use Start TLS. This uses Start TLS to establish a secure connection over the server's standardport.

5. Select the appropriate authentication method and supply the required information. This givesthe information that the supplier uses to authenticate and bind to the consumer server to sendupdates.

• Simple means that the server connects over the standard port with no encryption. The onlyrequired information is the bind DN and password for the Replication Manager (which must existon the consumer server).

• Server TLS/SSL Certificate uses the supplier's SSL certificate to authenticate to the consumerserver. A certificate must be installed on the supplier for certificate-based authentication, and theconsumer server must have certificate mapping configured so that it can map the subject DN inthe supplier's certificate to its Replication Manager entry.

Configuring SSL and certificate mapping is described in Chapter 12, Managing SSL.

• SASL/DIGEST-MD5 requires the standard port to connect to the server. Like simpleauthentication, this requires only the bind DN and password to authenticate.

• SASL/GSSAPI also requires the standard LDAP connection because the Directory Server doesnot support using GSS-API over SSL/TLS.

The supplier server must have a Kerberos keytab (as in Section 13.1.4.2, “About the KDCServer and Keytabs”), and the consumer server must have a SASL mapping to map thesupplier's principal to the real replication manager entry (as in Section 13.2.1, “ConfiguringSASL Identity Mapping from the Console”).

6. Hit Next.

7. Fractional replication controls which entry attributes are replicated between servers. By default,all attributes are replicated. To select attributes that will not be replicated to the consumer, checkthe Enable Fractional Replication checkbox. Then, highlight the attribute (or attributes) in theIncluded column on the right, and click Remove. All attributes that will not be replicated arelisted in the Excluded column on the left, as well as in the summary the replication agreement iscomplete.

Page 407: Red Hat Directory Server 5.1

Setting up the Replication Agreements

387

8. Set the schedule for when replication runs. By default, replication runs continually.

Page 408: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

388

NOTEThe replication schedule cannot cross midnight (0000). So, it is possible to set aschedule that begins at 0001 and ends at 2359 on the same day, but it is not possibleto set one that begins at 2359 on one day and ends at 0001 on the next.

Hit Next.

9. Set when the consumer is initialized. Initializing a consumer manually copies all data over from thesupplier to the consumer. The default is to create an initialization file (an LDIF of all supplier data)so that the consumer can be initialized later. It is also possible to initialize the consumer as soonas the replication agreement is completed or not at all. For information on initializing consumers,see Section 8.10, “Initializing Consumers”. For cascading replication, consider the following:

• Create the supplier-hub replication agreement on the supplier first, and initialize the hub fromthe supplier.

• Create the hub-consumer replication agreements on the hub, and initialize the consumers fromthe hub.

Page 409: Red Hat Directory Server 5.1

Setting up the Replication Agreements

389

NOTEReplication will not begin until the consumer is initialized.

Hit Next.

10. The final screen shows the settings for the replication agreement, as it will be included in thedse.ldif file. Hit Done to save the agreement.

Page 410: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

390

NOTEAfter creating a replication agreement, the connection type (SSL or non-SSL) cannotbe change because LDAP and LDAPS connections use different ports. To change theconnection type, re-create the replication agreement.

8.7. Configuring Replication from the Command LineReplication can be configured on the command line by creating the appropriate replica and agreemententries on the servers. The process follows the same order as setting up replication through theDirectory Server Console:

1. Create the supplier bind DN on every consumer, hub, and multi-master supplier (Section 8.3,“Creating the Supplier Bind DN Entry”).

2. If the corresponding database and suffix do not exist on one of the replicas, create it(Section 2.1.1, “Creating Suffixes”).

Page 411: Red Hat Directory Server 5.1

Configuring Suppliers from the Command Line

391

3. Configure the supplier replicas (Section 8.7.1, “Configuring Suppliers from the Command Line”).

4. Configure consumers (Section 8.7.2, “Configuring Consumers from the Command Line”).

5. Configure hubs for cascading replication (Section 8.7.3, “Configuring Hubs from the CommandLine”).

6. Create the replication agreements (Section 8.7.4, “Configuring Replication Agreements fromthe Command Line”). For cascading replication, create the agreement between the supplier andhub, then between the hub and consumers; for multi-master, create the agreements between allsuppliers, then between the suppliers and consumers.

7. Lastly, initialize all of the consumers (Section 8.7.5, “Initializing Consumers Online from theCommand Line”), if the consumers were not initialized when the replication agreement wascreated.

8.7.1. Configuring Suppliers from the Command LineThere are two steps to setting up the supplier replica. First, the changelog must be enabled, whichallows the supplier to track changes to the Directory Server. Then, the supplier replica is created.

1. On the supplier server, use ldapmodify to create the changelog1 entry.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h supplier1.example.com -v

dn: cn=changelog5,cn=configchangetype: addobjectclass: topobjectclass: extensibleObjectcn: changelog5nsslapd-changelogdir: /var/lib/dirsrv/slapd-instance_name/changelogdbnsslapd-changelogmaxage: 10d

Example 8.2. Example Changelog Entry

There are two important attributes with the changelog.

• nsslapd-changelogdir sets the directory where the changelog is kept.

• nsslapd-changelogmaxage sets how long the changelog is kept; since the changelog canget very large, this helps trim the changelog to prevent affecting server performance and usingup disk space. If this parameter is not set, the default is for the changelog to be kept forever.

The changelog entry attributes are described in Table 8.1, “Changelog Attributes”. These attributesare described in more detail in the Directory Server Configuration, Command, and File Reference.

2. Create the supplier replica.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h supplier1.example.com -v

dn: cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsds5replicaobjectclass: extensibleObject

Page 412: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

392

cn: replicansds5replicaroot: dc=example,dc=comnsds5replicaid: 7nsds5replicatype: 3nsds5flags: 1nsds5ReplicaPurgeDelay: 604800nsds5ReplicaBindDN: cn=replication manager,cn=config

Example 8.3. Example Supplier Replica Entry

• nsds5replicaroot sets the subtree (suffix) which is being replicated.

• nsds5replicatype sets what kind of replica this database is. For either a single master or a multi-master supplier, this value must be 3.

• nsds5replicaid sets the replica ID. The value must be unique among all suppliers and hubs; thevalid range is 1 to 65534.

• nsds5ReplicaPurgeDelay sets how long an entry holds its status information or how long atombstone entry is kept before deleting the information. The default value is 604800 (oneweek).

• nsds5flags sets whether the replica writes to the changelog. For a supplier, this value must be 1.

The replica entry attributes are described in Table 8.2, “Replica Attributes”.

After creating every supplier which will take part in the replication setup, then begin creating thereplication agreements.

Object Class or Attribute Description Values

objectclass: top Required object class for everyentry.

objectclass: extensibleObject An object class which allowsany other object class orattribute to be added to anentry.

cn: changelog5 The naming attribute for thechangelog entry.

Any string; the default usageis to set the common name tochangelog5.

nsslapd-changelogdir: directory Sets the file and directorychangelog, to which theDirectory Server writeschanges.

Any directory; the defaultis /var/lib/dirsrv/slapd-instance_name/changelogdb.

nsslapd-changelogmaxage:number unit

Sets how long the changelogkeeps an entry beforepurging it. This is notused by consumers, butis recommended for hubsand suppliers, which keepchangelogs.

The number is any integer.

The unit can be s for seconds,m for minutes, h for hours, d fordays, or w for weeks.

Table 8.1. Changelog Attributes

Page 413: Red Hat Directory Server 5.1

Configuring Suppliers from the Command Line

393

Object Class or Attribute Description Values

objectclass: top Required object class for everyentry.

objectclass: extensibleObject An object class which allowsany other object class orattribute to be added to anentry.

objectclass: nsds5replica An object class which allowsreplication attributes to beadded to an entry.

cn: replica The naming attribute for thereplica.

Any string; the default usageis to set the common name toreplica for every configuredreplica.

nsds5replicaroot: suffix Sets which subtree isreplicated.

A root suffix associated witha database, since the entiredatabase is replicated. Forexample:

dc=example,dc=com

nsds5replicaid: number The ID of the replica. Thismust not be set for consumersor hubs, but is required forsuppliers.

1 to 65534, inclusive.

nsds5replicatype: number Sets the type of replica, eitherread-only or read-write.

2 for consumers and hubs(read-only replicas)3 for both single and multi-master suppliers (read-writereplicas)

nsds5flags: number Sets whether the replica writesto the changelog.

0 means the replica does notwrite to the changelog; this isthe default for consumers.1 means the relics writes to thechangelog; this is the defaultfor hubs and suppliers.

nsds5ReplicaPurgeDelay:number

Sets the period of time inseconds to wait beforepurging the state informationfrom an entry or purgingtombstone entries. This settingis required for all types ofreplicas — suppliers, hubs, andconsumers.

0 (keep forever) to2147483647 (the maximum32-bit integer); the default valueis 604800, one week.

nsds5ReplicaBindDN: DN The supplier bind DN usedby the supplier to bind to theconsumer. This is required forconsumers, hubs, and multi-

Any DN; the recommendedDN is cn=ReplicationManager,cn=config.

Page 414: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

394

Object Class or Attribute Description Valuesmaster suppliers, but not forsingle-master suppliers. NOTE

For security,it is stronglyrecommended thatyou do not use theDirectory Manageras the supplier bindDN.

nsds5replicareferral: URL Optional. An LDAP URL whicha consumer or hub to which aconsumer or hub can forwardupdate requests. By default,update requests are sent to themasters for the consumer; usethis parameter to override thedefault.

Any LDAP URL. For example:

nsds5replicareferral: ldap://supplier1.example.com:389

.

Table 8.2. Replica Attributes

8.7.2. Configuring Consumers from the Command LineOn the consumer host, such as consumer1.example.com, create the replica entry. This entryidentifies the database and suffix as participating in replication and sets what kind of replica thedatabase is. There are four key attributes:

• nsds5replicaroot sets the subtree (suffix) which is being replicated.

• nsds5replicatype sets what kind of replica this database is. For a consumer, this value must be 2.

• nsds5ReplicaBindDN give the DN as which the supplier will bind to the consumer to make changes.

• nsds5flags sets whether the replica writes to the changelog. For a consumer, this value must be 0.

This ldapmodify creates a new consumer replica on the consumer1.example.com host for thedc=example,dc=com subtree.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h consumer1.example.com -v

dn: cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsds5replicaobjectclass: extensibleObjectcn: replicansds5replicaroot: dc=example,dc=comnsds5replicatype: 2nsds5ReplicaBindDN: cn=replication manager,cn=confignsds5flags: 0

The replica entry attributes are described in Table 8.2, “Replica Attributes”. These attributes aredescribed in more detail in the Directory Server Configuration, Command, and File Reference.

Page 415: Red Hat Directory Server 5.1

Configuring Hubs from the Command Line

395

8.7.3. Configuring Hubs from the Command LineHubs are intermediate read-only replicas which receive updates from suppliers and pass them on toother consumers. These are part of the cascading replication scenario, described in Section 8.2.3,“Cascading Replication”.Creating the hub has two steps: first, creating the changelog database sincethe hub keeps a record of changes sent by the supplier, and second, configuring the hub replica.

1. On the hub server, such as hub1.example.com, use ldapmodify to create the changelog1

entry.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h hub1.example.com -v

dn: cn=changelog5,cn=configchangetype: addobjectclass: topobjectclass: extensibleObjectcn: changelog5nsslapd-changelogdir: /var/lib/dirsrv/slapd-instance_name/changelogdb

There is one important attribute with the changelog, nsslapd-changelogdir, which sets thedirectory where the changelog is kept.

The changelog entry attributes are described in Table 8.1, “Changelog Attributes”. These attributesare described in more detail in the Directory Server Configuration, Command, and File Reference.

2. On the hub host, create the replica entry. This ldapmodify command creates a new hub replicaon the hub1.example.com host for the dc=example,dc=com subtree.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h hub1.example.com -v

dn: cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsds5replicaobjectclass: extensibleObjectcn: replicansds5replicaroot: dc=example,dc=comnsds5replicatype: 2nsds5ReplicaPurgeDelay: 604800nsds5ReplicaBindDN: cn=replication manager,cn=confignsds5flags: 1

This entry identifies the database and suffix as participating in replication and sets what kind ofreplica the database is. There are five key attributes:

• nsds5replicaroot sets the subtree (suffix) which is being replicated.

• nsds5replicatype sets what kind of replica this database is. For a hub, this value must be 2.

• nsds5ReplicaPurgeDelay sets how long an entry holds its status information or how long atombstone entry is kept before deleting the information. The default value is 604800 (oneweek).

• nsds5ReplicaBindDN give the DN as which the supplier will bind to the hub to make changes.

• nsds5flags sets whether the replica writes to the changelog. For a hub, this value must be 1.

Page 416: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

396

The replica entry attributes are described in Table 8.2, “Replica Attributes”. These attributes aredescribed in more detail in the Directory Server Configuration, Command, and File Reference.

8.7.4. Configuring Replication Agreements from the Command LineWhen setting up replication agreements, first set them up between all suppliers, then between thesuppliers and the hubs, and last between the hub and the consumers.

The replication agreement has to define seven things:

• The consumer host (nsds5replicahost) and port (nsds5replicaport).

• The DN for the supplier to use to bind with the consumer (nsds5ReplicaBindDN), theway that the supplier binds (nsds5replicabindmethod), and any credentials required(nsds5replicabindcredentials).

• The subtree being replicated (nsds5replicaroot).

• The replication schedule (nsds5replicaupdateschedule).

• Any attributes which will not be replicated (nsds5replicatedattributelist).

Use ldapmodify to add a replication agreement to every supplier for every consumer which it willupdated. For example:

dn: cn=ExampleAgreement,cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsds5replicationagreementcn: ExampleAgreementnsds5replicahost: consumer1nsds5replicaport: 389nsds5ReplicaBindDN: cn=replication managernsds5replicabindmethod: SIMPLEnsds5replicaroot: dc=example,dc=comdescription: agreement between supplier1 and consumer1nsds5replicaupdateschedule: 0000-0500 1nsds5replicatedattributelist: (objectclass=*) $ EXCLUDE authorityRevocationListnsds5replicacredentials: secretnsds5BeginReplicaRefresh: start

Example 8.4. Example Replication Agreement Entry

The replication agreement attributes are listed in Table 8.3, “Replication Agreement Attributes”. Theseattributes are described in more detail in the Directory Server Configuration, Command, and FileReference.

After creating every replication agreement, begin initializing consumers.

Object Class or Attribute Description Values

objectclass: top Required object class for everyentry.

objectclass:nsds5replicationagreement

An operational object classwhich contains the replicationagreement attributes.

Page 417: Red Hat Directory Server 5.1

Configuring Replication Agreements from the Command Line

397

Object Class or Attribute Description Values

cn: agreement_name The naming attribute for thereplication agreement.

Any string.

nsds5replicahost: hostname Gives the hostname of theconsumer server; the hostnamecan be the fully qualified hostand domain name. If TLS/SSLis enabled, the fully-qualifieddomain name is required.

Any hostname. For example:

nsds5replicahost: consumer1

nsds5replicaport: number Gives the LDAP port for theconsumer server.

To use TLS/SSL, give thesecure port number (636by default) and set thensds5ReplicaTransportInfoattribute to SSL.

To use Start TLS, whichinitiates a secure connectionover a standard port, use thestandard port, 389, with thensds5ReplicaTransportInfoattribute to TLS.

To use simple authenticationor SASL, use the standardport, 389, with thensds5ReplicaTransportInfoattribute to LDAP.

Any port number.

nsds5replicatransportinfo:method

To use TLS/SSL, set thisparameter to SSL.

To use Start TLS, whichinitiates a secure connectionover a standard port, set thisparameter to TLS.

To use simple authenticationor SASL, set this parameter toLDAP.

empty or LDAP (standardconnection over port 389)SSL (secure connection overthe secure port, such as 636)TLS (secure connection overthe standard port, 389, usingStart TLS)

nsds5ReplicaBindDN: DN The supplier bind DN usedby the supplier to bind to theconsumer. This is required forconsumers, hubs, and multi-master suppliers, but not forsingle-master suppliers.

Any DN; the recommendedDN is cn=ReplicationManager,cn=config.

nsds5replicabindmethod: type The connection type forreplication between theservers. The connection type

SIMPLESSLCLIENTAUTHSASL/GSSAPI

Page 418: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

398

Object Class or Attribute Description Valuesdefines how the supplierauthenticates to the consumer.

Leaving the bind methodempty or setting it to SIMPLEmeans that the serveruses basic password-based authentication.This requires thensds5ReplicaBindDN andnsds5ReplicaCredentialsattributes to give the bindinformation.

The SSLCLIENTAUTH optionuses a secure connection.This requires setting thensds5ReplicaTransportInfoattribute be set to SSL orTLS. For certificate-basedauthentication, the consumerserver must also have acertificate mapping to map thesubject DN in the supplier'scertificate to the replicationmanager entry.

Using SASL/GSSAPIrequires that thensds5ReplicaTransportInfoattribute is set to LDAP;Directory Server does notsupport using GSS-API overSSL/TLS. The supplier servermust have a Kerberos keytab(as in Section 13.1.4.2, “Aboutthe KDC Server and Keytabs”),and the consumer servermust have a SASL mapping tomap the supplier's principal tothe real replication managerentry (as in Section 13.2.1,“Configuring SASL IdentityMapping from the Console”).

The SASL/DIGEST-MD5 setting, like SIMPLE,uses password-basedauthentication and requires thensds5ReplicaBindDN andnsds5ReplicaCredentials

SASL/DIGEST-MD5

Page 419: Red Hat Directory Server 5.1

Configuring Replication Agreements from the Command Line

399

Object Class or Attribute Description Valuesattributes to give the bindinformation.

nsds5replicabindcredentials:hash

Only for simple authentication.Stores the hashed passwordused with the bind DN given forsimple authentication.

nsds5replicaroot: suffix Sets which subtree isreplicated.

A root suffix associated witha database, since the entiredatabase is replicated. Forexample:

dc=example,dc=com

description: text A text description of thereplication agreement.

Any text string. It is advisable tomake this a useful description,such as agreement betweensupplier1 and consumer1.

nsds5replicatedattributelist:'(objectclass=*)' $ EXCLUDEattributes

Optional. Sets which attributeswill not be replicated.The filter must be set to"(objectclass=*)", and thelist of attributes are separatedby a single space.

'(objectclass=*)' $ EXCLUDE userPassword manager cn

nsds5replicaupdateschedule:start_time end_time days

Sets the start and end time forthe replication updates andthe days on which replicationoccurs. If the schedule isomitted, replication will takeplace all the time.

The replication schedulecannot cross midnight (0000).So, it is possible to set aschedule that begins at 0001and ends at 2359 on the sameday, but it is not possible to setone that begins at 2359 on oneday and ends at 0001 on thenext.

Has the following value, withthe start (SSSS) and end(EEEE) times set in the formHHMM

The times are given in 24hour clock format, so 0000 ismidnight and 2359 is 11:59 PM.For example, the setting 10301630 schedules replicationfrom 10:30 AM to 4:30 PM.The times cannot wrap aroundmidnight, so the setting 23000100 is not valid.

The days ranging from 0(Sunday) to 6 (Saturday).Setting 06 schedulesreplication on Sunday andSaturday, while 135 schedulesreplication on Monday,Wednesday, and Friday.

nsds5replicaupdateschedule: SSSS EEEE DDDDDDD

Page 420: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

400

Object Class or Attribute Description ValuesFor example, this schedulesreplication between midnight(0000) and 5am (0500) onMonday and Tuesday:

nsds5replicaupdateschedule: 0000 0500 12

nsds5BeginReplicaRefresh:start

Optional. Performs an online(immediate) initialization ofthe consumer. If this is set,the attribute is only presentas long as the consumer isbeing initialized; when theinitialization is complete,the attribute is deletedautomatically.

If this is not set, then consumerinitialization must be performedmanually.

start

To initialize the consumer, thisattribute must have a valueof start; any other value isignored.

Table 8.3. Replication Agreement Attributes

8.7.5. Initializing Consumers Online from the Command LineAn online initialization can be initiated from the command line by adding the nsds5replicarefreshattribute to the replication agreement entry. If the attribute is included when the replication agreementis created, initialization begins immediately. It can be added later to initialize the consumer at any time.This attribute is absent by default, and it will be automatically deleted once the consumer initializationis complete.

1. Find the DN of the replication agreement on the supplier server that is for the consumer to beinitialized. For example:

ldapsearch -h supplier1.example.com -p 389 -D "cn=directory manager" -w secret -s sub -b cn=config "(objectclass=nsds5ReplicationAgreement)"

This command returns all of the replication agreements configured on the supplier in LDIF format.Get the DN of the replication agreement with the consumer to be initialized. This is the replicationagreement which will be edited.

2. Edit the replication agreement, and add the nsds5BeginReplicaRefresh attribute:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h supplier1.example.com

dn: cn=ExampleAgreement,cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: modifyreplace: nsds5BeginReplicaRefreshnsds5BeginReplicaRefresh: start

Page 421: Red Hat Directory Server 5.1

Making a Replica Updatable

401

ldapmodify does not prompt for input; simply type in the LDIF statement, and then hit entertwice when the LDIF statement is complete. Close the ldapmodify utility by hitting Ctrl+C.

When the initialization is complete, the nsds5BeginReplicaRefresh attribute is automaticallydeleted from the replication agreement entry.

NOTEInitializing consumers from the command line is also explained in Section 8.10.3,“Initializing Consumers Online Using the Command Line”. Manually initializing consumersis explained in Section 8.10.4, “Manual Consumer Initialization Using the Command Line”.The replication monitoring attributes are described in more detail in the Directory ServerConfiguration, Command, and File Reference.

To keep data integrity, initialize the consumer databases from the appropriate supplier. Depending onthe replication scenario, this can be more difficult in mixed replication environments, but, even whenmanually initializing consumers, consider four things:

• Use one supplier, a data master, as the source for initializing consumers.

• Do not reinitialize a data master when the replication agreements are created. For example, do notinitialize server1 from server2 if server2 has already been initialized from server1.

• For a multi-master scenario, initialize all of the other master servers in the configuration from onemaster.

• For cascading replication, initialize all of the hubs from a supplier, then initialize the consumers fromthe hubs.

8.8. Making a Replica UpdatableMaking a read-only server writable means changing the replica from a dedicated consumer or a hub toa supplier.

1. Make sure there are no updates in progress.

2. Stop the supplier server.

3. Open the Directory Server Console for the read-only replica.

4. In the Configuration tab, select Replication. In the right pane, select the Enable changelogcheckbox.

5. Select the suffix, and, in the Replica Settings tab, change the replica role to a single master ormulti-master, and assign a unique replica ID.

6. Save the changes, and restart the server.

8.9. Deleting the ChangelogThe changelog is a record of all modifications on a given replica that the supplier uses to replay thesemodifications to replicas on consumer servers (or suppliers in the case of multi-master replication).

Page 422: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

402

If a supplier server goes offline, it is important to be able to delete the changelog because it no longerholds a true record of all modifications and, as a result, should not be used as a basis for replication. Achangelog can be effectively deleted by deleting the log file or by moving it to a new location.

After deleting the changelog, reinitialize the consumers and begin the replication process afresh.

• Section 8.9.1, “Removing the Changelog”

• Section 8.9.2, “Moving the Changelog to a New Location”

8.9.1. Removing the ChangelogTo remove the changelog from the supplier server:

1. In the Directory Server Console, select the Configuration tab.

2. Select the Replication Agreements folder in the left navigation tree and then the SupplierServer Settings tab in the right pane.

3. Clear the Enable Changelog checkbox.

4. Click Save.

5. Restart the Directory Server.

6. Reinitialize the consumers, as in Section 8.10, “Initializing Consumers”.

NOTEIf the changelog is removed, the consumer servers must be reinitialized.

8.9.2. Moving the Changelog to a New LocationSometimes, it may be necessary to delete the changelog while the supplier server is still running andcontinuing to log changes.

In this case, simply move the current changelog file to a new location. The server then automaticallycreates a new changelog in the specified directory.

After moving the changing, reinitialize the consumers; any changes to the changelog requiresconsumer reinitialization.

8.10. Initializing ConsumersOnce a replication agreement is created, the consumer must be initialized; that is, the data must bephysically copied from the supplier server to the consumer servers.

NOTEReplication will not begin until the consumer is initialized.

Page 423: Red Hat Directory Server 5.1

When to Initialize a Consumer

403

• Section 8.10.1, “When to Initialize a Consumer”

• Section 8.10.2, “Online Consumer Initialization Using the Console”

• Section 8.10.3, “Initializing Consumers Online Using the Command Line”

• Section 8.10.4, “Manual Consumer Initialization Using the Command Line”

• Section 8.10.5, “Filesystem Replica Initialization”

8.10.1. When to Initialize a ConsumerConsumer initialization involves copying data from the supplier server to the consumer server. Oncethe subtree has been physically placed on the consumer, the supplier server can begin replayingupdate operations to the consumer server.

Under normal operations, the consumer should not ever have to be reinitialized. However, any timethere is a chance that there is a big discrepancy between the supplier's data and the consumer's,reinitialize the consumer. For example, if the data on the supplier server is restored from backup, thenall consumers supplied by that server should be reinitialize. As another example, if the supplier hasnot been able to contact the consumer for a long time, like a week, the supplier may determine that theconsumer is too far out of date to be updated, and must be reinitialized.

The consumer can either be initialized online using the Console or manually using the command line.Online consumer initialization using the Console is an effective method of initializing a small numberof consumers. However, since each replica is initialized in sequence, this method is not suited toinitializing a large number of replicas. Online consumer initialization is the method to use when theconsumer is initialized as part of configuring the replication agreement on the supplier server.

Manual consumer initialization using the command line is a more effective method of initializing a largenumber of consumers from a single LDIF file.

8.10.2. Online Consumer Initialization Using the ConsoleOnline consumer initialization using the Console is the easiest way to initialize or reinitialize aconsumer. However, for replicating across a slow link, this process can be very time-consuming, andmanual consumer initialization using the command line may be a more efficient approach. This isdescribed in more detail Section 8.10.4, “Manual Consumer Initialization Using the Command Line”.

NOTEWhen a consumer server is being initialized using the online consumer creation method,all operations (including searches) on the replica are referred to the supplier server untilthe initialization process is completed.

To initialize or reinitialize a consumer online:

1. Create a replication agreement.

2. On the supplier server, on the Directory Server Console, select the Configuration tab.

3. Expand the Replication folder, then expand the replicated database. Right-click the replicationagreement, and choose Initialize Consumer from the pop-up menu.

Page 424: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

404

A message opens warning that any information already stored in the replica on the consumer willbe removed.

4. Click Yes in the confirmation box.

Online consumer initialization begins immediately. To check the status of the online consumerinitialization, open the Summary tab in the Status box. If online consumer initialization is in progress,the status shows that a replica is being initialized.

To update this window, right-click the replicated database icon in the navigation tree, and chooseRefresh Replication Agreements. When online consumer initialization finishes, the status changesto reflect this.

For more information about monitoring replication and initialization status, see Section 8.18,“Monitoring Replication Status”.

8.10.3. Initializing Consumers Online Using the Command LineOnline consumer initialization can be performed through the command line by adding thensds5BeginReplicaRefresh attribute to the replication agreement entry. This attribute is absent bydefault, and it will be automatically deleted once the consumer initialization is complete.

1. Find the DN of the replication agreement on the supplier server that is for the consumer to beinitialized. For example:

ldapsearch -h supplier1.example.com -p 389 -D "cn=directory manager" -w secret -s sub -b cn=config "(objectclass=nsds5ReplicationAgreement)"

This command returns all of the replication agreements configured on the supplier in LDIF format.Get the DN of the replication agreement with the consumer to be initialized. This is the replicationagreement which will be edited.

2. Edit the replication agreement, and add the nsds5BeginReplicaRefresh attribute:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h supplier1.example.com

dn: cn=ExampleAgreement,cn=replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: modifyreplace: nsds5BeginReplicaRefreshnsds5BeginReplicaRefresh: start

ldapmodify does not prompt for input; simply type in the LDIF statement, and then hit entertwice when the LDIF statement is complete. Close the ldapmodify utility by hitting Ctrl+C.

To check the initialization status, do an ldapsearch for the replication agreement entry.

ldapsearch -h hostname -p port -D "cn=directory manager" -w secret -s base -b 'cn=ExampleAgreement,cn="dc=example,dc=com", cn=mapping tree, cn=config' '(objectclass=*)'

If the nsds5BeginReplicaRefresh attribute is present, the initialization is still in progress. If theinitialization is complete, then the attribute nsds5ReplicaLastInitStatus shows the status. Ifthe initialization was successful, the value of nsds5ReplicaLastInitStatus is Total update

Page 425: Red Hat Directory Server 5.1

Manual Consumer Initialization Using the Command Line

405

succeeded. If the initialization was not successful, this attribute shows information about the error;check the error logs for both the supplier and consumer for additional information.

The replication monitoring attributes are described in more detail in the Directory Server Configuration,Command, and File Reference.

8.10.4. Manual Consumer Initialization Using the Command LineManual consumer initialization using the command line is the fastest method of consumer initializationfor sites that are replicating very large numbers of entries. However, the manual consumer initializationprocess is more complex than the online consumer initialization process. Red Hat suggests using themanual process whenever the online process is inappropriate due to performance concerns.

Initializing or reinitializing a server manually has three steps:

1. Create a replication agreement.

2. Export the replica on the supplier server to an LDIF file.

See Section 8.10.4.1, “Exporting a Replica to LDIF”.

3. Import the LDIF file with the supplier replica contents to the consumer server.

See Section 8.10.4.2, “Importing the LDIF File to the Consumer Server”.

8.10.4.1. Exporting a Replica to LDIFThere are three ways to convert a replica database to LDIF:

• When creating a replication agreement, by selecting Create consumer initialization file in theInitialize Consumer dialog box of the Replication Agreement Wizard.

• From the Directory Server Console, by right-clicking the replication agreement under theReplication folder and choosing Create LDIF File from the pop-up menu.

• From the command line by using the export command, as described in Section 4.2.3, “Exporting toLDIF from the Command Line”. Exporting to LDIF with any of the command-line tools requires usingan option to export the database as a replica; this means that the exported LDIF contains the properentries to initialize the consumer when the LDIF is imported.

For the db2ldif and db2ldif.pl scripts, this is the -r option. For example:

db2ldif -r -n database1 -a /export/output.ldif

For the cn=export, cn=tasks, cn=config entry, this is the nsExportReplica attribute.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example export, cn=export, cn=tasks, cn=config objectclass: extensibleObject cn: example export nsInstance: userRoot nsFilename: /home/files/example.ldif nsExportReplica: true

Page 426: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

406

8.10.4.2. Importing the LDIF File to the Consumer ServerImport the LDIF file which contains the supplier replica contents to the consumer server by using theimport features in the Directory Server Console or by using either the ldif2db script or ldif2db.plscript. Both import methods are described in Section 4.1.4, “Importing from the Command Line”.

NOTEWith the ldif2db.pl script, the LDIF file import operation does not require a server restart.For more information on command-line scripts, see the Directory Server Configuration,Command, and File Reference.

8.10.5. Filesystem Replica InitializationA very large database, such as one with several million entries, can take an hour or more to initializea consumer from the Console or even with manual initialization. To save time, use filesystem replicainitialization.

Directory Server has the capability to initialize a replica using the database files from the supplierserver. This avoids the need to rebuild the consumer database and can be done at essentially thespeed of the network between the two servers by transferring the files with FTP or NFS, for example.Instead of sending entries via LDAP to replica servers, filesystem replica initialization populates thenew database on the destination server by backing up the supplier database on one server andrestoring the database on the destination server.

This method of initializing consumers is especially useful in replication over wide-area networks orover networks with slow or unstable connections.

For smaller databases, Red Hat recommends using manual initialization or initialize consumers fromthe Console.

NOTEThe destination server must have the same architecture and the same bit size as thesupplier server for the initialization to succeed. For example, Red Hat Enterprise Linux 5(32-bit) to Red Hat Enterprise Linux 5 (32-bit).

8.10.5.1. Initializing the Consumer Replica from the Backup Files1. Create a new database on the destination server to match the database from the source server.

Before initializing the consumer from the backup files, be certain that the appropriate database hasbeen created on the destination server so that the database exists to be restored and initialized.

2. Enable replication on the backend as a dedicated consumer.

3. If there is already a replication agreement to that host and port, then replication should resumeimmediately after running the restore script. Otherwise, create the replication agreement on thesource server (or whatever server is the supplier), and select the Do not initialize consumers atthis time radio button.

4. Stop the source Directory Server if it is running. For example:

Page 427: Red Hat Directory Server 5.1

Forcing Replication Updates

407

service dirsrv stop slapd-example

5. From the command line, run the db2bak utility, and archive the current directory installation.

/etc/dirsrv/slapd-instance_name/db2bak

In addition, a new backup can be created by hitting the Back Up Directory Server button in theTasks tab of the Directory Server Console and then putting the name of the archive directory inthe Directory:... field. Alternatively, select any previous back-up to initialize the consumer.

This backup information is recovered in the destination replica.

6. Restart the source Directory Server. For example:

service dirsrv start slapd-example

7. Copy the archived files to a directory on the destination server, such as archiveDirectory.

8. Stop the destination Directory Server if it is running.

service dirsrv stop slapd-example2

9. On the destination server, restore the archives with the bak2db script, using the optional -nparameter to specify the backend instance name. This -n parameter is similar to the -n used withldif2db and db2ldif. For example:

/usr/lib/dirsrv/slapd-example2/bak2db /tmp/archiveDirectory -n userRoot

10. Restart the destination Directory Server. For example:

service dirsrv start slapd-example2

Replication will begin on schedule as soon as the destination server is restarted.

For more information on using these scripts, see the Directory Server Configuration, Command, andFile Reference.

8.11. Forcing Replication UpdatesWhen a Directory Server involved in replication is stopped for regular maintenance, it must be updatedimmediately when it comes back online. In the case of a supplier in a multi-master environment, thedirectory information needs to be updated by the other supplier in the multi-master set. In other cases,when a hub or a dedicated consumer is taken offline for maintenance, when they come back online,they need to be updated by the supplier server.

Even if the replication agreements are configured to keep the supplier and consumer servers alwaysin sync, it is not sufficient to bring back up-to-date a server that has been offline for over five minutes.The Always Keep in Sync option means that the server generates a replication operation for everyupdate operation it processes. However, if this replication operation cannot be performed because theconsumer is offline, the operation times out after 10 minutes.

Page 428: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

408

NOTEThe procedures described in this section can only be used when replication is already setup and consumers have been initialized.

To ensure that directory information will be synchronized immediately when a server comes backonline, use either the Directory Server Console on the supplier server that holds the reference copy ofthe directory information or a customizable script.

8.11.1. Forcing Replication Updates from the ConsoleTo ensure that replication updates are sent immediately when a consumer or a supplier in a multi-master replication configuration comes back online after a period of time, do the following on thesupplier server that holds the most recent version of the directory information:

1. In the Directory Server Console, click the Configuration tab, expand the Replication folder anddatabase nodes, and select the replication agreement corresponding to the replica to update.

2. Right click the replication agreement, and choose Send Updates Now from the drop-down list.

This initiates replication toward the server that holds the information that needs to be updated.

8.11.2. Forcing Replication Updates from the Command LineFrom the consumer that requires updating, run a script that prompts the supplier to send replicationupdates immediately. This script is shown in Example 8.5, “Replicate_Now Script Example”.

Copy this example script and name it something like replicate_now.sh. Substitute the actualvalues for the variables listed in Example 8.5, “Replicate_Now Script Example”.

NOTEThis script must be run manually since it cannot be configured to run automatically assoon as the server, which was offline, comes back online again.

#!/bin/shSUP_HOST=supplier_hostnameSUP_PORT=supplier_portnumberSUP_MGRDN=supplier_directoryManagerSUP_MGRPW=supplier_directoryManager_password MY_HOST=consumer_hostname MY_PORT=consumer_portnumber

ldapsearch -1 -T -h ${SUP_HOST} -p ${SUP_PORT} -D "${SUP_MGRDN}" \ -w ${SUP_MGRPW} -b "cn=mapping tree, cn=config" \"(&(objectclass=nsds5replicationagreement)(nsDS5ReplicaHost=${MY_HOST}) \(nsDS5ReplicaPort=${MY_PORT}))" dn nsds5ReplicaUpdateSchedule > /tmp/$$

cat /tmp/$$ |awk 'BEGIN { s = 0 }/^dn: / { print $0;print "changetype: modify";print "replace: nsds5ReplicaUpdateSchedule";print "nsds5ReplicaUpdateSchedule: 0000-2359 0123456";print "-";print "";print $0;print "changetype: modify"; print "replace:nsds5ReplicaUpdateSchedule";}

/^nsds5ReplicaUpdateSchedule: / { s = 1; print $0; }/^$/{if ( $s == 1 ){ print "-" ;

Page 429: Red Hat Directory Server 5.1

Replicating Account Lockout Attributes

409

print ""; }else{ print "nsds5ReplicaUpdateSchedule: 0000-2359 0123456";print "-" ; print ""; };s = 0; }

' > /tmp/ldif.$$echo "Ldif is in /tmp/ldif.$$"echo

ldapmodify -c -h ${SUP_HOST} -p ${SUP_PORT} -D "${SUP_MGRDN}" \-w ${SUP_MGRPW} -f /tmp/ldif.$$

Example 8.5. Replicate_Now Script Example

Variable Definition

supplier_hostname Hostname of the supplier to contact forinformation on replication agreements with thecurrent consumer.

supplier_portnumber LDAP port in use on the supplier.

supplier_directoryManager DN of the privileged Directory Manager user onthe supplier.

supplier_directoryManager_password Password of the privileged Directory Manageruser on the supplier.

consumer_hostname Hostname of the current consumer.

consumer_portnumber LDAP port in use on the consumer.

Table 8.4. Replicate_Now Variables

For the update operation to occur over an SSL connection, modify the ldapmodify command inthe script with the appropriate parameters and values. For more information on the ldapmodifycommand, see Section 3.2, “Managing Entries from the Command Line” and the Directory ServerConfiguration, Command, and File Reference.

8.12. Replicating Account Lockout AttributesAccount lockout policies will block a user ID from being able to access the Directory Server if the loginattempt fails a set number of times. This prevents hackers or other malicious people from illegitimatelyaccessing the Directory Server by guessing a password. Password policies are set locally, andgenerally account lockout attributes are local to each replica. This means that a person can attempt tolog in to one replica until the account lockout count is reached, then try again immediately on anotherreplica. The way to prevent that is to replicate the attributes related to the account lockout countsfor an entry, so that the malicious user is locked out of every supplier and consumer replica in theconfiguration if a login attempt fails on a single master.

By default, three password policy attributes are not replicated, even if other password attributes are.These attributes are related to of login failures and lockout periods:

• passwordRetryCount

• retryCountResetTime

• accountUnlockTime

Page 430: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

410

8.12.1. Configuring Directory Server to Replicate Password PolicyAttributesA special core configuration attribute controls whether password policy operational attributes arereplicated. This is the passwordIsGlobalPolicy attribute, which is enabled in the consumerDirectory Server configuration to allow the consumer to accept password policy operational attributes.

By default, this attribute is set to off.

To enable these attributes to be replicated, change the passwordIsGlobalPolicy configurationattribute on the consumer:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h consumer1.example.com

dn: cn=configchangetype: modifyreplace: passwordIsGlobalPolicypasswordIsGlobalPolicy: on

Changing that value to on allows the passwordRetryCount, retryCountResetTime, andaccountUnlockTime to be replicated. No other configuration is necessary for the attributes to beincluded with the replicated attributes.

8.12.2. Configuring Fractional Replication for Password PolicyAttributesSetting the passwordIsGlobalPolicy attribute affects the consumer in replication, in that it allowsthe consumer to receive updates to those attributes. To control whether the password policy attributesare actually replicated by the supplier, use fractional replication, which controls what specific entryattributes are replicated.

If the password policy attributes should be replicated, then make sure these attributes are included inthe fractional replication agreement (as they are by default).

If the passwordIsGlobalPolicy attribute is set to off on the consumer, so no password policyattributes should be replicated, use fractional replication (described in Section 8.1.7, “ReplicatingAttributes with Fractional Replication”) to enforce that on the supplier and specifically exclude thoseattributes from the replication agreement.

1. When configuring the replication agreement on the supplier, as described (for example) inSection 8.4.3, “Create the Replication Agreement”, select the Enable Fractional Replicationcheckbox.

2. By default, every attribute is listed in the Replicated Attributes box. Select thepasswordRetryCount, retryCountResetTime, and accountUnlockTime parameters andclick the arrow button to move them into the Do Not Replicate box.

3. Finish configuring the replication agreement.

8.13. Replication over SSLThe Directory Servers involved in replication can be configured so that all replication operations occurover an SSL connection. To use replication over SSL, first do the following:

Page 431: Red Hat Directory Server 5.1

Setting Replication Timeout Periods

411

• Configure both the supplier and consumer servers to use SSL.

• Configure the consumer server to recognize the supplier server's certificate as the supplier DN. Dothis only to use SSL client authentication rather than simple authentication.

These procedures are described in Chapter 12, Managing SSL.

If attribute encryption is enabled, a secure connection is required for replication.

NOTEReplication configured over SSL with certificate-based authentication will fail if thesupplier's certificate is only capable of behaving as a server certificate, and not also aclient during an SSL handshake. Replication with certificate-based authentication uses theDirectory Server's server certificate for authentication to the remote server.

When the servers are configured to use SSL, configure an SSL connection for replication in theReplication Agreement Wizard. The Source and Destination sets how to bind between the supplierand the consumer, and this is where SSL is set.

There are two ways to use SSL for replication:

• Select SSL Client Authentication.

With SSL client authentication, the supplier and consumer servers use certificates to authenticate toeach other.

• Select Simple Authentication.

With simple authentication, the supplier and consumer servers use a bind DN and password toauthenticate to each other, which are supplied in the Replication Agreement Wizard text fieldsprovided. Simple authentication takes place over a secure channel but without certificates.

Once a replication agreement is created, the connection type (SSL or non SSL) cannot be changed inthe agreement because LDAP and LDAPS connections use different ports. To change the connectiontype, re-create the replication agreement.

Also, the port listed for the consumer is the non-SSL port, even if the Directory Server instance isconfigured to run over SSL. This port number is used only for identification of the Directory Serverinstance in the Console; it does not specify the actual port number or protocol that is used forreplication.

8.14. Setting Replication Timeout PeriodsSuppliers must have an exclusive connection to a consumer to send updates to the directory. Asmentioned in Section 8.5.4, “Preventing Monopolization of the Consumer in Multi-Master Replication”,it is possible to configure a wait time for suppliers attempting to connect to a consumer, so that thesupplier does not hang while the consumer is tied up with another supplier.

It is also possible to set a timeout period for a supplier, so that it does not stay connected to aconsumer interminably attempting to send updates over a slow or broken connection.

There are two attributes which set the timeout period:

Page 432: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

412

• nsDS5ReplicaTimeout sets the number of seconds that the replication operation waits for aresponse from the consumer before timing out and failing. To set the optimum number, checkthe access logs to see the average amount of time that the replication process takes, and set thetimeout period accordingly.

• nsDS5DebugReplicaTimeout sets the timeout period for the replication operation when debuglogging is enabled. This setting may be appreciably higher than the nsDS5ReplicaTimeoutsetting because debug logging can slow down directory operations. This attribute can optionally setan error log level where this parameter is applied; the default is replication debugging (8192).

NOTEThe timeout period is limited to the maximum 32-bit integer in seconds, which translates to24.8 days.

Both of these attributes are set in the configuration for the replicated suffix. For example, this setstimeout periods for the ou=People suffix:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=replica, cn="ou=People,dc=example,dc=com", cn=mapping tree, cn=configchangetype: modifyadd: nsDS5ReplicaTimeoutnsDS5ReplicaTimeout: 600add: nsDS5DebugReplicaTimeoutnsDS5DebugReplicaTimeout: 6000

8.15. Replicating o=NetscapeRoot for AdministrationServer FailoverReplication usually occurs between Directory Server user databases to distribute directory data, but itis also possible to use replication to provide failover support for the Administration Server database,o=NetscapeRoot.

1. Install and configure the first Directory Server instance.

The setup-ds-admin.pl script has an option, -f, which references an inf. The inf canbe used to import LDIF files through the ConfigFile parameter, and the LDIF files can createdatabases, suffixes, and replication entries. (The inf file is described in more detail in theDirectory Server Installation Guide.)

/usr/sbin/setup-ds-admin.pl -f /tmp/server1.inf

To configure the o=NetscapeRoot database on server1 as a multi-master supplier replica, usethe following statements in the inf file:

[slapd]... ConfigFile = repluser.ldif Example 8.1, “Example Supplier Bind DN Entry” ConfigFile = changelog.ldif Example 8.2, “Example Changelog Entry” ConfigFile = replica.ldif Example 8.3, “Example Supplier Replica Entry” ConfigFile = replagreement.ldif Example 8.4, “Example Replication Agreement Entry”

Page 433: Red Hat Directory Server 5.1

Replication with Earlier Releases

413

...

2. Install and configure the second Directory Server instance. For the second server,server2.example.com, use the setup-ds.pl command, which installs a Directory Serverinstance without installing a local Administration Server.

/usr/sbin/setup-ds.pl -f /tmp/server2.inf

With server2, use the inf file to create and configure a o=NetscapeRoot database on server2as a multi-master supplier replica:

[slapd]... ConfigFile = netscaperootdb.ldif Example 2.1, “Example Root Suffix Entry” ConfigFile = repluser.ldif Example 8.1, “Example Supplier Bind DN Entry” ConfigFile = changelog.ldif Example 8.2, “Example Changelog Entry” ConfigFile = replica.ldif Example 8.3, “Example Supplier Replica Entry” ConfigFile = replagreement.ldif Example 8.4, “Example Replication Agreement Entry” ...

3. Initialize the o=NetscapeRoot database on server2 from server1. Add thensds5replicarefresh attribute to the replication agreement on server1.

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h supplier1.example.com

dn: cn=ExampleAgreement1,cn=replica,cn="o=NetscapeRoot",cn=mapping tree,cn=configchangetype: modifyreplace: nsds5beginreplicarefreshnsds5beginreplicarefresh: start

4. Run the register-ds-admin.pl to create a local Administration Server on server2 andswitch the configuration directory for server2 to its own o=NetscapeRoot database fromserver1.

/usr/sbin/register-ds-admin.pl

5. Disable the PTA Plug-in on server2 so that it does not pass bind operations for theadministrative users in its o=NetscapeRoot to server1.

See Section 1.9, “Enabling Plug-ins”.

8.16. Replication with Earlier ReleasesThis section provides information on how to optimize replication with earlier releases of DirectoryServer.

8.16.1. Using Legacy ReplicationDirectory Server 8.1 can be involved in replication with earlier releases of Directory Server, providingthe following conditions are met:

• Directory Server 8.1 is a consumer.

Page 434: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

414

• The legacy suppliers can be Directory Server 4.0, 4.1, and 4.1x.

The following restrictions apply:

• A legacy Directory Server and Directory Server 8.1 cannot update the same replica. However, thisversion of Directory Server can have different replicas, where one is supplied by a legacy DirectoryServer and the other is supplied by Directory Server 8.1.

• Directory Server 8.1 cannot be a supplier for other replicas.

The main advantage of using Directory Server 8.1 as a consumer of a legacy Directory Server is toease the migration of a replicated environment, especially since migration is not supported from 4.xservers to 8.1. For more information on migration, see the Directory Server Installation Guide.

8.16.2. Legacy Replication and Parent Object ClassesThere is one important difference between the way that Directory Server 4.x servers handle replicatedentries and the way that Directory Server 8.1 handles replicated entries. In Directory Server 4.x,entries could be added without specifying parent object classes, and when those entries were modifiedor replicated, the server would not automatically insert those parent object classes. For example,a user could be added with the inetorgperson object class, but not the top or person objectclasses:

dn: uid=jsmith, ou=People, dc=example, dc=comobjectclass: inetorgpersonuid: jsmithcn: John Smithsn: Smith

However, in Directory Server 8.1, the parent object classes are automatically added to the entry whenthe entry is added, modified, or replicated. This means that the entries will be slightly different on theDirectory Server 4.x supplier and the Directory Server 8.1 consumer, because the Directory Server 8.1entry will have the parent object classes:

dn: uid=jsmith, ou=People, dc=example, dc=com objectclass: top objectclass: person objectclass: inetorgperson uid: jsmith cn: John Smith sn: Smith

8.16.3. Configuring Legacy ReplicationTo set up legacy replication:

1. In the Directory Server Console, click the Configuration tab.

2. Select the Replication node, and click the Legacy Consumer Settings tab in the right pane.

3. Check the Enable Legacy Consumer checkbox.

This activates the fields in the Authentication box.

4. Specify the supplier bind DN that the legacy supplier server will use to bind to the consumer.

Page 435: Red Hat Directory Server 5.1

Using the Retro Changelog Plug-in

415

Optionally, specify a password at least 8 characters long.

5. Click Save.

6. Now configure legacy consumer settings for each replica that will receive updates from a legacysupplier.

a. In the navigation tree, expand the Replication node, and select a replica that will receiveupdates from the legacy supplier.

b. In the Replica Settings tab, select the Enable Replica and Updatable by a 4.x Replicacheckboxes.

These options are the only ones required for replication to work. Optionally, specify a replicaID. It is not necessary to specify a supplier DN because the one specified in step 4 will beused.

c. Click Save.

7. Repeat step 6 for each read-only replica that will receive updates from a legacy supplier.

8. To complete the legacy replication setup, configure the legacy supplier to replicate to the DirectoryServer 8.1 instance. For instructions on configuring a replication agreement on a 4.x DirectoryServer, refer to the documentation for the legacy Directory Server.

NOTEThe Directory Server Console will not prevent you from configuring a database as aread-write replica and enabling legacy consumer settings. This makes migration easierbecause the Directory Server can be configured as it should be after the migration andlegacy consumer settings only have to be active for the duration of the transition.

8.17. Using the Retro Changelog Plug-inThe Retro Changelog plug-in configures Directory Server to maintain a changelog that is compatiblewith the changelog implemented in Directory Server 4.0, 4.1, and 4.1x. Maintaining a retro changelogis essential to maintain a changelog for directory clients that depend on a Directory Server 4.x-stylechangelog.

To use the retro changelog plug-in, the Directory Server 8.1 instance must be configured as a single-master replica.

When the Directory Server is configured to maintain a retro changelog, this changelog is stored in aseparate database under a special suffix, cn=changelog.

The retro changelog consists of a single level of entries. Each entry in the changelog has the objectclass changeLogEntry and can include the attributes listed in Table 8.5, “Attributes of a RetroChangelog Entry”.

Attribute Definition

changeNumber This single-valued attribute is always present.It contains an integer which uniquely identifies

Page 436: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

416

Attribute Definitioneach change. This number is related to the orderin which the change occurred. The higher thenumber, the later the change.

targetDN This attribute contains the DN of the entry thatwas affected by the LDAP operation. In thecase of a modrdn operation, the targetDNattribute contains the DN of the entry before itwas modified or moved.

changetype Specifies the type of LDAP operation. Thisattribute can have a value of add, delete, modify,or modrdn.

changes For add and modify operations, contains thechanges made to the entry in LDIF format.

newrdn In the case of modrdn operations, specifies thenew RDN of the entry.

deleteoldrdn In the case of modrdn operations, specifieswhether the old RDN was deleted.

newSuperior In the case of modrdn operations, specifies thenewSuperior attribute of the entry.

Table 8.5. Attributes of a Retro Changelog Entry

This section contains information on the following retro changelog items:

• Section 8.17.1, “Enabling the Retro Changelog Plug-in”

• Section 8.17.2, “Trimming the Retro Changelog”

• Section 8.17.3, “Searching and Modifying the Retro Changelog”

• Section 8.17.4, “Retro Changelog and the Access Control Policy”

8.17.1. Enabling the Retro Changelog Plug-inThe retro changelog plug-in configuration information is stored in the cn=Retro ChangelogPlugin,cn=plugins,cn=config entry in dse.ldif. To enable the retro changelog plug-in fromthe command line:

1. Create an LDIF file that contains the following LDIF update statements:

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on

2. Use the ldapmodify command to import the LDIF file into the directory.

For more information on the ldapmodify command, see Section 3.2, “Managing Entries from theCommand Line” and the Directory Server Configuration, Command, and File Reference.

3. Restart the server.

Page 437: Red Hat Directory Server 5.1

Trimming the Retro Changelog

417

For information on restarting the server, see Section 1.3, “Starting and Stopping Servers”.

The retro changelog is created in the directory tree under a special suffix, cn=changelog.

The procedure for enabling the retro changelog plug-in from Directory Server Console is the same asfor all Directory Server plug-ins. For information, see Section 1.9, “Enabling Plug-ins”.

8.17.2. Trimming the Retro ChangelogThe entries in the changelog can be automatically removed after a specified period of time. Toconfigure the period of time after which entries are automatically deleted from the changelog,set the nsslapd-changelogmaxage configuration attribute in the cn=Retro ChangelogPlugin,cn=plugins,cn=config entry.

The nsslapd-changelogmaxage attribute is a single-valued attribute. Its syntax is as follows:

nsslapd-changelogmaxage: Integer timeUnit

Integer is a number, and timeUnit can be s for seconds, m for minutes, h for hours, d for days, or w forweeks.

NOTEThere should not be a space between the Integer and timeUnit variables. The space inthe syntax above is intended to show that the attribute value is composed of two variableparts, not just one. For example:

nsslapd-changelogmaxage: 2d

8.17.3. Searching and Modifying the Retro ChangelogThe changelog supports search operations and is optimized for searches that include filters of the form(&(changeNumber>=X)(changeNumber<=Y)).

As a general rule, do not perform add or modify operations on the retro changelog entries, althoughentries can be deleted to trim the size of the changelog. Only modify the retro changelog entry tomodify the default access control policy.

8.17.4. Retro Changelog and the Access Control PolicyWhen the retro changelog is created, the following access control rules apply by default:

• Read, search, and compare rights are granted to all authenticated users (userdn=anyone, notto be confused with anonymous access where userdn=all) to the retro changelog top entrycn=changelog.

• Write and delete access are not granted, except implicitly to the Directory Manager.

Do not grant read access to anonymous users because the changelog entries can containmodifications to sensitive information, such as passwords. Only authenticated applications and usersshould be allowed to access this information.

Page 438: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

418

To modify the default access control policy which applies to the retro changelog, modify the aciattribute of the cn=changelog entry.

8.18. Monitoring Replication StatusThe replication status can be viewed in the Directory Server Console or Red Hat AdministrationExpress.

• Section 8.18.1, “Monitoring Replication Status from the Directory Server Console”

• Section 8.18.2, “Monitoring Replication Status from Administration Express”

8.18.1. Monitoring Replication Status from the Directory ServerConsoleTo view a summary of replication status in the Directory Server Console. do the following:

1. Open the Directory Server Console.

2. Select the Status tab, and then, in the left navigation tree, select Replication Status.

In the right pane, a table appears that contains information about each of the replicationagreements configured for this server.

3. Click Refresh to update the contents of the tab.

The status information displayed is described in Table 8.6, “Directory Server Console ReplicationStatus”.

Table Header Description

Agreement The name of the replication agreement.

Replica suffix The suffix that is replicated.

Supplier The supplier server in the agreement.

Consumer The consumer server in the agreement.

Number of changes The number of changes sent to this replica sincethe server started.

Last replica update began The time when the most recent replicationupdate started.

Last replica update ended The time when the most recent replicationupdate ended.

Last update message The status for the most recent replicationupdates.

Consumer initialization The current status on consumer initialization (inprogress or not).

Last consumer initialization update message The status on the last initialization of theconsumer.

Last consumer initialization began The time when the initialization of the consumerreplica started.

Page 439: Red Hat Directory Server 5.1

Monitoring Replication Status from Administration Express

419

Table Header Description

Last consumer initialization ended The time when the initialization of the consumerreplica ended.

Table 8.6. Directory Server Console Replication Status

8.18.2. Monitoring Replication Status from Administration ExpressAlthough the replication status report in the Directory Server Console shows many details, it does notshow the progress of the replication. Additionally, because one report is generated per agreement, thislists all status reports for all different agreements.

The repl-monitor.pl script, which is explained in detail in the Directory Server Configuration,Command, and File Reference, monitors replication status to a greater extent by providing thesefunctionalities:

• Lists for each supplier replica on each Directory Server discovered, server URL or alias, replica ID,replica root, and maximum change sequence number (maxcsn).

• Lists corresponding to each supplier replica listed above and for each direct or indirect consumerreplicas discovered, server URL or alias, replica root, replica type, connection type of the replicationsessions, replication schedule, replication status, supplier maxcsn, and time lag between theconsumer maxcsn and the supplier maxcsn.

The time lag field uses different colors to indicate the degree of time lag. The threshold for eachcolor is configurable.

• Displays the change sequence number (CSN) in human-readable format (instead of hex strings) inthe MM/DD/YYYY HH:MI Seq# SubSeq# format, where Seq# and SubSeq# are omitted if they arezero.

• Shows the output/result in the HTML format. The script writes the output to an HTML file, which canbe configured to refresh itself automatically; the refresh interval is also configurable.

The script is integrated into the Red Hat Administration Express, so the replication status can beviewed in a web browser. The Administration Express is an HTML-based version of Red Hat Consolethat provides quick access to servers running Administration Server.

To view in-progress status of replication in Administration Express:

1. Prepare a configuration file following the guidelines provided in the "repl-monitor.pl (Monitorreplication status)" section of the Directory Server Configuration, Command, and File Reference.

2. Open the Administration Server URL in a web browser.

http://hostname:admin_port

3. Click Red Hat Administration Express, and, when prompted, log in.

4. Select a supplier Directory Server instance, and click Replication Status.

This brings up a page for specifying the runtime parameters of the replication-monitoring tool.

5. In the Configuration file field, type the path to the configuration file created in step 1, and clickOK.

Page 440: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

420

The replication-status page appears; by default, the page gets refreshed every 300 seconds.

Each table shows the status of the changes originated from a supplier replica.

Table Description

Table Header The table header shows the replica ID ofthe supplier replica, the replica root, and themaximum Change State Number (CSN) on thesupplier. The important thing is to make sure thateach supplier LDAP server has its unique replicaID. Multiple replica roots on one LDAP server,however, could share the same replica ID.

Table Row Each row represents a direct or indirectconsumer of the supplier (identified in the TableHeader).

Max CSN It is the most recent CSN the consumer hasreplayed that was originated from the supplier(identified in the Table Header).

Time Lag It shows the time difference between the supplierand the consumer's max CSNs for the changesoriginated from the supplier (identified in theTable Header). A consumer is in sync with itssupplier when its time lag is 0.

Last Modify Time It is roughly the time when the consumer's maxCSN was replayed.

Supplier This column lists all the suppliers of theconsumer.

Sent/Skipped Each supplier lists roughly how many changesoriginated from the supplier (identified in theTable Header) have been replayed or skippedby the consumer. The numbers are kept insuppliers' memory only. They will be cleared ifthe supplier is restarted.

Update Status The number is the status code, and the stringis the implication of the status code. Watch thiscolumn for possible deadlock if all the supplierscomplain that they cannot acquire the busyreplica. It is normal if one of the suppliers isdoing an update while the others can't acquirethe busy replica.

8.19. Solving Common Replication ConflictsMulti-master replication uses a loose consistency replication model. This means that the same entriescan be changed on different servers. When replication occurs between the two servers, the conflictingchanges need to be resolved. Mostly, resolution occurs automatically, based on the timestampassociated with the change on each server. The most recent change takes precedence.

Page 441: Red Hat Directory Server 5.1

Solving Naming Conflicts

421

However, there are some cases where change conflicts require manual intervention in order to reach aresolution. Entries that have a change conflict that cannot be resolved automatically by the replicationprocess contain a conflict marker attribute nsds5ReplConflict. The nsds5ReplConflictattribute is an operational attribute which is indexed for presence and equality, so it is simple to searchfor entries that contain this attribute. For example:

ldapsearch -D adminDN -w password -b "dc=example,dc=com" "nsds5ReplConflict=*" \* nsds5ReplConflict

The nsds5ReplConflict attribute is already indexed for presence and equality, but for performancereasons, if there are many conflicting entries every day, index the nsds5ReplConflict attribute inother indexes. For information on indexing, see Chapter 11, Managing Indexes.

• Section 8.19.1, “Solving Naming Conflicts”

• Section 8.19.2, “Solving Orphan Entry Conflicts”

• Section 8.19.3, “Solving Potential Interoperability Problems”

8.19.1. Solving Naming ConflictsWhen two entries are created with the same DN on different servers, the automatic conflict resolutionprocedure during replication renames the last entry created, including the entry's unique identifierin the DN. Every directory entry includes a unique identifier given by the operational attributensuniqueid. When a naming conflict occurs, this unique ID is appended to the non-unique DN.

For example, the entry uid=adamss,ou=people,dc=example,dc=com is created on Server A attime t1 and on Server B at time t2, where t2 is greater (or later) than t1. After replication, Server Aand Server B both hold the following entries:

• uid=adamss,ou=people,dc=example,dc=com (created at time t1)

• nsuniqueid=66446001-1dd211b2+uid=adamss,dc=example,dc=com (created at time t2)

The second entry needs to be renamed in such a way that it has a unique DN. The renamingprocedure depends on whether the naming attribute is single-valued or multi-valued.

8.19.1.1. Renaming an Entry with a Multi-Valued Naming AttributeTo rename an entry that has a multi-valued naming attribute:

1. Rename the entry using a new value for the naming attribute, and keep the old RDN. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: nsuniqueid=66446001-1dd211b2+uid=adamss,dc=example,dc=com changetype: modrdn newrdn: uid=NewValue deleteoldrdn: 0

2. Remove the old RDN value of the naming attribute and the conflict marker attribute. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: uid=NewValue,dc=example,dc=com

Page 442: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

422

changetype: modify delete: uid uid: adamss - delete: nsds5ReplConflict -

NOTEThe unique identifier attribute nsuniqueid cannot be deleted.

For more information on the ldapmodify command, see Section 3.2, “Managing Entries from theCommand Line” and the Directory Server Configuration, Command, and File Reference.

The Console does not support editing multi-valued RDNs. For example, if there are two servers ina multi-master mode, an entry can be created on each server with the same user ID, and then thenew entries' RDN changed to the nsuniqueid uid value. Attempting to modify this entry from theConsole returns the error Changes cannot be saved for entries with multi-valued RDNs.

Opening the entry in the advanced mode shows that the naming attribute has been set tonsuniqueid uid. However, the entry cannot be changed or corrected by changing the user ID andRDN values to something different. For example, if jdoe was the user ID and it should be changed tojdoe1, it cannot be done from the Console. Instead, use the ldapmodify command:

dn: cn=John Doe changetype: modify replace: uid uid: jdoe

dn: cn=John Doe changetype: modrdn newrdn: uid=jdoe1 deleteoldrdn: 1

8.19.1.2. Renaming an Entry with a Single-Valued Naming AttributeTo rename an entry that has a single-valued naming attribute:

1. Rename the entry using a different naming attribute, and keep the old RDN. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: nsuniqueid=66446001-1dd211b2+dc=pubs,dc=example,dc=com changetype: modrdn newrdn: cn=TempValue deleteoldrdn: 0

2. Remove the old RDN value of the naming attribute and the conflict marker attribute. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: cn=TempValue,dc=example,dc=com changetype: modify delete: dc

Page 443: Red Hat Directory Server 5.1

Solving Orphan Entry Conflicts

423

dc: pubs - delete: nsds5ReplConflict -

NOTEThe unique identifier attribute nsuniqueid cannot be deleted.

3. Rename the entry with the intended attribute-value pair. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: cn=TempValue,dc=example,dc=com changetype: modrdn newrdn: dc=NewValue deleteoldrdn: 1

Setting the value of the deleteoldrdn attribute to 1 deletes the temporary attribute-value paircn=TempValue. To keep this attribute, set the value of the deleteoldrdn attribute to 0.

For more information on the ldapmodify command, see Section 3.2, “Managing Entries from theCommand Line” and the Directory Server Configuration, Command, and File Reference.

8.19.2. Solving Orphan Entry ConflictsWhen a delete operation is replicated and the consumer server finds that the entry to be deleted haschild entries, the conflict resolution procedure creates a glue entry to avoid having orphaned entriesin the directory.

In the same way, when an add operation is replicated and the consumer server cannot find the parententry, the conflict resolution procedure creates a glue entry representing the parent so that the newentry is not an orphan entry.

Glue entries are temporary entries that include the object classes glue and extensibleObject.Glue entries can be created in several ways:

• If the conflict resolution procedure finds a deleted entry with a matching unique identifier, theglue entry is a resurrection of that entry, with the addition of the glue object class and thensds5ReplConflict attribute.

In such cases, either modify the glue entry to remove the glue object class and thensds5ReplConflict attribute to keep the entry as a normal entry or delete the glue entry and itschild entries.

• The server creates a minimalistic entry with the glue and extensibleObject object classes.

In such cases, modify the entry to turn it into a meaningful entry or delete it and all of its child entries.

8.19.3. Solving Potential Interoperability ProblemsFor reasons of interoperability with applications that rely on attribute uniqueness, such as a mailserver, it may be necessary to restrict access to the entries which contain the nsds5ReplConflict

Page 444: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

424

attribute. If access is not restricted to these entries, then the applications requiring one attribute onlypick up both the original entry and the conflict resolution entry containing the nsds5ReplConflict,and operations will fail.

To restrict access, modify the default ACI that grants anonymous read access:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com> dn: dc=example,dc=com> changetype: modify> delete: aci> aci: (target ="ldap:///dc=example,dc=com")(targetattr !="userPassword")(version 3.0;acl "Anonymous read-search access";allow (read, search, compare)(userdn = "ldap:///anyone");)> -> add: aci> aci: (target="ldap:///dc=example,dc=com")(targetattr!="userPassword") (targetfilter="(!(nsds5ReplConflict=*))")(version 3.0;acl "Anonymous read-search access";allow (read, search, compare) (userdn="ldap:///anyone");)> -

The new ACI filters out all entries that contain the nsds5ReplConflict attribute from search results.

For more information on the ldapmodify command, see Section 3.2, “Managing Entries from theCommand Line” and the Directory Server Configuration, Command, and File Reference.

8.20. Troubleshooting Replication-Related ProblemsThis section lists some error messages, explains possible causes, and offers remedies.

It is possible to get more debugging information for replication by setting the error log level to 8192,which is replication debugging. See Section 14.1.4.2, “Configuring the Error Log”.

To change the error log level to 8192, run the following ldapmodify command:

dn: cn=configchangetype: modifyreplace: nsslapd-errorlog-levelnsslapd-errorlog-level: 8192

Because log level is additive, running the above command will result in excessive messages in theerror log. So, use it judiciously.

To turn off replication debugging log, set the same attribute to 0.

The cl-dump.pl script, which is explained in detail in the Directory Server Configuration, Command,and File Reference can also help troubleshoot replication-related problems. Depending on the usageoptions, the script can selectively dump a particular replica:

• Dump the contents of a replication-change-log file and in-memory variables purge RUV andmaxRUV.

• Grep and interpret change sequence numbers (CSNs) in the changelog.

• Get the base-64 encoded changelog from the Directory Server, and then decode the changelog.

Page 445: Red Hat Directory Server 5.1

Troubleshooting Replication-Related Problems

425

Many common replication problems are described in Table 8.7, “Replication Errors”.

Error/Symptom Reason Impact Remedy

agmt=%s (%s:%d)Replica has a differentgeneration ID than thelocal data

The consumerspecified at thebeginning of thismessage has not been(successfully) initializedyet, or it was initializedfrom a different rootsupplier.

The local supplier willnot replicate any datato the consumer.

Ignore this messageif it occurs before theconsumer is initialized.Otherwise, reinitializethe consumer if themessage is persistent.In a multi-masterenvironment, all theservers should beinitialized only oncefrom a root supplier,directly or indirectly.For example, M1initializes M2 and M4,M2 then initializesM3, and so on. Theimportant thing to noteis that M2 must notstart initializing M3 untilM2's own initializationis done (check the totalupdate status from theM1's Console or M1 orM2's error log). Also,M2 should not initializeM1 back.

Warning: data forreplica's was reloaded,and it no longermatches the data in thechangelog. Recreatingthe changelog file.This could affectreplication withreplica's consumers,in which case theconsumers should bereinitialized.

This message mayappear only when asupplier is restarted.It indicates that thesupplier was unableto write the changelogor did not flush outits RUV at its lastshutdown. The formeris usually because ofa disk-space problem,and the latter becausea server crashed orwas ungracefully shutdown.

The server will notbe able to send thechanges to a consumerif the consumer'smaxcsn no longerexists in the server'schangelog.

Check the disk spaceand the possible corefile (under the server'slogs directory). If thisis a single-masterreplication, reinitializethe consumers.Otherwise, if the serverlater complains thatit can't locate someCSN for a consumer,see if the consumercan get the CSN fromother suppliers. Ifnot, reinitialize theconsumer.

agmt=%s(%s:%d):Can't locate CSN%s in the changelog(DB rc=%d). The

Most likely thechangelog wasrecreated because ofthe disk is full or the

The local server willnot be able to sendany more changeto that consumeruntil the consumer is

If this is a single-master replication,reinitialize theconsumers. Otherwise,see if the consumer

Page 446: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

426

Error/Symptom Reason Impact Remedyconsumer may need tobe reinitialized.

server ungracefullyshutdown.

reinitialized or getsthe CSN from othersuppliers.

can get the CSN fromother suppliers. Ifnot, reinitialize theconsumer.

Too much time skew The system clocks onthe host machines areextremely out of sync.

The system clock isused to generate apart of the CSN. Inorder to reflect thechange sequenceamong multiplesuppliers, supplierswould forward-adjusttheir local clocksbased on the remoteclocks of the othersuppliers. Because theadjustment is limited toa certain amount, anydifference that exceedsthe permitted limit willcause the replicationsession to be aborted.

Synchronize thesystem clocks on theDirectory Server hostmachines. If applicable,run the network timeprotocol (ntp) daemonon those hosts.

agmt=%s(%s:%d):Warning: Unable tosend endReplicationextended operation(%s)

The consumer is notresponding.

If the consumerrecovers without beingrestarted, there is achance that the replicaon the consumer willbe locked forever ifit did not receive therelease lock messagefrom the supplier.

Watch if the consumercan receive any newchange from any of itssuppliers, or start thereplication monitor, andsee if all the suppliersof this consumer warnthat the replica is busy.If the replica appears tobe locked forever andno supplier can get in,restart the consumer.

Changelog is gettingtoo big.

Either changelog purgeis turned off, which isthe default setting, orchangelog purge isturned on, but someconsumers are waybehind the supplier.

By default changelogpurge is turned off.To turn it on fromthe command line,run ldapmodify asfollows:

dn: cn=changelog5,cn=config changetype: modify add: nsslapd-changelogmaxage nsslapd-changelogmaxage: 1d

Page 447: Red Hat Directory Server 5.1

Troubleshooting Replication-Related Problems

427

Error/Symptom Reason Impact Remedywhere 1d means 1 day.Other valid time unitsare s for seconds, m forminutes, h for hours,and w for weeks. Avalue of 0 turns off thepurge.

With changelog purgeturned on, a purgethread that wakes upevery five minutes willremove a change if itsage is greater than thevalue of nsslapd-changelogmaxageand if it has beenreplayed to all thedirect consumers ofthis supplier (supplieror hub).

If it appears that thechangelog is notpurged when thepurge threshold isreached, check themaximum time lagfrom the replicationmonitor among allthe consumers.Irrespective of what thepurge threshold is, nochange will be purgedbefore it is replayed byall the consumers.

The ReplicationMonitor is notresponding. (Forinformation onReplication Monitor,see Section 8.18,“Monitoring ReplicationStatus”.)

The SSL port isspecified in somereplication agreement,but the certificatedatabase is notspecified or notaccessible by theReplication Monitor.If there is no SSLport problem, oneof the servers in thereplication topologymight hang.

Map the SSL port toa non-SSL port in theconfiguration file of theReplication Monitor.For example, if 636 isthe SSL port and 389is the non-SSL port,add the following linein the [connection]section:

*:636=389:*:password

Page 448: Red Hat Directory Server 5.1

Chapter 8. Managing Replication

428

Error/Symptom Reason Impact Remedy

In the ReplicationMonitor, someconsumers show justthe header of the table.(For information onReplication Monitor,see Section 8.18,“Monitoring ReplicationStatus”.)

No change hasoriginated fromthe correspondingsuppliers. In this case,the MaxCSN: in theheader part should be"None".

There is nothing wrongif there is no changeoriginated from asupplier.

Table 8.7. Replication Errors

Page 449: Red Hat Directory Server 5.1

Chapter 9.

429

Synchronizing Red Hat DirectoryServer with Microsoft Active DirectoryWindows Sync carries over changes in a directory — adds, deletes, and changes in groups, users,and passwords — between Red Hat Directory Server and Microsoft Active Directory. This makes itmuch more efficient and effective to maintain consistent information across directories.

9.1. About Windows SyncSynchronization allows the user and group entries in Active Directory to be matched with the entries inthe Red Hat Directory Server. As entries are created, modified, or deleted, the corresponding changeis made to the sync peer server, allowing two-way synchronization of users, passwords, and groups.

The synchronization process is analogous to the replication process: the synchronization is enabledby a plug-in, configured and initiated through a sync agreement, and record of directory changes ismaintained and updates are sent according to that changelog. This synchronizes users and groupsbetween Directory Server and a Windows server.

Windows Sync has two parts is configured in two parts, one for user and group entries and the otherfor passwords:

• Directory Server Windows Sync. Synchronization for user and group entries is configured in asynchronization agreement, much like replication is configured in a replication agreement. A syncagreement defines what kinds of entries are synchronized (users, groups, or both) and whichdirection changes are synced (from the Directory Server to Active Directory, from Active Directory toDirectory Server, or both).

The Directory Server relies on the Multi-Master Replication Plug-in to synchronize user and groupentries. The same changelog that is used for multi-master replication is also used to send updatesfrom the Directory Server to Active Directory as LDAP operations. The server also performs LDAPsearch operations against its Windows server to synchronize changes made to Windows entries tothe corresponding Directory Server entry.

• Password Sync Service. Password changes made on Directory Server are automatically syncedover to Active Directory, but there must be a special hook to recognize and transmit passwordchanges on Active Directory over to Directory Server. This is done by the Password Sync Service.This application captures password changes on the Windows machines and send them to theDirectory Server over LDAPS.

The Password Sync Service must be installed on every Active Directory domain controller.

Page 450: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

430

Figure 9.1. Active Directory — Directory Server Synchronization Process

Synchronization is configured and controlled by one or more synchronization agreements, whichestablishes synchronization between sync peers, the directory servers being synced. These aresimilar in purpose to replication agreements and contain a similar set of information, including thehostname and port number for Active Directory. The Directory Server connects to its peer Windowsserver via LDAP/LDAPS to both send and receive updates.

LDAP, a standard connection, can be used for syncing user and group entries alone, but tosynchronize passwords, some sort of secure connection is required. If a secure connection is notused, the Windows domain will not accept password changes from the Directory Server and thePassword Sync Service will not send passwords from the Active Directory domain to the DirectoryServer. Win Sync allows both LDAPS using SSL/TLS and Start TLS.

A single Active Directory subtree is synchronized with a single Directory Server subtree, and viceversa. Unlike replication, which connects databases, synchronization is between suffixes, parts of thedirectory tree structure. The synced Active Directory and Directory Server suffixes are both specifiedin the sync agreement. All entries within the respective subtrees are candidates for synchronization,including entries that are not immediate children of the specified suffix DN.

NOTEAny descendant container entries need to be created separately in Active Directory by anadministrator; Windows Sync does not create container entries.

The Directory Server maintains a changelog, a database that records modifications that haveoccurred. The changelog is used by Windows Sync to coordinate and send changes made to theActive Directory peer. Changes to entries in Active Directory are found by using Active Directory'sDirsync search feature. The Dirsync search is issued periodically, every five minutes, to check forchanges on the Active Directory server. Using Dirsync ensures that only those entries that havechanged since the previous search are retrieved.

In some situations, such as when synchronization is configured or there have been major changesto directory data, a total update, or resynchronization, can be run. This examines every entry in bothsync peers and sends any modifications or missing entries. A full Dirsync search is initiated whenevera total update is run. See Section 9.6, “Sending Synchronization Updates” for more information.

Page 451: Red Hat Directory Server 5.1

About Windows Sync

431

Windows Sync provides some control over which entries are synchronized to grant administrators fine-grained control of the entries that are synchronized and to give sufficient flexibility to support differentdeployment scenarios. This control is set through different configuration attributes set in the DirectoryServer:

• When creating the sync agreement, there is an option to synchronizing new Windows entries(nsDS7NewWinUserSyncEnabled and nsDS7NewWinGroupSyncEnabled) as they are created.If these attributes are set to on, then existing Windows users/groups are synchronized to theDirectory Server, and users/groups as they are created are synchronized to the Directory Server.

Within the Windows subtree, only entries with user or group object classes can be synchronized toDirectory Server.

• On the Directory Server, only entries with the ntUser or ntGroup object classes and attributes canbe synchronized.

The placement of the sync agreement depends on what suffixes are synchronized; for a single suffix,the sync agreement is made for that suffix alone; for multiple suffixes, the sync agreement is madeat a higher branch of the directory tree. To propagate Windows entries and updates throughout theDirectory Server deployment, make the agreement between a master in a multi-master replicationenvironment, and use that master to replicate the changes across the Directory Server deployment, asshown in Figure 9.2, “Multi-Master Directory Server — Windows Domain Synchronization”.

WARNINGThere can only be a single sync agreement between the Directory Server environmentand the Active Directory environment. Multiple sync agreements to the same ActiveDirectory domain can create entry conflicts.

Figure 9.2. Multi-Master Directory Server — Windows Domain Synchronization

Page 452: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

432

Directory Server passwords are synchronized along with other entry attributes because plain-textpasswords are retained in the Directory Server changelog. The Password Sync service is neededto catch password changes made on Active Directory. Without the Password Sync service, it wouldbe impossible to have Windows passwords synchronized because passwords are hashed in ActiveDirectory, and the Windows hashing function is incompatible with the one used by Directory Server.

9.2. Configuring Windows SyncConfiguring synchronization is very similar to configuring replication. It requires configuring thedatabase as a master with a changelog and creating an agreement to define synchronization. Acommon user identity, a sync user, connects to the Windows sync peer to send updates from theDirectory Server and to check for updates to sync back to the Directory Server.

NOTETo synchronize passwords (which is the only way for users to be active on both DirectoryServer and Active Directory), synchronization must be configured to run over SSL/TLS.Therefore, this configuration section assumes that SSL/TLS must also be configured.

Configuring synchronization over SSL/TLS is also similar to configuring replication over SSL/TLS. Bothsync peers must be configured to trust each other for encrypted sessions (all password operations areperformed over TLS/SSL).

All synchronization for user and group entries is passive from the Active Directory side; it is theDirectory Server which sends updates on its side and polls for updates on the Active Directory domain.For passwords, the Active Directory server requires a separate password service; this service activelysends password changes from the Active Directory domain to Directory Server.

9.2.1. Step 1: Configure SSL on Directory ServerThe full instructions for configuring the Directory Server to run in SSL are at Section 12.4.1, “EnablingTLS/SSL Only in the Directory Server”. Basically, the Directory Server needs to have the appropriateSSL certificates installed, be configured to run over an SSL port, and allow client authentication fromother servers.

Two certificates must be issued and installed on both the Directory Server and the Active Directorysync peer:

• CA certificate, shared between the Directory Server and Active Directory

• Server certificates for the Directory Server and Active Directory sync peers, which are accessible bythe sync services

To set up SSL:

1. Generate a certificate request.

a. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

b. Select the Server Certs tab, and click the Request button.

c. Fill in the certificate information, and save the certificate request to a file.

2. Submit the certificate to a certificate authority, and retrieve it once it is issued.

Page 453: Red Hat Directory Server 5.1

Step 2: Configure the Active Directory Domain

433

The method for submitting certificate requests and retrieving certificates varies for each CA.

3. Install the new certificate.

a. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

b. Select the Server Certs tab, and click Install.

c. Paste in the certificate, and set the password for the token database.

4. Install the CA certificate for the issuing CA.

a. Download and save the CA certificate from the CA's site. Each CA has a slightly different wayof making its CA certificate available.

b. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

c. Go to the CA Certs tab, and click Install.

d. Paste in the CA certificate or point to the downloaded file, and go through the certificateinstaller.

5. Change the server to the SSL port.

a. Open the Directory Server Console, and open the Configuration tab for the Directory Server.

b. In the Settings tab, set the secure port for the server to use for TLS/SSL communications,such as 636. Click Save.

c. Select the Encryption tab in the right pane.

d. Select the Enable SSL for this Server checkbox, then select the certificate to use from thedrop-down menu. Click Save.

e. Restart the Directory Server. The Directory Server must be restarted from the command line.

service dirsrv restart example

To restart the Directory Server without the password prompt, create a PIN file or use ahardware crypto device. See Section 12.4.3, “Creating a Password File for the DirectoryServer” for information on how to create a PIN file.

9.2.2. Step 2: Configure the Active Directory Domain

NOTESynchronization can only be configured with an Active Directory domain controller, somake sure that the domain is properly installed and configured.

The first configuration step is to make sure that the Active Directory password complexity policies areare enabled so that the Password Sync service will run.

1. Run secpol.msc.

Page 454: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

434

2. Select Security Settings.

3. Open Account Policies, and then open Password Policy.

4. Select the Password must meet complexity requirements option and save.

If SSL is not already enabled, set up SSL on the Active Directory server. Setting up LDAPS isexplained in more detail in the Microsoft knowledgebase at http://support.microsoft.com/kb/321051.

1. Install a certificate authority in the Windows Components section in Add/Remove Programs.

2. Select the Enterprise Root CA option.

3. Reboot the Active Directory server. If IIS web services are running, the CA certificate can beaccessed by opening http://servername/certsrv.

4. Set up the Active Directory server to use the SSL server certificate.

a. Create a certificate request .inf, using the fully-qualified domain name of the ActiveDirectory as the certificate subject. For example:

;----------------- request.inf -----------------

[Version]

Signature="$Windows NT$

[NewRequest]

Subject = "CN=ad.server.example.com, O=Engineering, L=Raleigh, S=North Carolina, C=US"KeySpec = 1 KeyLength = 2048 Exportable = TRUE MachineKeySet = TRUE SMIME = False PrivateKeyArchive = FALSE UserProtected = FALSE UseExistingKeySet = FALSE ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12RequestType = PKCS10 KeyUsage = 0xa0

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1

;-----------------------------------------------

For more information on the .inf request file, see the Microsoft documentation, such ashttp://technet.microsoft.com/en-us/library/cc783835.aspx.

b. Generate the certificate request.

certreq -new request.inf request.req

c. Submit the request to the Active Directory CA. For example:

Page 455: Red Hat Directory Server 5.1

Step 3: Select or Create the Sync Identity

435

certreq -submit request.req certnew.cer

NOTEIf the command-line tool returns an error message, then use the Web browser toaccess the CA and submit the certificate request. If IIS is running, then the CAURL is http://servername/certsrv.

d. Accept the certificate request. For example:

certreq -accept certnew.cer

e. Make sure that the server certificate is present on the Active Directory server.

In the File menu, click Add/Remove, then click Certificates and Personal>Certificates.

f. Import the CA certificate from Directory Server into Active Directory. Click Trusted Root CA,then Import, and browse for the Directory Server CA certificate.

5. Reboot the domain controller.

To test that the server is running in SSL correctly, try searching the Active Directory over LDAPS.

9.2.3. Step 3: Select or Create the Sync IdentityThere are two users used to configure Windows Sync:

• An Active Directory user, specified in the sync agreement.

The user specified in the sync agreement is the entity as whom the Directory Server binds toActive Directory to send and receive updates. The Active Directory user should be a member ofthe Domain Admins group, or have equivalent rights, and must have rights to replicate directorychanges.

For information on adding users and setting privileges in Active Directory, see the Microsoftdocumentation.

• A Directory Server user, specified in the Password Sync Service.

The user referenced in the Password Sync Service must have read and write permissions to everyentry within the synchronized subtree and absolutely must have write access to password attributesin Directory Server so that Password Sync can update password changes.

NOTEThe user cited in the sync agreement (the supplier DN) exists on the Active Directoryserver. The user cited in the Password Sync configuration exists on Directory Server.

To create a sync user on Directory Server:

1. Create a new entry, such as cn=sync user,cn=config, with a password. For example:

Page 456: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

436

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=sync user,cn=config objectClass: inetorgperson objectClass: person objectClass: top cn: sync usersn: SU userPassword: secret passwordExpirationTime: 20380119031407Z

2. Set an ACI that grants the sync user access to compare and write user passwords.

The ACI must be set at the top of the subtree which will be synchronized. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: ou=People,dc=example,dc=comchangetype: modifyadd: aciaci: (targetattr="userPassword")(version 3.0;aci "password sync";allow (write,compare) userdn="ldap:///cn=sync user,cn=config";)

For security reasons, the Password Sync user should not be Directory Manager and should not bepart of the synchronized subtree.

9.2.4. Step 4: Install the Password Sync ServicePassword Sync can be installed on every domain controller in the Active Directory domain in order tosynchronize Windows passwords.

Passwords can only be synchronized if both the Directory Server and Windows server are runningin SSL, the sync agreement is configured over an SSL connection, and certificate databases areconfigured for Password Sync to access.

1. Download the PassSync.msi file from the appropriate Directory Server channel in Red HatNetwork and save it to the Active Directory machine.

IMPORTANTAlthough the Password Sync packages are listed in every Directory Server channelin Red Hat Network (Solaris, Red Hat Enterprise Linux 32-bit and Red Hat EnterpriseLinux 64-bit), Password Sync is only supported on 32-bit Windows machines.

2. Double-click on the PassSync.msi file to install it.

3. The Password Sync Setup window appears. Hit Next to begin installing.

4. Fill in the Directory Server hostname, secure port number, user name (such as cn=syncuser,cn=config), the certificate token (password), and the search base (e.g.,ou=People,dc=example,dc=com).

Page 457: Red Hat Directory Server 5.1

Step 4: Install the Password Sync Service

437

Hit Next, then Finish to install Password Sync.

5. Reboot the Windows machine to start Password Sync.

NOTEThe Windows machine must be rebooted. Without the rebooting,PasswordHook.dll is not enabled, and password synchronization will not function.

The first attempt to synchronize passwords, which happened when the Password Sync applicationis installed, will always fail because the SSL connection between the Directory Server and ActiveDirectory sync peers. The tools to create the certificate and key databases is installed with the .msi.

Password Sync and many of its libraries are installed in C:\Program Files\Red Hat DirectoryPassword Synchronization. All of the files installed with Password Sync are listed in Table 9.1,“Installed Password Sync Libraries”.

Directory Library Directory Library

C:\WINDOWS\system32

passhook.dll C:\WINDOWS\system32

libnspr4.dll

Page 458: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

438

Directory Library Directory Library

C:\WINDOWS\system32

nss3.dll C:\WINDOWS\system32

sqlite3.dll

C:\WINDOWS\system32

softokn3.dll C:\WINDOWS\system32

nssdbm3.dll

C:\WINDOWS\system32

nssutil3.dll

C:\WINDOWS\system32

smime3.dll C:\WINDOWS\system32

freebl3.dll

C:\ProgramFiles\Red HatDirectory PasswordSynchronization

nsldap32v60.dll C:\ProgramFiles\Red HatDirectory PasswordSynchronization

certutil.exe

C:\ProgramFiles\Red HatDirectory PasswordSynchronization

nsldappr32v60.dll C:\ProgramFiles\Red HatDirectory PasswordSynchronization

nsldapssl32v60.dll

C:\WINDOWS\system32

ssl3.dll C:\WINDOWS\system32

libplc4.dll

C:\ProgramFiles\Red HatDirectory PasswordSynchronization

nssckbi.dll C:\ProgramFiles\Red HatDirectory PasswordSynchronization

nsldif32v60.dll

C:\ProgramFiles\Red HatDirectory PasswordSynchronization

passsync.log1 C:\ProgramFiles\Red HatDirectory PasswordSynchronization

passsync.exe

C:\ProgramFiles\Red HatDirectory PasswordSynchronization

pk12util.exe C:\ProgramFiles\Red HatDirectory PasswordSynchronization

msvcr71.dll

C:\WINDOWS\system32

libplds4.dll

This log file is not an installed library, but it is created at installation.

Table 9.1. Installed Password Sync Libraries

9.2.5. Step 5: Configure the Password Sync ServiceNext, set up certificates that Password Sync uses to access the Directory Server over SSL:

NOTESSL is required for Password Sync to send passwords to Directory Server. The servicewill not send the passwords except over SSL to protect the clear text password sent fromthe Active Directory machine to the Directory Server machine. This means that PasswordSync will not work until SSL is configured.

Page 459: Red Hat Directory Server 5.1

Step 6: Configure the Directory Server Database for Synchronization

439

1. On the Directory Server, export the server certificate.

cd /etc/dirsrv/slapd-instance_namecertutil -d . -L -n "CA certificate" -a > dsca.crt

2. Copy the exported certificate from the Directory Server to the Windows machine.

3. Open a command prompt on the Windows machine, and open the Password Sync installationdirectory.

cd "C:\Program Files\Red Hat Directory Password Synchronization"

4. Create new cert8.db and key.db databases on the Windows machine.

certutil.exe -d . -N

5. Import the server certificate from the Directory Server into the new certificate database.

certutil.exe -d . -A -n "DS CA cert" -t CT,, -a -i \path\to\dsca.crt

6. Verify that the CA certificate was correctly imported.

certutil.exe -d . -L -n "DS CA cert"

7. Reboot the Windows machine. The Password Sync service is not available until after a systemreboot.

NOTEIf any Active Directory user accounts exist when Password Sync is first installed, thenthe passwords for those user accounts cannot be synchronized until they are changedbecause Password Sync cannot decrypt a password once it has been hashed in ActiveDirectory.

9.2.6. Step 6: Configure the Directory Server Database forSynchronizationJust as with replication, there must be a changelog available to track and send directory changes andthe Directory Server database being synchronized must be configured as a replica.

NOTEIf the Directory Server database is already configured for replication, this step is notnecessary.

Setting up a database for replication is described in Section 8.5.1, “Configuring the Read-WriteReplicas on the Supplier Servers”.

Page 460: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

440

9.2.6.1. Setting up the Directory Server from the ConsoleFirst, enable the changelog:

1. In the Directory Server Console, select the Configuration tab.

2. In the left-hand navigation tree, click the Replication folder.

3. In the main window, click the Supplier Settings tab.

4. Check the Enable Changelog database.

5. Set the changelog database directory. Click the Use default button to use the default or Browse...to select a custom directory.

6. Save the changelog settings.

After setting up the changelog, then configure the database that will be synchronized as a replica. Thereplica role should be either a single-master or multi-master.

1. In the Directory Server Console, select the Configuration tab.

2. In the left-hand navigation tree, click the Replication folder, then click the name of the database tosynchronize.

By default, there are two databases, NetscapeRoot for directory configuration and userRoot fordirectory entries. Other databases may be listed if they have been added to Directory Server.

3. Check the Enable Replica checkbox, and select the radio button by the type of replica which thedatabase is.

4. In the Update Settings section, either select or add a supplier DN. This is the user account aswhich synchronization process will be run. As mentioned in Section 9.2.3, “Step 3: Select orCreate the Sync Identity”, this user must be on the Active Directory server.

5. Save the replication settings for the database.

NOTEFor more information on replication settings, see Chapter 8, Managing Replication.

9.2.6.2. Setting up the Directory Server for Sync from the Command LineFirst, enable the changelog:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=changelog5,cn=configobjectclass: topobjectclass: extensibleObjectcn: changelog5nsslapd-changelogdir: /var/lib/dirsrv/slapd-instance_name/changelogdb

Then, create the supplier replica entry:

Page 461: Red Hat Directory Server 5.1

Step 7: Create the Synchronization Agreement

441

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=sync replica,cn="dc=example,dc=com",cn=mapping tree,cn=configobjectclass: topobjectclass: nsds5replicaobjectclass: extensibleObjectcn: sync replicansds5replicaroot: dc=example,dc=comnsds5replicaid: 7nsds5replicatype: 3nsds5flags: 1nsds5ReplicaPurgeDelay: 604800nsds5ReplicaBindDN: cn=sync user,cn=config

These different parameters are described in more detail in the Configuration, Command, and FileReference and Section 8.7.1, “Configuring Suppliers from the Command Line”.

9.2.7. Step 7: Create the Synchronization AgreementCreate the synchronization agreement.

9.2.7.1. Creating the Sync Agreement from the Console1. In the Directory Server Console, select the Configuration tab.

2. In the left-hand navigation tree, click Replication, then right-click on the database to sync. Thedefault user database is userRoot, but additional databases are added as new suffixes areadded to the Directory Server.

Alternatively, highlight the database, and in the top tool bar, click Object.

3. Select New Windows Sync Agreement from the menu.

4. In the two fields, supply a name and description of the synchronization agreement. Hit Next.

5. In the Windows Sync Server Info window, fill in the Active Directory information in the WindowsDomain Information area.

Page 462: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

442

• The name of the Windows domain.

• What kinds of entries to synchronize; users and groups are synchronized independently. Whena type of entry is chosen, then all of the entries of that type that are found in the Windowssubtree are created in the Directory Server.

• The Windows and Directory Server subtree information; this is automatically filled in.

Page 463: Red Hat Directory Server 5.1

Step 7: Create the Synchronization Agreement

443

• The hostname of the domain controller

• The Windows server's port number

6. Set the connection type. There are three options:

• Use LDAP. This sets either a standard, unencrypted connection.

• Use TLS/SSL. This uses a secure connection over the server's secure LDAPS port, such as636. Both the Directory Server and the Windows server must be properly configured to run inTLS/SSL for this connection and must have installed each other's CA certificates in order totrust their server certificates.

• Use Start TLS. This uses Start TLS to establish a secure connection over the server's standardport. Like regular SSL, these peer servers must be able to trust each other's certificates.

Using either TLS/SSL or Start TLS is recommended for security reasons. TLS/SSL or Start TLSis required for synchronizing passwords because Active Directory refuses to modify passwordsunless the connection is SSL-protected.

7. Fill in the authentication information in the Bind as... and Password fields with the sync IDinformation. This user must exist in the Active Directory domain.

8. Save the sync agreement.

NOTEBy default, Win Sync polls the Active Directory peer every five (5) minutes to check forchanges. In the sync agreement summary, this is displayed as the Update Interval. Theupdate interval can be changed by editing the winSyncInterval attribute manually. SeeSection 9.7, “Modifying the Sync Agreement”.

When the agreement is complete, the new sync agreement is listed under the suffix.

9.2.7.2. Creating the Sync Agreement from the Command LineIt is also possible to add the sync agreement through the command line.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ExampleSyncAgreement,cn=sync replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsDSWindowsReplicationAgreementcn: ExampleSyncAgreementnsds7WindowsReplicaSubtree: cn=Users,dc=ad1nsds7DirectoryReplicaSubtree: ou=People, dc=example,dc=comnsds7NewWinUserSyncEnabled: onnsds7NewWinGroupSyncEnabled: onnsds7WindowsDomain: ad1nsDS5ReplicaRoot: dc=example,dc=comnsDS5ReplicaHost: ad1.windows-server.comnsDS5ReplicaPort: 389nsDS5ReplicaBindDN: cn=sync user,cn=config

Page 464: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

444

nsDS5ReplicaBindCredentials: {DES}ffGad646dT0nnsT8nJOaMA==nsDS5ReplicaTransportInfo: TLSwinSyncInterval: 1200

All of the different parameters used in the sync agreement are listed in Table 9.6, “Sync AgreementAttributes”. These different parameters are described in more detail in the Configuration, Command,and File Reference.

9.2.8. Step 8: Configure Directory Server User and Group Entries forSynchronizationAdd the ntUser and ntGroup object classes to any user and group entries, respectively, which willbe synchronized, along with any required attributes. Only Directory Server entries with those objectclasses are synchronized. Active Directory entries which are synced over to Directory Server havethose object classes automatically.

Whenever the appropriate object classes are added to an entry, both for new entries and existingentries, the entry is synced over at the next incremental update.

Configuring Directory Server user entries for synchronization is described in Section 9.3.3,“Configuring User Sync for Directory Server Users”, and configuring Directory Server group entries forsynchronization is described in Section 9.4.4, “Configuring Group Sync for Directory Server Groups”.

9.2.9. Step 9: Begin SynchronizationAfter the sync agreement is created, begin the synchronization process.

1. Go to the Configuration tab in the Console.

2. Open the Replication folder and expand the appropriate database.

3. Select the sync agreement.

4. Right-click on the agreement or open the Object menu.

5. Select Initiate Full Re-synchronization.

Page 465: Red Hat Directory Server 5.1

Synchronizing Users

445

If synchronization stops for any reason, begin another total update (resynchronization) by selectingthis from the sync agreement menu. Beginning a total update (resynchronization) will not delete oroverwrite the databases.

9.3. Synchronizing UsersUsers are not automatically synced between Directory Server and Active Directory. Synchronizationboth directions has to be configured:

• Users in the Active Directory domain are synced if it is configured in the sync agreement byselecting the Sync New Windows Users option. All of the Windows users are copied to theDirectory Server when synchronization is initiated and then new users are synced over when theyare created.

• A Directory Server user account is synchronized to Active Directory through specific attributes thatare present on the Directory Server entry. Any Directory Server entry must have the ntUser objectclass and the ntUserCreateNewAccount attribute; the ntUserCreateNewAccount attribute(even on an existing entry) signals Directory Server Win Syn to write the entry over to the ActiveDirectory server.

New or modified user entries with the ntUser object class added are created and synced over tothe Windows machine at the next regular update, which is a standard poll of entry.

NOTEA user is not active on the Active Directory domain until it has a password. When anexisting user is modified to have the required Windows attributes, that user entry will besynced over to the Active Directory domain, but will not be able to log in until the passwordis changed on the Directory Server side or an administrator sets the password on ActiveDirectory. This is because passwords stored in the Directory Server are encrypted, andPassword Sync cannot sync already encrypted passwords.

To make the user active on the Active Directory domain, reset the user's password.

All synchronized entries in the Directory Server, whether they originated in the Directory Server or inActive Directory, have special synchronization attributes:

• ntUserDomainId. This corresponds to the sAMAccountName attribute for Active Directory entries.

• ntUniqueId. This contains the value of the objectGUID attribute for the corresponding Windowsentry. This attribute is set by the synchronization process and should not be set or modifiedmanually.

• ntUserDeleteAccount. This attribute is set automatically when a Windows entry is synced over butmust be set manually for Directory Server entries. If ntUserDeleteAccount has the value true,the corresponding Windows entry be deleted when the Directory Server entry is deleted. Otherwise,the entry remains in Active Directory, but is removed from the Directory Server database if it isdeleted in the Directory Server.

Setting ntUserCreateNewAccount and ntUserDeleteAccount on Directory Server entriesallows the Directory Manager precise control over which users within the synchronized subtree aresynced on Active Directory.

Page 466: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

446

9.3.1. User Attributes Synchronized between Directory Server andActive DirectoryOnly a subset of Directory Server and Active Directory attributes are synchronized. These attributesare hard-coded and are defined regardless of which way the entry is being synchronized. Any otherattributes present in the entry, either in Directory Server or in Active Directory, remain unaffected bysynchronization.

Some attributes used in Directory Server and Active Directory are identical. These are usuallyattributes defined in an LDAP standard, which are common among all LDAP services. These attributesare synchronized to one another exactly. Table 9.3, “User Schema That Are the Same in DirectoryServer and Windows Servers” shows attributes that are the same between the Directory Server andWindows servers.

Some attributes define the same information, but the names of the attributes or their schemadefinitions are different. These attributes are mapped between Active Directory and Directory Server,so that attribute A in one server is treated as attribute B in the other. For synchronization, many ofthese attributes relate to Windows-specific information. Table 9.2, “User Schema Mapped betweenDirectory Server and Active Directory” shows the attributes that are mapped between the DirectoryServer and Windows servers.

For more information on the differences in ways that Directory Server and Active Directory handlesome schema elements, see Section 9.3.2, “User Schema Differences between Red Hat DirectoryServer and Active Directory”.

Directory Server Active Directory

cn1 name

ntUserDomainId sAMAccountName

ntUserHomeDir homeDirectory

ntUserScriptPath scriptPath

ntUserLastLogon lastLogon

ntUserLastLogoff lastLogoff

ntUserAcctExpires accountExpires

ntUserCodePage codePage

ntUserLogonHours logonHours

ntUserMaxStorage maxStorage

ntUserProfile profilePath

ntUserParms userParameters

ntUserWorkstations userWorkstations

The cn is treated differently than other synced attributes. It is mapped directly (cn to cn) when syncing from Directory Serverto Active Directory. When syncing from Active Directory to Directory Server, however, cn is mapped from the name attribute onWindows to the cn attribute in Directory Server.

Table 9.2. User Schema Mapped between Directory Server and Active Directory

cn1 physicalDeliveryOfficeName

description postOfficeBox

Page 467: Red Hat Directory Server 5.1

User Schema Differences between Red Hat Directory Server and Active Directory

447

destinationIndicator postalAddress

facsimileTelephoneNumber postalCode

givenname registeredAddress

homePhone sn

homePostalAddress st

initials street

l telephoneNumber

mail teletexTerminalIdentifier

mobile telexNumber

o title

ou usercertificate

pager x121Address

The cn is treated differently than other synced attributes. It is mapped directly (cn to cn) when syncing from Directory Serverto Active Directory. When syncing from Active Directory to Directory Server, however, cn is mapped from the name attribute onWindows to the cn attribute in Directory Server.

Table 9.3. User Schema That Are the Same in Directory Server and Windows Servers

9.3.2. User Schema Differences between Red Hat Directory Serverand Active DirectoryAlthough Active Directory supports the same basic X.500 object classes as Directory Server, there area few incompatibilities of which administrators should be aware.

9.3.2.1. Values for cn AttributesIn Directory Server, the cn attribute can be multi-valued, while in Active Directory this attribute musthave only a single value. When the Directory Server cn attribute is synchronized, then, only one valueis sent to the Active Directory peer.

What this means for synchronization is that,potentially, if a cn value is added to an Active Directoryentry and that value is not one of the values for cn in Directory Server, then all of the Directory Servercn values are overwritten with the single Active Directory value.

One other important difference is that Active Directory uses the cn attribute attribute as its namingattribute, where Directory Server uses uid. This means that there is the potential to rename theentry entirely (and accidentally) if the cn attribute is edited in the Directory Server. If that cn changeis written over to the Active Directory entry, then the entry is renamed, and the new named entry iswritten back over to Directory Server.

9.3.2.2. Password PoliciesBoth Active Directory and Directory Server can enforce password policies such as password minimumlength or maximum age. Windows Sync makes no attempt to ensure that the policies are consistent,enforced, or synchronized. If password policy is not consistent in both Directory Server and ActiveDirectory, then password changes made on one system may fail when synced to the other system.The default password syntax setting on Directory Server mimics the default password complexity rulesthat Active Directory enforces.

Page 468: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

448

9.3.2.3. Values for street and streetAddressActive Directory uses the attribute streetAddress for a user or group's postal address; this isthe way that Directory Server uses the street attribute. There are two important differences in theway that Active Directory and Directory Server use the streetAddress and street attributes,respectively:

• In Directory Server, streetAddress is an alias for street. Active Directory also has thestreet attribute, but it is a separate attribute that can hold an independent value, not an alias forstreetAddress.

• Active Directory defines both streetAddress and street as single-valued attributes, whileDirectory Server defines street as a multi-valued attribute, as specified in RFC 4519.

Because of the different ways that Directory Server and Active Directory handle streetAddress andstreet attributes, there are two rules to follow when setting address attributes in Active Directory andDirectory Server:

• Windows Sync maps streetAddress in the Windows entry to street in Directory Server. Toavoid conflicts, the street attribute should not be used in Active Directory.

• Only one Directory Server street attribute value is synced to Active Directory. If thestreetAddress attribute is changed in Active Directory and the new value does not already existin Directory Server, then all street attribute values in Directory Server are replaced with the new,single Active Directory value.

9.3.2.4. Constraints on the initials AttributeFor the initials attribute, Active Directory imposes a maximum length constraint of six characters,but Directory Server does not have a length limit. If an initials attribute longer than six charactersis added to Directory Server, the value is trimmed when it is synchronized with the Active Directoryentry.

9.3.3. Configuring User Sync for Directory Server UsersFor Directory Server users to be synchronized over to Active Directory, the user entries must have theappropriate sync attributes set.

9.3.3.1. Configuring User Sync in the Console1. In the Directory Server Console, select the Directory tab.

2. For an existing entry, right-click the entry, and click Properties to open the property editor for theentry.

For a new entry, right-click the main entry in the left window to add the new entry, select User, andthen fill in the required entry attributes.

3. On the left side of the Property Editor, click the NT User link.

4. In the NT User tab, check the Enable NT Attributes checkbox.

Page 469: Red Hat Directory Server 5.1

Configuring User Sync for Directory Server Users

449

5. To enable synchronization, two fields are required:

• Setting a NT User ID

• Selecting the Create New NT Account checkbox

6. Selecting the Delete NT Account checkbox means that the corresponding Windows user isdeleted if the Directory Server entry is deleted.

7. Set the other Windows attributes. These attributes are mapped to relevant Windows attributes.

Additional ntUser attributes can be created either by using the Advanced button; seeSection 3.2.4.2, “Modifying Entries Using ldapmodify”.

TIPReset the user's password.

A user is not active on the Active Directory domain until it has a password. When anexisting user is modified to have the required Windows attributes, that user entry will besynced over to the Active Directory domain, but will not be able to log in until the passwordis changed on the Directory Server side or an administrator sets the password on ActiveDirectory. Password Sync cannot sync encrypted passwords.

Page 470: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

450

So, to make the user active on the Active Directory domain, reset the user's password.

9.3.3.2. Configuring User Sync in the Command LineTo enable synchronization through the command line, add the required sync attributes to an entry orcreate an entry with those attributes.

Three schema elements are required for synchronization:

• The ntUser object class

• The ntUserDomainId attribute, to give the Windows ID

• The ntUserCreateNewAccount attribute, to signal to the synchronization plug-in to sync theDirectory Server entry over to Active Directory

For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: uid=scarter, ou=People, dc=example,dc=comchangetype: modifyadd: objectClassobjectClass:ntUser

add: ntUserDomainIdntUserDomainId: Sam Carter

add: ntUserCreateNewAccountntUserCreateNewAccount: true

add: ntUserDeleteAccountntUserDeleteAccount: true

Many additional Windows and user attributes can be added to the entry. All of the schema which issynchronized is listed in Section 9.3.1, “User Attributes Synchronized between Directory Server andActive Directory”. Windows-specific attributes, belonging to the ntUser object class, are described inmore detail in the Schema Reference.

TIPReset the user's password.

A user is not active on the Active Directory domain until it has a password. When anexisting user is modified to have the required Windows attributes, that user entry will besynced over to the Active Directory domain, but will not be able to log in until the passwordis changed on the Directory Server side or an administrator sets the password on ActiveDirectory. Password Sync cannot sync encrypted passwords.

So, to make the user active on the Active Directory domain, reset the user's password.

Page 471: Red Hat Directory Server 5.1

Configuring User Sync for Active Directory Users

451

9.3.4. Configuring User Sync for Active Directory UsersSynchronization for Windows users (users which originate in the Active Directory domain) isconfigured in the sync agreement.

9.3.4.1. Configuring User Sync in the Console1. Open the Configuration tab and expand the Replication folder.

2. Open the appropriate database, and select the sync agreement.

3. Open the Connection tab.

4. Check the New Windows User Sync checkbox to enable users sync. To disable sync, uncheckthe box.

For new sync agreements, select the corresponding users sync checkbox in the sync agreementcreation wizard.

9.3.4.2. Configuring User Sync in the Command LineThe attribute to set Active Directory user sync is nsds7NewWinUserSyncEnabled and is set onthe sync agreement. To enable user sync, add this attribute to the sync agreement or create a syncagreement with this attribute set to on:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ExampleSyncAgreement, cn=userRoot, cn="dc=example, dc=com", cn=mapping tree, cn=configchangetype: modifyreplace: nsds7NewWinUserSyncEnabled

Page 472: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

452

nsds7NewWinUserSyncEnabled: on

To disable user sync, set nsds7NewWinUserSyncEnabled: off.

9.4. Synchronizing GroupsLike user entries, groups are not automatically synced between Directory Server and Active Directory.Synchronization both directions has to be configured:

• Groups in the Active Directory domain are synced if it is configured in the sync agreement byselecting the Sync New Windows Groups option. All of the Windows groups are copied to theDirectory Server when synchronization is initiated and then new groups are synced over as they arecreated.

• A Directory Server group account is synchronized to Active Directory through specific attributes thatare present on the Directory Server entry. Any Directory Server entry must have the ntGroup objectclass and the ntGroupCreateNewGroup attribute; the ntGroupCreateNewGroup attribute (evenon an existing entry) signals Directory Server Win Syn to write the entry over to the Active Directoryserver.

New or modified groups that have the ntGroup object class are created and synced over to theWindows machine at the next regular update.

IMPORTANTWhen a group is synced, the list of all of its members is also synced. However, themember entries themselves are not synced unless user sync is enabled and applies tothose entries.

This could created a problem is an application or service tries to do a modify operationon all members in a group on the Active Directory server, and some of those users do notexist.

Additionally, groups have a few other common attributes:

• Two attributes control whether Directory Server groups are created and deleted on Active Directory,ntGroupCreateNewGroup and ntGroupDeleteGroup.

ntGroupCreateNewGroup is required to sync Directory Server groups over to Active Directory.

• ntUserDomainId contains the unique ID for the entry on the Active Directory domain. This is the onlyrequired attribute for the ntGroup object class.

• ntGroupType is the type of Windows group. Windows group types are global/security, domainlocal/security, global/distribution, or domain local/distribution. This is set automatically for Windowsgroups that are synchronized over, but this attribute must be set manually on Directory Serverentries before they can be synced.

9.4.1. About Windows Group TypesIn Active Directory, there are two major types of groups: security and distribution. Security groupsare most similar to groups in Directory Server, since security groups can have policies configuredfor access controls, resource restrictions, and other permissions. Distribution groups are for mailing

Page 473: Red Hat Directory Server 5.1

Group Attributes Synchronized between Directory Server and Active Directory

453

distribution. These are further broken down into global and local groups. The Directory ServerntGroupType supports all four group types:

• -21483646 for global/security (the default)

• -21483644 for domain local/security

• 2 for global/distribution

• 4 for domain local/distribution

9.4.2. Group Attributes Synchronized between Directory Server andActive DirectoryOnly a subset of Directory Server and Active Directory attributes are synchronized. These attributesare hard-coded and are defined regardless of which way the entry is being synchronized. Any otherattributes present in the entry, either in Directory Server or in Active Directory, remain unaffected bysynchronization.

Some attributes used in Directory Server and Active Directory group entries are identical. These areusually attributes defined in an LDAP standard, which are common among all LDAP services. Theseattributes are synchronized to one another exactly. Table 9.5, “Group Entry Attributes That Are theSame between Directory Server and Active Directory” shows attributes that are the same between theDirectory Server and Windows servers.

Some attributes define the same information, but the names of the attributes or their schemadefinitions are different. These attributes are mapped between Active Directory and Directory Server,so that attribute A in one server is treated as attribute B in the other. For synchronization, many ofthese attributes relate to Windows-specific information. Table 9.4, “Group Entry Attribute Mappingbetween Directory Server and Active Directory” shows the attributes that are mapped between theDirectory Server and Windows servers.

For more information on the differences in ways that Directory Server and Active Directory handlesome schema elements, see Section 9.4.3, “Group Schema Differences between Red Hat DirectoryServer and Active Directory”.

Directory Server Active Directory

cn name

ntGroupDomainID name

ntGroupType groupType

uniqueMembermember

Member1

The Member attribute in Active Directory is synced to the uniqueMember attribute in Directory Server.

Table 9.4. Group Entry Attribute Mapping between Directory Server and Active Directory

cn o

description ou

l seeAlso

mail

Table 9.5. Group Entry Attributes That Are the Same between Directory Server and Active Directory

Page 474: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

454

9.4.3. Group Schema Differences between Red Hat Directory Serverand Active DirectoryAlthough Active Directory supports the same basic X.500 object classes as Directory Server, there area few incompatibilities of which administrators should be aware.

Nested groups (where a group contains another group as a member) are supported and for WinSyncare synchronized. However, Active Directory imposes certain constraints as to the composition ofnested groups. For example, a global group contain a domain local group as a member. DirectoryServer has no concept of local and global groups, and, therefore, it is possible to create entries on theDirectory Server side that violate Active Directory's constraints when synchronized.

9.4.4. Configuring Group Sync for Directory Server GroupsFor Directory Server groups to be synchronized over to Active Directory, the group entries must havethe appropriate sync attributes set.

9.4.4.1. Configuring Group Sync in the Console1. In the Directory Server Console, select the Directory tab.

2. Right-click the group entry, and click Advanced to open the advanced property editor for the entry.All of the sync-related attributes must be added manually, so only the advanced property editorcan set the attributes.

3. Click the objectClasses field, and then click the Add Value button.

4. Select the ntGroup object class.

Page 475: Red Hat Directory Server 5.1

Configuring Group Sync for Directory Server Groups

455

5. Setting the ntGroup object class automatically adds the ntUserDomainId attribute. Thisattribute is required, so add a value.

6. To enable synchronization, click the Add Attribute button, and select thentGroupCreateNewGroup attribute from the list. Then, set its value to on. This signals to thesync plug-in that the entry should be added to the Active Directory directory.

To delete the group entry from the Active Directory domain if it is deleted from the Directory Serverdatabase, set the ntGroupDeleteGroup attribute and set it to on.

7. Add any other Windows attributes for the Directory Server entry. The available attributes are listedin Section 9.4.2, “Group Attributes Synchronized between Directory Server and Active Directory”.

If the ntGroupType is not added, then the group is automatically added as a global securitygroup (ntGroupType:-21483646).

9.4.4.2. Configuring Group Sync in the Command LineTo enable synchronization through the command line, add the required sync attributes to an entry orcreate an entry with those attributes.

Three schema elements are required for synchronization:

• The ntGroup object class.

• The ntUserDomainId attribute, to give the Windows ID for the entry.

• The ntGroupCreateNewGroup attribute, to signal to the synchronization plug-in to sync theDirectory Server entry over to Active Directory.

The ntGroupDeleteGroup attribute is optional, but this sets whether to delete the entryautomatically from the Active Directory domain if it is deleted in the Directory Server.

It is also recommended to the ntGroupType attribute. If this attribute is not specified, then the groupis automatically added as a global security group (ntGroupType:-21483646).

For example:

Page 476: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

456

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=Example Group, ou=Groups, dc=example,dc=comchangetype: modifyadd: objectClassobjectClass:ntGroup

add: ntUserDomainIdntUserDomainId: example-group

add: ntGroupCreateNewGroupntGroupCreateNewGroup: true

add: ntGroupDeleteGroupntGroupDeleteGroup: true

add: ntGroupTypentGroupType: 2

Many additional Windows and group attributes can be added to the entry. All of the schema which issynchronized is listed in Section 9.4.2, “Group Attributes Synchronized between Directory Server andActive Directory”. Windows-specific attributes, belonging to the ntGroup object class, are described inmore detail in the Schema Reference.

9.4.5. Configuring Group Sync for Active Directory GroupsSynchronization for Windows users (users which originate in the Active Directory domain) isconfigured in the sync agreement.

9.4.5.1. Configuring Group Sync in the Console1. Open the Configuration tab and expand the Replication folder.

2. Open the appropriate database, and select the sync agreement.

3. Open the Connection tab.

4. Check the New Windows Group Sync checkbox to enable group sync. To disable sync, uncheckthe box.

Page 477: Red Hat Directory Server 5.1

Deleting and Resurrecting Entries

457

For new sync agreements, select the corresponding group sync checkbox in the sync agreementcreation wizard.

9.4.5.2. Configuring Group Sync in the Command LineThe attribute to set Active Directory group sync is nsds7NewWinGroupSyncEnabled and is set onthe sync agreement. To enable group sync, add this attribute to the sync agreement or create a syncagreement with this attribute set to on:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ExampleSyncAgreement, cn=userRoot, cn="dc=example, dc=com", cn=mapping tree, cn=configchangetype: modifyreplace: nsds7NewWinGroupSyncEnablednsds7NewWinGroupSyncEnabled: on

To disable group sync, set nsds7NewWinGroupSyncEnabled: off.

9.5. Deleting and Resurrecting EntriesThis section describes how enabling synchronization affects deleted entries on the sync peers andhow resurrected entries are handled.

9.5.1. Deleting EntriesAll changes on an Active Directory peers are always synced back to the Directory Server. This meansthat when an Active Directory group or user account is deleted on the Active Directory domain, thedeletion is automatically synced back to the Directory Server sync peer server.

On Directory Server, on the other hand, when a Directory Server account is deleted, the correspondingentry on Active Directory is only deleted if the Directory Server entry has the ntUserDeleteAccountor ntGroupDeleteGroup attribute set to true.

NOTEWhen a Directory Server entry is synchronized over to Active Directory for the firsttime, Active Directory automatically assigns it a unique ID. At the next synchronizationinterval, the unique ID is synchronized back to the Directory Server entry and stored asthe ntUniqueId attribute. If the Directory Server entry is deleted on Active Directorybefore the unique ID is synchronized back to Directory Server, the entry will not be deletedon Directory Server. Directory Server uses the ntUniqueId attribute to identify andsynchronize changes made on Active Directory to the corresponding Directory Serverentry; without that attribute, Directory Server will not recognize the deletion.

Page 478: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

458

To delete the entry on Active Directory and then synchronize the deletion over to DirectoryServer, wait the length of the winSyncInterval (by default, five minutes) after the entryis created before deleting it so that the ntUniqueId attribute is synchronized.

9.5.2. Resurrecting EntriesIt is possible to add deleted entries back in Directory Server; the deleted entries are called tombstoneentries. When a deleted entry which was synced between Directory Server and Active Directory is re-added to Directory Server, the resurrected Directory Server entry has all of its original attributes andvalues. This is called tombstone reanimation. The resurrected entry includes the original ntUniqueIdattribute which was used to synchronize the entries, which signals to the Active Directory server thatthis new entry is a tombstone entry.

The way that tombstone entries are handled is different between Windows Server 2000 and WindowsServer 2003:

• On Windows 2000, Active Directory creates a new entry with a new unique ID; this new ID is syncedback to the Directory Server entry.

• On Windows 2003, Active Directory resurrects the old entry and preserves the original unique ID forthe entry.

For Active Directory entries on both on Windows 2000 and 2003, when the tombstone entry isresurrected on Directory Server, all of the attributes of the original Directory Server are retained andare still included in the resurrected Active Directory entry.

9.6. Sending Synchronization UpdatesSynchronization occurs as frequently as is set in the winSyncInterval setting (for retrievingchanges from the Active Directory domain) or nsds5replicaupdateschedule setting (for pushingchanges from the Directory Server). By default, changes are retrieved from Active Directory every fiveminutes, and changes from the Directory Server are sent immediately.

A sync update can be triggered manually. It is also possible to do a full resynchronization, whichsends and pulls every entry in the Directory Server and Active Directory as if it were new. A fullresynchronization includes existing Directory Server entries which may not have previously beensynchronized.

9.6.1. Performing a Manual Sync UpdateDuring normal operations, all the updates made to entries in the Directory Server that need to be sentto Active Directory are collected the changelog and then replayed during an incremental update.

1. Go to the Configuration tab in the Console.

2. Open the Replication folder and expand the appropriate database.

3. Select the sync agreement.

4. Right-click on the agreement or open the Object menu.

5. Select Send and Receive Updates from the drop down menu.

Page 479: Red Hat Directory Server 5.1

Sending a Total Update (Full Synchronization)

459

9.6.2. Sending a Total Update (Full Synchronization)If there have been major changes to data, or synchronization attributes are added to pre-existingDirectory Server entries, it is necessary to initiate a resynchronization. Resynchronization is a totalupdate; the entire contents of synchronized subtrees are examined and, if necessary, updated.Resynchronization is done without using the changelog. This is similar to initializing or reinitializing aconsumer in replication.

1. Go to the Configuration tab in the Console.

2. Open the Replication folder and expand the appropriate database.

3. Select the sync agreement.

4. Right-click on the agreement or open the Object menu.

5. Select Initialize Full Re-synchronization from the drop down menu.

Resynchronizing will not delete data on the sync peer; it sends and receives all updates and addany new or modified Directory Server entries; for example, it adds a pre-existing Directory Serveruser that had the ntUser object class added.

Page 480: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

460

9.6.3. Sending Sync Updates in the Command LineTo send sync updates through the command line, add the nsDS5BeginReplicaRefresh attribute tothe sync agreement. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ExampleSyncAgreement,cn=sync replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: modifyadd: nsDS5BeginReplicaRefreshnsDS5BeginReplicaRefresh: start

This attribute is removed from the entry as soon as the update is complete.

NOTEThis initiates a full synchronization for the entire database, not an incremental update ofrecent changes.

9.6.4. Checking Synchronization StatusCheck synchronization status in the Replication tab in the Status of the Console. Highlight thesynchronization agreement to monitor, and the relevant information should appear in the right-handpane. The Status area shows whether the last incremental and total updates were successful andwhen they occurred.

1. Go to the Configuration tab in the Console.

2. Open the Replication folder and expand the appropriate database.

3. Select the sync agreement.

4. In the Summary tab, the status of the latest sync process is shown at the bottom.

Page 481: Red Hat Directory Server 5.1

Modifying the Sync Agreement

461

9.7. Modifying the Sync AgreementCertain attributes of the sync agreement can be modified, including the connection information. Usingthe command line, many additional parameters can be created with or added to the sync agreement,including changing the sync interval and setting a sync schedule.

9.7.1. Editing the Sync Agreement in the ConsoleMost of the information which can be edited in the Console is limited to connection information,including the protocol to use and the bind credentials. It is also possible to edit the sync agreementdescription.

1. In the Configuration tab, expand the Replication folder.

2. Expand the database being synced. All of the synchronization agreements are listed below thedatabase. Double-click the sync agreement to open it in the main window.

Page 482: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

462

3. Click the Connection tab.

There are three areas of information that can be edited.

• The connection type (standard, TLS/SSL, and Start TLS).

• The bind user, both DN and password.

• Whether to sync new Directory Server users and new Directory Server groups automatically.

There are three options for the connection type — standard, TLS/SSL, and Start TLS — but thereare really only two connection protocols, LDAP and LDAPS. Both a standard connection and StartTLS connection use LDAP (Start TLS creates a secure connection over an insecure port).

It is not possible to change the connection protocol because it is not possible to change the portnumber used to connect to the Windows sync peer.

Page 483: Red Hat Directory Server 5.1

Adding and Editing the Sync Agreement in the Command Line

463

It is possible to change the connection type between the standard connection and Start TLS,but it is not possible to change from TLS/SSL to either the standard or Start TLS connections.Likewise, it is not possible to go from standard or Start TLS to TLS/SSL. If you need to change theconnection protocol or the port number, delete the sync agreement and create a new one.

9.7.2. Adding and Editing the Sync Agreement in the Command LineCreating or editing the sync agreement through the command line is more flexible and provides moreoptions than using the Directory Server Console. The full list of sync agreement attributes are listed inSection 9.7.2.4, “Sync Agreement Attributes” and described in the Configuration, Command, and FileReference.

9.7.2.1. Creating a Basic Sync AgreementThe most basic sync agreement defines the Directory Server database and the Active Directory syncpeer:

• For the Directory Server database:

• The replicated subtree in the directory (nsds7DirectoryReplicaSubtree)

• The Directory Server root DN (nsDS5ReplicaRoot)

• The replicated subtree in the directory (nsds7DirectoryReplicaSubtree)

• For the Active Directory domain:

• The replicated subtree in the Active Directory domain (nsds7WindowsReplicaSubtree)

• The Active Directory domain name (nsds7WindowsDomain)

It also defines the connection information that the Directory Server uses to bind to the Active Directorydomain:

• The Active Directory hostname (nsDS5ReplicaHost).

• The Active Directory port (nsDS5ReplicaPort).

• The type of connection (nsDS5ReplicaTransportInfo), which can be standard (LDAP), SSL(SSL), or Start TLS (TLS), which is a secure connection over a standard port.

• The username (nsDS5ReplicaBindDN) and password (nsDS5ReplicaBindCredentials) forthe Directory Server to use to bind to the Active Directory server.

For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=ExampleSyncAgreement,cn=sync replica,cn="dc=example,dc=com",cn=mapping tree,cn=configchangetype: addobjectclass: topobjectclass: nsDSWindowsReplicationAgreementcn: ExampleSyncAgreementnsds7WindowsReplicaSubtree: cn=Users,dc=ad1nsds7DirectoryReplicaSubtree: ou=People, dc=example,dc=com

Page 484: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

464

nsds7WindowsDomain: ad1nsDS5ReplicaRoot: dc=example,dc=comnsDS5ReplicaHost: ad1.windows-server.comnsDS5ReplicaPort: 389nsDS5ReplicaBindDN: cn=sync user,cn=confignsDS5ReplicaBindCredentials: {DES}ffGad646dT0nnsT8nJOaMA==nsDS5ReplicaTransportInfo: TLSnsds7NewWinUserSyncEnabled: onnsds7NewWinGroupSyncEnabled: on

9.7.2.2. Setting Sync SchedulesSynchronization works two ways. The Directory Server sends its updates to Active Directory on aconfigurable schedule, similar to replication, using the nsds5replicaupdateschedule attribute.The Directory Server polls the Active Directory to check for changes; the frequency that it checks theActive Directory server is set in the winSyncInterval attribute.

By default, the Directory Server update schedule is to always be in sync. The Active Directory intervalis to poll the Active Directory every five minutes.

To change the schedule the Directory Server uses to send its updates to the Active Directory, edit thensds5replicaupdateschedule attribute. The schedule is set with start (SSSS) and end (EEEE)times in the form HHMM, using a 24-hour clock. The days to schedule sync updates are use rangingfrom 0 (Sunday) to 6 (Saturday).

nsds5replicaupdateschedule: SSSS EEEE DDDDDDD

For example, this schedules synchronization to run from noon to 2:00pm on Sunday, Tuesday,Thursday, and Saturday:

nsds5replicaupdateschedule: 1200 1400 0246

NOTEThe synchronization times cannot wrap around midnight, so the setting 2300 0100 is notvalid.

To change how frequently the Directory Server checks the Active Directory for changes to ActiveDirectory entries, reset the winSyncInterval attribute. This attribute is set in seconds, so thedefault of 300 means that the Directory Server polls the Active Directory server every 300 seconds, orfive minutes. Setting this to a higher value can be useful if the directory searches are taking too longand affecting performance.

winSyncInterval: 1000

9.7.2.3. Changing Sync ConnectionsTwo aspects of the connection for the sync agreement can be altered:

• The bind username and password (nsDS5ReplicaBindDN andnsDS5ReplicaBindCredentials).

• The connection method (nsDS5ReplicaTransportInfo).

Page 485: Red Hat Directory Server 5.1

Adding and Editing the Sync Agreement in the Command Line

465

It is only possible to change the nsDS5ReplicaTransportInfo from LDAP to TLS and viceversa. It is not possible to change to or from SSL because it is not possible to change the portnumber, and switching between LDAP and LDAPS requires changing the port number.

For example:

nsDS5ReplicaBindDN: cn=sync user,cn=confignsDS5ReplicaBindCredentials: {DES}ffGad646dT0nnsT8nJOaMA==nsDS5ReplicaTransportInfo: TLS

CAUTIONIt is not possible to change the port number of the Active Directory sync peer. Therefore,it is also not possible to switch between standard/Start TLS connections and SSLconnections, since that requires changing between standard and insecure ports.

To change to or from SSL/TLS, delete the sync agreement and add it again with theupdated port number and new transport information.

9.7.2.4. Sync Agreement AttributesThe common sync agreement attributes are listed in Table 9.6, “Sync Agreement Attributes”. All of thepossible sync agreement attributes are described in detail in the Configuration, Command, and FileReference and Schema Reference.

Object Class or Attribute Description

nsDSWindowsReplicationAgreement An operational object class which contains thesync agreement attributes.

cn Gives the name for the sync agreement.

nsds7WindowsReplicaSubtree Specifies the Windows server suffix (root or sub)that is synced.

nsds7DirectoryReplicaSubtree Specifies the Directory Server suffix (root or sub)that is synced.

nsds7NewWinUserSyncEnabled Sets whether new Windows user accounts areautomatically created on the Directory Server.

nsds7NewWinGroupSyncEnabled Specifies whether new Windows group accountsare automatically created on the DirectoryServer.

nsds7WindowsDomain Identifies the Windows domainbeing synchronized; analogous tonsDS5ReplicaHost in a replication agreement.

nsds5replicaport Gives the LDAP port for the Windows server.

To use TLS/SSL, give the secure portnumber (636 by default) and set thensds5ReplicaTransportInfo attribute toSSL.

Page 486: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

466

Object Class or Attribute DescriptionTo use Start TLS, which initiates asecure connection over a standard port,use the standard port, 389, with thensds5ReplicaTransportInfo attribute toTLS.

nsds5replicatransportinfo To use TLS/SSL, set this parameter to SSL.

To use Start TLS, which initiates a secureconnection over a standard port, set thisparameter to TLS.

To use simple authentication, set this parameterto LDAP.

nsds5ReplicaBindDN The sync user DN used by the Directory Serverinstance to bind to the Windows server.

nsds5replicabindmethod The connection type for replication between theservers. The connection type defines how thesupplier authenticates to the consumer.

Leaving the bind method empty or settingit to SIMPLE means that the server usesbasic password-based authentication. Thisrequires the nsds5ReplicaBindDN andnsds5ReplicaCredentials attributes to givethe bind information.

The SSLCLIENTAUTH option uses a secureconnection. This requires setting thensds5ReplicaTransportInfo attribute beset to SSL or TLS.

nsds5replicabindcredentials Only for simple authentication. Stores thehashed password used with the bind DN givenfor simple authentication.

nsds5replicaroot Sets which Directory Server subtree isreplicated. Usually, it is recommended that thereplicated subtree be high in the directory treeso that the entire database is replicated. Forexample:

dc=example,dc=com

description A text description of the replication agreement.Make this a useful description so it is easier tomanage sync agreements.

nsds5replicaupdateschedule Sets the start and end time for the replicationupdates and the days on which replicationoccurs in the form start_time end_time days. Ifthe schedule is omitted, synchronization occursall of the time.

Page 487: Red Hat Directory Server 5.1

Configuring Unidirectional Synchronization

467

Object Class or Attribute Description

winSyncInterval Optional. Sets how frequently, in seconds, theDirectory Server polls the Windows server forupdates to write over. If this is not set, the defaultis 300, which is 300 seconds or five (5) minutes.

nsds5BeginReplicaRefresh Optional. Performs an online (immediate)initialization of the sync peer. If this is set, theattribute is only present as long as the sync peeris being updated initialized; when the initializationis complete, the attribute is deleted automatically.The only value when adding this attribute isstart.

Table 9.6. Sync Agreement Attributes

9.8. Configuring Unidirectional SynchronizationSynchronization has to be configured both ways. This means it is also possible to configuresynchronization only one way.

Directory Server synchronization is set by adding the appropriate attributes on the individual directoryentries. To configure synchronization from the Directory Server database to the Active Directoryserver, set the appropriate ntUser and ntGroup object classes and attributes on the user and groupentries, respectively.

Active Directory synchronization is configured in the sync agreement. To configure synchronizationfrom Active Directory to the Directory Server database, then set the New Windows Users Sync andNew Windows Groups Sync attributes in the synchronization agreement.

NOTEA synchronization agreement needs to be configured for both kinds of unidirectionalsynchronization.

To only sync Directory Server entries, then do not set the Active Directory sync attributes in the syncagreement. Likewise, to only synchronize Active Directory over to Directory Server, do not add anysync attributes to Directory Server entries.

9.9. Password Sync ServiceThe Password Sync Service must be installed on every Active Directory domain controller. The servicesynchronizes password changes made on Active Directory with the corresponding entries' passwordson the Directory Server. Like any Windows service, it can be modified, started and stopped, anduninstalled, depending on how synchronization between Directory Server and Active Directorychanges.

9.9.1. Modifying Password SyncTo reconfigure Password Sync, open the Windows Services panel, highlight Password Sync, andselect Modify. This goes back through the configuration screens.

Page 488: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

468

9.9.2. Starting and Stopping the Password Sync ServiceThe Password Sync Service is configured to start whenever the Active Directory host is started. Toreconfigure the service so that it does not start when Windows reboots:

1. Go to the Control Panel, and select Services.

2. Scroll through the list of services for the Password Sync Service. The Startup field is set toAutomatic.

3. Double-click on Password Sync.

4. Select the Manual radio button, and then click OK.

To start and stop Password Sync:

1. Go to the Control Panel, and select Services.

2. Scroll through the list of services for Password Sync, and right-click on it.

3. Select Stop or Start, and hit okay.

Changed passwords are captured even if Password Sync is not running. If Password Sync isrestarted, the password changes are sent to Directory Server at the next synchronization.

9.9.3. Uninstalling Password Sync ServiceTo uninstall the Password Sync Service:

1. Open the Add/Remove Programs utility.

2. Select click remove to uninstall the Password Sync Service.

3. If SSL was configured for the Password Sync, then the cert8.db and key3.db databases thatwere created were not removed when Password Sync was uninstalled. Delete these files by hand.

9.9.4. Upgrading Password SyncThe Password Sync service cannot be upgraded directly. However, the existing certificates, keys, andconfiguration can be applied to the new service if the new service is installed before the old one isremoved. Then, it is not necessary to reconfigure the service like new; it picks up the information itneeds from the registry.

1. Download the PassSync.msi file from the appropriate Directory Server channel in Red HatNetwork and save it to the Active Directory machine.

IMPORTANTAlthough the Password Sync packages are listed in every Directory Server channelin Red Hat Network (Solaris, Red Hat Enterprise Linux 32-bit and Red Hat EnterpriseLinux 64-bit), Password Sync is only supported on 32-bit Windows machines.

2. Double-click on the PassSync.msi file to install it.

Page 489: Red Hat Directory Server 5.1

Troubleshooting

469

3. All of the previous information should be included, so click Finish to install the new PasswordSync.

The previous SSL certificates and configuration is also preserved, so it is not necessary toreconfigure SSL.

4. Open the Add/Remove Programs window.

5. Select the older version of Password Sync and click the Remove button.

NOTECheck the version numbers to make sure the right Password Sync service isremoved.

6. Reboot the Windows machine to start Password Sync.

NOTEThe Windows machine must be rebooted. Without the rebooting,PasswordHook.dll is not enabled, and password synchronization will not function.

9.10. TroubleshootingIf synchronization does not seem to be functioning properly, see the Windows event log and/orDirectory Server error log for information on any potential problems.

Enable replication logging for more detailed information on synchronization to be recorded in theerror logs. Replication log levels produces more verbose logs from the sync code that can help indiagnosing problems.

1. In the Console, click the Configuration tab, select Logs from the navigation menu on the right,and open the error log.

2. Scroll down to error log level, and select Replication from the menu. Hit save.

For complete information on error log levels, refer to Red Hat Directory Server Configuration,Command, and File Reference.

Error #1: The message box when creating the sync agreement indicates that the itcannot connect to Active Directory.Make sure that the directory suffixes, Windows domain and domain host, and the administrator DNand password are correct. Also verify that the port numbers used for LDAPS is correct. If all of this iscorrect, make sure that Active Directory or the Windows machine are running.

Error #2: After synchronization, the status returns error 81.One of the sync peer servers has not been properly configured for SSL communication. Examine theDirectory Server access log file to see if the connection attempt was received by the Directory Server.There are also helpful messages in the Directory Server's error log file.

Page 490: Red Hat Directory Server 5.1

Chapter 9. Synchronizing Red Hat Directory Server with Microsoft Active Directory

470

To narrow down the source of the misconfiguration, try to establish an LDAPS connection to theDirectory Server. If this connection attempt fails, check all values (port number, hostname, searchbase, and so forth) to see if any of these are the problem. If all else fails, reconfigure the DirectoryServer with a new certificate.

If the LDAPS connection is successful, it is likely that the misconfiguration is on Active Directory.Examine the Windows event log file for error messages.

NOTEA common problem is that the certificate authority was not configured as trusted when theWindows sync services certificate database was configured.

Error #3: An entry is moved from one subtree on Active Directory to another subtree,but the user is not moved to the corresponding subtree on Directory Server.This is a known issue with synchronizing modrdn operations on Active Directory with entries onDirectory Server. To workaround it, delete the entry on Active Directory and then add it anew to thenew subtree. The deletion and the addition will be properly synchronized to the Directory Server peer.

Page 491: Red Hat Directory Server 5.1

Chapter 10.

471

Managing the Directory SchemaRed Hat Directory Server comes with a standard schema that includes hundreds of object classesand attributes. While the standard object classes and attributes should meet most deployments'requirements, it can be necessary to extend the schema for specific directory data. Extending theschema is done by creating new object classes and attributes.

The Directory Server Schema Reference is a references for most the standard Directory Serverattributes and object classes, with information on allowed and required attributes, which object classestake which attribute, and OID and value information. This is a good resource for identifying usefulschema elements for a directory and determining what custom schema needs to be created.

10.1. Overview of SchemaThe directory schema is a set of rules that defines how data can be stored in the directory. Directoryinformation is stored discrete entries, and each entry is comprised of a set of attributes and theirvalues. The kind of identity being described in the entry is defined in the entry's object classes. Anobject class specifies the kind of object the entry describes through the defined set of attributes for theobject class.

In LDAP, an object class defines the set of attributes that can be used to define an entry. The LDAPstandard provides object classes for many common types of entries, including people, groups,locations, organizations and divisions, and equipment. The identity is described in a directory entrieswith attributes and their values, pairs are called attribute-value assertions or AVAs. Any piece ofinformation in the directory is associated with a descriptive attribute. Other aspects of the DirectoryServer configuration, including matching rules and LDAP controls, are also defined in the schema. Allof these together are schema elements.

Every schema element is identified by a unique, dot-separated number. This is called the objectidentifier or OID.

10.1.1. Default Schema FilesThe schema for Directory Server is defined in several different schema files (LDIF files which defineschema elements). The Directory Server schema files are instance-specific and are located in the /etc/dirsrv/slapd-instance_name/schema directory. There is also a common /etc/dirsrv/schema directory; the files in this directory are used as templates for new Directory Server instances.Putting custom schema in the /etc/dirsrv/schema directory means that it is automaticallyincluded with any new instances.

The default schema files are listed and described in the Schema Reference, which also describes thecommon standard attributes and object classes. The attributes used by the Directory Server to performoperations and manage entries is described with other configuration settings in the Configuration,Command, and File Reference.

10.1.2. Object ClassesIn LDAP, an object class defines the set of attributes that can be used to define an entry. The LDAPstandard provides object classes for many common types of entries, such as people (person andinetOrgPerson), groups (groupOfUniqueNames), locations (locality), organizations anddivisions (organization and organizationalUnit), and equipment (device).

Page 492: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

472

In a schema file, an object class is identified by the objectclasses line, then followed by its OID,name, a description, its direct superior object class (an object class which is required to be used inconjunction with the object class and which shares its attributes with this object class), and the list ofrequired (MUST) and allowed (MAY) attributes.

This is shown in Example 10.1, “person Object Class Schema Entry”.

objectClasses: ( 2.5.6.6 NAME 'person' DESC 'Standard LDAP objectclass' SUP top MUST ( sn $ cn ) MAY ( description $ seeAlso $ telephoneNumber $ userPassword ) X-ORIGIN 'RFC 2256' )

Example 10.1. person Object Class Schema Entry

Every object class defines a number of required attributes and of allowed attributes. Requiredattributes must be present in entries using the specified object class, while allowed attributes arepermissible and available for the entry to use, but are not required for the entry to be valid.

As in Example 10.1, “person Object Class Schema Entry”, the person object class requires the cn,sn, and objectClass attributes and allows the description, seeAlso, telephoneNumber, anduserPassword attributes.

An object class can inherit attributes from another class, in addition to its own required and allowedattributes. The second object class is the superior or parent object class of the first.

For example, a user's entry has to have the inetOrgPerson object class. In that case, the entrymust also include the superior object class for inetOrgPerson, organizationalPerson, and thesuperior object class for organizationalPerson, which is person:

objectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPerson

10.1.3. AttributesDirectory entries are composed of attributes and their values. These pairs are called attribute-valueassertions or AVAs. Any piece of information in the directory is associated with a descriptive attribute.For instance, the cn attribute is used to store a person's full name, such as cn: John Smith.

Additional attributes can supply additional information about John Smith:

givenname: Johnsurname: Smithmail: [email protected]

In a schema file, an attribute is identified by the attributetypes line, then followed by its OID,name, a description, syntax (allowed format for its value), optionally whether the attribute is single- ormulti-valued, and where the attribute is defined.

This is shown in Example 10.2, “description Attribute Schema Entry”.

attributetypes: ( 2.5.4.13 NAME 'description' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2256' )

Example 10.2. description Attribute Schema Entry

Page 493: Red Hat Directory Server 5.1

About Extending the Schema

473

10.1.4. About Extending the SchemaNew, custom attributes and object classes can be added to a Directory Server instance to extend theschema, and there are several ways to add schema elements. Using the Directory Server Console orLDAP tools adds schema elements to the default custom schema file for an instance, 99user.ldif.It is also possible to create a new, separate schema file and include it with the default schema files.

Adding new schema elements requires three things:

1. Planning and defining OIDs for the new schema. Schema elements are recognized by the serverby their OID, so it is important for the OIDs to be unique and organized. Directory Server itselfdoes not manage OIDs, but there are some best practices described in Section 10.2, “ManagingObject Identifiers”.

2. Create the new attributes. Attribute definitions require a name, a syntax (the allowed format ofthe values), an OID, and a description of whether the attribute can only be used once per entry ormultiple times.

3. Create an object class to contain the new attributes. An object class lists the required attributes forthat entry type and the allowed (permissible) attributes. Because the default schema should neverbe altered, if any new attributes are created, then they should be added to a custom object class.

The schema elements should be planned in advance; do not use multiple attributes for the sameinformation. Whenever possible, use the standard Directory Server schema. Directory Server hashundreds of attributes and dozens of object classes defined in the default schema files. The DirectoryServer Schema Reference lists and describes the standard attributes and object classes; all of theschema can be viewed in the Directory Server Console or read in the schema files in /etc/dirsrv/slapd-instance_name/schema. Become familiar with the available schema; then plan whatinformation attributes are missing and how best to fill those gaps with custom attributes. Planning theschema is covered in the Deployment Guide.

CAUTIONThe default object classes and attributes in Directory Server are based on LDAP andX.500 standards and RFCs. Using standard schema makes the Directory Server moreeasily integrated with other applications and servers and allows interoperability with LDAPclients, legacy Directory Server instances, and future release. It is inadvisable for you toedit the standard attributes or change the object classes.

Keep the following rules in mind when customizing the Directory Server schema:

• Keep the schema as simple as possible.

• Reuse existing schema elements whenever possible.

• Minimize the number of mandatory attributes defined for each object class.

• Do not define more than one object class or attribute for the same purpose.

• Do not modify any existing definitions of attributes or object classes.

Page 494: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

474

NOTENever delete or replace the standard schema. Doing so can lead to compatibility problemswith other directories or other LDAP client applications.

The schema is loaded into the Directory Server instance when the instance is started; any newschema files are not loaded until the Directory Server is restarted or unless a reload task is initiated.Always, any custom schema is loaded before the standard schema.

10.1.5. Schema ReplicationSchema elements are replicated by default whenever the schema is changed in the Directory ServerConsole or through ldapmodify because the changes are logged in the server change log. However,replicated schema elements are all copied to 99user.ldif regardless of what schema file held theschema on the supplier server, so replication can lead to multiple files defining the same schema.

To keep from having duplicate schema definitions in multiple files, and for the easiest maintenanceof the schema, keep all custom schema in the default custom schema file, 99user.ldif in /etc/dirsrv/slapd-instance_name/schema.

When new schema files are added to the server and loaded dynamically into the Directory Server, theschema is only loaded locally because the schema reload operation is a local task. Since the changesdo not show up in the changelog, these newly-loaded schema files are not replicated. In order to loadthose schema files on any other servers, the schema has to be copied over, and then a local reloadtask has to be run.

10.2. Managing Object IdentifiersEach LDAP object class or attribute must be assigned a unique name and object identifier (OID).An OID is a dot-separated number which identifies the schema element to the server. OIDs can behierarchical, with a base OID that can be expanded to accommodate different branches. For example,the base OID could be 1, and there can be a branch for attributes at 1.1 and for object classes at1.2.

NOTEIt is not required to have a numeric OID for creating custom schema, but Red Hat stronglyrecommends it for better forward compatibility and performance.

OIDs are assigned to an organization through the Internet Assigned Numbers Authority (IANA), andDirectory Server does not provide a mechanism to obtain OIDs. To get information about obtainingOIDs, visit the IANA website at http://www.iana.org/cgi-bin/enterprise.pl.

After obtaining a base OID from IANA, plan how the OIDs are going to be assigned to custom schemaelements. Define a branch for both attributes and object classes; there can also be branches formatching rules and LDAP controls.

Once the OID branches are defined, create an OID registry to track OID assignments. An OID registryis a list that gives the OIDs and descriptions of the OIDs used in the directory schema. This ensuresthat no OID is ever used for more than one purpose. Publish the OID registry with the custom schema.

Page 495: Red Hat Directory Server 5.1

Attribute Syntax

475

10.3. Attribute SyntaxThe attribute's syntax defines the format of the values which the attribute allows; as with other schemaelements, the syntax is defined for an attribute using the syntax's OID in the schema file entry. In theDirectory Server Console, the syntax is referenced by its friendly name.

Name OID Definition

Binary 1.3.6.1.4.1.1466.115.121.1.5 Indicates that values for thisattribute are binary.

Boolean 1.3.6.1.4.1.1466.115.121.1.7 Indicates that this attribute hasone of only two values, true orfalse.

Country String 1.3.6.1.4.1.1466.115.121.1.11 Indicates that values for thisattribute are limited to exactlytwo printable string characters;for example, US for the UnitedStates.

DN 1.3.6.1.4.1.1466.115.121.1.12 Indicates that values for thisattribute are DNs.

DirectoryString 1.3.6.1.4.1.1466.115.121.1.15 Indicates that values for thisattribute are case-insensitivestrings.

GeneralizedTime 1.3.6.1.4.1.1466.115.121.1.24 Indicates that values for thisattribute are encoded asprintable strings. The time zonemust be specified. It is stronglyrecommended to use GMTtime.

IA5String 1.3.6.1.4.1.1466.115.121.1.26 Indicates that values for thisattribute are case-exact strings.

Integer 1.3.6.1.4.1.1466.115.121.1.27 Indicates that valid values forthis attribute are numbers.

OctetString 1.3.6.1.4.1.1466.115.121.1.40 Indicates that values for thisattribute are binary; this isthe same as using the binarysyntax.

Postal Address 1.3.6.1.4.1.1466.115.121.1.41 Indicates that values for thisattribute are encoded in theformat postal-address =dstring * ("$" dstring). Forexample:

1234 Main St.$Raleigh, NC 12345$USA

Each dstring component isencoded as a DirectoryStringvalue. Backslashes and dollar

Page 496: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

476

Name OID Definitioncharacters, if they occur, arequoted, so that they will notbe mistaken for line delimiters.Many servers limit the postaladdress to 6 lines of up to thirtycharacters.

TelephoneNumber 1.3.6.1.4.1.1466.115.121.1.50 Indicates that values for thisattribute are in the form oftelephone numbers. It isrecommended to use telephonenumbers in international form.

URI Indicates that the values forthis attribute are in the formof a URL, introduced by astring such as http://,https://, ftp://, ldap://,and ldaps://. The URIhas the same behavior asIA5String. See RFC 2396for more information on thissyntax.

Table 10.1. LDAP Attribute Syntax

10.4. Managing Custom Schema in the ConsoleThe Directory Server Console shows all attributes in the schema, and custom attributes can becreated, edited, and deleted from the schema.

• Section 10.4.1, “Viewing Attributes and Object Classes”

• Section 10.4.2, “Creating Attributes”

• Section 10.4.3, “Creating Object Classes”

• Section 10.4.4, “Editing Custom Schema Elements”

• Section 10.4.5, “Deleting Schema”

10.4.1. Viewing Attributes and Object ClassesAll of the information about the attributes and object classes which are currently loaded in the serverinstance are visible with the other server configuration.

1. In the Directory Server Console, select the Configuration tab.

2. In the left navigation tree, select the Schema folder.

Page 497: Red Hat Directory Server 5.1

Viewing Attributes and Object Classes

477

3. There are three tabs which display the schema elements loaded in Directory Server: ObjectClass, Attributes, and Matching Rules.

The Attributes tab is broken into two sections for default and custom attributes. Both sections showthe attribute name, OID, syntax, and whether the attribute is multi-valued.

The Object Classes tab shows the list of object classes on the left. When an object class ishighlighted, its OID and superior object class are listed in the fields at the top and its required andallowed attributes are listed in the boxes on the right.

Page 498: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

478

10.4.2. Creating Attributes

NOTEAfter adding new attributes to the schema, create a new object class to contain them, asdescribed in Section 10.4.3, “Creating Object Classes”.

1. Select the Configuration tab.

2. In the left navigation tree, select the Schema folder, and then select the Attributes tab in the rightpane.

Page 499: Red Hat Directory Server 5.1

Creating Attributes

479

3. Click Create.

4. Fill in the information for the new attribute.

• The attribute name; this must be unique.

• The OID; this is not required, but for compatibility and server performance, assigning a uniquenumeric OID is strongly recommended.

• The syntax; this is the allowed format for the attributes values.

• Whether the attribute is multi-valued; by default, all attributes can be used more than once in anentry, but deselecting the checkbox means the attribute can be used only once.

5. Click OK.

Page 500: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

480

10.4.3. Creating Object ClassesA new object class must be created with a unique name, a parent object, and required and optionalattributes. To create an object class:

1. In the Directory Server Console, select the Configuration tab.

2. In the navigation tree, select the Schema folder, and then select the Object Classes tab in theright pane.

3. Click the Create button in the Object Classes tab.

4. Fill in the information about the new object class.

Page 501: Red Hat Directory Server 5.1

Creating Object Classes

481

• The name; this must be unique.

• The OID; this is not required, but for compatibility and server performance, assigning a uniquenumeric OID is strongly recommended.

• The superior object class for the entry. The default is top; selecting another object class meansthat the new object class inherits all of the required and allowed attributes from the parent, inaddition to its own defined attributes.

• Required and allowed attributes. Select the attributes on the left and used the Add buttons bythe Available Attributes and Required Attributes boxes to add the attributes as appropriate.

NOTEAttributes that are inherited from the parent object classes cannot be removed,regardless of whether they are allowed or required.

5. Click OK to save the new object class.

Page 502: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

482

10.4.4. Editing Custom Schema ElementsOnly user-created attributes or object classes can be edited; standard schema elements cannot beedited.

1. In the Directory Server Console, select the Configuration tab.

2. In the left navigation tree, select the Schema folder.

3. Open the Object Classes or Attributes tab.

4. Select the schema element to edit from the list. Only custom (user-defined) schema can be editedin the Directory Server Console.

5. Click the Edit button at the bottom of the window.

6. Edit any of the schema information.

10.4.5. Deleting SchemaOnly user-created attributes or object classes can be deleted; standard schema elements cannot bedeleted.

1. In the Directory Server Console, select the Configuration tab.

2. In the left navigation tree, select the Schema folder.

Page 503: Red Hat Directory Server 5.1

Managing Schema Using ldapmodify

483

3. Open the Object Classes or Attributes tab.

4. Select the schema element to delete from the list. Only custom (user-defined) schema can bedeleted in the Directory Server Console.

5. Click the Delete button at the bottom of the window.

6. Confirm the deletion.

WARNINGThe server immediately deletes the schema element. There is no undo.

10.5. Managing Schema Using ldapmodifyAs with the Directory Server Console, ldapmodify can be used to add, edit, and delete customschema elements. ldapmodify also modifies the default custom schema file for a Directory Serverinstance, 99user.ldif.

10.5.1. Creating AttributesA custom attribute entry is itself an attributetypes entry for the cn=schema entry. Theattributetypes attribute has the format:

attributetypes: ( definition )

The definition contains five components:

Page 504: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

484

• An OID, usually a dot-separated number

• A unique name, in the form NAME name

• A description, in the form DESC description

• The OID for the syntax of the attribute values, listed in Table 10.1, “LDAP Attribute Syntax”, in theform SYNTAX OID

• Optionally, the source where the attribute is defined

The attribute definition is added to the custom schema file, 99user.ldif, by by running an LDAPcommand and modifying the cn=schema entry. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com -v

dn: cn=schemachangetype: modifyadd: attributetypesattributetypes: ( 1.2.3.4.5.6.1 NAME 'dateofbirth' DESC 'For employee birthdays' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUED X-ORIGIN 'Example defined')

10.5.2. Creating Object ClassesAn object class definition is an objectclasses attribute for the cn=schema entry. Theobjectclasses attribute has the format:

objectclasses: ( definition )

The object class definition contains several components:

• An OID, usually a dot-separated number

• A unique name, in the form NAME name

• A description, in the form DESC description

• The superior, or parent, object class for this object class, in the form SUP object_class; if there is norelated parent, use SUP top

• The word AUXILIARY, which gives the type of entry to which the object class applies; AUXILIARYmeans it can apply to any entry

• A list of required attributes, preceded by the word MUST; to include multiple attributes, enclose thegroup in parentheses and separate with attributes with dollar signs ($)

• A list of allowed attributes, preceded by the word MAY; to include multiple attributes, enclose thegroup in parentheses and separate with attributes with dollar signs ($)

The object class definition is added to the custom schema file, 99user.ldif, by by running an LDAPcommand and modifying the cn=schema entry. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com -v

Page 505: Red Hat Directory Server 5.1

Deleting Schema

485

dn: cn=schemachangetype: modifyadd: objectclassesobjectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY MUST cn MAY (exampleDateOfBirth $ examplePreferredOS) )

10.5.3. Deleting Schema

WARNINGNever delete default schema elements. Those are required by the Directory Server to run.

1. Remove the unwanted attributes from any entries which use them, then from any object classesin the schema file which accept that attribute. Likewise, to remove an object class, remove it fromany entries.

2. Run ldapmodify to remove the attribute. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=schema changetype: modify delete: objectclassesobjectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY MUST cn MAY (exampleDateOfBirth $ examplePreferredOS) )

CAUTIONBe sure to specify the exact object class or attribute to remove; using only theattributetypes or objectclasses attribute without the value will delete everyuser-defined attribute or object class in the file.

If the custom attribute or object class is in a custom schema file other than 99user.ldif, edit thefile directly. Neither the Directory Server Console nor LDAP tools can edit a schema file other than99user.ldif.

10.6. Creating Custom Schema FilesSchema files are simple LDIF files which define the cn=schema entry. Each attribute and object classis added as an attribute to that entry. Here are the requirements for creating a schema file:

• The first line must be dn: cn=schema.

• The schema file can include both attributes and object classes, but it can also include only one orthe other.

• If both attributes and object classes are defined in the style, all of the attributes must be listed in thefile first, then all of the attributes must be listed first, then the object classes.

Page 506: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

486

• The object classes can use attributes defined in other schema files.

• The file must be named in the format [1-9][0-9]text.ldif.

The file must always begin with two numbers. Numerically, the schema file cannot be loaded afterthe core configuration schema (which begin with 00 and 01).

Also, the Directory Server always writes its custom schema to the numerically and alphabeticallyhighest named schema file in the schema directory. It expects this file to be 99user.ldif. Ifthis file is not 99user.ldif, the server can experience problems. So, always make sure customschema files are at least alphabetically lower than 99user.ldif. The name 99alpha.ldif isokay; the name 99zzz.ldif is not.

Practices for creating schema files are described in more detail in the Deployment Guide.

Attributes are defined in the schema file as attributetypes attributes to the schema, with fivecomponents:

• An OID, usually a dot-separated number

• A unique name, in the form NAME name

• A description, in the form DESC description

• The OID for the syntax of the attribute values, listed in Table 10.1, “LDAP Attribute Syntax”, in theform SYNTAX OID

• Optionally, the source where the attribute is defined

For example:

attributetypes: ( 1.2.3.4.5.6.1 NAME 'dateofbirth' DESC 'For employee birthdays' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUED X-ORIGIN 'Example defined')

Likewise, object classes are defined as objectclasses attributes, although there is slightly moreflexibility in how the object class is defined. The only required configurations are the name and OID forthe object class; all other configuration depends on the needs for the object class:

• An OID, usually a dot-separated number

• A unique name, in the form NAME name

• A description, in the form DESC description

• The superior, or parent, object class for this object class, in the form SUP object_class; if there is norelated parent, use SUP top

• The word AUXILIARY, which gives the type of entry to which the object class applies; AUXILIARYmeans it can apply to any entry

• A list of required attributes, preceded by the word MUST; to include multiple attributes, enclose thegroup in parentheses and separate with attributes with dollar signs ($)

• A list of allowed attributes, preceded by the word MAY; to include multiple attributes, enclose thegroup in parentheses and separate with attributes with dollar signs ($)

Page 507: Red Hat Directory Server 5.1

Dynamically Reloading Schema

487

For example:

objectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY MUST cn MAY (exampleDateOfBirth $ examplePreferredOS) )

Example 10.3, “Example Schema File” shows a simplified schema file.

dn: cn=schemaattributetypes: ( 2.16.840.1133730.1.123 NAME 'dateofbirth' DESC 'For employee birthdays' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Example defined')objectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY MAY (dateofbirth) )

Example 10.3. Example Schema File

Custom schema files should be added to the Directory Server instance's schema directory, /etc/dirsrv/slapd-instance_name/schema. The schema in these files are not loaded and availableto the server unless the server is restarted or a dynamic reload task is run.

10.7. Dynamically Reloading SchemaBy default, the schema files used by the Directory Server instance are loaded into the directory whenit is started. This means that any new schema files added to the schema directory are not availablefor use unless the server is restarted. The Directory Server has a task which manually reloads the fullschema for the Directory Server instance, including custom files, without requiring a server restart.

The schema reload task can be initiated in two ways:

• Using the schema-reload.pl script

• Adding a cn=schema reload task entry using ldapmodify

10.7.1. Reloading Schema Using schema-reload.plThe schema-reload.pl script launches a special task to reload all of the schema files used by aspecific Directory Server instance. This allows custom schema files to be loaded dynamically withouthaving to add schema elements to 99user.ldif.

1. Open the tool directory for the Directory Server instance, /usr/lib/dirsrv/slapd-instance_name/.

2. Run the script, binding as the Directory Manager.

./schema-reload.pl -D "cn=Directory Manager" -w secret

The Directory Server responds that it has added the new reload task entry.

adding new entry cn=schema_reload_2009_1_6_17_52_4, cn=schema reload task, cn=tasks, cn=config

This reloads the schema from the default schema directory, /etc/dirsrv/slapd-instance_name/schema, which is recommended. It is also possible to specify adifferent directory using the -d option.

Page 508: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

488

./schema-reload.pl -D "cn=Directory Manager" -w password -d /export/custom-schema

IMPORTANTAll of the schema is reloaded with the schema reload task, not just the newestschema or modified schema. This means that whatever directory is specified shouldcontain the full schema for the Directory Server, or the Directory Server instance mayhave serious performance problems.

The schema-reload.pl is described in more detail in the Configuration, Command, and FileReference1.

10.7.2. Reloading Schema Using ldapmodifyThe schema-reload.pl script creates a special task entry in a Directory Server instance whichreloads schema files; it is also possible to reload schema by creating the task entry directly. Taskentries occur under the cn=tasks configuration entry in the dse.ldif file, so it is also possible toinitiate a task by adding the entry using ldapmodify. As soon as the task is complete, the entry isremoved from the directory.

To initiate a schema reload task, add an entry under the cn=schema reload task, cn=tasks,cn=config entry. The only required attribute is the cn for the specific task.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example schema reload,cn=schema reload task, cn=tasks, cn=configcn:example schema reload

The default schema directory from which the Directory Server instance reloads the schema is in /etc/dirsrv/slapd-instance_name/schema; it is possible to specify a different schema directoryusing the schemadir attribute, which is analogous to the -d option with schema-reload.pl.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example schema reload,cn=schema reload task, cn=tasks, cn=configcn:example schema reloadschemadir: /export/schema

IMPORTANTAll of the schema is reloaded with the schema reload task, not just the newest schemaor modified schema. This means that whatever directory is specified should contain thefull schema for the Directory Server, or the Directory Server instance may have seriousperformance problems.

As soon as the task is completed, the entry is deleted from the dse.ldif configuration, so it ispossible to reuse the same task entry continually.

1 ../cli/Configuration_Command_File_Reference-Command_Line_Scripts-Perl_Scripts.html#schema-reload.pl

Page 509: Red Hat Directory Server 5.1

Reloading Schema with Replication

489

The cn=schema reload task configuration is described in more detail in the Configuration,Command, and File Reference2.

10.7.3. Reloading Schema with ReplicationThe schema reload task is a local operation, so schema changes are not replicated in a multi-masterenvironment if the schema is added to one supplier but not to the others. To load the new schema fileson all of the supplier servers:

1. Stop replication.

2. Copy the new schema file over and run the schema reload task for every supplier and replicaserver.

3. Restart replication.

10.7.4. Schema Reload ErrorsWhen the schema reload task runs, the command prompt only shows that the task is initiated.

adding new entry cn=schema reload task 1, cn=schema reload task, cn=tasks, cn=config

However, the task does not return whether it completed successfully. To verify the schema reloadoperation was successful, check the error logs. The schema reload has two tasks, first validating theschema file and then loading it.

A success message shows that the validation passed and the task finished.

[06/Jan/2009:17:52:04 -0500] schemareload - Schema reload task starts (schema dir: default) ...[06/Jan/2009:17:52:04 -0500] schemareload - Schema validation passed.[06/Jan/2009:17:52:04 -0500] schemareload - Schema reload task finished.

If there is a failure, then the logs show which step failed and why.

[..] schemareload - Schema reload task starts (schema dir: /bogus) ...[..] schema - No schema files were found in the directory /bogus[..] schema_reload - schema file validation failed[..] schemareload - Schema validation failed.

10.8. Turning Schema Checking On and OffWhen schema checking is on, the Directory Server ensures three things:

• The object classes and attributes using are defined in the directory schema.

• The attributes required for an object class are contained in the entry.

• Only attributes allowed by the object class are contained in the entry.

Schema checking is turned on by default in the Directory Server, and the Directory Server shouldalways run with schema checking turned on. The only situation where is may be beneficial to turn

2 ../cli/Configuration_Command_File_Reference-Core_Server_Configuration_Reference-Core_Server_Configuration_Attributes_Reference.html#cn-schema-reload-task

Page 510: Red Hat Directory Server 5.1

Chapter 10. Managing the Directory Schema

490

schema checking off is to accelerate LDAP import operations. However, there is a risk of importingentries that do not conform to the schema. Consequently, it is impossible to search for these entries.

To turn schema checking on and off:

1. In the Directory Server Console, select the Configuration tab.

2. Highlight the server icon at the top of the navigation tree, then select the Settings tab in the rightpane.

3. To enable schema checking, check the Enable Schema Checking checkbox; clear it to turn offschema checking.

4. Click Save.

Page 511: Red Hat Directory Server 5.1

Turning Schema Checking On and Off

491

To turn schema checking on and off using LDAP commands, edit the value of the nsslapd-schemacheck attribute. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=config changetype: modify replace: nsslapd-schemacheck: on nsslapd-schemacheck: off

For information, see the Directory Server Configuration, Command, and File Reference.

Page 512: Red Hat Directory Server 5.1

492

Page 513: Red Hat Directory Server 5.1

Chapter 11.

493

Managing IndexesIndexing makes searching for and retrieving information easier by classifying and organizing attributesor values. This chapter describes the searching algorithm itself, placing indexing mechanisms incontext, and then describes how to create, delete, and manage indexes.

11.1. About IndexesThis section provides an overview of indexing in Directory Server. It contains the following topics:

• Section 11.1.1, “About Index Types”

• Section 11.1.2, “About Default, System, and Standard Indexes”

• Section 11.1.3, “Overview of the Searching Algorithm”

• Section 11.1.5, “Indexing Performance”

• Section 11.1.6, “Balancing the Benefits of Indexing”

11.1.1. About Index TypesIndexes are stored in files in the directory's databases. The names of the files are based on theindexed attribute, not the type of index contained in the file. Each index file may contain multipletypes of indexes if multiple indexes are maintained for the specific attribute. For example, all indexesmaintained for the common name attribute are contained in the cn.db4 file.

Directory Server supports the following types of index:

• Presence index (pres) contains a list of the entries that contain a particular attribute, which is veryuseful for searched. For example, it makes it easy to examine any entries that contain accesscontrol information. Generating an aci.db4 file that includes a presence index efficiently performsthe search for ACI=* to generate the access control list for the server.

The presence index is not used for base object searches.

• Equality index (eq) improves searches for entries containing a specific attribute value. For example,an equality index on the cn attribute allows a user to perform the search for cn=Babs Jensen farmore efficiently.

• Approximate index (approx) is used for efficient approximate or sounds-like searches. For example,an entry may include the attribute value cn=Robert E Lee. An approximate search wouldreturn this value for searches against cn~=Robert Lee, cn~=Robert, or cn~=Lee. Similarly, asearch against l~=San Fransisco (note the misspelling) would return entries including l=SanFrancisco.

• Substring index (sub) is a costly index to maintain, but it allows efficient searching againstsubstrings within entries. Substring indexes are limited to a minimum of three characters for eachentry.

For example, searches of the form cn=*derson , match the common names containing stringssuch as Bill Anderson, Jill Henderson, or Steve Sanderson. Similarly, the search fortelephoneNumber= *555* returns all the entries in the directory with telephone numbers thatcontain 555.

Page 514: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

494

• International index speeds up searches for information in international directories. The process forcreating an international index is similar to the process for creating regular indexes, except that itapplies a matching rule by associating an object identifier (OID) with the attributes to be indexed.

The supported locales and their associated OIDs are listed in Appendix D, Internationalization. Ifthere is a need to configure the Directory Server to accept additional matching rules, contact RedHat Professional Services.

• Browsing index, or virtual list view (VLV) index, speeds up the display of entries in the DirectoryServer Console. This index is particularly useful if a branch of your directory contains hundreds ofentries; for example, the ou=people branch. You can create a browsing index on any branch pointin the directory tree to improve display performance through the Directory Server Console or byusing the vlvindex command-line tool, which is explained in the Directory Server Configuration,Command, and File Reference.

11.1.2. About Default, System, and Standard IndexesWhen you install Directory Server, a set of default and system indexes is created per databaseinstance. To maintain these indexes, the directory uses standard indexes.

11.1.2.1. Overview of Default IndexesThe default indexes can be modified depending on the directory indexing needs. Always ensure thatno server plug-ins or other servers depend on a default index before removing it.

Table 11.1, “Default Indexes” lists the default indexes installed with the directory.

Attribute Eq Pres Sub Purpose

cn Improves theperformanceof the mostcommon typesof user directorysearches.

givenname Improves theperformanceof the mostcommon typesof user directorysearches.

mail Improves theperformanceof the mostcommon typesof user directorysearches.

mailHost Used by amessaging server.

member ImprovesDirectory Serverperformance. This

Page 515: Red Hat Directory Server 5.1

About Default, System, and Standard Indexes

495

Attribute Eq Pres Sub Purposeindex is also usedby the ReferentialIntegrity Plug-in.See Section 3.5,“MaintainingReferentialIntegrity” for moreinformation.

owner ImprovesDirectory Serverperformance. Thisindex is also usedby the ReferentialIntegrity Plug-in.See Section 3.5,“MaintainingReferentialIntegrity” for moreinformation.

see Also ImprovesDirectory Serverperformance. Thisindex is also usedby the ReferentialIntegrity Plug-in.See Section 3.5,“MaintainingReferentialIntegrity” for moreinformation.

sn Improves theperformanceof the mostcommon typesof user directorysearches.

telephoneNumber Improves theperformanceof the mostcommon typesof user directorysearches.

uid ImprovesDirectory Serverperformance.

unique member ImprovesDirectory Serverperformance. This

Page 516: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

496

Attribute Eq Pres Sub Purposeindex is also usedby the ReferentialIntegrity Plug-in.See Section 3.5,“MaintainingReferentialIntegrity” for moreinformation.

Table 11.1. Default Indexes

11.1.2.2. Overview of System IndexesSystem indexes cannot be deleted or modified. They are required by the directory to function properly.Table 11.2, “System Indexes” lists the system indexes included with the directory.

Attribute Eq Pres Purpose

aci Allows the DirectoryServer to quickly obtainthe access controlinformation maintainedin the database.

objectClass Used to helpaccelerate subtreesearches in thedirectory.

entryDN Speeds up entryretrieval based on DNsearches.

parentID Enhances directoryperformance duringone-level searches.

numSubordinates Used by the DirectoryServer Console toenhance displayperformance on theDirectory tab.

nsUniqueID Used to search forspecific entries.

Table 11.2. System Indexes

11.1.2.3. Overview of Standard IndexesBecause of the need to maintain default indexes and other internal indexing mechanisms, theDirectory Server also maintains certain standard index files. The standard index, id2entry.db4,exists by default in Directory Server; you do not need to generate it.

The id2entry.db4 contains the actual directory database entries. All other database files can berecreated from this one.

Page 517: Red Hat Directory Server 5.1

Overview of the Searching Algorithm

497

11.1.3. Overview of the Searching AlgorithmIndexes are used to speed up searches. To understand how the directory uses indexes, it helps tounderstand the searching algorithm. Each index contains a list of attributes (such as the cn, commonname, attribute) and a pointer to the entries corresponding to each value. Directory Serverprocesses asearch request as follows:

1. An LDAP client application sends a search request to the directory.

2. The directory examines the incoming request to make sure that the specified base DN matches asuffix contained by one or more of its databases or database links.

• If they do match, the directory processes the request.

• If they do not match, the directory returns an error to the client indicating that the suffix does notmatch. If a referral has been specified in the nsslapd-referral attribute under cn=config,the directory also returns the LDAP URL where the client can attempt to pursue the request.

• If the search request for each database attribute can be satisfied by a single index, then theserver reads that index to generate a list of potential matches.

• If there is no index for the attribute, the directory generates a candidate list that includes allentries in the database, which makes the search considerably slower.

• If a search request contains multiple attributes, the directory consults multiple indexes and thencombines the resulting lists of candidate entries.

• If there is an index for the attribute, the directory takes the candidate matches from the indexfiles in the form of a series of entry ID numbers.

3. The directory uses the returned entry ID numbers to read the corresponding entries from theid2entry.db4 file. The Directory Server then examines each of the candidate entries to see ifany match the search criteria. The directory returns matching entries to the client as each is found.

The directory continues until either it has examined all candidate entries or it reaches the limit setin one of the following attributes:

• nsslapd-sizelimit which specifies the maximum number of entries to return from a searchoperation. If this limit is reached, the directory returns any entries it has located that match thesearch request, as well as an exceeded size limit error.

• nsslapd-timelimit which specifies the maximum number of seconds allocated for a searchrequest. If this limit is reached, the directory returns any entries it has located that match thesearch request, as well as an exceeded time limit error.

• nsslapd-lookthroughlimit, which specifies the maximum number of entries that thedirectory will check when examining candidate entries in response to a search request.

• nsslapd-idlistscanlimit which specifies the maximum number of entries in an ID listbefore the list is considered to equal the entire database.

See Directory Server Configuration, Command, and File Reference for further information aboutthese attributes.

Page 518: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

498

11.1.4. Approximate SearchesIn addition, the directory uses a variation of the metaphone phonetic algorithm to perform searcheson an approximate index. Each value is treated as a sequence of words, and a phonetic code isgenerated for each word.

NOTEThe metaphone phonetic algorithm in Directory Server supports only US-ASCII letters.Therefore, use approximate indexing only with English values.

Values entered on an approximate search are similarly translated into a sequence of phonetic codes.An entry is considered to match a query if both of the following are true:

• All of the query string codes match the codes generated in the entry string.

• All of the query string codes are in the same order as the entry string codes.

Name in the Directory(Phonetic Code)

Query String (Phonetic code) Match Comments

Alice B Sarette (ALS B SRT) Alice Sarette (ALS SRT) Matches. Codes are specifiedin the correct order.

Alice Sarrette (ALS SRT) Matches. Codes are specifiedin the correct order, despite themisspelling of Sarette.

Surette (SRT) Matches. The generated codeexists in the original name,despite the misspelling ofSarette.

Bertha Sarette (BR0 SRT) No match. The code BR0 doesnot exist in the original name.

Sarette, Alice (SRT ALS) No match. The codes are notspecified in the correct order.

11.1.5. Indexing PerformanceEach index that the directory uses is composed of a table of index keys and matching entry ID lists.This entry ID list is used by the directory to build a list of candidate entries that may match a clientapplication's search request; Section 11.1, “About Indexes” describes each kind of Directory Serverindex.The Directory Server secondary index structure greatly improves write and search operations.

11.1.5.1. Indexing PerformanceWhile achieving extremely high read performance, in previous versions of Directory Server, writeperformance was limited by the number of bytes per second that could be written into the storagemanager's transaction log file. Large log files were generated for each LDAP write operation; infact, log file verbosity could easily be 100 times the corresponding number of bytes changed in theDirectory Server. The majority of the contents in the log files are related to index changes (ID insertand delete operations).

Page 519: Red Hat Directory Server 5.1

Indexing Performance

499

The secondary index structure was separated into two levels in the old design:

• The ID list structures, which were the province of the Directory Server backend and opaque to thestorage manager.

• The storage manager structures (Btrees), which were opaque to the Directory Server backend code.

Because it had no insight into the internal structure of the ID lists, the storage manager had to treat IDlists as opaque byte arrays. From the storage manager's perspective, when the content of an ID listchanged, the entire list had changed. For a single ID that was inserted or deleted from an ID list,the corresponding number of bytes written to the transaction log was the maximum configured size forthat ID list, about 8 kilobytes. Also, every database page on which the list was stored was marked asdirty, since the entire list had changed.

In the redesigned index, the storage manager has visibility into the fine-grain index structure, whichoptimizes transaction logging so that only the number of bytes actually changed need to be loggedfor any given index modification. The Berkeley DB provides ID list semantics, which are implementedby the storage manager. The Berkeley API was enhanced to support the insertion and deletionof individual IDs stored against a common key, with support for duplicate keys, and an optimizedmechanism for the retrieval of the complete ID list for a given key.

The storage manager has direct knowledge of the application's intent when changes are made to IDlists, resulting in several improvements to ID list handling:

• For long ID lists, the number of bytes written to the transaction log for any update to the list issignificantly reduced, from the maximum ID list size (8 kilobytes) to twice the size of one ID (4bytes).

• For short ID lists, storage efficiency, and in most cases performance, is improved because only thestorage manager meditate need to be stored, not the ID list metadata.

• The average number of database pages marked as dirty per ID insert or delete operation is verysmall because a large number of duplicate keys will fit into each database page.

11.1.5.2. Search PerformanceFor each entry ID list, there is a size limit that is globally applied to all index keys managed by theserver. In previous versions of Directory Server, this limit was called the All IDs Threshold. Becausemaintaining large ID lists in memory can affect performance, the All IDs Threshold set a limit on howlarge a single entry ID list could get. When a list hit a certain pre-determined size, the search wouldtreat it as if the index contained the entire directory.

The difficulty in setting the All IDs Threshold hurt performance. If the threshold was too low, too manysearches examined every entry in the directory. If it was too high, too many large ID lists had to bemaintained in memory.

The problems addressed by the All IDs Threshold are no longer present because of the efficiency ofentry insertion, modification, and deletion in the Berkeley DB design. The All IDs Threshold is removedfor database write operations, and every ID list is now maintained accurately.

Since loading a long ID list from the database can significantly reduce search performance, theconfiguration parameter, nsslapd-idlistscanlimit, sets a limit on the number of IDs that areread before a key is considered to match the entire primary index. nsslapd-idlistscanlimit isanalogous to the All IDs Threshold, but it only applies to the behavior of the server's search code, notthe content of the database.

Page 520: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

500

When the server uses indexes in the processing of a search operation, it is possible thatone index key matches a large number of entries. For example, consider a search forobjectclass=inetorgperson in a directory that contained one million inetorgperson entries.When the server reads the inetorgperson index key in the objectclass index, it finds one millionmatching entries. In cases like this, it is more efficient simply to conclude in the index lookup phaseof the search operation processing that all the entries in the database match the query. This causessubsequent search processing to scan the entire database content, checking each entry as to whetherit matches the search filter. The time required to fetch the index keys is not worthwhile; the searchoperation is likely to be processed more efficiently by omitting the index lookup.

In Directory Server, when examining an index, if more than a certain number of entries are found, theserver stops reading the index and marks the search as unindexed for that particular index.

The threshold number of entries is called the idlistscanlimit and is configured with thensslapd-idlistscanlimit configuration attribute. The default value is 4000, which is designed togive good performance for a common range of database sizes and access patterns. Typically, it is notnecessary to change this value. However, in rare circumstances it may be possible to improve searchperformance with a different value. For example, lowering the value will improve performance forsearches that will otherwise eventually hit the default limit of 4000. This might reduce performance forother searches that benefit from indexing. Conversely, increasing the limit could improve performancefor searches that were previously hitting the limit. With a higher limit, these searches could benefitfrom indexing where previously they did not.

For more information on search limits for the server, refer to Section 11.1.3, “Overview of theSearching Algorithm”.

11.1.5.3. Backwards Compatibility and MigrationWhile current versions of Directory Server can support the old database design, only the new design issupported for this and later releases of Directory Server.

Upon startup, the server will read the database version from the DBVERSION file, which contains thetext Netscape-ldbm/6.2 (old database version), Netscape-ldbm/7.1 (new database format),or bdb/4.2/libback-ldbm (new database format). If the file indicates that the old format is used,then the old code is selected for the database. Because the DBVERSION file stores everything per-backend, it is possible to have different database formats for different individual backends, but the olddatabase format is not recommended.

All databases must be migrated to Directory Server 8.1 when the system is upgraded. Migrationis supported for Directory Server 6.x versions, and for releases earlier than version 6.x, dump thedatabases be dumped, and install Directory Server fresh. Migrating databases is covered in theDirectory Server Installation Guide.

Also, the index sizes can be larger than in older releases, so you may want to increase your databasecache size. To reconfigure your cache size, look up the nsslapd-dbcachesize entry in theDirectory Server Configuration, Command, and File Reference.

11.1.6. Balancing the Benefits of IndexingBefore creating new indexes, balance the benefits of maintaining indexes against the costs.

• Approximate indexes are not efficient for attributes commonly containing numbers, such astelephone numbers.

Page 521: Red Hat Directory Server 5.1

Balancing the Benefits of Indexing

501

• Substring indexes do not work for binary attributes.

• Equality indexes should be avoided if the value is big (such as attributes intended to containphotographs or passwords containing encrypted data).

• Maintaining indexes for attributes not commonly used in a search increases overhead withoutimproving global searching performance.

• Attributes that are not indexed can still be specified in search requests, although the searchperformance may be degraded significantly, depending on the type of search.

• The more indexes you maintain, the more disk space you require.

Indexes can become very time-consuming. For example:

1. The Directory Server receives an add or modify operation.

2. The Directory Server examines the indexing attributes to determine whether an index ismaintained for the attribute values.

3. If the created attribute values are indexed, then the Directory Server generates the new indexentries.

4. Once the server completes the indexing, the actual attribute values are created according to theclient request.

For example, the Directory Server adds the entry:

dn: cn=John Doe, ou=People,dc=example,dc=comobjectclass: topobjectClass: personobjectClass: orgpersonobjectClass: inetorgpersoncn: John Doecn: Johnsn: Doeou: Manufacturingou: peopletelephoneNumber: 408 555 8834description: Manufacturing lead for the Z238 line of widgets.

The Directory Server is maintaining the following indexes:

• Equality, approximate, and substring indexes for cn (common name) and sn (surname) attributes.

• Equality and substring indexes for the telephone number attribute.

• Substring indexes for the description attribute.

When adding that entry to the directory, the Directory Server must perform these steps:

1. Create the cn equality index entry for John and John Doe.

2. Create the appropriate cn approximate index entries for John and John Doe.

3. Create the appropriate cn substring index entries for John and John Doe.

4. Create the sn equality index entry for Doe.

Page 522: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

502

5. Create the appropriate sn approximate index entry for Doe.

6. Create the appropriate sn substring index entries for Doe.

7. Create the telephone number equality index entry for 408 555 8834.

8. Create the appropriate telephone number substring index entries for 408 555 8834.

9. Create the appropriate description substring index entries for Manufacturing lead for theZ238 line of widgets. A large number of substring entries are generated for this string.

As this example shows, the number of actions required to create and maintain databases for a largedirectory can be resource-intensive.

11.2. Creating Standard IndexesThis section describes how to create presence, equality, approximate, substring, and internationalindexes for specific attributes using the Directory Server Console and the command line.

When a new index type is created, that index is used as a template for any additional databases asthey are added. The Directory Server uses the current set of default indexes defined for the instanceas the basis for additional databases.

However, new indexes are not added to existing databases automatically, though they can beadded manually. This means that if you add a default index to your second database instance,it will not be maintained in your first database instance but will be maintained in any subsequentinstances. To apply a new index to an existing database, run the db2index.pl script or run acn=index,cn=tasks task, as described in Section 11.3, “Applying New Indexes to ExistingDatabases”.

• Section 11.2.1, “Creating Indexes from the Server Console”

• Section 11.2.2, “Creating Indexes from the Command Line”

11.2.1. Creating Indexes from the Server ConsoleTo create presence, equality, approximate, substring, or international indexes:

1. Select the Configuration tab.

2. Expand the Data node, expand the suffix of the database to index, and select the database.

3. Select the Indexes tab in the right pane.

NOTEDo not click the Database Settings node because this opens the Default IndexSettings window, not the window for configuring indexes per database.

4. If the attribute to be indexed is listed in the Additional Indexes table, go to step 6. Otherwise,click Add Attribute to open a dialog box with a list of all of the available attributes in the serverschema.

5. Select the attribute you want to index, and click OK.

Page 523: Red Hat Directory Server 5.1

Creating Indexes from the Command Line

503

The server adds the attribute to the Additional Indexes table.

6. Select the checkbox for each type of index to maintain for each attribute.

7. To create an index for a language other than English, enter the OID of the collation order to use inthe Matching Rules field.

To index the attribute using multiple languages, list multiple OIDs separated by commas, butno whitespace. For a list of languages, their associated OIDs, and further information regardingcollation orders, see Appendix D, Internationalization.

8. Click Save.

9. The Indexes dialog box appears, displaying the status of the index creation and informing youwhen the indexes have been created. Click the Status Logs box to view the status of the indexescreated. Once the indexing is complete, click Close.

The new index is immediately active for any new data that you add and any existing data in yourdirectory. You do not have to restart your server.

11.2.2. Creating Indexes from the Command Line

NOTEYou cannot create new system indexes because system indexes are hard-coded inDirectory Server.

Use ldapmodify 1 to add the new index attributes to your directory.

• To create a new index that will become one of the default indexes, add the new index attributesto the cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=configentry.

• To create a new index for a particular database, add it to thecn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config entry, wherecn=database_name corresponds to the name of the database.

NOTEAvoid creating entries under cn=config in the dse.ldif file. The cn=config entryin the simple, flat dse.ldif configuration file is not stored in the same highly scalabledatabase as regular entries. As a result, if many entries, particularly entries that are likelyto be updated frequently, are stored under cn=config, performance will probably suffer.Although we recommend you do not store simple user entries under cn=config forperformance reasons, it can be useful to store special user entries such as the Directory

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 524: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

504

Manager entry or replication manager (supplier bind DN) entry under cn=config sincethis centralizes configuration information.

For information on the LDIF update statements required to add entries, see Section 3.4, “LDIF UpdateStatements”.

For example, to create presence, equality, and substring indexes for the sn (surname) attribute in theExample1 database, do the following:

1. Open the Directory Server LDAP tool directory.1

cd /usr/lib/mozldap

2. Run ldapmodify.

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

The ldapmodify utility binds to the server and prepares it to add an entry to the configuration file.

3. Add the LDIF entry for the new indexes:

dn: cn=sn,cn=index,cn=Example1,cn=ldbm database,cn=plugins,cn=configobjectClass:topobjectClass:nsIndexcn:snnsSystemIndex:falsensIndexType:presnsIndexType:eqnsIndexType:subnsMatchingRule:2.16.840.1.113730.3.3.2.3.1

The cn attribute contains the name of the attribute to index, in this example the sn attribute.The entry is a member of the nsIndex object class. The nsSystemIndex attribute is false,indicating that the index is not essential to Directory Server operations. The multi-valuednsIndexType attribute specifies the presence (pres), equality (eq) and substring (sub) indexes.Each keyword has to be entered on a separate line. The nsMatchingRule attribute specifies theOID of the Bulgarian collation order.

You can use the keyword none in the nsIndexType attribute to specify that no indexes are to bemaintained for the attribute. This example temporarily disables the sn indexes on the Example1database by changing the nsIndexType to none:

dn: cn=sn,cn=index,cn=Example1,cn=ldbm database,cn=plugins,cn=configobjectClass:top objectClass:nsIndex cn:sn nsSystemIndex:false nsIndexType:none

For a complete list of collation orders and their OIDs, see Appendix D, Internationalization, and forthe index configuration attributes or the ldapmodify command-line utility, see the Directory ServerConfiguration, Command, and File Reference.

Page 525: Red Hat Directory Server 5.1

Applying New Indexes to Existing Databases

505

NOTEAlways use the attribute's primary name (not the attribute's alias) when creating indexes.The primary name of the attribute is the first name listed for the attribute in the schema; forexample, uid for the user ID attribute.

11.3. Applying New Indexes to Existing DatabasesNew indexes are not added to existing databases automatically. They must be added manually, andDirectory Server has two methods for applying new indexes to an existing database: running thedb2index.pl script or running a cn=index,cn=tasks task.

11.3.1. Running the db2index.pl ScriptAfter creating an indexing entry or adding additional index types to an existing indexing entry, run thedb2index.pl script to generate the new set of indexes to be maintained by the Directory Server.After the script is run, the new set of indexes is active for any new data added to the directory and anyexisting data in the directory.

1. Open the Directory Server instance directory. 2

cd /etc/dirsrv/slapd-instance_name

2. Run the db2index.pl Perl script.

db2index.pl-D "cn=Directory Manager" -w secret -n ExampleServer -t sn

For more information about using this Perl script, see the Directory Server Configuration,Command, and File Reference.

Table 11.6, “db2index Options” describes the db2index.pl options.

Option Description

-D Specifies the DN of the administrative user.

-w Specifies the password of the administrativeuser.

-n Specifies the name of the database beingindexed.

-t Specifies the name of the attribute contained bythe index.

Table 11.3. db2index.pl Options

11.3.2. Using a cn=tasks Entry to Create an IndexThe cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=index, cn=tasks, cn=config to initiate an indexing operation.

Page 526: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

506

This task entry requires a unique name (cn) and a definition for the attribute and type of index, set innsIndexAttribute in the format attribute:index_type.

For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example presence index, cn=index, cn=tasks, cn=configobjectclass: extensibleObjectcn: example presence indexnsIndexAttribute: "cn:pres"

There are three possible index_types:

• pres for presence indexes

• eq for equality indexes

• sub for substring indexes

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on runningDirectory Server tasks under the cn=tasks entries.

11.4. Creating Browsing (VLV) IndexesA virtual list view (VLV) index is a way of creating a truncated list for faster searching while enhancingserver performance. The VLV index itself can be resource-intensive to maintain, but it can bebeneficial in large directories (over 1000 entries).

A browsing index is a type of VLV index that organizes the entries listed into alphabetical order,making it easier to find entries.

VLV indexes are not applied to attributes, like standard indexes are, but they are dynamicallygenerated based on attributes set in entries and the location of those entries in the directory tree. VLVindexes, unlike standard indexes, are special entries in the database rather than configuration settingsfor the database.

11.4.1. Creating Browsing Indexes from the Server Console1. Select the Directory tab.

2. In the left navigation tree, select the entry, such as People, for which to create the index.

3. From the Object menu, select Create Browsing Index.

The Create Browsing Index dialog box appears displaying the status of the index creation. Clickthe Status Logs box to view the status of the indexes created.

4. Click Close.

The new index is immediately active for any new data that is added to the directory. You do not have torestart your server.

Page 527: Red Hat Directory Server 5.1

Creating Browsing Indexes from the Command Line

507

For more information on how to change the VLV search information or the access control rules thatare set by default for VLV searches, see Section 11.4.2.1, “Adding a Browsing Index Entry” andSection 11.4.3, “Setting Access Control for VLV Information”.

11.4.2. Creating Browsing Indexes from the Command LineCreating a browsing index or virtual list view (VLV) index from the command line has these steps:

1. Using ldapmodify to add new browsing index entries or edit existing browsing index entries. SeeSection 11.4.2.1, “Adding a Browsing Index Entry”.

2. Running the vlvindex script to generate the new set of browsing indexes to be maintainedby the server. See Section 11.4.2.2, “Running the vlvindex Script”. Alternatively, launch anappropriate task under cn=tasks, cn=config (Section 11.4.2.3, “Using a cn=tasks Entry toCreate a Browsing Index”).

3. Ensuring that access control on VLV index information is set appropriately. See Section 11.4.3,“Setting Access Control for VLV Information”.

11.4.2.1. Adding a Browsing Index EntryThe type of browsing index entry to create depends on the type of ldapsearch attribute sorting toaccelerate. It is important to take the following into account:

• The scope of the search (base, one, sub)

• The base of the search (the entry to use as a starting point for the search)

• The attributes to sort

• The filter of the search

For more information on specifying filters for searches, see Appendix B, Finding Directory Entries.

• The LDBM database to which the entry that forms the base of the search belongs. You can onlycreate browsing indexes in LDBM databases.

There is more information on ldapsearch options in the Directory Server Configuration, Command,and File Reference.

For example, create a browsing index to accelerate an ldapsearch on the entryou=People,dc=example,dc=com held in the Example1 database with the following attributes:

• The search base is ou=People,dc=example,dc=com

• The search filter is (|(objectclass=*)(objectclass=ldapsubentry))

• The scope is one

• The sorting order for the returned attributes is cn, givenname, o, ou, and sn

1. Run ldapmodify.1

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

Page 528: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

508

The ldapmodify utility binds to the server and prepares it to add an entry to the configuration file.

2. Add an entry which specifies the base, scope, and filter of the browsing index:

dn: cn=MCC ou=People dc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins, cn=config objectClass: top objectClass: vlvSearch cn: MCC ou=People dc=example dc=com vlvBase: ou=People, dc=example,dc=com vlvScope: 1 vlvFilter: (|(objectclass=*)(objectclass=ldapsubentry))

• The cn contains the browsing index identifier, which specifies the entry on which to createthe browsing index; in this example, the ou=People,dc=example,dc=com entry. Red Hatrecommends using the dn of the entry for the browsing index identifier, which is the approachadopted by the Directory Server Console, to prevent identical browsing indexes from beingcreated. The entry is a member of the vlvSearch object class.

• The vlvbase attribute value specifies the entry on which you want to create the browsingindex; in this example, the ou=People,dc=example,dc=com entry (the browsing indexidentifier).

• The vlvscope attribute is 1, indicating that the scope for the search you want to accelerate is1. A search scope of 1 means that only the immediate children of the entry specified in the cnattribute, and not the entry itself, will be searched.

• The vlvfilter specifies the filter to be used for the search; in this example, (|(objectclass=*)(objectclass=ldapsubentry)).

3. Add the second entry, to specify the sorting order for the returned attributes:

dn: cn=by MCC ou=People dc=example dc=com,cn=MCC ou=People dc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins, cn= configobjectClass: topobjectClass: vlvIndexcn: by MCC ou=People dc=example dc=comvlvSort: cn givenName o ou sn

• The cn contains the browsing index sort identifier. The above cn is the type created by theConsole by default, which has the sorting order as being set by the browsing index base. Theentry is a member of the vlvIndex object class.

• The vlvsort attribute value specifies the order in which you want your attributes to be sorted;in this example, cn, givenName, o, ou, and then sn.

NOTEThis first browsing index entry must be added to the cn=database_name,cn=ldbmdatabase,cn=plugins,cn=config directory tree node, and the second entry must bea child of the first entry.

Page 529: Red Hat Directory Server 5.1

Creating Browsing Indexes from the Command Line

509

11.4.2.2. Running the vlvindex ScriptAfter creating the two browsing indexing entries or added additional attribute types to an existingindexing browsing entries, run the vlvindex script to generate the new set of browsing indexes to bemaintained by the Directory Server. After running the script, the new set of browsing indexes is activefor any new data added to the directory and any existing data in the directory.

To run the vlvindex script, do the following:

1. Open the Directory Server instance directory.2

cd /etc/dirsrv/slapd-instance_name

2. Stop the server.3

service dirsrv stop instance

3. Run the vlvindex script.

vlvindex -n Example1 -T "by MCC ou=people dc=example dc=com"

For more information about using this script, see the Directory Server Configuration, Command,and File Reference.

4. Restart the server.

service dirsrv start instance

Table 11.4, “vlvindex Options” describes the vlvindex options used in the examples:

Option Description

-n Name of the database containing the entries toindex.

-T Browsing index identifier to use to createbrowsing indexes.

Table 11.4. vlvindex Options

11.4.2.3. Using a cn=tasks Entry to Create a Browsing IndexAs an alternative to running the vlvindex script, it is possible to initiate an indexing task directly.

NOTERunning the indexing task is the same as running the vlvindex script.

The cn=tasks, cn=config entry in the Directory Server configuration is a container entry fortemporary entries that the server uses to manage tasks. Several common directory tasks havecontainer entries under cn=tasks, cn=config. Temporary task entries can be created undercn=index, cn=tasks, cn=config to initiate an indexing operation.

Page 530: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

510

This task entry requires a unique name (cn) and one other attribute, nsIndexVLVAttribute, whichgives the name of the browsing index definition entry to use to generate the VLV index.

For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example VLV index, cn=index, cn=tasks, cn=configobjectclass: extensibleObjectcn: example VLV indexnsIndexVLVAttribute: "by MCC ou=people,dc=example,dc=com"

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on runningDirectory Server tasks under the cn=tasks entries.

11.4.3. Setting Access Control for VLV InformationThe default access control for the VLV index information is to allow anyone who has authenticated. If asite requires anonymous users to use the VLV index information, modify the access control set for cn:VLV Request Control in the Directory Server's configuration.

1. Open the Directory Server configuration directory:2

cd /etc/dirsrv/slapd-instance_name

2. In a text editor, open the dse.ldif file.

3. Locate the oid=2.16.840.1.113730.3.4.9 entry.

dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config objectClass: top objectClass: directoryServerFeature oid: 2.16.840.1.113730.3.4.9 cn: VLV Request Control aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow( read, search, compare, proxy ) userdn = "ldap:///all" ;) creatorsName: cn=server,cn=plugins,cn=config modifiersName: cn=server,cn=plugins,cn=config ...

4. Change "ldap://all" to "ldap://anyone" and save your changes.

11.5. Changing the Index Sort OrderBy default, indexes are sorted alphabetically, in descending ASCII order. This is true for everyattribute, even attributes which may have numeric attribute values like Integer or TelephoneNumber. Itis possible to change the sort method by changing the matching rule set for the attribute.

11.5.1. Changing the Sort Order in the Console1. Select the Configuration tab.

2. Expand the Data node, expand the suffix of the database to index, and select the database.

Page 531: Red Hat Directory Server 5.1

Changing the Sort Order in the Command Line

511

3. Select the Indexes tab in the right pane.

4. Select the index to change the sort order for, and click Edit.

5. In the Matching Rules field, enter the new sort order to use. For example, to sort by numbers,rather than alphabetically, enter integerOrderingMatch.

6. Click Save.

11.5.2. Changing the Sort Order in the Command LineTo change the sort order using the command line, change the nsMatchingRule for the attributeindex. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=sn,cn=index,cn=Example1,cn=ldbm database,cn=plugins,cn=config changetype:modifyreplace:nsMatchingRulensMatchingRule:integerOrderingMatch

11.6. Changing the Width for Indexed Substring SearchesBy default, for a search to be indexed, the search string must be at least three characters long, withoutcounting any wildcard characters. For example, the string abc would be an indexed search while ab*would not be. Indexed searches are significantly faster than unindexed searches, so changing theminimum length of the search key is helpful to increase the number of indexed searches.

To improve search performance, particularly for sites with many wildcard searches, the search stringlength for indexed searches can be changed. Directory Server has three attributes which allow you tochange the minimum number of characters required for an indexed search:

• The nsSubStrBegin attribute sets the required number of characters for an indexed search for thebeginning of a search string, before the wildcard.

abc*

• The nsSubStrMiddle attribute sets the required number of characters for an indexed searchwhere a wildcard is used in the middle of a search string. For example:

ab*z

• The nsSubStrEnd attribute sets the required number of characters for an indexed search for theend of a search string, after the wildcard. For example:

*xyz

The default substring search length for the string triplet (before, middle, and end) is 3, 3, and 3,meaning every search requires a minimum of three characters, in every wildcard position.

For any attribute index to have alternate string lengths, add the extensibleObject object class tothe entry and then set the substring search lengths.

Page 532: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

512

1. Set the new key length for the specific attribute index. This requires adding theextensibleObject object class and then adding the nsSubStrBegin, nsSubStrEnd, ornsSubStrMiddle attributes as appropriate. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: attribute_name, cn=index, cn=database_name, ldbm database, cn=plugins, cn=configobjectClass: extensibleObjectnsSubStrBegin: 2nsSubStrMiddle: 2nsSubStrEnd: 2

2. Stop the server.

service dirsrv stop

3. Recreate the attribute index. If even one of the substring search width options is changed, then theentire index must be recreated.

db2index -t attribute_name

4. Start the server again.

service dirsrv start

11.7. Deleting IndexesThis section describes how to delete presence, equality, approximate, substring, international, andbrowsing indexes for specific attributes.

NOTEBecause Directory Server 8.1 can operate in either a single or multi-databaseenvironment, you have to delete any unwanted indexes from every database instance.Any default indexes you delete will not be deleted from previous sets of indexes onexisting database instances.

• Section 11.7.1, “Deleting Indexes from the Server Console”

• Section 11.7.2, “Deleting Indexes from the Command Line”

• Section 11.7.3, “Deleting Browsing Indexes from the Server Console”

• Section 11.7.4, “Deleting Browsing Indexes from the Command Line”

WARNINGDo not delete system indexes because deleting them can significantlyaffect Directory Server performance. System indexes are located in thecn=index,cn=instance,cn=ldbm database,cn=plugins,cn=config

Page 533: Red Hat Directory Server 5.1

Deleting Indexes from the Server Console

513

entry and the cn=default indexes,cn=config,cn=ldbmdatabase,cn=plugins,cn=config entry.

Also, be cautious when deleting default indexes since this can also affect how DirectoryServer works.

11.7.1. Deleting Indexes from the Server ConsoleThe Directory Server Console allows you to delete any indexes you have created, indexes used byother server applications such as a messaging or web server, and default indexes.

NOTEYou cannot delete system indexes.

To delete indexes using the Directory Server Console, do the following:

1. Select the Configuration tab.

2. Expand the Data node and expand the suffix associated with the database containing the index.

3. Select the database from which to delete the index.

4. Locate the attribute containing the index to delete. Clear the checkbox under the index.

To delete all indexes maintained for a particular attribute, select the attribute's cell under AttributeName, and click Delete Attribute.

5. Click Save.

A Delete Index warning dialog box opens, requiring a confirmation to delete the index.

6. Click Yes to delete the index.

7. The Delete Browsing Index dialog box appears displaying the status of the index deletion. Clickthe Status Logs button to view the status of the indexes deleted.

8. Once the indexing is complete, click Close.

11.7.2. Deleting Indexes from the Command LineCreating browsing indexes, or virtual list view (VLV) indexes, using the ldapdelete command-lineutility has two steps:

1. Delete an entire index entry or delete unwanted index types from an existing index entry using theldapdelete command-line utility (Section 11.7.2.1, “Deleting an Index Entry”).

2. Generate the new set of indexes to be maintained by the server using the db2index.pl Perlscript (Section 11.7.2.2, “Running the db2index.pl Script”).

Page 534: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

514

11.7.2.1. Deleting an Index EntryUse the ldapdelete command-line utility to delete either the entire indexing entry or the unwantedindex types from an existing entry.

• To delete the indexes for a particular database, remove the index entry from thecn=index,cn=database_name,cn=ldbm database,cn=plugins,cn=config entry, wherecn=database_name corresponds to the name of the database.

• To delete a default index, remove it from the cn=default indexes,cn=config,cn=ldbmdatabase,cn=plugins,cn=config entry.

1. Run ldapdelete.1

ldapdelete -D "cn=Directory Manager" -w secret -h ExampleServer -p 389 "cn=sn,cn=index,cn=Example1,dn=ldbm database,cn=plugins,dn=config"

For complete information on ldapdelete, see the Directory Server Configuration, Command,and File Reference.

2. For example, delete the presence, equality, and substring indexes for the sn attribute on thedatabase named Example1:

dn: cn=sn,cn=index,cn=Example1,cn=ldbm database,cn=plugins,cn=config objectClass:top objectClass:nsIndex cn:sn nsSystemIndex:false nsIndexType:pres nsIndexType:eq nsIndexType:sub nsMatchingRule:2.16.840.1.113730.3.3.2.3.1

Table 11.5, “ldapdelete Options” describes the ldapdelete options.

Option Description

-D Specifies the distinguished name with which toauthenticate to the server. The value must bea DN recognized by the Directory Server, andit must also have the authority to modify theentries.

-w Specifies the password associated with thedistinguished name specified in the -D option.

-h Specifies the name of the host on which theserver is running.

-p Specifies the port number that the server uses.

Table 11.5. ldapdelete Options

After deleting the index entry, the presence, equality, and substring indexes for the sn attribute are nolonger maintained by the Example1 database.

Page 535: Red Hat Directory Server 5.1

Deleting Browsing Indexes from the Server Console

515

11.7.2.2. Running the db2index.pl ScriptAfter deleting an indexing entry or some of the index types from an indexing entry, run thedb2index.pl script to generate the new set of indexes to be maintained by the Directory Server.Once you run the script, the new set of indexes is active for any new data you add to your directoryand any existing data in your directory.

To run the db2index.pl Perl script, do the following:

1. Open the Directory Server instance directory.2

cd /etc/dirsrv/slapd-instance_name

2. Run the db2index.pl Perl script. For example:

db2index.pl-D "cn=Directory Manager" -w secret -n Example1

For more information about using the db2index.pl Perl script, refer to Directory ServerConfiguration, Command, and File Reference. Table 11.6, “db2index Options” describes thedb2index.pl options used in the examples:

Option Description

-D Specifies the DN of the administrative user.

-w Specifies the password of the administrativeuser.

-n Specifies the name of the database into whichyou are importing the data.

Table 11.6. db2index Options

11.7.3. Deleting Browsing Indexes from the Server ConsoleTo delete a browsing index through the Directory Server Console, do the following:

1. Select the Directory tab.

2. Select the entry from which to delete the index in the navigation tree, and select Delete BrowsingIndex from the Object menu.

Alternatively, select and right-click the entry of the index to delete in the navigation tree, and thenchoose Delete Browsing Index from the pop-up menu.

3. A Delete Browsing Index dialog box appears asking you to confirm the deletion of the index.Click Yes.

4. The Delete Browsing Index dialog box appears displaying the status of the index deletion.

11.7.4. Deleting Browsing Indexes from the Command LineDeleting a browsing index or virtual list view (VLV) index from the command line involves two steps:

1. Using the ldapdelete to delete browsing index entries or edit existing browsing index entries(Section 11.7.4.1, “Deleting a Browsing Index Entry”).

Page 536: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

516

2. Running the vlvindex script to generate the new set of browsing indexes to be maintained bythe server (Section 11.7.4.2, “Running the vlvindex Script”). Alternatively, launch an appropriatetask under cn=tasks, cn=config (Section 11.4.2.3, “Using a cn=tasks Entry to Create aBrowsing Index”).

The actual entries for an alphabetical browsing index and virtual list view are the same. The followingsections describe the steps involved in deleting browsing indexes.

11.7.4.1. Deleting a Browsing Index EntryUse the ldapdelete command-line utility to either delete browsing indexing entries oredit existing browsing index entries. To delete browsing indexes for a particular database,remove the browsing index entries from the cn=index,cn=database_name,cn=ldbmdatabase,cn=plugins,cn=config entry, where cn=database_name corresponds to the name ofthe database.

For example, there is a browsing index for accelerating ldapsearch operations on the entryou=People,dc=example,dc=com. It held in the Example1 database where the searchbase is ou=People,dc=example,dc=com, the search filter is (|(objectclass=*)(objectclass=ldapsubentry)), the scope is 1, and the sorting order for the returned attributes iscn, givenname, o, ou, and sn.

1. Run ldapdelete.1

ldapdelete-D "cn=Directory Manager" -w secret -h ExampleServer-p 389 "cn=MCC ou=People dc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins, cn=config"

"cn=by MCC ou=People dc=example dc=com,cn=MCC ou=Peopledc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins, cn=config"

For full information on ldapdelete options, see the Directory Server Configuration, Command,and File Reference.

2. To delete this browsing index, delete the two corresponding browsing index entries:

dn: cn=MCC ou=People dc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins, cn=config objectClass: top objectClass: vlvSearch cn: MCC ou=People dc=example dc=com vlvBase: ou=People, dc=example,dc=com vlvScope: 1 vlvFilter: (|(objectclass=*)(objectclass=ldapsubentry))

dn: cn=by MCC ou=People dc=example dc=com,cn=MCC ou=Peopledc=example dc=com, cn=userRoot, cn=ldbm database, cn=plugins,cn=configobjectClass: topobjectClass: vlvIndexcn: by MCC ou=People dc=example dc=comvlvSort: cn givenname o ou sn

The following table describes the ldapdelete options used in the example:

Page 537: Red Hat Directory Server 5.1

Deleting Browsing Indexes from the Command Line

517

Option Description

-D Specifies the distinguished name with which toauthenticate to the server. The value must bea DN recognized by the Directory Server, andit must also have the authority to modify theentries.

-w Specifies the password associated with thedistinguished name specified in the -D option.

-h Specifies the name of the host on which theserver is running.

-p Specifies the port number that the server uses.

After deleting the two browsing index entries, the browsing index will no longer be maintained by theExample1 database.

11.7.4.2. Running the vlvindex ScriptAfter deleting browsing indexing entries or unwanted attribute types from existing browsing indexingentries, run the vlvindex script to generate the new set of browsing indexes to be maintained bythe Directory Server. After the script is run, the new set of browsing indexes is active for any new dataadded to the directory and any existing data in the directory.

1. Open the Directory Server instance directory.2

cd /etc/dirsrv/slapd-instance_name

2. Stop the server.3

service dirsrv stop instance

3. Run the vlvindex script.

vlvindex -n Example1 -T "by MCC ou=people dc=example dc=com"

For more information about using the vlvindex script, see the Directory Server Configuration,Command, and File Reference.

4. Restart the server.

service dirsrv start instance

Table 11.4, “vlvindex Options” describes the vlvindex options.

Alternatively, create a new task entry under cn=index, cn=tasks, cn=config to initiatean indexing operation. This task entry requires a unique name (cn) and one other attribute,nsIndexVLVAttribute, which gives the name of the browsing index definition entry to use togenerate the VLV index. This task is the same as running vlvindex.

For example:

Page 538: Red Hat Directory Server 5.1

Chapter 11. Managing Indexes

518

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=example VLV index, cn=index, cn=tasks, cn=configobjectclass: extensibleObjectcn: example VLV indexnsIndexVLVAttribute: "by MCC ou=people,dc=example,dc=com"

As soon as the task is completed, the entry is removed from the directory configuration.

The Directory Server Configuration, Command, and File Reference has more information on runningDirectory Server tasks under the cn=tasks entries.

Page 539: Red Hat Directory Server 5.1

Chapter 12.

519

Managing SSLTo provide secure communications over the network, Red Hat Directory Server includes the LDAPScommunications protocol. LDAPS is the standard LDAP protocol, running over Transport LayerSecurity (TLS, formerly Secure Sockets Layer or SSL). Directory Server also allows spontaneoussecure connections over otherwise-insecure LDAP ports, using the Start TLS LDAP extendedoperation.

This chapter describes how to use TLS/SSL with Directory Server.

12.1. Introduction to TLS/SSL in the Directory ServerThe Directory Server supports TLS/SSL to secure communications between LDAP clients and theDirectory Server, between Directory Servers that are bound by a replication agreement, or between adatabase link and a remote database. Directory Server can use TLS/SSL with simple authentication(bind DN and password) or with certificate-based authentication.

Directory Server's cryptographic services are provided by Mozilla Network Security Services (NSS),a library of TLS/SSL and base cryptographic functions. NSS includes a software-based cryptographictoken which is FIPS 140-2 certified.

Using TLS/SSL with simple authentication ensures confidentiality and data integrity. There are twomajor benefits to using a certificate — smart card, token, or software-based — to authenticate to theDirectory Server instead of a bind DN and password:

• Improved efficiency. When using applications that prompt once for the certificate database passwordand then use that certificate for all subsequent bind or authentication operations, it is more efficientthan continuously providing a bind DN and password.

• Improved security. The use of certificate-based authentication is more secure than non-certificatebind operations because certificate-based authentication uses public-key cryptography. Bindcredentials cannot be intercepted across the network. If the certificate or device is lost, it is uselesswithout the PIN, so it is immune from third-party interference like phishing attacks.

The Directory Server is capable of simultaneous TLS/SSL and non-SSL communications. This meansthat you do not have to choose between TLS/SSL or non-SSL communications for the DirectoryServer; both can be used at the same time. Directory Server can also utilize the Start TLS extendedoperation to allow TLS/SSL secure communication over a regular (insecure) LDAP port.

12.1.1. Enabling SSL: Summary of StepsTo configure the Directory Server to use LDAPS, follow these steps:

1. Obtain and install a certificate for the Directory Server, and configure the Directory Server to trustthe certification authority's (CA's) certificate.

For information, see Section 12.2, “Obtaining and Installing Server Certificates”.

2. Turn on TLS/SSL in the directory.

For information, refer to Section 12.4, “Starting the Server with TLS/SSL Enabled”.

3. Configure the Administration Server connect to an SSL-enabled Directory Server.

Page 540: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

520

4. Optionally, ensure that each user of the Directory Server obtains and installs a personal certificatefor all clients that will authenticate with TLS/SSL.

For information, refer to Section 12.8.1, “Configuring Directory Server to Accept Certificate-BasedAuthentication from LDAP Clients”.

12.1.2. Command-Line Functions for Start TLSLDAP operations such as ldapmodify, ldapsearch, and ldapdelete can use TLS/SSL whencommunicating with an SSL-enabled server or to use certificate authentication. Command-line optionsalso specify or enforce Start TLS, which which allows a secure connection to be enabled on a cleartext port after a session has been initiated.

IMPORTANTThese options to use Start TLS applies only for the Mozilla LDAP tools provided with RedHat Directory Server.

In the following example, a network administrator enforces Start TLS for a search for Mike Connor'sidentification number:

ldapsearch -p 389 -ZZZ -P certificateDB -s base -b "uid=mconnors,ou=people,dc=example,dc=com" "(attribute=govIdNumber)"

-ZZZ enforces Start TLS, and certificateDB gives the filename and path to the certificate database.

NOTEThe -ZZZ option enforces the use of Start TLS, and the server must respond that a StartTLS command was successful. If the -ZZZ command is used and the server does notsupport Start TLS, the operation is aborted immediately.

For information on the command-line options available, see the Directory Server Configuration,Command, and File Reference.

12.1.2.1. Troubleshooting Start TLSWith the -ZZ option, the following errors could occur:

• If there is no certificate database, the operation fails. See Section 12.2, “Obtaining and InstallingServer Certificates” for information on using certificates.

• If the server does not support Start TLS, the connection proceeds in clear text. To enforce the use ofStart TLS, use the -ZZZ command option.

• If the certificate database does not have the certificate authority (CA) certificate, the connectionproceeds in clear text. See Section 12.2, “Obtaining and Installing Server Certificates” forinformation on using certificates.

With the -ZZZ option, the following errors could occur, causing the Start TLS operation to fail:

Page 541: Red Hat Directory Server 5.1

Obtaining and Installing Server Certificates

521

• If there is no certificate database. See Section 12.2, “Obtaining and Installing Server Certificates” forinformation on using certificates.

• If the certificate database does not have the certificate authority (CA) certificate. See Section 12.2,“Obtaining and Installing Server Certificates” for information on using certificates.

• The server does not support Start TLS as an extended operation.

For SDK libraries used in client programs, if a session is already in TLS mode and Start TLS isrequested, then the connection continues to be in secure mode but prints the error "DSA isunwilling to perform".

12.2. Obtaining and Installing Server CertificatesBefore the Directory Server can be set to run in TLS/SSL, server and CA certificates must be properlyconfigured in the Directory Server. If a server certificate has already been generated for the DirectoryServer instance and the issuing certificate authority (CA) is already trusted by the Directory Server,begin setting up TLS/SSL as described in Section 12.4, “Starting the Server with TLS/SSL Enabled”.

Obtaining and installing certificates consists of the following steps:

1. Generate a certificate request.

2. Send the certificate request to a certificate authority.

3. Install the server certificate.

4. Set the Directory Server to trust the certificate authority.

5. Confirm that the certificates are installed.

Two wizards automate the process of creating a certificate database and of installing the key-pair. TheCertificate Request Wizard in the Directory Server Console can generate a certificate request andsend it to a certificate authority. The Certificate Install Wizard in the Directory Server Console canthen install the server certificate and the CA certificate.

12.2.1. Step 1: Generate a Certificate RequestGenerate a certificate request, and send it to a CA. The Directory Server Console has a tool, theCertificate Request Wizard, which generates a valid certificate request to submit to any certificateauthority (CA).

1. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

2. Select the Server Certs tab, and click the Request button.

3. Click Next.

Page 542: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

522

4. Enter the Requester Information in the blank text fields, then click Next.

• Server Name. Enter the fully qualified hostname of the Directory Server as it is used in DNS andreverse DNS lookups; for example, dir.example.com. The server name is critical for client-side validation to work, which prevents man-in-the-middle attacks.

• Organization. Enter the legal name of the company or institution. Most CAs require thisinformation to be verified with legal documents such as a copy of a business license.

• Organizational Unit. Optional. Enter a descriptive name for the organization within the company.

• Locality. Optional. Enter the company's city name.

• State or Province. Enter the full name of the company's state or province (no abbreviations).

• Country. Select the two-character abbreviation for the country's name (ISO format). The countrycode for the United States is US.

5. If an external security device is to be used to store the Directory Server certificates, the deviceis plugged in, and the module has been installed as described in Section 12.6, “Using ExternalSecurity Devices”, then the module is available in the Active Encryption Token menu. Thedefault is to use the software databases with Directory Server, internal (software).

6. Enter the password that will be used to protect the private key, and click Next.

Page 543: Red Hat Directory Server 5.1

Step 1: Generate a Certificate Request

523

The Next button is grayed out until a password is supplied.

7. The Request Submission dialog box provides two ways to submit a request: directly to the CA (ifthere is one internally) or manually. To submit the request manually, select Copy to Clipboard orSave to File to save the certificate request which will be submitted to the CA.

8. Click Done to dismiss the Certificate Request Wizard.

After generating the certificate request, send it to the CA.

Page 544: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

524

12.2.2. Step 2: Send the Certificate RequestAfter the certificate request is generated, send it to a certificate authority (CA); the CA will generatereturn a server certificate.

1. Most certificate requests are emailed to the CA, so open a new message.

2. Copy the certificate request information from the clipboard or the saved file into the body of themessage.

-----BEGIN NEW CERTIFICATE REQUEST----- MIIBrjCCARcCAQAwbjELMAkGA1UEBhMCVXMxEzARBgNVBAgTCkNBTElGT1J OSUExLDAqBgVBAoTI25ldHNjYXBlIGNvbW11bmljYXRpb25zIGNvcnBvcmF 0aW9uMRwwGgYDVQQDExNtZWxsb24ubmV0c2NhcGUuY29tMIGfMA0GCSqGSI b3DQEBAQUAA4GNADCBiQKBgQCwAbskGh6SKYOgHy+UCSLnm3ok3X3u83Us7 ug0EfgSLR0f+K41eNqqRftGR83emqPLDOf0ZLTLjVGJaH4Jn4l1gG+JDf/n /zMyahxtV7+mT8GOFFigFfuxaxMjr2j7IvELlxQ4IfZgWwqCm4qQecv3G+N 9YdbjveMVXW0v4XwIDAQABoAAwDQYK ------END NEW CERTIFICATE REQUEST-----

3. Send the email message to the CA.

After emailing the certificate request, wait for the CA to respond with the server certificate. Responsetime for requests varies. For example, if the CA is internal to the company, it may only take a dayor two to respond to the request. If the selected CA is a third-party, it could take several weeks torespond to the request.

After receiving the certificate, install it in the Directory Server's certificate database. When the CAsends a response, be sure to save the information in a text file. The certificate must be available toinstall in the Directory Server.

Also, keep a backup of the certificate data in a safe location. If the system ever loses the certificatedata, the certificate can be reinstalled using the backup file.

12.2.3. Step 3: Install the Certificate1. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

2. Select the Server Certs tab, and click Install.

3. Give the certificate location or paste the certificate text in the text box, then click Next.

Page 545: Red Hat Directory Server 5.1

Step 4: Trust the Certificate Authority

525

• In this file. Enter the absolute path to the certificate in this field.

• In the following encoded text block. Copy the text from the CA's email or from the created textfile, and paste it in this field.

4. Check that the certificate information displayed is correct, and click Next.

5. Give a name to the certificate, and click Next.

6. Provide the password that protects the private key. This password is the same as the one providedin step 6 in Section 12.2.1, “Step 1: Generate a Certificate Request”.

After installing the server certificate, configure the Directory Server to trust the CA which issued theserver's certificate.

12.2.4. Step 4: Trust the Certificate AuthorityConfiguring the Directory Server to trust the certificate authority consists of obtaining the CA'scertificate and installing it into the server's certificate database. This process differs depending onthe certificate authority. Some commercial CAs provide a web site that allow users to automaticallydownload the certificate. Others will email it back to users.

After receiving the CA certificate, use the Certificate Install Wizard to configure the Directory Serverto trust the certificate authority.

1. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

Page 546: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

526

2. Go to the CA Certs tab, and click Install.

3. If the CA's certificate is saved to a file, enter the path in the field provided. Alternatively, copy andpaste the certificate, including the headers, into the text box. Click Next.

4. Check that the certificate information that opens is correct, and click Next.

5. Name the certificate, and click Next.

6. Select the purpose of trusting this certificate authority; it is possible to select both options:

• Accepting connections from clients (Client Authentication). The server checks that the client'scertificate has been issued by a trusted certificate authority.

• Accepting connections to other servers (Server Authentication). This server checks thatthe directory to which it is making a connection (for replication updates, for example) has acertificate that has been issued by a trusted certificate authority.

7. Click Done.

Once both the server and CA certificates are installed, it is possible to configure the Directory Serverto run in TLS/SSL. However, Red Hat recommends verifying that the certificates have been installedcorrectly.

12.2.5. Step 5: Confirm That The New Certificates Are Installed1. In the Directory Server Console, select the Tasks tab, and click Manage Certificates.

2. Select the Server Certs tab.

A list of all the installed certificates for the server opens.

3. Scroll through the list. The certificates installed previously should be listed.

It is now possible to set up the Directory Server to run in TLS/SSL.

NOTEWhen renewing a certificate using the Certificate Wizard, the text on the introductionscreen does not clearly indicate that the process is renewal and not requesting a newcertificate. Also, the requester information is not filled in automatically.

12.3. Using certutilThe Directory Server has a command-line tool, certutil, which locally creates self-signed CA andclient certificates, certificate databases, and keys. The default location for the Directory Server certutiltool is /usr/bin/. 1

certutil can also be downloaded from ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/.

This is the location for Red Hat Enterprise Linux 5 (32-bit). File locations for other platforms are listed in Section 1.1, “DirectoryServer File Locations”.

Page 547: Red Hat Directory Server 5.1

Creating Directory Server Certificates through the Command Line

527

12.3.1. Creating Directory Server Certificates through the CommandLineThe following steps outline how to make the databases, key, CA certificate, server/client certificate,and convert the certificates into pkcs12 format.

1. Open the directory where the Directory Server certificate databases are stored.

cd /etc/dirsrv/slapd-instance_name

2. Make a backup copy of all of the filed in the directory as a precaution. If something goes awry withwhile managing certificates, the databases can then be restored. For example:

tar -cf /tmp/db-backup.tar *

3. Create a password file for the security token password.

vi /tmp/pwdfile

secretpw

This password locks the server's private key in the key database and is used when the keys andcertificates are first created. The password in this file is also the default password to encrypt PK12files used by pk12util. Because this password is stored in plaintext, the password file should beowned by the user as which Directory Server runs, by default nobody, and it must be set as read-only for the Directory Server user and allow no access to anyone else (mode 0400). It's a goodidea to have a secure backup of this file.

4. Set the environment variable for the shell to include the certutil directory path. For example:

export PATH=/usr/bin/:$PATH

The command varies depending on the shell.

5. Create the key and certificate databases databases.

certutil -N -d . -f /tmp/pwdfile

6. Generate the self-signed CA certificate. certutil creates the required key pairs and thecertificate. This certificate is used to generate the other server certificates and can be exported foruse with other servers and clients.

certutil -S -n "CA certificate" -s "cn=My Org CA cert, dc=example,dc=com" -2 -x -t "CT,," -m 1000 -v 120 -d . -k rsa -f /tmp/pwdfile

7. Generate the Directory Server client certificate.

certutil -S -n "Server-Cert" -s "cn=FQDN" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -k rsa -f /tmp/pwdfile

The value of the -s argument is very important. The leftmost RDN must be cn=FQDN (whereFQDN is the fully-qualified host and domain name of the Directory Server). For example,

Page 548: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

528

to issue a certificate for a server with the name ldap.example.com, specify at least -s"cn=ldap.example.com"; it is beneficial to have a more descriptive name to help with serveridentification, such as "cn=ldap.example.com, ou=DS1". The FQDN must be availablefor DNS and reverse DNS lookups to Directory Server clients because certificate validationmay fail if the clients cannot properly resolve the FQDN, and some clients refuse to connectif a server certificate does not have its FQDN in the subject. Additionally, using the formatcn=hostname.domain is essential for Directory Server clients to protect themselves from man inthe middle attacks.

NOTEThere should only be one cn in a certificate subject name. To add detail to the subjectname, use cn as the RDN and another attribute — like ou, l, or c — for the othersubject name elements.

To provide a subjectAltName, as well as the nickname, use the -8 argument in addition to the -sargument.

To use the Directory Server behind a DNS round robin or any other scheme which aliases asingle server certificate to multiple hostnames, see the TLS/SSL information about server namewildcards or subjectAltName.

Server certificates for other servers are created using a similar command as for the DirectoryServer certificate. Make sure that every -n option (nickname) and -m option (serial number) isunique for every certificate, and make sure that the -s option gives the correct FQDN for theserver.

NOTEKeep careful track on the numbers set with the -m option. The -m option sets theunique identifier for the server certificate, and a CA cannot issue two certificateswith the same ID. Keep a log of issued serial numbers so that no number is everduplicated.

8. Export the CA certificate for use with other servers and clients. A client usually requires the CAcertificate to validate the server certificate in an TLS/SSL connection. Use certutil to export theCA certificate in ASCII/PEM format:

certutil -d . -L -n "CA certificate" -a > cacert.asc

The way that the CA certificate is imported is different for every client. For example, certutilcan import a CA certificate into another Directory Server certificate database:

cd /etc/dirsrv/slapd-otherservercertutil -A -d . -n "CA certificate" -t "CT,," -a -i cacert.asc

9. Use pk12util to export other server certificates and keys created with certutil so that theycan be used on a remote server.

Page 549: Red Hat Directory Server 5.1

certutil Usage

529

pk12util -d . -o ldap1.p12 -n Server-Cert -w /tmp/pwdfile -k /tmp/pwdfile

The -w argument is the password used to encrypt the .p12 file for transport. The -k argumentspecifies the password for the key database containing the server certificate being exported to.p12.

10. If the Directory Server will run with TLS/SSL enabled, then create a password file (pin.txt)for the server to use so it will not prompt you for a password every time it restarts. Creating thepassword file is described in Section 12.4.3, “Creating a Password File for the Directory Server”.

The certificates created by certutil are automatically available in the Encryption tab of theConsole. There is no need to import them because they are already in the certificate database.

12.3.2. certutil Usagecertutil can be used for a variety of tasks to manage certificates and keys, such as generatingcertificate requests and removing certificates from the certificate database. Some of the most commonoptions are listed in Table 12.1, “certutil Options”. For the full list of commands and arguments, runcertutil -H from the command line.

Options Description

-x Creates a self-signed CA certificate.

-S Creates a server or client certificate.

-R Generates a certificate request.

-N Creates new security databases.

-L Lists all of the certificates in the database.

-A Adds a certificate to the certificate database.

-n Gives the name of the certificate.

-d Certificate database directory; this is thedirectory for the subsystem instance.

-m The serial number for the certificate.

-k The key type to use; the only option is rsa.

-g The key size. The recommended size for RSAkeys is 2048.

-s The subject name of the certificate.

-t The trust arguments for the certificate, meaningthe purposes for which the certificate is allowedto be used.

-v The validity period, in months.

numbers 1-8 These set the available certificate extensions.Only eight can be specified through thecertutil tool:• Key Usage: 1

• Basic Constraints: 2

Page 550: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

530

Options Description• Certificate Authority Key ID: 3

• CRL Distribution Point: 4

• Netscape Certificate Type: 5

• Extended Key Usage: 6

• Email Subject Alternative Name: 7

• DNS Subject Alternative Name: 8

-a Outputs the certificate request to an ASCII fileinstead of binary.

-o The output file to which to save the certificaterequest.

-i An input file containing a certificate.

-f The path to a password file for the securitydatabases password.

Table 12.1. certutil Options

Table 12.2, “certutil Examples” has some of the common uses for the certutil command.

Example Description

certutil -L -d . Lists the certificates in the database.

certutil -N -d . Creates new key (key3.db) and certificate(cert8.db) databases.

certutil -S -n "CA certificate" -s "cn=My Org CAcert, dc=example,dc=com" -2 -x -t "CT,," -m 1000-v 120 -d . -k rsa

Creates a self-signed CA certificate.

certutil -S -n "Server-Cert" -s "cn=FQDN" -c "CAcertificate" -t "u,u,u" -m 1001 -v 120 -d . -k rsa

Creates a client certificate.

certutil -L -d . -n "cert_name" "Pretty prints" the specified certificate; thecert_name can specify either a CA certificate ora client certificate.

certutil -L -d . -n "cert_name" > certfile.asc Exports the specified certificate out of thedatabase to ASCII (PEM) format.

certutil -L -d . -n "cert_name" -r > certfile.bin Exports the specified certificate out of thedatabase to binary format; this can be usedwith Directory Server attributes such asusercertificate;binary.

Table 12.2. certutil Examples

12.4. Starting the Server with TLS/SSL EnabledMost of the time, the server should run with TLS/SSL enabled. If TLS/SSL is temporarily disabled, re-enable it before processing transactions that require confidentiality, authentication, or data integrity.

Page 551: Red Hat Directory Server 5.1

Enabling TLS/SSL Only in the Directory Server

531

Before TLS/SSL can be activated, first create a certificate database, obtain and install a servercertificate, and trust the CA's certificate, as described in Section 12.2, “Obtaining and Installing ServerCertificates”.

With TLS/SSL enabled, when the server restarts, it prompts for the PIN or password to unlock thekey database. This is the same password used when the server certificate and key were importedinto the database. Restarting the Directory Server without the password prompt is possible by usinguse a hardware crypto device or creating a PIN file (Section 12.4.3, “Creating a Password File for theDirectory Server”).

NOTEOn SSL-enabled servers, be sure to check the file permissions on certificate databasefiles, key database files, and PIN files to protect the sensitive information they contain.Because the server does not enforce read-only permissions on these files, check the filemodes to protect the sensitive information contained in these files.

The files must be owned by the Directory Server user, such as the default nobody. Thekey and cert databases should be owned by the Directory Server user and should typicallyhave read/write access for the owner with no access allowed to any other user (mode0600). The PIN file should also be owned by the Directory Server user and set to read-only by this user, with no access to anyone other user (mode 0400).

12.4.1. Enabling TLS/SSL Only in the Directory Server1. Obtain and install CA and server certificates.

2. Set the secure port for the server to use for TLS/SSL communications.

The encrypted port number must not be the same port number used for normal LDAPcommunications. By default, the standard port number is 389, and the secure port is 636.

Change the secure port number in the Configuration>Settings tab of the Directory ServerConsole.

3. In the Directory Server Console, select the Configuration tab, and then select the top entry in thenavigation tree in the left pane. Select the Encryption tab in the right pane.

4. Select the Enable SSL for this Server checkbox.

5. Check the Use this Cipher Family checkbox.

6. Select the certificate to use from the drop-down menu.

7. Click Cipher Settings.

The Cipher Preference dialog box opens. By default, all ciphers are selected.

8. Set the preferences for client authentication.

• Do not allow client authentication. With this option, the server ignores the client's certificate. Thisdoes not mean that the bind will fail.

Page 552: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

532

• Allow client authentication. This is the default setting. With this option, authentication isperformed on the client's request. For more information about certificate-based authentication,see Section 12.8, “Using Certificate-Based Authentication”.

• Require client authentication. With this option, the server requests authentication from the client.

If TLS/SSL is only enabled in the Directory Server and not the Directory Server Console, do notselect Require client authentication checkbox.

NOTETo use certificate-based authentication with replication, the consumer server must beconfigured either to allow or to require client authentication.

9. To verify the authenticity of requests, select the Check hostname against name in certificate foroutbound SSL connections option. The server does this verification by matching the hostnameagainst the value assigned to the common name (cn) attribute of the subject name in the beingpresented for authentication.

By default, this feature is disabled. If it's enabled and if the hostname does not match the cnattribute of the certificate, appropriate error and audit messages are logged. For example, in areplicated environment, messages similar to these are logged in the supplier server's log files if itfinds that the peer server's hostname doesn't match the name specified in its certificate:

[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81 (Netscape runtime error -12276 - Unable to communicate securely with peer: requested domain name does not match the server's certificate.)[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth" (ultra60:1924): Replication bind with SSL client authentication failed: LDAP error 81 (Can't contact LDAP server)

Red Hat recommends enabling this option to protect Directory Server's outbound SSL connectionsagainst a man-in-the-middle (MITM) attack.

10. Click Save.

11. Restart the Directory Server. The Directory Server must be restarted from the command line. 2

service dirsrv restart instance

When the server restarts, it prompts for the PIN or password to unlock the key database. This isthe same password used when the server certificate and key were imported into the database.

To restart the Directory Server without the password prompt, create a PIN file or use a hardwarecrypto device. See Section 12.4.3, “Creating a Password File for the Directory Server” forinformation on how to create a PIN file.

Page 553: Red Hat Directory Server 5.1

Enabling TLS/SSL in the Directory Server, Administration Server, and Console

533

12.4.2. Enabling TLS/SSL in the Directory Server, AdministrationServer, and Console1. Obtain server certificates and CA certs, and install them on the Directory Server. This is described

in Section 12.2, “Obtaining and Installing Server Certificates”.

2. Obtain and install server and CA certificates on the Administration Server. This is a similar processas for the Directory Server.

NOTEIt is important that the Administration Server and Directory Server have a CAcertificate in common so that they can trust the other's certificates.

3. If the default port number of 636 is not used, change the secure port setting.

Change the secure port number in the Configuration>Settings tab of the Directory ServerConsole, and save.

4. In the Configuration tab of the Directory Server Console, highlight the server name at the top ofthe table, and select the Encryption tab.

5. Select the Enable SSL checkbox.

6. Check the Use this Cipher Family checkbox.

7. Select the certificate to use from the drop-down menu.

8. Click Cipher Settings.

The Cipher Preference dialog box opens. By default, all ciphers are selected.

9. Set the preferences for client authentication.

• Do not allow client authentication. With this option, the server ignores the client's certificate. Thisdoes not mean that the bind will fail.

• Allow client authentication. This is the default setting. With this option, authentication isperformed on the client's request. For more information about certificate-based authentication,see Section 12.8, “Using Certificate-Based Authentication”.

• Require client authentication. With this option, the server requests authentication from the client.

NOTETo use certificate-based authentication with replication, then configure the consumerserver either to allow or to require client authentication.

10. To verify the authenticity of requests, select the Check hostname against name in certificate foroutbound SSL connections option. The server does this verification by matching the hostnameagainst the value assigned to the common name (cn) attribute of the subject name in the beingpresented for authentication.

Page 554: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

534

By default, this feature is disabled. If it's enabled and if the hostname does not match the cnattribute of the certificate, appropriate error and audit messages are logged. For example, in areplicated environment, messages similar to these are logged in the supplier server's log files if itfinds that the peer server's hostname doesn't match the name specified in its certificate:

[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81 (Netscape runtime error -12276 - Unable to communicate securely with peer: requested domain name does not match the server's certificate.)[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth" (ultra60:1924): Replication bind with SSL client authentication failed: LDAP error 81 (Can't contact DAP server)

Red Hat recommends enabling this option to protect Directory Server's outbound TLS/SSLconnections against a man-in-the-middle (MITM) attack.

11. Save the changes to the SSL configuration.

12. Restart the Administration Server. The server must be restarted from the command line.2

service dirsrv-admin restart

When the server restarts, it prompts for the PIN or password to unlock the key database. This isthe same password used when the server certificate and key were imported into the database.

To restart the Administration Server without the password prompt, create a PIN file or use ahardware crypto device. See Section 12.4.4, “Creating a Password File for the AdministrationServer” for information on how to create a PIN file.

13. If necessary, reopen the Configuration, select the server, and open the Encryption tab.

14. Check the Use SSL in the Console box. Hit Save.

15. In the Administration Server Console, select the Configuration tab. Select the Encryption tab,check the Enable SSL checkbox, and fill in the appropriate certificate information.

16. In the Configuration DS tab, change the port number to the new Directory Server secure portinformation. See Section 1.6, “Changing Directory Server Port Numbers” for more information. Dothis even if the default port of 636 is used. Check the Secure Connection checkbox.

17. In the User DS tab, select the Set User Directory radio button, and fill in the Directory Serversecure port information, the LDAP URL, and the user database information. Check the SecureConnection checkbox.

18. Save the new TLS/SSL settings and Configuration DS and User DS information in theAdministration Server Console.

NOTEWhen next logging into the Directory Server Console, be certain that the address readshttps; otherwise, the operation will time out, unable to find the server since it is runningon a secure connection. After successfully connecting, a dialog box appears to accept

Page 555: Red Hat Directory Server 5.1

Creating a Password File for the Directory Server

535

the certificate. Click OK to accept the certificate (either only for that current session orpermanently).

12.4.3. Creating a Password File for the Directory ServerIt is possible to store the certificate password in a password file. By placing the certificate databasepassword in a file, the server can be started from the Directory Server Console and also restartedautomatically when running unattended.

WARNINGThis password is stored in clear text within the password file, so its usage represents asignificant security risk. Do not use a password file if the server is running in an unsecuredenvironment.

The password file must be in the same directory where the other key and certificate databasesfor Directory Server are stored. This is usually the main configuration directory, /etc/dirsrv/slapd-instance_name. The file should be named pin.txt.

Include the token name and password in the file. For example:

Internal (Software) Token:secret

For the NSS software crypto module (the default software database), the token is always calledinternal.

The PIN file should be owned by the Directory Server user and set to read-only by the DirectoryServer user, with no access to anyone other user (mode 0400).

12.4.4. Creating a Password File for the Administration ServerLike the Directory Server, the Administration Server can use a password file during login when TLS/SSL is enabled.

WARNINGThis password is stored in clear text within the password file, so its usage represents asignificant security risk. Do not use a password file if the server is running in an unsecuredenvironment.

1. Open the Administration Server configuration directory, /etc/dirsrv/admin-serv.

2. Create a password file named password.conf. The file should include a line with the tokenname and password, in the form token:password. For example:

internal:secret

For the NSS software crypto module (the default software database), the token is always calledinternal.

Page 556: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

536

The password file should be owned by the Administration Server user and set to read-only by theAdministration Server user, with no access to any other user (mode 0400).

NOTETo find out what the Administration Server user ID is, run grep in the AdministrationServer configuration directory:

cd /etc/dirsrv/admin-serv

grep \^User console.conf

3. In the /etc/dirsrv/admin-serv directory, edit the nss.conf file to point to the location of thenew password file.

# Pass Phrase Dialog:# Configure the pass phrase gathering process.# The filtering dialog program (`builtin' is a internal# terminal dialog) has to provide the pass phrase on stdout.NSSPassPhraseDialog file://etc/dirsrv/admin-serv/password.conf

4. Restart the Administration Server. 2

service dirsrv-admin restart

12.5. Updating Attribute Encryption for New SSL/TLSCertificatesWhen SSL is first configured, there is no problem with attribute encryption. However, if the SSLcertificate is changed, then attribute encryption fails, with messages like these:

Apr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - attrcrypt_unwrap_key: failed to unwrap key for cipher AESApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to retrieve key for cipher AES in attrcrypt_cipher_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to initialize cipher AES in attrcrypt_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - attrcrypt_unwrap_key: failed to unwrap key for cipher AESApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to retrieve key for cipher AES in attrcrypt_cipher_initApr 4 13:00:35 smtp1 logger: [04/Apr/2009:13:00:34 -0700] - Failed to initialize cipher AES in attrcrypt_init

This is because the previously-generated keys do not work with the new server certificate. To correctthese errors, force the server to generate new keys for attribute encryption:

1. Stop the server.

service dirsrv stop

2. Open the dse.ldif file.

Page 557: Red Hat Directory Server 5.1

Using External Security Devices

537

vim /etc/dirsrv/dse.ldif

3. There are special encryption key entries for the encryption ciphers used for attribute encryptionunder the database configuration. For example:

dn: cn=AES,cn=encrypted attribute keys,cn=userRoot,cn=ldbm database,cn=plugins,cn=configobjectClass: topobjectClass: extensibleObjectcn: AESnssymmetrickey:: mSLm/RlCLvPZrSdARHPowedF9zKx+kjVTww5ARE4w0lbl2YlYvrIg6mUlSsmzMfdhc1BBURhFDNwwUDisHWwiMJRIvHXstx5EGstWE9xokIU+xeMZF8cPJrY1udFSPFc0iKyiCOaPacWpomn/XPaVxkQqBWk4vJzrHHhH1o3bNg=

Delete these entries.

4. Start the server again.

service dirsrv start

As soon as the server restarts, it generates new encryption keys for the encrypted attribute keys.

12.6. Using External Security DevicesA security module serves as a medium between the Directory Server and the SSL layer. The modulestores the keys and certificates used for encryption and decryption. The standard which defines thesemodules is Public Key Cryptography Standard (PKCS) #11, so these modules are PKCS #11 modules.

By default, Directory Server uses build in security databases, key3.db and cert8.db, to store thekeys and certificates used by the servers.

It is also possible to use external security devices to store Directory Server certificates and keys.For Directory Server to use an external PKCS #11 module, the module's drivers must be installed inDirectory Server.

To install an external security device:

1. Connect the device, and install its drivers on the server machine.

2. Open the Directory Server Console for the server instance with which to use the security device.

3. Open the Console in the top navigation menu, and select the Security and then the ConfigureSecurity Modules item.

4. In the window, click the Install button.

5. In the configuration box, enter the full path to the driver file for the device and the name for themodule.

6. Click OK to save the new module driver.

12.7. Setting Security PreferencesThe Directory Server supported several different ciphers, and the type of ciphers to use for TLS/SSL communications are set by the user. A cipher is the algorithm used in encryption. Some ciphers

Page 558: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

538

are more secure, or stronger, than others. Generally speaking, the more bits a cipher uses duringencryption, the more difficult it is to decrypt the key.

When a client initiates an TLS/SSL connection with a server, the client tells the server what ciphers itprefers to use to encrypt information. In any two-way encryption process, both parties must use thesame ciphers. There are a number of ciphers available. The server needs to be able to use the ciphersthat will be used by client applications connecting to the server.

12.7.1. Available CiphersThis section lists information about the available ciphers for Directory Server encryption. Each cipherhas the following information:

• Directory Server name. The name of the cipher suite used when configuring the Directory Server.The Directory Server uses this name both internally and in the Directory Server Console.

• Key exchange. The key exchange algorithm. DHE stands for Diffie-Hellman; DSS stands for DigitalSignature Standard. The 1024 bit ciphers are lower strength ciphers formerly used for exportcontrol.

• Encryption Algorithm. AES stands for the American Encryption Standard. DES stands for DataEncryption Standard.

• Symmetric Key Bit Size. The size in bits of the key used for the actual transport data encryption.

• Message Authentication. SHA stands for Secure Hash Algorithm.

The Mozilla site, http://www.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html fordefinitions and explanations of the encryption algorithms.

NOTEDirectory Server supports ciphers for TLSv1 (recommended) and SSLv3. SSLv2 supportis deprecated and not enabled by default in Directory Server.

Directory Server provides the following TLSv1 ciphers:

Directory ServerName

Key Exchange EncryptionAlgorithm

Symmetric KeyBit Size

MessageAuthentication

tls_dhe_dss_aes_128_shaDHE with DHS AES 128 SHA

tls_dhe_rsa_aes_128_shaDHE with RSA AES 128 SHA

tls_rsa_aes_256_shaRSA AES 256 SHA

tls_dhe_dss_aes_256_shaDHE with DSS AES 256 SHA

tls_dhe_rsa_aes_256_shaDHE with RSA AES 256 SHA

tls_dhe_dss_1024_rc4_shaDHE with DSS1024 bit publickey

RC4 56 SHA

tls_dhe_dss_rc4_128_shaDHE with DSS RC4 128 SHA

tls_rsa_export1024_with_rc4_56_shaRSA with 1024 bitpublic key

RC4 56 SHA

Page 559: Red Hat Directory Server 5.1

Selecting the Encryption Cipher

539

Directory ServerName

Key Exchange EncryptionAlgorithm

Symmetric KeyBit Size

MessageAuthentication

tls_rsa_export1024_with_des_cbc_shaRSA with 1024 bitpublic key

DES 56 SHA

Table 12.3. TLSv1 Ciphers

Directory Server provides the following SSLv3 ciphers:

Directory ServerName

Key Exchange EncryptionAlgorithm

Symmetric KeyBit Size

MessageAuthentication

dhe_rsa_3des_sha DHE with RSA 3DES 168 SHA

dhe_rsa_des_sha DHE with RSA DES 56 SHA

dhe_dss_3des_sha DHE with DSS 3DES 168 SHA

dhe_dss_des_sha DHE with DSS DES 56 SHA

rsa_des_sha RSA DES 56 SHA

rsa_3des_sha RSA 3DES 168 SHA

rsa_fips_des_sha RSA DES 56 SHA

rsa_fips_3des_sha RSA 3DES 168 SHA

rsa_rc4_128_md5 RSA RC4 128 MD5

rsa_rc4_40_md5 RSA RC4 40 MD5

rsa_rc2_40_md5 RSA RC2 40 MD5

rsa_null_md5 RSA null (none) N/A MD5

fortezza fortezza fortezza 80 SHA

fortezza_rc4_128_shafortezza RC4 128 SHA

fortezza_null fortezza null (none) N/A SHA

Table 12.4. SSLv3 Ciphers

12.7.2. Selecting the Encryption CipherTo select the ciphers for the Directory Server to use, do the following:

1. Make sure TLS/SSL is enabled for the server. For instructions on enabling TLS/SSL, seeSection 12.4, “Starting the Server with TLS/SSL Enabled”.

2. In the Directory Server Console, select the Configuration tab, and then select the topmost entryin the navigation tree in the left pane.

3. Select the Encryption tab in the right pane.

This displays the current server encryption settings.

4. Click Cipher Setting.

The Cipher Preference dialog box opens.

5. In the Cipher Preference dialog box, specify which ciphers for the Directory Server to use byselecting them from the list, and click OK.

Page 560: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

540

Unless there is a security reason not to use a specific cipher, select all of the ciphers, except fornone,MD5.

6. In the Encryption tab, click Save.

WARNINGAvoid selecting the none,MD5 cipher because the server will use this option if noother ciphers are available on the client, instead of refusing the connection. Thenone,MD5 cipher is not secure because encryption does not occur.

12.8. Using Certificate-Based AuthenticationDirectory Server allows certificate-based authentication for the command-line tools (which are LDAPclients) and for server-to-server connections (replication and chaining).

NOTEA single configuration parameter, nsslapd-certdir, in cn=config in dse.ldiflists the directory containing the key, certificate, and security files. The directoryname should be unique and specific to the server. For example, the /etc/dirsrv/slapd-instance_name directory contains the key and certificate databases only for theDirectory Server instance called instance_name. That directory will not contain key andcertificate databases for any other server or client, nor will any of the key, certificate, orother security-related files for instance_name be located in any other directory.

Directory Server used to keep separate files for the key and certificate databases. Withthe change to Filesystem Hierarchy Standard, the certificate and key files have beenconsolidated into a single file, specified in the nsslapd-certdir parameter, and the keyand certificate file is stored in the /etc/dirsrv/slapd-instance_name directory.

Previous versions of Directory Server used a single directory, /opt/redhat-ds/slapd-instance/alias, for all security-related files for all servers, and required a uniqueprefix, such as slapd-instance-, for the key, certificate, and security-related files. TheDirectory Server used the attributes nsCertFile and nsKeyFile to give the locationsfor the key and certificate databases.

When a server receives a request from a client, it can ask for the client's certificate before proceeding.

After checking that a client certificate chain ends with a trusted CA, the server can optionallydetermine which user is identified by the client certificate and then look up that user's entry in thedirectory. Each certificate has the name of the identity it verifies in a subject name, called the subjectDN. The server authenticates the user by comparing the information in the subject DN with the DN ofthe user's directory entry.

In order to locate user entries in the directory, a server must know how to interpret the subject namesof certificates from different CAs. The mapping between the subject names of the certificates and theuser DNs is defined in the certmap.conf file. This file provides three kinds of information for eachlisted CA:

Page 561: Red Hat Directory Server 5.1

Configuring Directory Server to Accept Certificate-Based Authentication from LDAP Clients

541

• It maps the distinguished name (DN) in the certificate to a branch point in the LDAP directory.

• It specifies which DN values from the certificate (user name, email address, and so on) the servershould use for the purpose of searching the directory.

• It specifies whether the server should go through an additional verification process. This processinvolves comparing the certificate presented for authentication with the certificate stored in theuser's directory entry. By comparing the certificate, the server determines whether to allow access orwhether to revoke a certificate by removing it from the user's entry.

If more than one directory entry contains the information in the user's certificate, the server canexamine all matching entries in order to determine which user is trying to authenticate. Whenexamining a directory entry, the server compares the presented certificate with the one stored in theentry. If the presented certificate does not match any certificates or if the matching entries do notcontain certificates, client authentication fails.

After the server finds a matching entry and certificate in the directory, it can determine the appropriatekind of authorization for the client. For example, some servers use information from a user's entry todetermine group membership, which in turn can be used during evaluation of ACIs to determine whatresources the user is authorized to access.

Three things are required for the Directory Server to allow client authentication:

• The server must have SSL turned on. See Section 12.4, “Starting the Server with TLS/SSL Enabled”for more information.

• The Directory Server must trust the CA who issued the certificate to the client, as described in step6 of Section 12.2.4, “Step 4: Trust the Certificate Authority”.

• The subject DN in the certificate must be mapped in the user DN through a mapping in thecertmap.conf file, as in Section 12.8.2, “Mapping DNs to Certificates”.

12.8.1. Configuring Directory Server to Accept Certificate-BasedAuthentication from LDAP ClientsClient authentication to the Directory Server will require or allow a user to use a certificate to establishits identity, in addition to the server having to present a certification. This is also called certificate-based authentication.

1. On the client system, obtain a client certificate from the CA.

2. Install the client certificate on the client system.

Regardless of how the certificate is sent (either in email or on a web page), there should be a linkto click to install the certificate.

Record the certificate information that is sent from the CA, especially the subject DN of thecertificate because the server must be configured to map it to an entry in the directory. The clientcertificate resembles the following:

-----BEGIN CERTIFICATE----- MIICMjCCAZugAwIBAgICCEEwDQYJKoZIhvcNAQEFBQAwfDELMAkGA1UEBh MCVVMxIzAhBgNVBAoTGlBhbG9va2FWaWxsZSBXaWRnZXRzLCBJbmMuMR0w GwYDVQQLExRXaWRnZXQgTWFrZXJzICdSJyBVczEpMCcGA1UEAxMgVGVzdC

Page 562: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

542

BUZXN0IFRlc3QgVGVzdCBUZXN0IFRlc3QgQ0EwHhcNOTgwMzEyMDIzMzU3 WhcNOTgwMzI2MDIzMzU3WjBPMQswCQYDVQQGEwJVUzEoMCYGA1UEChMfTm V0c2NhcGUgRGlyZWN0b3 ------END CERTIFICATE-----

3. Convert the client certificate into binary format using the certutil utility.

certutil -L -d certdbPath -n userCertName -r > userCert.bin

certdbPath is the directory which contains the certificate database; for example, a user certificatefor Mozilla Thunderbird is stored in $HOME/.thunderbird. userCertName is the name of thecertificate, and userCert.bin is the name of the output file for binary format.

4. On the server, map the subject DN of the certificate to the appropriate directory entry by editingthe certmap.conf file.

NOTEDo not map a certificate-based authentication certificate to a distinguished nameunder cn=monitor. Mapping a certificate to a DN under cn=monitor causesthe bind operation to fail. Map the certificate to a target located elsewhere in thedirectory information tree. Make sure that the verifyCert parameter is set toon in the certmap.conf file. If this parameter is not set to on, Directory Serversimply searches for an entry in the directory that matches the information in thecertmap.conf file. If the search is successful, it grants access without actuallychecking the value of the userCertification and usercertificate;binaryattributes.

5. In the Directory Server, modify the directory entry for the user or identity (if it is another server)who owns the client certificate to add the usercertificate attribute.

a. Select the Directory tab, and navigate to the user entry.

b. Double-click the user entry, and use the Property Editor to add the usercertificateattribute, with the binary subtype.

When adding this attribute, instead of an editable field, the server provides a Set Value button.

c. Click Set Value.

A file selector opens. Use it to select the binary file created in step 3.

For information on using the Directory Server Console to edit entries, see Section 3.1.3,“Modifying Directory Entries”.

For information on how to use TLS/SSL with ldapmodify, ldapdelete, and ldapsearch, seeSection 12.8.6, “Connecting to the Directory Server with Certificate-Based Authentication” and theDirectory Server Configuration, Command, and File Reference.

12.8.2. Mapping DNs to CertificatesWhen a server performs client authentication, it interprets a certificate, extracts user information, andthen searches the directory for that information. In order to process certificates from different CAs, the

Page 563: Red Hat Directory Server 5.1

Mapping DNs to Certificates

543

server uses a file called certmap.conf. This file contains instructions on how to interpret differentcertificates and how to search the directory for the information that those certificates contain.

In the Directory Server, a user entry has a format like the following:

dn: uid=jsmith,ou=People,dc=example,dc=com...

cn: John Smithmail: [email protected]

A subject DN, however, is almost always formatted differently than an LDAP DN. For example:

cn=John Smith, [email protected], c=US, o=Example.com

The email attribute in the directory is almost always unique within the organization, as is the commonname of the user. These attributes are also indexed by default, so they are easily searched, andare common attributes to be used in the subject names of certificates. The certmap.conf file canbe configured so that the server looks for any mail or common name elements in the subject DNand matches them against the entries in the directory. Much like an ldapsearch, the cert mappingdefines a search base (DNComps) and search filter (FilterComps).

certmap Example o=Example.com,c=USExample:DNComps dcExample:FilterComps mail,cn

The certmap.conf file is stored in the /etc/dirsrv/config folder. The file contains a defaultmapping as well as mappings for specific CAs.

The default mapping specifies what the server should do if a client certificate was issued by a CA thatis not listed in certmap.conf. The mappings for specific CAs specify what the server should do forclient certificates issued by those CAs. All mappings define the following:

• Where in the directory the server should begin its search

• What certificate attributes the server should use as search criteria

• Whether the server should verify the certificate with one that is stored in the directory

Mappings have the following syntax:

certmap name issuer DN name:property [value] name:property [value] ...

The first line of a mapping specifies the mapping's name as well as the DN for the issuer of the clientcertificate. The mapping can have any name, but the issuerDN must exactly match the issuer DN ofthe CA that issued the client certificate. For example, the following two issuerDN lines differ only in thenumber of spaces they contain, but the server would treat these two entries as different:

certmap moz ou=Example CA,o=Example,c=UScertmap moz ou=Example CA, o=Example, c=US

Page 564: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

544

The second and subsequent lines of a mapping identify the rules that the server should use whensearching the directory for information extracted from a certificate. These rules are specified throughthe use of one or more of the following properties:

• DNComps

• FilterComps

• VerifyCert

• CmapLdapAttr

• Library

• InitFn

DNCompsDNComps is a comma-separated list of relative distinguished name (RDN) keywords used to determinewhere in the user directory the server should start searching for entries that match the informationfor the owner of the client certificate. The server gathers values for these keywords from the clientcertificate and uses the values to form a DN, which determines where the server starts its search inthe directory.

For example, if the DNComps is set to use the o and c RDN keywords, the server starts the searchfrom the o=org, c=country entry in the directory, where org and country are replaced with values fromthe DN in the certificate.

• If there is not a DNComps entry in the mapping, the server uses either the CmapLdapAttr setting orthe entire subject DN in the client certificate to determine where to start searching.

• If the DNComps entry is present but has no value, the server searches the entire directory tree forentries matching the filter specified by FilterComps.

The following RDN keywords are supported for DNComps:

• cn

• ou

• o

• c

• l

• st

• e or mail (but not both)

• mail

Keywords can be in either lower case or upper case.

Page 565: Red Hat Directory Server 5.1

Mapping DNs to Certificates

545

FilterCompsFilterComps is a comma-separated list of RDN keywords used to create a filter by gatheringinformation from the user's DN in the client certificate. The server uses the values for these keywordsto form the search criteria for matching entries in the LDAP directory. If the server finds one or moreentries in the directory that match the user's information gathered from the certificate, the search issuccessful and the server performs a verification (if verifycert is set to on).

For example, if FilterComps is set to use the e and uid attribute keywords(FilterComps=e,uid), the server searches the directory for an entry whose values for e and uidmatch the user's information gathered from the client certificate. Email addresses and user IDs aregood filters because they are usually unique entries in the directory.

The filter needs to be specific enough to match one and only one entry in the directory.

The following RDN keywords are supported for FilterComps:

• cn

• ou

• o

• c

• l

• st

• e or mail (but not both)

• mail

Keywords can be in either lower case or upper case.

VerifyCertverifycert tells the server whether it should compare the client's certificate with the certificate foundin the user's directory entry. The value is either on or off. Setting the value to on ensures that theserver will not authenticate the client unless the certificate presented exactly matches the certificatestored in the directory. Setting the value to off disables the verification process.

CmapLdapAttrCmapLdapAttr is the name of the attribute in the directory that contains subject DNs from allcertificates belonging to the user. Because this attribute is not a standard LDAP attribute, this attributemust be added to the schema. See Section 10.4.2, “Creating Attributes” for information on addingschema elements.

If the CmapLdapAttr property exists in a certmap.conf mapping, the server searches the entiredirectory for an entry that contains the subject's full DN. The search criteria are the attribute namedby CmapLdapAttr and the subject's full DN as listed in the certificate. If the search doesn't yieldany entries, the server retries the search using the DNComps and FilterComps mappings. Thesearch will take place more quickly if the attribute specified by CmapLdapAttr is indexed. For moreinformation on indexing attributes, see Chapter 11, Managing Indexes.

Page 566: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

546

Using CmapLdapAttr to match a certificate to a directory entry is useful when it is difficult to matchentries using DNComps and FilterComps.

LibraryLibrary is the pathname to a shared library or DLL. Use this property only to extend or replace thestandard functions that map information in certmap.conf to entries in the directory. This property istypically not necessary unless there are very specialized mapping requirements.

InitFnInitFn is the name of an init function from a custom library. You need to use this property onlyif you want to extend or replace the functions that map information in certmap.conf to entries inthe directory. This property is typically not necessary unless you have very specialized mappingrequirements.

12.8.3. Editing the certmap.conf File1. In a text editor, open /etc/dirsrv/config/certmap.conf

2. If necessary, make changes to the default mapping.

For example, change the value for DNComps or FilterComps. To comment out a line, insert a #before it.

3. If desired, create a mapping for a specific CA.

The mapping should take the form certmap mappingName issuerDN.

For example, to create a mapping named Example CA which has the issuer DN ou=exampleCA, o=example, c=US, enter the following:

certmap example CA ou=example CA, o=example, c=US

4. Add property settings for a specific CA's mapping.

Specify the Library and InitFn properties before adding any additional properties.

When adding a property, use the form mappingName:propertyName value.

For example, add a DNComps value of o, c for Example CA by entering the following line:

example CA:DNComps o, c

For the Library and InitFn properties, a complete mapping looks like this:

certmap Example CA ou=example CA, o=example, c=USExample CA:Library /ldapserver/ldap/servers/slapd/plugin.cExample CA:InitFn plugin_init_dnExample CA:DNComps o, cExample CA:FilterComps e, uidExample CA:VerifyCert onExample CA:CmapLdapAttr certSubjectDN

Page 567: Red Hat Directory Server 5.1

Example certmap.conf Mappings

547

5. Save the certmap.conf file.

12.8.4. Example certmap.conf MappingsIn Example 12.1, “Default Mapping”, the server starts its search at the directory branch pointcontaining the entry ou=organizationalUnit, o=organization, c=country, where the italics representvalues from the subject's DN in the client certificate.

certmap default defaultdefault:DNComps ou, o, cdefault:FilterComps e, uiddefault:verifycert on

Example 12.1. Default Mapping

The server then uses the values for e (email address) and uid (user ID) from the certificate tosearch for a match in the directory before authenticating the user. When it finds a matching entry, theserver verifies the certificate by comparing the certificate the client sent to the certificate stored in thedirectory.

Example 12.2, “An Additional Mapping” shows the contents of a sample certmap.conf file thatdefines a default mapping as well as a mapping for MyCA:

certmap default defaultdefault:DNCompsdefault:FilterComps e, uidcertmap MyCA ou=MySpecialTrust,o=MyOrg,c=USMyCA:DNComps ou,o,cMyCA:FilterComps eMyCA:verifycert on

Example 12.2. An Additional Mapping

When the server gets a certificate from a CA other than MyCA, the server uses the default mapping,which starts at the top of the directory tree and searches for an entry matching the client's emailaddress (e) and user ID (uid). If the certificate is from MyCA, the server starts its search at thedirectory branch containing the organizational unit specified in the subject DN and searches for emailaddresses (e) that match the one specified in the certificate. If the certificate is from MyCA, the serververifies the certificate. If the certificate is from another CA, the server does not verify it.

Example 12.3, “A Mapping with an Attribute Search” uses the CmapLdapAttr property to search thedirectory for an attribute called certSubjectDN whose value exactly matches the entire subject DNin the client certificate:

certmap MyCo ou=My Company Inc, o=MyCo, c=USMyCo:CmapLdapAttr certSubjectDNMyCo:DNComps o, cMyCo:FilterComps mail, uid MyCo:verifycert on

Example 12.3. A Mapping with an Attribute Search

If the subject DN in the client certificate is uid=jsmith, o=example Inc, c=US, then the serversearches for entries that have certSubjectDN=uid=jsmith, o=example Inc, c=US.

Page 568: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

548

If one or more matching entries are found, the server proceeds to verify the entries. If no matchingentries are found, the server uses DNComps and FilterComps to search for matching entries. Forthe client certificate described above, the server would search for uid=jsmith in all entries undero=example Inc, c=US.

12.8.5. Allowing and Requiring Client Authentication to the ConsoleClient authentication must be explicitly set in the Directory Server.

1. Click the Configuration tab.

2. With the top server entry highlighted in the left navigation pane, click the Encryption tab in themain window.

3. Set whether to require or allow client authentication to the Directory Server.

• Do not allow client authentication. With this option, the server ignores the client's certificate. Thisdoes not mean that the bind will fail.

• Allow client authentication. This is the default setting. With this option, authentication isperformed on the client's request.

• Require client authentication. With this option, the server requests authentication from the client.

If client authentication is required, then SSL cannot be used with the Console because TheDirectory Server Console does not support client authentication.

NOTETo use certificate-based authentication with replication, configure the consumer servereither to allow or to require client authentication.

NOTEThe Directory Server must already be configured to run over TLS/SSL or Start TLS forclient authentication to be enabled.

4. Save the changes, and restart the server. For example, open the Tasks tab and click the Restartserver task.

To change the server configuration from requiring client authentication to allowing it through thecommand line, reset the nsSSLClientAuth parameter:

Page 569: Red Hat Directory Server 5.1

Connecting to the Directory Server with Certificate-Based Authentication

549

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -D "cn=directory manager" -N "Server-Cert" -p 636 -host server.example.com

dn: cn=encryption,cn=configchangetype: modifyreplace: nsSSLClientAuthnsSSLClientAuth: allowed

The nsSSLClientAuth parameter can be set to off, allowed, and required.

12.8.6. Connecting to the Directory Server with Certificate-BasedAuthenticationThe Directory Server can connect to another Directory Server instance for chaining or replication usingcertificate-based authentication, as configured in the database link or replication agreement.

Users can connect to the Directory Server with certificate-based authentication when using LDAP toolssuch as ldapsearch. This requires four parameters:

• -P to give certificate database's filename and path

• -N to give the SSL certificate name

• -K to specify the private key database's filename and path

• -W to give the password to the private key database

For example:

/usr/lib/mozldap/ldapsearch -p 389 -h server.example.com -D "uid=jsmith,ou=people,dc=example,dc=com" -P /home/jsmith/alias/cert8.db -N "My Cert" -K /home/jsmith/alias/key3.db -W secret

For information on how to use TLS/SSL with ldapmodify, ldapdelete, and ldapsearch, see theDirectory Server Configuration, Command, and File Reference.

12.9. Managing Certificates for the Directory ServerAfter installing certificates, it can be necessary to renew the certificates, adjust the settings, or managethe security databases which store them.

12.9.1. Renewing CertificatesAs with any issued identification — drivers' licenses, student IDs — certificates are valid for apredefined period and then expire and must be renewed. To renew a certificate, regenerate acertificate request, using the same information that was used to create the original, submit the requestto a CA, and re-install the renewed certificate.

1. Open the Directory Server Console.

2. In the Tasks tab, click the Manage Certificates button.

3. Click the Server Certs tab.

Page 570: Red Hat Directory Server 5.1

Chapter 12. Managing SSL

550

4. Select the certificate to renew from the list of certificates, and click the Renew button.

5. Go through the request wizard, using the same information used for requesting the originalcertificate.

6. Submit the request to a certificate authority.

7. Once the certificate is issued, reinstall it in the Directory Server.

a. In the Tasks tab, click the Manage Certificates button.

b. Click the Server Certs tab.

c. Click the Install button.

d. Paste in the renewed certificate, and continue through the installation wizard.

12.9.2. Changing the CA Trust OptionsIt is sometimes necessary to reject certificates issued by a generally trusted CA. The trust settings onCA certificates installed in the Directory Server can be untrusted, trusted, or change the operations forwhich it is trusted.

1. In the Tasks tab, click the Manage Certificates button.

2. Click the CA Certs tab.

3. Select the CA certificate to edit.

4. Click the Edit Trust button.

5. Set the CA trust options.

• Accepting connections from clients (Client Authentication). This option sets whether to acceptclient, or user, certificates issued by the CA.

• Making connections to other servers (Server Authentication). This option sets whether to acceptserver certificates issued by the CA.

• Click OK.

12.9.3. Changing Security Device PasswordsPeriodically change the settings for the security databases or devices.

1. In the Tasks tab, click the Manage Certificates button.

2. Click the CA Certs tab.

3. Choose a security device from the drop-down list.

4. Click the Password button.

5. In the Change Security Device Password dialog box, enter the old password, and then enterand confirm the new password.

6. Click OK.

Page 571: Red Hat Directory Server 5.1

Managing Certificate Lists

551

12.9.4. Managing Certificate ListsCertificate revocation lists (CRLs) allow CAs to specify certificates that client or server users shouldno longer trust. If data in a certificate changes, a CA can revoke the certificate and list it in a CRL.CRLs are produced and periodically updated by a CA, so updated CRLs can be added to the DirectoryServer.

1. Obtain the CRL from the CA; these can usually be downloaded from the CA's website.

2. In the Tasks tab, click the Manage Certificates button.

3. Click the CA Certs tab.

4. At the top of the Managing Certificates window, choose a security device from the drop-downmenu.

5. Select the Revoked Certs tab.

6. Every loaded CRL is listed. To view a CRL, select the CRL and click Detail.

7. To add a CRL, click Add at the bottom of the window, and enter the full path to the CRL file.

8. Click OK.

Page 572: Red Hat Directory Server 5.1

552

Page 573: Red Hat Directory Server 5.1

Chapter 13.

553

Managing SASLRed Hat Directory Server supports LDAP client authentication through the Simple Authentication andSecurity Layer (SASL), an alternative to TLS/SSL and a native way for some applications to shareinformation securely.

The SASL framework allows different mechanisms to be used to authenticate a user to the server,depending on what mechanism is enabled in both client and server applications. SASL also createsa layer for encrypted (secure) sessions. Using GSS-API, Directory Server utilizes Kerberos tickets toauthenticate sessions and encrypt data.

This chapter describes how to use SASL with Directory Server.

NOTESASL encryption is not supported for client connections that use TLS/SSL.

13.1. Overview of SASL in Directory ServerSimple Authentication and Security Layer (SASL) is an abstraction layer between protocols like LDAPand authentication methods like GSS-API which allows any protocol which can interact with SASL toutilize any authentication mechanism which can work with SASL. Simply put, SASL is an intermediarythat makes authenticating to applications using different mechanisms easier. SASL can also be usedto establish an encrypted session between a client and server.

Directory Server uses SASL as an alternative TLS/SSL, particularly for environments which are usingKerberos to implement single sign-on. Directory Server allows user to use SASL to authenticate andbind to the server. This includes LDAP tools like ldapsearch and ldapmodify. For example:

/usr/lib/mozldap/ldapsearch -p 389 -h server.example.com -o "mech=GSSAPI" -o "authid=dn:uid=jsmith,ou=people,dc=example,dc=com" -o realm=EXAMPLE.COM

NOTESASL proxy authorization is not supported in Directory Server; therefore, Directory Serverignores any SASL authzid value supplied by the client.

Two primary pieces of information are required to use SASL with Directory Server:

• The authentication method, in this example GSS-API

• The user as whom you are authenticating (the authid or authorization ID)

Other information, such as the Kerberos realm, can also be passed with the command. The SASLoptions for Directory Server tools are described more in the Configuration, Command, and FileReference.

When a client connects to Directory Server using SASL, the Directory Server takes the identity offeredas the SASL authid and maps that entry back to an entry in the Directory Server. If the authid isdefined as a DN (as in authid=dn:DN), this is done simply by matching the DN. It is also possible to

Page 574: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

554

use a username or a part of a DN, and these can be mapped to the directory entry using SASL identitymappings.

13.1.1. About SASL Identity MappingWhen processing a SASL bind request, the server matches, or maps, the SASL authenticationID used to authenticate to the Directory Server with an LDAP entry stored within the server.When using Kerberos, the SASL user ID usually has the format userid@REALM, such [email protected]. This ID must be converted into the DN of the user's Directory Server entry,such as uid=scarter,ou=people,dc=example,dc=com.

If the authentication ID clearly corresponds to the LDAP entry for a person, it is possible to configurethe Directory Server to map the authentication ID automatically to the entry DN. Directory Server hassome pre-configured default maps which handle most common configurations, and customized mapscan be created. During a bind attempt, the first matching mapping rule is applied. If only one useridentity is returned, the bind is successful; if none or more than one are returned, then the bind fails.

Be sure to configure SASL maps so that only one mapping rule matches the authentication string.

SASL mappings are configured by entries under a container entry:

dn: cn=sasl,cn=configobjectClass: topobjectClass: nsContainercn: sasl

SASL identity mapping entries are children of this entry:

dn: cn=mapping,cn=sasl,cn=configobjectClass: topobjectClass: nsContainercn: mapping

Mapping entries are defined by three attributes:

• nsSaslMapRegexString, the regular expression which is used to map the elements of the suppliedauthid

• nsSaslMapFilterTemplate, a template which applies the elements of the nsSaslMapRegexStringto create the DN

• nsSaslMapBaseDNTemplate, which provides the search base or a specific entry DN to matchagainst the constructed DN

For example:

dn: cn=mymap,cn=mapping,cn=sasl,cn=configobjectclass:topobjectclass:nsSaslMappingcn: mymapnsSaslMapRegexString: \(.*\)@\(.*\)\.\(.*\)nsSaslMapFilterTemplate: (objectclass=inetOrgPerson)nsSaslMapBaseDNTemplate: uid=\1,ou=people,dc=\2,dc=\3

The nsSaslMapRegexString attribute sets variables of the form \1, \2, \3 for bind IDs which arefilled into the template attributes during a search. This example sets up a SASL identity mapping for

Page 575: Red Hat Directory Server 5.1

About SASL Identity Mapping

555

any user in the ou=People, dc=example,dc=com subtree who belongs to the inetOrgPersonobject class.

When a Directory Server receives a SASL bind request with [email protected] the user ID (authid), the regular expression fills in the base DN template withuid=mconnors,ou=people,dc=EXAMPLE,dc=COM as the user ID, and authentication proceedsfrom there.

NOTEThe dc values are not case sensitive, so dc=EXAMPLE and dc=example are equivalent.

The Directory Server can also use a more inclusive mapping scheme, such as the following:

dn: cn=example map,cn=mapping,cn=sasl,cn=configobjectclass: topobjectclass: nsSaslMappingcn: example mapnsSaslMapRegexString: \(.*\)nsSaslMapBaseDNTemplate: ou=People,dc=example,dc=comnsSaslMapFilterTemplate: (cn=\1)

This matches any user ID and map it an entry under the ou=People,dc=example,dc=com subtreewhich meets the filter cn=userId.

Mappings can be confined to a single realm by specifying the realm in the nsSaslMapRegexStringattribute. For example:

dn: cn=example map,cn=mapping,cn=sasl,cn=configobjectclass: topobjectclass: nsSaslMappingcn: example mapnsSaslMapRegexString: \(.*\)@US.EXAMPLE.COM nsSaslMapBaseDNTemplate: ou=People,dc=example,dc=comnsSaslMapFilterTemplate: (cn=\1)

This mapping is identical to the previous mapping, except that it only applies to users authenticatingfrom the US.EXAMPLE.COM realm. (Realms are described in Section 13.1.4.1, “About Principals andRealms”.)

When a server connects to another server, such as during replication or with chaining, the defaultmappings for the will not properly map the identities. This is because the principal (SASL identity) forone server does not match the principal on the server where authentication is taking place, so it doesnot match the mapping entries.

To allow server to server authentication using SASL, create a mapping for the specific server principalto a specific user entry. For example, this mapping matches the ldap1.example.com server to thecn=replication manager,cn=config entry. The mapping entry itself is created on the secondserver, such as ldap2.example.com.

dn: cn=z,cn=mapping,cn=sasl,cn=configobjectclass: topobjectclass: nsSaslMappingcn: z

Page 576: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

556

nsSaslMapRegexString: ldap/[email protected]: cn=replication manager,cn=confignsSaslMapFilterTemplate: (objectclass=*)

Sometimes, the realm name is not included in the principal name in SASL GSS-API configuration. Asecond mapping can be created which is identical to the first, only without specifying the realm in theprincipal name. For example:

dn: cn=y,cn=mapping,cn=sasl,cn=configobjectclass: topobjectclass: nsSaslMappingcn: ynsSaslMapRegexString: ldap/ldap1.example.comnsSaslMapBaseDNTemplate: cn=replication manager,cn=confignsSaslMapFilterTemplate: (objectclass=*)

Because the realm is not specified, the second mapping is more general (meaning, it has the potentialto match more entries than the first. The best practice is to have more specific mappings processedfirst and gradually progress through more general mappings.

There is no way to specify the order that mappings are processed. However, there is a way to controlhow SASL mappings are processed: the name. The Directory Server processes SASL mappings inreverse ASCII order. In the past two example, then the cn=z mapping (the first example) is processedfirst. If there is no match, the server processes the cn=y mapping (the second example).

TIPSASL mappings can be added when an instance is created during a silent installation byspecifying the mappings in an LDIF file and adding the LDIF file with the ConfigFiledirective. Using silent installation is described in the Installation Guide.

13.1.2. Default SASL Mappings for Directory ServerThe Directory Server has pre-defined SASL mapping rules to handle some of the most commonusage.

Kerberos UID MappingThis matches a Kerberos principal using a two part realm, such as [email protected]. The realm isthen used to define the search base, and the user ID (authid) defines the filter. The search base isdc=example,dc=com and the filter of (uid=user).

dn: cn=Kerberos uid mapping,cn=mapping,cn=sasl,cn=configobjectClass: topobjectClass: nsSaslMappingcn: Kerberos uid mappingnsSaslMapRegexString: \(.*\)@\(.*\)\.\(.*\)nsSaslMapBaseDNTemplate: dc=\2,dc=\3nsSaslMapFilterTemplate: (uid=\1)

RFC 2829 DN SyntaxThis mapping matches an authid that is a valid DN (defined in RFC 2829) prefixed by dn:. Theauthid maps directly to the specified DN.

Page 577: Red Hat Directory Server 5.1

Authentication Mechanisms for SASL in Directory Server

557

dn: cn=rfc 2829 dn syntax,cn=mapping,cn=sasl,cn=configobjectClass: topobjectClass: nsSaslMappingcn: rfc 2829 dn syntaxnsSaslMapRegexString: ^dn:\(.*\)nsSaslMapBaseDNTemplate: \1nsSaslMapFilterTemplate: (objectclass=*)

RFC 2829 U SyntaxThis mapping matches an authid that is a UID prefixed by u:. The value specified after the prefixdefines a filter of (uid=value). The search base is hard-coded to be the suffix of the defaultuserRoot database.

dn: cn=rfc 2829 u syntax,cn=mapping,cn=sasl,cn=configobjectClass: topobjectClass: nsSaslMappingcn: rfc 2829 u syntaxnsSaslMapRegexString: ^u:\(.*\)nsSaslMapBaseDNTemplate: dc=example, dc=comnsSaslMapFilterTemplate: (uid=\1)

UID MappingThis mapping matches an authid that is any plain string that does not match the other defaultmapping rules. It use this value to define a filter of (uid=value). The search base is hard-coded tobe the suffix of the default userRoot database.

dn: cn=uid mapping,cn=mapping,cn=sasl,cn=configobjectClass: topobjectClass: nsSaslMappingcn: uid mappingnsSaslMapRegexString: ^[^:@]+$nsSaslMapBaseDNTemplate: dc=example, dc=comnsSaslMapFilterTemplate: (uid=&)

13.1.3. Authentication Mechanisms for SASL in Directory ServerDirectory Server support the following SASL encryption mechanisms:

• EXTERNAL.EXTERNAL, as with TLS/SSL, performs certificate-based authentication. This method uses publickeys for strong authentication.

• CRAM-MD5.CRAM-MD5 is a simple challenge-response authentication method. It does not establish any securitylayer, unlike GSS-API. Both DIGEST-MD5 and GSS-API are much more secure, so both of thosemethods are recommended over CRAM-MD5.

• DIGEST-MD5.DIGEST-MD5 is a mandatory authentication method for LDAPv3 servers. While it is not as strongas public key systems or Kerberos authentication methods, it is preferred over plain text passwordsand does protect against plain text attacks.

• Generic Security Services (GSS-API).

Page 578: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

558

Generic Security Services (GSS) is a security API that is the native way for UNIX-based operatingsystems to access and authenticate Kerberos services. GSS-API also supports session encryption,similar to TLS/SSL. (GSS-API is not compatible with TLS/SSL; they cannot be used simultaneously.)This allows LDAP clients to authenticate with the server using Kerberos version 5 credentials(tickets) and to use network session encryption.

For Directory Server to use GSS-API, Kerberos must be configured on the host machine. SeeSection 13.1.4, “About Kerberos with Directory Server”.

NOTEGSS-API and, thus, Kerberos are only supported on platforms that have GSS-APIsupport. To use GSS-API, it may be necessary to install the Kerberos client libraries;any required Kerberos libraries will be available through the operating system vendor.

CRAM--MD5, DIGEST-MD5, and GSS-API are all shared secret mechanisms. The server challengesthe client attempting to bind with a secret, such as a password, that depends on the mechanism. Theuser sends back the response required by the mechanism.

NOTEDIGEST-MD5 requires clear text passwords. The Directory Server requires the clear textpassword in order to generate the shared secret. Passwords already stored as a hashedvalue, such as SHA1, cannot be used with DIGEST-MD5.

13.1.4. About Kerberos with Directory ServerKerberos v5 must be deployed on the host for Directory Server to utilize the GSS-API mechanism forSASL authentication. GSS-API and Kerberos client libraries must be installed on the Directory Serverhost to take advantage of Kerberos services.

Operating System Kerberos Version

Linux MIT Kerberos version 5

HP-UX 11i HP Kerberos version 2.1

Table 13.1. Supported Kerberos Systems

The concepts of Kerberos, as well as using and configuring Kerberos, are covered at the MITKerberos website, http://web.mit.edu/Kerberos/.

13.1.4.1. About Principals and RealmsA principal is a user in the Kerberos environment. A realm is a set of users and the authenticationmethods for those users to access the realm. A realm resembles a fully-qualified domain name andcan be distributed across either a single server or a single domain across multiple machines. A singleserver instance can also support multiple realms.

Page 579: Red Hat Directory Server 5.1

About Kerberos with Directory Server

559

NOTEKerberos realms are only supported for GSS-API authentication and encryption, not forDIGEST-MD5.

Realms are used by the server to associate the DN of the client in the following form, which looks likean LDAP DN:

uid=user_name/[server_instance],cn=realm,cn=mechanism,cn=auth

For example, Mike Connors in the engineering realm of the European division of example.comuses the following association to access a server in the US realm:

uid=mconnors/cn=Europe.example.com, cn=engineering,cn=gssapi,cn=auth

Babara Jensen, from the accounting realm of US.example.com, does not have to specify a realmwhen to access a local server:

uid=bjensen,cn=accounting,cn=gssapi,cn=auth

If realms are supported by the mechanism and the default realm is not used to authenticate to theserver, then the realm must be specified in the Kerberos principal. Otherwise, the realm can beomitted.

NOTEKerberos systems treat the Kerberos realm as the default realm; other systems default tothe server.

13.1.4.2. About the KDC Server and KeytabsKerberos is a protocol which allows users or servers to authenticate to a server securely over aninsecure connection. As with protocols like TLS and SSL, Kerberos generates and issues sessionkeys which encrypt information. A Kerberos server, then, has two functions: as an authenticatingserver to validate clients and as a ticket granting server.

Because of this, the Kerberos server is called a key distribution center or KDC.

See the operating system documentation for information on installing and configuring a Kerberosserver.

When a client authenticates to the Directory Server using GSS-API, the KDC sends a session key,followed by a ticket granting ticket (TGT). The TGT contains the client's ID and network address, avalidity period, and the session key. The ticket and the ticket's lifetime are parameters in the Kerberosclient and server configuration. In many systems, this TGT is issued to the client when the user firstlogs into the operating system.

Command-line utilities provided with the operating system — including kinit, klist, and kdestroy— can acquire, list, and destroy the TGT. These tools usually use a file called a keytab to the issuedkeys. This file is created by the Kerberos administrator by exporting the key from the KDC.

Page 580: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

560

In order to respond to Kerberos operations, the Directory Server requires access to its owncryptographic key. The Kerberos key is written in the keytab file. The keytab gives the credentials thatthe Directory Server uses to authenticate to other servers. Directory Server can use the system defaultkeytab file (typically /etc/krb5.keytab) or it can assign a keytab through the KRB5_KTNAMEenvironment variable in its startup script (/etc/sysconfig/dirsrv):

KRB5_KTNAME=/etc/dirsrv/ds.keytab ; export KRB5_KTNAME

Setting the variable in the Directory Server start script ensures that the variable is properly set eachtime Directory Server starts.

When the Directory Server authenticates to the server, it is as if it is running a kinit command toinitiate the connection:

kinit -k -t /etc/dirsrv/ds.keytab ldap/FQDN@REALM

The Directory Server uses the service name ldap. Its Kerberos principal is ldap/host-fqdn@realm,such as ldap/dap.corp.example.com/EXAMPLE.COM. The host-fqdn must be the fully-qualifiedhost and domain name, which can be resolved by all LDAP and Kerberos clients through both DNSand reverse DNS lookups. A key with this identity must be stored in the server's keytab in order forKerberos to work.

Whatever server the Directory Server is authenticating to must have a SASL mappingthat maps the Directory Server's principal (its user entry, usually something like ldap/[email protected]) to a real entry DN in the receiving server.

On Red Hat Enterprise Linux, the client-side Kerberos configuration is in the /etc/krb5.conf.

The HP server and client are separate packages with their own configuration. The server stores configfiles in /opt/krb5. The client is Classic MIT Kerberos and uses /etc/krb5.conf. Both the serverand client must be configured to have a working Kerberos system.

For information on setting up the service key, see the Kerberos documentation.

Example 13.1, “KDC Server Configuration” shows a KDC server configured with thecompany.example.com realm.

[libdefaults] ticket_lifetime = 24000 default_realm = COMPANY.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = false ccache_type = 1 forwardable = true proxiable = true default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc permitted_enctypes = des3-hmac-sha1 des-cbc-crc [realms] COMPANY.EXAMPLE.COM = { kdc = kdcserver.company.example.com:88 admin_server =adminserver.company.example.com:749 default_domain = company.example.com } [appdefaults]

Page 581: Red Hat Directory Server 5.1

Configuring SASL Identity Mapping

561

pam = { debug = true ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log admin_server = FILE:/var/log/kadmind.log

Example 13.1. KDC Server Configuration

13.2. Configuring SASL Identity MappingSASL identity mapping can be configured from either the Directory Server or the command line. ForSASL identity mapping to work for SASL authentication, the mapping must return one, and only one,entry that matches and Kerberos must be configured on the host machine.

13.2.1. Configuring SASL Identity Mapping from the Console1. In the Directory Server Console, open the Configuration tab.

2. Select the SASL Mapping tab.

3. To add a new SASL identity mapping, select the Add button, and fill in the required values.

Page 582: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

562

• Name. This field sets the unique name of the SASL mapping.

• Regular expression. This field sets the regular expression used to match the DN components,such as \(.*\). This field corresponds to the nsSaslMapRegexString value in the SASLmapping LDIF entry.

• Search base DN. This field gives the base DN to search to map entries,such as ou=People,dc=example,dc=com. This field corresponds to thensSaslMapBaseDNTemplate value in the SASL mapping LDIF entry.

• Search filter. This field gives the search filter for the components to replace, such as(objectclass=*). This field corresponds to the nsSaslMapFilterTemplate value in theSASL mapping LDIF entry.

To edit a SASL identity mapping, highlight that identity in the SASL Mapping tab, and click Modify.Change any values, and save.

To delete a SASL identity mapping, highlight it and hit Delete. A dialog box comes up to confirm thedeletion.

13.2.2. Configuring SASL Identity Mapping from the Command LineTo configure SASL identity mapping from the command line, use the ldapmodify utility to add theidentity mapping scheme. For example:

/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: dn: cn=example map,cn=mapping,cn=sasl,cn=configobjectclass: topobjectclass: nsSaslMappingcn: example mapnsSaslMapRegexString: \(.*\)nsSaslMapBaseDNTemplate: ou=People,dc=example,dc=comnsSaslMapFilterTemplate: (cn=\1)

This matches any user's common name and maps it to the result of the the subtree search with baseou=People,dc=example,dc=com, based on the filter cn=userId.

Page 583: Red Hat Directory Server 5.1

Configuring SASL Authentication at Directory Server Startup

563

NOTEWhen SASL maps are added over LDAP, they are not used by the server until it isrestarted. Adding the SASL map with ldapmodify adds the mapping to the end of thelist, regardless of its ASCII order.

13.3. Configuring SASL Authentication at Directory ServerStartupSASL GSS-API authentication has to be activated in Directory Server so that Kerberos tickets can beused for authentication. This is done by supplying a system configuration file for the init scripts to usewhich identifies the variable to set the keytab file location. When the init script runs at Directory Serverstartup, SASL authentication is then immediately active.

The default configuration file is in /etc/sysconfig/dirsrv.

If there are multiple Directory Server instances and not all of them will use SASL authentication, thenthere can be instance-specific configuration files created in that directory named dirsrv-instance.For example, dirsrv-example. The default dirsrv file can be used if there is a single instance ona host.

To enable SASL authentication, uncomment the KRB5_KTNAME line in the /etc/sysconfig/dirsrv (or instance-specific) file, and set the keytab location for the KRB5_KTNAME variable. Forexample:

# In order to use SASL/GSSAPI the directory# server needs to know where to find its keytab# file - uncomment the following line and set# the path and filename appropriatelyKRB5_KTNAME=/etc/krb5.keytab ; export KRB5_KTNAME

13.4. Using an External KeytabA default keytab file is specified in the Directory Server start script and is used by the Directory Serverautomatically. However, it is possible to specify a different keytab file, referencing a different principal,by manually running kinit and then specifying the cached credentials.

To specify the cached kinit credentials, add the principal as the KRB5CCNAME line in /etc/sysconfig/dirsrv:

KRB5CCNAME=/tmp/krb_ccache ; export KRB5CCNAMEkinit principalname # how to provide the password here is left as an exercise# or kinit -k -t /path/to/file.keytab principalnamechown serveruid:serveruid $KRB5CCNAME # so the server process can read it# start a cred renewal "daemon"( while XXX ; do sleep NNN ; kinit ..... ; done ) &# the exit condition XXX and sleep interval NNN are left as an exercise...

Page 584: Red Hat Directory Server 5.1

Chapter 13. Managing SASL

564

The server has no way to renew these cached credentials. The kinit process must be run manually,external to Directory Server processes, or the server could begin receiving SASL bind failures whenthe server attempts to use expired credentials.

Page 585: Red Hat Directory Server 5.1

Chapter 14.

565

Monitoring Server and DatabaseActivityThis chapter describes monitoring database and Red Hat Directory Server logs. For information onusing SNMP to monitor the Directory Server, see Chapter 15, Monitoring Directory Server UsingSNMP.

14.1. Viewing and Configuring Log FilesDirectory Server provides three types of logs to help better manage the directory and tuneperformance. There are three types of logs:

• Access

• Errors

• Audit

For all types of logs, the log creation and log deletion policies have to be configured. The log creationpolicy sets when a new log file is started, and the log deletion policy sets when an old log file isdeleted. The following sections describe how to define the log file creation and deletion policy and howto view and configure each type of log.

NOTEWhen the server is not running, the log files cannot be viewed in the Directory ServerConsole, but they can be viewed in the Admin Express. Open the Administration ServerURL in a browser:

http://hostname:admin_server_port

Then log in with the admin login ID and password, and click the link for AdministrationExpress.

14.1.1. Defining a Log File Rotation PolicyFor the directory to archive the current log periodically and start a new one, define a log file rotationpolicy in the Directory Server Console. The log file rotation policy has the following configurationparameters:

• The access mode or file permissions with which log files are to be created. The default value is 600.The valid values are any combination of 000 to 777, as they mirror numbered or absolute UNIX filepermissions. This value must be a combination of a 3-digit number, the digits varying from 0 through7:

0 — None1 — Execute only2 — Write only

Page 586: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

566

3 — Write and execute4 — Read only5 — Read and execute6 — Read and write7 — Read, write, and execute

In the 3-digit number, the first digit represents the owner's permissions, the second digit representsthe group's permissions, and the third digit represents everyone's permissions. When changingthe default value, keep in mind that 000 will not allow access to the logs and that allowing writepermissions to everyone can result in the logs being overwritten or deleted by anyone.

The newly configured access mode will only affect new logs that are created; the mode will be setwhen the log rotates to a new file.

• The maximum number of logs for the directory to keep. When the directory reaches this number oflogs, it deletes the oldest log file in the folder before creating a new log. The default is 10 logs. Donot set this value to 1, or the directory will not rotate the log, and the log will grow indefinitely.

• The maximum size (in megabytes) for each log file. To keep from setting a maximum size, type-1 in this field. The default is 100 megabytes. Once a log file reaches this maximum size (or themaximum age), the directory archives the file and starts a new one. Setting the maximum number oflogs to 1 causes the directory to ignore this attribute.

• How often the directory archives the current log file and creates a new one. The maximum age ofthe file can be set in minutes, hours, days, weeks, or months. The logs can also be rotated at aparticular time of the day; for example, every day at midnight. The default is every day. Setting themaximum number of logs to 1 causes the directory to ignore this attribute.

Each log file includes a title, which identifies the server version, hostname, and port, for ease ofarchiving or exchanging log files. The title has the following form:

Red Hat-Directory/version build_number hostname:port (/etc/dirsrv/slapd-instance_name)

For example, the first couple of lines of any log files generated by a Directory Server instance mayshow lines similar to these:

Red Hat-Directory/8.1 B2007.188.1157 myhost.example.com:389 (/usr/lib/dirsrv/slapd-example)

14.1.2. Defining a Log File Deletion PolicyFor the directory to automatically delete old archived logs, define a log file deletion policy from theDirectory Server Console.

NOTEThe log deletion policy only makes sense if there is already a defined log file rotationpolicy. Log file deletion will not work if there is just one log file. The server evaluates thelog file deletion policy at the time of log rotation.

The log file deletion policy can be configured with the following parameters:

Page 587: Red Hat Directory Server 5.1

Access Log

567

• The maximum size of the combined archived logs. When the maximum size is reached, the oldestarchived log is automatically deleted. The default size is -1, which sets an unlimited maximum size.This parameter is ignored if the maximum number of log files is set to 1.

• The minimum amount of free disk space. When the free disk space reaches this minimum value, theoldest archived log is automatically deleted. The default is -1, which means that the server does notcheck or require a minimum amount of free disk space. This parameter is ignored if the maximumnumber of log files is set to 1.

• The maximum age of log files. When a log file reaches this maximum age, it is automaticallydeleted. The default is 1 month. This parameter is ignored if the maximum number of log files is setto 1.

14.1.3. Access LogThe access log contains detailed information about client connections to the directory.

14.1.3.1. Viewing the Access LogTo view the access log in the Directory Server Console:

1. In the Directory Server Console, select the Status tab.

2. In the navigation tree, expand the Log folder, and select the Access Log icon.

A table displays a list of the last 25 entries in the access log.

• To refresh the current display, click Refresh. Select the Continuous checkbox for the display torefresh automatically every ten seconds.

NOTEContinuous log refresh does not work well with log files over 10 megabytes.

• To view an archived access log, select it from the Select Log pull-down menu.

• To display a different number of messages, enter the number to view in the Lines to show textbox, and then click Refresh.

• To display messages containing a specified string,y enter the string in the Show only linescontaining text box, and click Refresh.

14.1.3.2. Configuring the Access LogThere are a number of settings that can be configured to customize the access log, including wherethe directory stores the access log and the creation and deletion policies.

It is also possible to disable access logging for the directory. It may be useful to disable access loggingbecause the access log can grow very quickly; every 2,000 accesses to the directory increases theaccess log by approximately 1 megabyte. However, before turning off access logging, consider thatthe access log provides beneficial troubleshooting information.

To configure the access log for the directory:

Page 588: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

568

1. In the Directory Server Console, select the Configuration tab.

2. In the navigation tree, expand the Log folder, and select the Access Log icon.

The access log configuration attributes are displayed in the right pane.

3. To enable access logging, select the Enable Logging checkbox.

Clear this checkbox to keep the directory from maintaining an access log. Access logging isenabled by default.

4. Enter the full path and filename for the directory to use for the access log in the Log File field. Thedefault path is /var/log/dirsrv/slapd-instance_name/access.

5. Set the maximum number of logs, log size, and archive time period.

For information on these parameters, see Section 14.1.1, “Defining a Log File Rotation Policy”.

6. Set the maximum size of combined archived logs, minimum amount of free disk space, andmaximum age for a log file.

For information on these parameters, see Section 14.1.2, “Defining a Log File Deletion Policy”.

7. Click Save.

The logconv.pl Perl script reports the statistical information retrieved from the access log. Formore information on logconv.pl, refer to the Directory Server Configuration, Command, and FileReference.

14.1.4. Error LogThe error log contains detailed messages of errors and events the directory experiences during normaloperations.

WARNINGIf the Directory Server fails to write to the errors log, the server sends the message tosyslog and exits.

14.1.4.1. Viewing the Error LogTo view the error log: 1

1. In the Directory Server Console, select the Status tab.

2. In the navigation tree, expand the Log folder, and select the Error Log icon.

A table displays a list of the last 25 entries in the error log.

• To refresh the current display, click Refresh. Select the Continuous checkbox for the display torefresh automatically every ten seconds.

If the Directory Server fails to write to the errors log, the server sends the message to syslog and exits.

Page 589: Red Hat Directory Server 5.1

Error Log

569

NOTEContinuous log refresh does not work well with log files over 10 megabytes.

• To view an archived error log, select it from the Select Log pull-down menu.

• To specify a different number of messages, enter the number of lines to view in the Lines toshow text box, and click Refresh.

• To display messages containing a specified string, enter the string in the Show only linescontaining text box, and click Refresh.

14.1.4.2. Configuring the Error LogThere are several configuration settings for the error log, including where the directory stores the logand what information the directory includes in the log. To configure the error log:

1. In the Directory Server Console, select the Configuration tab.

2. In the navigation tree, expand the Logs folder, and select the Error Log icon.

The error log configuration attributes are displayed in the right pane.

3. Select the Error Log tab in the right pane.

4. To enable error logging, select the Enable Logging checkbox.

Clear this checkbox to keep the directory from maintaining an error log. Error logging is enabled bydefault.

5. Enter the full path and filename for the directory to use for the error log in the Log File field. Thedefault path is the /var/log/dirsrv/slapd-instance_name/errors directory.

6. Set the maximum number of logs, log size, and time period when the file is archived.

For information on these parameters, see Section 14.1.1, “Defining a Log File Rotation Policy”.

7. Set the maximum size of combined archived logs, minimum amount of free disk space, andmaximum age for a log file.

For information on these parameters, see Section 14.1.2, “Defining a Log File Deletion Policy”.

8. To set the log level, use the Ctrl key and click the options for the directory to include in the LogLevel list box.

For more information about log level options, see Log Level in the Directory Server Configuration,Command, and File Reference.

Page 590: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

570

NOTEChanging these values from the defaults may cause the error log to grow very rapidly,so Red Hat recommends not changing the logging level without being asked to do soby Red Hat technical support.

9. Click Save.

14.1.5. Audit LogThe audit log contains detailed information about changes made to each database as well as to serverconfiguration.

14.1.5.1. Viewing the Audit LogBefore the audit log can be viewed, audit logging must be enabled for the directory, so the audit logwill not be kept. Section 14.1.5.2, “Configuring the Audit Log” has more information.

To view the audit log:

1. In the Directory Server Console, select the Status tab.

2. In the navigation tree, expand the Log folder, and select the Audit Log icon.

A table displays a list of the last 25 entries in the audit log.

• To refresh the current display, click Refresh. Select the Continuous checkbox for the display torefresh automatically every ten seconds.

NOTEContinuous log refresh does not work well with log files over 10 megabytes.

• To view an archived audit log, select it from the Select Log pull-down menu.

• To display a different number of messages, enter the number of lines to view in the Lines toshow text box, and click Refresh.

• To display messages containing a specified string, enter the string in the Show only linescontaining text box, and click Refresh.

14.1.5.2. Configuring the Audit LogThe Directory Server Console can be used to enable and disable audit logging and to specify wherethe audit log file is stored. To configure audit logging:

1. In the Directory Server Console, select the Configuration tab.

2. In the navigation tree, expand the Log folder, and select the Audit Log icon.

The audit log configuration attributes are displayed in the right pane.

Page 591: Red Hat Directory Server 5.1

Manual Log File Rotation

571

3. To enable audit logging, select the Enable Logging checkbox.

To disable audit logging, clear the checkbox. By default, audit logging is disabled.

4. Enter the full path and filename for the directory to use for the audit log in the field provided. Thedefault path is /var/log/dirsrv/slapd-instance_name/audit.

5. Set the maximum number of logs, log size, and time period when the file is archived.

For information on these parameters, see Section 14.1.1, “Defining a Log File Rotation Policy”.

6. Set the maximum size of combined archived logs, minimum amount of free disk space, andmaximum age for a log file.

For information on these parameters, see Section 14.1.2, “Defining a Log File Deletion Policy”.

7. Click Save.

14.2. Manual Log File RotationThe Directory Server supports automatic log file rotation for all three logs. However, it is possible torotate log files manually if there are not automatic log file creation or deletion policies configured. Bydefault, access, error, and audit log files can be found in the following location:

/var/log/dirsrv/slapd-instance_name

To rotate log files manually:

1. Shut down the server. 2

service dirsrv stop instance

2. Move or rename the log file being rotated so that the old log file is available for future reference.

3. Restart the server.

service dirsrv restart instance

14.3. Monitoring Server ActivityThe Directory Server's current activities can be monitored from either the Directory Server Console orthe command line. It is also possible to monitor the activity of the caches for all of the database.

Many performance counters in Directory Server use 32-bit numbers. This includes many kindof performance monitoring, such as the number of active connections (nsslapd-db-active-txns), the number of operations (threads), and the number of search requests (nsslapd-db-cache-try). However, under heavy loads, these 32-bit counter numbers can wrap too quickly. Thensslapd-counters attribute enabled the Directory Server to use 64-bit values for counter numbers,even on 32-bit systems. This enables long term statistics gathering for high-traffic systems.

Some of the counters for Directory Server database attributes monitored by server use 64-bit integers,even on 32-bit systems:

Page 592: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

572

• opsinitiated

• opscompleted

• entriessent

• bytessent

• totalconnections

The counters which use 64-bit integers are not configurable.

14.3.1. Monitoring the Server from the Directory Server ConsoleTo monitor the server's activities using Directory Server Console:

1. In the Directory Server Console, select the Status tab.

2. In the navigation tree, select Performance Counters.

The Status tab in the right pane displays current information about server activity. If the server iscurrently not running, this tab will not provide performance monitoring information.

3. Click Refresh to refresh the current display. For the server to continuously update the displayedinformation, select the Continuous checkbox.

The General Information table shows basic information about the server, which helps set a baselineabout the statistics that have been gathered.

Field Description

Server Version Identifies the current server version.

Startup Time on Server The date and time the server was started.

Current Time on Server The current date and time on the server.

Table 14.1. General Information (Server)

The Resource Summary table shows the totals of all operations performed by that instance, while theCurrent Resource Usage table shows the current demands on the server. The Connection Statustable simply lists the current active connections, with related connection information.

Page 593: Red Hat Directory Server 5.1

Monitoring the Server from the Directory Server Console

573

Resource Usage Since Startup Average Per Minute

Connections The total number ofconnections to this server sinceserver startup.

Average number of connectionsper minute since server startup.

Operations Initiated The total number of operationsinitiated since server startup.Operations include any clientrequests for server action,suchas searches, adds, andmodifies. Often, multipleoperations are initiated for eachconnection.

Average number of operationsper minute since server startup.

Operations Completed The total number of operationscompleted by the server sinceserver startup.

Average number of operationsper minute since server startup.

Entries Sent to Clients The total number of entriessent to clients since serverstartup. Entries are sent toclients as the result of searchrequests.

Average number of entriessent to clients per minute sinceserver startup.

Page 594: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

574

Resource Usage Since Startup Average Per Minute

Bytes Sent to Clients The total number of bytes sentto clients since server startup.

Average number of bytes sentto clients per minute sinceserver startup.

Table 14.2. Resource Summary

Resource Current Total

Active Threads The current number of active threads usedfor handling requests. Additional threads maybe created by internal server tasks, such asreplication or chaining.

Open Connections The total number of open connections. Eachconnection can account for multiple operations,and therefore multiple threads.

Remaining Available Connections The total number of remaining connections thatthe server can concurrently open. This numberis based on the number of currently openconnections and the total number of concurrentconnections that the server is allowed to open.In most cases, the latter value is determined bythe operating system and is expressed as thenumber of file descriptors available to a task.

Threads Waiting to Write to Client The total number of threads waiting to writeto the client. Threads may not be immediatelywritten when the server must pause whilesending data to a client. Reasons for a pauseinclude a slow network, a slow client, or anextremely large amount of information being sentto the client.

Threads Waiting to Read from Client The total number of threads waiting to read fromthe client. Threads may not be immediatelyread if the server starts to receive a requestfrom the client, and then the transmission of thatrequest is halted for some reason. Generally,threads waiting to read are an indication of aslow network or client.

Databases in Use The total number of databases being serviced bythe server.

Table 14.3. Current Resource Usage

Table Header Description

Time Opened The time on the server when the connection wasinitially opened.

Started The number of operations initiated by thisconnection.

Completed The number of operations completed by theserver for this connection.

Page 595: Red Hat Directory Server 5.1

Monitoring the Server from the Directory Server Console

575

Table Header Description

Bound as The distinguished name used by the clientto bind to the server. If the client has notauthenticated to the server, the server displaysnot bound in this field.

Read/Write Indicates whether the server is currently blockedfor read or write access to the client. There aretwo possible values:Not blocked means that the server is idle,activelysending data to the client, or actively readingdata from the client.Blocked means that the server is trying to senddata to the client or read data from the client butcannot. The probable cause is a slow network orclient.

Table 14.4. Connection Status

The Global Database Cache table lists the cache information for all databases within the DirectoryServer instance.

NOTEAlthough the performance counter for the global database cache is listed with the otherserver performance counters in the Directory Server Console, the actual databasecache entries are located and monitored in cn=monitor,cn=database_instance,cn=ldbm database, cn=plugins, cn=config, as are the other databaseactivities. Monitoring these entries through the command line is covered in Section 14.4.2,“Monitoring Databases from the Command Line”.

Table Header Description

Hits The number of times the server could process arequest by obtaining data from the cache ratherthan by going to the disk.

Tries The total number of database accesses sinceserver startup.

Page 596: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

576

Table Header Description

Hit Ratio The ratio of cache tries to successful cache hits.The closer this number is to 100%, the better.

Pages Read In The number of pages read from disk into thecache.

Pages Written Out The number of pages written from the cacheback to disk.

Read-Only Page Evicts The number of read-only pages discarded fromthe cache to make room for new pages. Pagesdiscarded from the cache have to be written todisk, possibly affecting server performance. Thelower the number of page evicts the better.

Read-Write Page Evicts The number of read-write pages discarded fromthe cache to make room for new pages. Thisvalue differs from Pages Written Out inthat these are discarded read-write pages thathave not been modified. Pages discarded fromthe cache have to be written to disk, possiblyaffecting server performance. The lower thenumber of page evicts, the better.

Table 14.5. Global Database Cache Information

14.3.2. Monitoring the Directory Server from the Command LineThe Directory Server's current activities can be monitored using LDAP tools such as ldapsearch3,with the following characteristics:

• Search with the attribute filter objectClass=*.

• Use the search base cn=monitor; the monitoring attributes for the server are found in thecn=monitor entry.

• Use the search scope base.

For example:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret -p 389 -h server.example.com -s base -b "cn=monitor" "(objectclass=*)"

The monitoring attributes for the Directory Server are found in the cn=monitor entry. For informationon searching the Directory Server, see Section B.2, “Using ldapsearch”.

Monitoring the server's activities using ldapsearch shows the following information:

Attribute Description

version Identifies the directory's current version number.

The LDAP tools referenced in this guide are Mozilla LDAP, installed with Directory Server in the /usr/lib/mozldap directoryon Red Hat Enterprise Linux 5 (32-bit); directories for other platforms are listed in Section 1.2, “LDAP Tool Locations”. However,Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP. It is possible to use the OpenLDAP commands asshown in the examples, but you must use the -x argument to disable SASL and allow simple authentication.

Page 597: Red Hat Directory Server 5.1

Monitoring the Directory Server from the Command Line

577

Attribute Description

threads The current number of active threads usedfor handling requests. Additional threads maybe created by internal server tasks, such asreplication or chaining.

connection:fd:opentime:opsinitiated:opscompleted:binddn:[rw]

Provides the following summary information foreach open connection (only available if you bindto the directory as Directory Manager):fd — The file descriptor used for this connection.opentime — The time this connection wasopened.opsinitiated — The number of operations initiatedby this connection.opscompleted — The number of operationscompleted.binddn — The distinguished name used by thisconnection to connect to the directory.rw — The field shown if the connection isblocked for read or write.

By default, this information is available toDirectory Manager. However, the ACI associatedwith this information can be edited to allowothers to access the information.

currentconnections Identifies the number of connections currently inservice by the directory.

totalconnections Identifies the number of connections handled bythe directory since it started.

dtablesize Shows the number of file descriptors availableto the directory. Each connection requiresone file descriptor: one for every open index,one for log file management, and one for ns-slapd itself. Essentially, this value shows howmany additional concurrent connections can beserviced by the directory. For more informationon file descriptors, refer to the operating systemdocumentation.

readwaiters Identifies the number of threads waiting to readdata from a client.

opsinitiated Identifies the number of operations the serverhas initiated since it started.

opscompleted Identifies the number of operations the serverhas completed since it started.

entriessent Identifies the number of entries sent to clientssince the server started.

bytessent Identifies the number of bytes sent to clientssince the server started.

Page 598: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

578

Attribute Description

currentime Identifies the time when this snapshot of theserver was taken. The time is displayed inGreenwich Mean Time (GMT) in UTC format.

starttime Identifies the time when the server started.The time is displayed in Greenwich Mean Time(GMT) in UTC format.

nbackends Identifies the number of back ends (databases)the server services.

backendmonitordn Identifies the DN of each directory database.

Table 14.6. Server Monitoring Attributes

14.4. Monitoring Database ActivityThe database's current activities can be monitored through Directory Server Console or from thecommand line.

Many performance counters in Directory Server use 32-bit numbers. However, under heavy loads,these 32-bit counter numbers can wrap too quickly. The nsslapd-counters attribute enabled theDirectory Server to use 64-bit values for counter numbers, even on 32-bit systems. This enables longterm statistics gathering for high-traffic systems.

Some of the counters for Directory Server database attributes monitored by server use 64-bit integers,even on 32-bit systems:

• entrycachehits

• entrycachetries

• currententrycachesize

• maxentrycachesize

The counters which use 64-bit integers are not configurable.

14.4.1. Monitoring Database Activity from the Directory ServerConsoleTo monitor the database's activities:

1. In the Directory Server Console, select the Status tab.

2. In the navigation tree, expand the Performance Counters folder, and select the database tomonitor.

The tab displays current information about database activity. If the server is currently not running,this tab will not provide performance monitoring information.

Page 599: Red Hat Directory Server 5.1

Monitoring Database Activity from the Directory Server Console

579

3. Click Refresh to refresh the currently displayed information. For the directory to continuouslyupdate the displayed information, select the Continuous checkbox, and then click Refresh.

Field Description

Database Identifies the type of database being monitored.

Configuration DN Identifies the distinguished name that must beused as a search base to obtain these resultsusing the ldapsearch command-line utility. 3

Table 14.7. General Information (Database)

The Summary Information section shows the cumulative information for all of the databases beingmonitored and some cache-related configuration settings which are applied to all databases.

Performance Metric Current Total

Read-Only Status Shows whether the database is currently in read-only mode. The database is in read-only modewhen the nsslapd-readonly attribute is set toon.

Entry Cache Hits The total number of successful entry cachelookups. That is, the total number of timesthe server could process a search request byobtaining data from the cache rather than bygoing to disk.

Entry Cache Tries The total number of entry cache lookups sincethe directory was last started. That is, the total

Page 600: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

580

Performance Metric Current Totalnumber of search operations performed againstthe server since server startup.

Entry Cache Hit Ratio Ratio that indicates the number of entry cachetries to successful entry cache lookups. Thisnumber is based on the total lookups and hitssince the directory was last started. The closerthis value is to 100%, the better. Whenever asearch operation attempts to find an entry thatis not present in the entry cache, the directoryhas to perform a disk access to obtain theentry. Thus, as this ratio drops towards zero,the number of disk accesses increases, anddirectory search performance drops.

To improve this ratio, increase the size of theentry cache by increasing the value of thensslapd-cachememsize attribute in thecn=database_name, cn=ldbm database,cn=plugins, cn=config entry for thedatabase. In the Directory Server Console, thisis set in the Memory available for cache fieldin the database settings. See Section 16.3.1,“Tuning Entry Cache” for information on changingthis value.

Current Entry Cache Size (in Bytes) The total size of directory entries currentlypresent in the entry cache.

Maximum Entry Cache Size (in Bytes) The size of the entry cache maintained by thedirectory.

This value is managed by the nsslapd-cachememsize attribute in thecn=database_name, cn=ldbm database,cn=plugins, cn=config entry for thedatabase. This is set in the Memory availablefor cache field in the database settings in theDirectory Server Console. See Section 16.3.1,“Tuning Entry Cache” for information on changingthis value.

Current Entry Cache Size (in Entries) The total size of all directory entries currentlypresent in the entry cache.

Maximum Entry Cache Size (in Entries) The maximum size of all directory entries thatcan be maintained in the entry cache.

Do not attempt to manage the cache size bysetting a maximum number of allowed entries.This can make it difficult for the host to allocateRAM effectively. Manage the cache size bysetting the amount of RAM available to thecache, using the nsslapd-cachememsize

Page 601: Red Hat Directory Server 5.1

Monitoring Database Activity from the Directory Server Console

581

Performance Metric Current Totalattribute,as in Section 16.3.1, “Tuning EntryCache”.

Table 14.8. Summary Information

There are many different databases listed for the database monitoring page, by default, becausedatabases are maintained for both entries and indexed attributes. All databases, though, have thesame kind of cache information monitored in the counters.

Performance Metric Current Total

Hits The number of times the database cachesuccessfully supplied a requested page. A pageis a buffer of the size 2K.

Tries The number of times the database cache wasasked for a page.

Hit Ratio The ratio of database cache hits to databasecache tries. The closer this value is to 100%,the better. Whenever a directory operationattempts to find a portion of the database that isnot present in the database cache, the directoryhas to perform a disk access to obtain theappropriate database page. Thus, as this ratiodrops towards zero, the number of disk accessesincreases, and directory performance drops.

To improve this ratio, increase the amount ofdata that the directory maintains in the databasecache by increasing the value of the nsslapd-cachememsize attribute. This is the MaximumCache Size database setting in the DirectoryServer Console. See Section 16.3.1, “TuningEntry Cache” for information on changing thisvalue.

Pages Read In The number of pages read from disk into thedatabase cache.

Pages Written Out The number of pages written from the cacheback to disk. A database page is written to diskwhenever a read-write page has been modifiedand then subsequently deleted from the cache.Pages are deleted from the database cachewhen the cache is full and a directory operationrequires a database page that is not currentlystored in cache.

Read-Only Page Evicts The number of read-only pages discarded fromthe cache to make room for new pages.

Read-Write Page Evicts The number of read-write pages discarded fromthe cache to make room for new pages. Thisvalue differs from Pages Written Out in that

Page 602: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

582

Performance Metric Current Totalthese are discarded read-write pages that havenot been modified.

Table 14.9. Database Cache Information

Performance Metric Current Total

Cache Hits The number of times that a search result resultedin a cache hit on this specific file. That is, a clientperforms a search that requires data from thisfile, and the directory obtains the required datafrom the cache.

Cache Misses The number of times that a search result failedto hit the cache on this specific file. That is,a search that required data from this file wasperformed, and the required data could not befound in the cache.

Pages Read In The number of pages brought to the cache fromthis file.

Pages Written Out The number of pages for this file written fromcache to disk.

Table 14.10. Database File-Specific

14.4.2. Monitoring Databases from the Command LineThe directory's database activities can be monitored using any LDAP too, such as ldapsearch3,using the following characteristics:

• Search with the attribute filter objectClass=*.

• Use the search base cn=monitor,cn=database_instance, cn=ldbm database,cn=plugins, cn=config. database_instance is the name of the database to monitor.

• Use the search scope base.

For example:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret -p 389 -h server.example.com -s base -b "cn=monitor,cn=Example,cn=ldbm database,cn=plugins, cn=config" "objectclass=*"

In this example, the ldapsearch operation looks for the Example database. For information onsearching the directory, see Section B.2, “Using ldapsearch”.

Monitoring the server's activities shows the following information:

Attribute Description

database Identifies the type of database currently beingmonitored.

readonly Indicates whether the database is in read-onlymode; 0 means that the server is not in read-onlymode, 1 means that it is in read-only mode.

Page 603: Red Hat Directory Server 5.1

Monitoring Databases from the Command Line

583

Attribute Description

entrycachehits The total number of successful entry cachelookups. That is, the total number of timesthe server could process a search request byobtaining data from the cache rather than bygoing to disk.

entrycachetries The total number of entry cache lookups sincethe directory was last started. That is, the totalnumber of search operations performed againstthe server since server startup.

entrycachehitratio Ratio that indicates the number of entry cachetries to successful entry cache lookups. Thisnumber is based on the total lookups and hitssince the directory was last started. The closerthis value is to 100%, the better. Whenever asearch operation attempts to find an entry thatis not present in the entry cache, the directoryhas to perform a disk access to obtain theentry. Thus, as this ratio drops towards zero,the number of disk accesses increases, anddirectory search performance drops.

To improve this ratio, increase the size of theentry cache by increasing the value of thensslapd-cachememsize attribute in thecn=database_name, cn=ldbm database,cn=plugins, cn=config entry for thedatabase. In the Directory Server Console, thisis set in the Memory available for cache fieldin the database settings. See Section 16.3.1,“Tuning Entry Cache” for information on changingthis value.

currententrycachesize The total size, in bytes, of directory entriescurrently present in the entry cache.

To increase the size of the entries which canbe present in the cache, increase the value ofthe nsslapd-cachememsize attribute in thecn=database_name, cn=ldbm database,cn=plugins, cn=config entry for thedatabase. In the Directory Server Console, thisis set in the Memory available for cache fieldin the database settings. See Section 16.3.1,“Tuning Entry Cache” for information on changingthis value.

maxentrycachesize The maximum size, in bytes, of directory entriesthat can be maintained in the entry cache.

To increase the size of the entries which canbe present in the cache, increase the value of

Page 604: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

584

Attribute Descriptionthe nsslapd-cachememsize attribute in thecn=database_name, cn=ldbm database,cn=plugins, cn=config entry for thedatabase. In the Directory Server Console, thisis set in the Memory available for cache fieldin the database settings. See Section 16.3.1,“Tuning Entry Cache” for information on changingthis value.

dbcachehits The number of times the server could process arequest by obtaining data from the cache ratherthan by going to the disk.

dbcachetries The total number of database accesses sinceserver startup.

dbcachehitratio The ratio of cache tries to successful cache hits.The closer this number is to 100%, the better.

dbcachepagein The number of pages read from disk into thecache.

dbcachepageout The number of pages written from the cacheback to disk.

dbcacheroevict The number of read-only pages discarded fromthe cache to make room for new pages. Pagesdiscarded from the cache have to be written todisk, possibly affecting server performance. Thelower the number of page evicts the better.

dbcacherwevict The number of read-write pages discarded fromthe cache to make room for new pages. Thisvalue differs from Pages Written Out inthat these are discarded read-write pages thathave not been modified. Pages discarded fromthe cache have to be written to disk, possiblyaffecting server performance. The lower thenumber of page evicts the better.

dbfilename-number The name of the file. number provides asequential integer identifier (starting at 0) for thefile. All associated statistics for the file are giventhis same numerical identifier.

dbfilecachehit-number The number of times that a search result resultedin a cache hit on this specific file. That is, a clientperforms a search that requires data from thisfile, and the directory obtains the required datafrom the cache.

dbfilecachemiss-number The number of times that a search result failedto hit the cache on this specific file. That is,a search that required data from this file wasperformed, and the required data could not befound in the cache.

Page 605: Red Hat Directory Server 5.1

Monitoring Database Link Activity

585

Attribute Description

dbfilepagein-number The number of pages brought to the cache fromthis file.

dbfilepageout-number The number of pages for this file written fromcache to disk.

Table 14.11. Directory Server Monitoring Attributes

14.5. Monitoring Database Link ActivityIt is possible to monitor the activity of database links from the command line using theldapsearch command-line utility to return the monitoring attributes that are required. Themonitoring attributes are stored in the cn=monitor,cn=database_link_name, cn=chainingdatabase,cn=plugins,cn=config.

For example, the ldapsearch3 command-line utility can be used to retrieve the number of addoperations received by a particular database link. For example, this command monitors a databaselink called DBLink1:

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret -p 389 -h server.example.com -s sub -b "cn=monitor,cn=DBLink1,cn=chaining database,cn=plugins,cn=config" "(objectclass=*)" nsAddCount

Table 14.12, “Database Link Monitoring Attributes” lists the database link monitoring attributes whichcan be monitored.

Attribute Name Description

nsAddCount The number of add operations received.

nsDeleteCount The number of delete operations received.

nsModifyCount The number of modify operations received.

nsRenameCount The number of rename operations received.

nsSearchBaseCount The number of base-level searches received.

nsSearchOneLevelCount The number of one-level searches received.

nsSearchSubtreeCount The number of subtree searches received.

nsAbandonCount The number of abandon operations received.

nsBindCount The number of bind request received.

nsUnbindCount The number of unbinds received.

nsCompareCount The number of compare operations received.

nsOperationConnectionCount The number of open connections for normaloperations.

nsBindConnectionCount The number of open connections for bindoperations.

Table 14.12. Database Link Monitoring Attributes

For more information about ldapsearch, see the Directory Server Configuration, Command, and FileReference.

Page 606: Red Hat Directory Server 5.1

Chapter 14. Monitoring Server and Database Activity

586

14.6. Enabling and Disabling CountersThe nsslapd-counters attribute enabled counters to run. However, running counters can affectperformance, so it also possible to turn off counters. If counters are off, they all have a value of zero(0).

By default, counters are already enabled. To enable or disable performance counters, useldapmodify:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com

dn: cn=configchangetype: modifyreplace: nsslapd-countersnsslapd-counters: off

NOTERegardless of the whether the Directory Server is run on a 32-bit or 64-bit platform, theserver itself records many counter values using 64-bit integers. For high-traffic sites, 32-bit counters turn over too quickly, which leads to quirky ratios and counts. Using 64-bitintegers (on all platforms) improves performance and enables administrators to gatherlong-term statistics accurately.

Page 607: Red Hat Directory Server 5.1

Chapter 15.

587

Monitoring Directory Server UsingSNMPThe server and database activity monitoring log setup described in Chapter 14, Monitoring Server andDatabase Activity is specific to Directory Server. You can also monitor your Directory Server usingSimple Network Management Protocol (SNMP), which is a management protocol used for monitoringnetwork activity which can be used to monitor a wide range of devices in real time.

Directory Server can be monitored with SNMP through an AgentX subagent. SNMP monitoringcollects useful information about the Directory Server, such as bind information, operations performedon the server, and cache information. The Directory Server SNMP subagent supports SNMP traps tosend notifications about changes in the running state of your server instances.

15.1. About SNMPSNMP has become interoperable on account of its widespread popularity. It is this interoperability,combined with the fact that SNMP can take on numerous jobs specific to a whole range of differentdevice classes, that make SNMP the ideal standard mechanism for global network control andmonitoring. SNMP allows network administrators to unify all network monitoring activities, withDirectory Server monitoring part of the broader picture.

SNMP is used to exchange data about network activity. With SNMP, data travels between a manageddevice and a network management application (NMS) where users remotely manage the network. Amanaged device is anything that runs SNMP, such as hosts, routers, and your Directory Server. AnNMS is usually a powerful workstation with one or more network management applications installed. Anetwork management application graphically shows information about managed devices, which deviceis up or down, which and how many error messages were received, and so on.

Information is transferred between the NMS and the managed device through the use of two types ofagents: the subagent and the master agent. The subagent gathers information about the manageddevice and passes the information to the master agent. Directory Server has a subagent. The masteragent exchanges information between the various subagents and the NMS. The master agent usuallyruns on the same host machine as the subagents it talks to, although it can run on a remote machine.

Values for SNMP attributes, otherwise known as variables, that can be queried are kept on themanaged device and reported to the NMS as necessary. Each variable is known as a managed object,which is anything the agent can access and send to the NMS. All managed objects are defined in amanagement information base (MIB), which is a database with a tree-like hierarchy. The top level ofthe hierarchy contains the most general information about the network. Each branch underneath ismore specific and deals with separate network areas.

SNMP exchanges network information in the form of protocol data units (PDUs). PDUs containinformation about variables stored on the managed device. These variables, also known as managedobjects, have values and titles that are reported to the NMS as necessary. Communication between anNMS and a managed device takes place either by the NMS sending updates or requesting informationor by the managed object sending a notice or warning, called a trap, when a server shuts down orstarts up.

Page 608: Red Hat Directory Server 5.1

Chapter 15. Monitoring Directory Server Using SNMP

588

15.2. Configuring the Master AgentTo use the subagent, you must have a master agent that supports AgentX. A common agent isNet-SNMP master agent, which may be available through your operating system vendor or can bedownloaded from the Net-SNMP website, http://www.net-snmp.org.

The SNMP subagent included with Directory Server uses the AgentX protocol to communicate withthe SNMP master agent running on your system. You must make sure that you enable AgentX supporton your master agent. For Net-SNMP, add a line containing agentx master in the master agent'ssnmpd.conf file. For more details on configuring the master agent for AgentX support, refer to theNet-SNMP website, http://www.net-snmp.org.

15.3. Configuring the SubagentThe Directory Server SNMP subagent is located in installed with the Directory Server tools. On RedHat Enterprise Linux 5 (32-bit), this is in /usr/bin/ldap-agent. On HP-UX, this is in /opt/dirsrv/bin/ldap-agent.

15.3.1. Subagent Configuration FileTo use the subagent, first create a subagent configuration file. This file can be named and locatedwherever you like. This configuration file is used to specify how to communicate with your masteragent, logfile location, and which Directory Server instances to monitor.

15.3.1.1. agentx-masterThe agentx-master setting tells the subagent how to communicate with the SNMP master agent. Ifthis setting is not specified, the subagent tries to communicate the the master agent through the Unixdomain socket /var/agentx/master. This is also where the Net-SNMP master agent listens forAgentX communications by default. If you configured your master agent to listen on a different Unixdomain socket, you must use the agentx-master setting for your subagent to communicate with yourmaster agent by setting the new path for the agentx-master parameter. For example:

agentx-master /var/snmp/agentx

Make sure that the user as whom you are running the subagent has the appropriate permissions towrite to this socket.

If the master agent is listening for AgentX communications on a TCP port, the agentx-mastersetting has the hostname and port number. For example:

agentx-master localhost:705

15.3.1.2. agent-logdirThe agent-logdir setting specifies the directory where the subagent will write its logfile. Forexample:

agent-logdir /var/log

Page 609: Red Hat Directory Server 5.1

Starting the Subagent

589

If this parameter is not specified, the agent will write its logfile to the same location as your subagentconfiguration file. The logfile will be named ldap-agent.log.

Make sure that the user as whom your subagent is running has write permission to this directory.

15.3.1.3. serverThe server setting specifies a Directory Server instance that you want to monitor. You must use oneserver setting for each Directory Server instance. The subagent requires at least one server settingto be specified in its configuration file. The server setting should be set to the name of the DirectoryServer instance you would like to monitor. For example:

server slapd-phonebook

To monitor multiple Directory Server instances, an additional server parameter in the subagentconfiguration file for each instance.

server slapd-phonebookserver slapd-exampleserver slapd-directory

15.3.2. Starting the SubagentOnce your master agent is running and you have created your subagent configuration file, start thesubagent. To start your subagent, run the ldap-agent program, specifying the absolute path to thesubagent configuration file as an argument. For example:

ldap-agent /etc/dirsrv/config/ldap-agent.conf

To enable extra debug logging, specify the -D option during startup:

ldap-agent -D /etc/dirsrv/config/ldap-agent.conf

NOTEThe Directory Server does not have to be started for the subagent to be started.

To stop your subagent, you must use the kill command against its process ID. Your subagent will printits process ID in its logfile, or you can run ps -ef | grep ldap-agent to find the process ID.

15.3.3. Testing the SubagentTo test your subagent, use any SNMP client tools to query the master agent. Net-SNMP containssimple command-line utilities such as snmpwalk and snmpget. In order for these tools to use variablenames for queries, configure them to load the Directory Server's MIB file. The Directory Server's MIBfile, redhat-directory.mib, is located in /usr/share/dirsrv/mibs on Red Hat Enterprise

Page 610: Red Hat Directory Server 5.1

Chapter 15. Monitoring Directory Server Using SNMP

590

Linux 5 (32-bit) and in /opt/dirsrv/share/mibs on HP-UX. There are some additional commonrequired MIB files in this mibs directory if you do not already have them with your MIB tools.

The MIB file is not needed for the subagent to operate; it is only required for any SNMP clientapplication to use variable names instead of numeric OIDs to refer to the monitored informationprovided by the subagent.

Each monitored server instance uses its port number as an index to identify that particular DirectoryServer instance. For example, querying for the dsEntityName.389 SNMP variable returns thevariable value for a server running on port 389, assuming that instance exists and is being monitoredby the subagent.

For details on configuring and using the Net-SNMP command-line tools, check out the Net-SNMPwebsite, http://www.net-snmp.org.

15.4. Configuring SNMP TrapsAn SNMP trap is essentially a threshold which triggers a notification if it is encountered by themonitored server. To use traps, the master agent must be configured to accept traps and do somethingwith them. For example, a trap can trigger an email notification for an administrator of the DirectoryServer instance stops.

The subagent is only responsible for sending the traps to the master agent. The master agent and atrap handler must be configured according to the documentation for the SNMP master agent you areusing.

Traps are accompanied by information from the Entity Table, which contains information specificto the Directory Server instance, such as its name and version number. The Entity Table isdescribed in Section 15.6.3, “Entity Table”. This means that the action the master agent takeswhen it receives a trap is flexible, such as sending an email to an email address defined in thedsEntityContact variable for one instance while sending a notification to a a pager number in thedsEntityContact variable for another instance.

There are two traps supported by the subagent:

• DirectoryServerDown. This trap is generated whenever the subagent detects the Directory Serveris potentially not running. This trap will be sent with the Directory Server instance description,version, physical location, and contact information, which are detailed in the dsEntityDescr,dsEntityVers, dsEntityLocation, and dsEntityContact variables.

• DirectoryServerStart. This trap is generated whenever the subagent detects that the DirectoryServer has started or restarted. This trap will be sent with the Directory Server instance description,version, physical location, and contact information, which are detailed in the dsEntityDescr,dsEntityVers, dsEntityLocation, and dsEntityContact variables.

15.5. Configuring the Directory Server for SNMPBy default, the Directory Server is ready to be monitored using SNMP as soon as the subagent isconfigured. However, there are some useful variables in the Directory Server instances which can beconfigured to help identify the Directory Server instance with SNMP. To configure these SNMP settingsfrom the Directory Server Console, do the following:

1. Select the Configuration tab, and then select the topmost entry in the navigation tree in the leftpane.

Page 611: Red Hat Directory Server 5.1

Using the Management Information Base

591

2. Select the SNMP tab in the right pane.

3. Enter a description that uniquely describes the directory instance in the Description text box.

4. Type the name the company or organization to which the directory belongs in the Organizationtext box.

5. Type the location within the company or organization where the directory resides in the Locationtext box.

6. Type the email address of the person responsible for maintaining the directory in the Contact textbox.

7. Click Save.

15.6. Using the Management Information BaseThe Directory Server's MIB is a file called redhat-directory.mib. This MIB contains definitions forvariables pertaining to network management for the directory. These variables are known as managedobjects. Using the directory MIB and Net-SNMP, you can monitor your directory like all other manageddevices on your network. For more information on using the MIB, refer to Section 15.3.3, “Testing theSubagent”.

The client tools need to load the Directory Server MIB to use the variable names listed in the followingsections.

Using the directory MIB enables administrators to use SNMP to see administrative information aboutthe directory and monitor the server in real-time. The directory MIB is broken into four distinct tables ofmanaged objects:

• Section 15.6.1, “Operations Table”

• Section 15.6.2, “Entries Table”

• Section 15.6.3, “Entity Table”

• Section 15.6.4, “Interaction Table”

NOTEAll of the Directory Server attributes monitored by SNMP use 64-bit integers for thecounters, even on 32-bit systems.

15.6.1. Operations TableThe Operations Table provides statistical information about Directory Server access, operations,and errors. Table 15.1, “Operations Table: Managed Objects and Descriptions” describes the managedobjects stored in the Operations Table of the redhat-directory.mib file.

Managed Object Description

dsAnonymousBinds The number of anonymous binds to the directorysince server startup.

Page 612: Red Hat Directory Server 5.1

Chapter 15. Monitoring Directory Server Using SNMP

592

Managed Object Description

dsUnauthBinds The number of unauthenticated binds to thedirectory since server startup.

dsSimpleAuthBinds The number of binds to the directory that wereestablished using a simple authenticationmethod (such as password protection) sinceserver startup.

dsStrongAuthBinds The number of binds to the directory that wereestablished using a strong authenticationmethod (such as SSL or a SASL mechanism likeKerberos) since server startup.

dsBindSecurityErrors The number of bind requests that have beenrejected by the directory due to authenticationfailures or invalid credentials since serverstartup.

dsInOps The number of operations forwarded to thisdirectory from another directory since serverstartup.

dsReadOps The number of read operations serviced bythis directory since application start. The valueof this object will always be 0 because LDAPimplements read operations indirectly via thesearch operation.

dsCompareOps The number of compare operations serviced bythis directory since server startup.

dsAddEntryOps The number of add operations serviced by thisdirectory since server startup.

dsRemoveEntryOps The number of delete operations serviced by thisdirectory since server startup.

dsModifyEntryOps The number of modify operations serviced bythis directory since server startup.

dsModifyRDNOps The number of modify RDN operations servicedby this directory since server startup.

dsListOps The number of list operations serviced by thisdirectory since server startup. The value ofthis object will always be 0 because LDAPimplements list operations indirectly via thesearch operation.

dsSearchOps The total number of search operations servicedby this directory since server startup.

dsOneLevelSearchOps The number of one-level search operationsserviced by this directory since server startup.

dsWholeSubtreeSearchOps The number of whole subtree search operationsserviced by this directory since server startup.

Page 613: Red Hat Directory Server 5.1

Entries Table

593

Managed Object Description

dsReferrals The number of referrals returned by this directoryin response to client requests since serverstartup.

dsSecurityErrors The number of operations forwarded to thisdirectory that did not meet security requirements.

dsErrors The number of requests that could not beserviced due to errors (other than security orreferral errors). Errors include name errors,update errors, attribute errors, and serviceerrors. Partially serviced requests will not becounted as an error.

Table 15.1. Operations Table: Managed Objects and Descriptions

15.6.2. Entries TableThe Entries Table provides information about the contents of the directory entries. Table 15.2,“Entries Table: Managed Objects and Descriptions” describes the managed objects stored in theEntries Table in the redhat-directory.mib file.

Managed Object Description

dsMasterEntries The number of directory entries for which thisdirectory contains the master entry. The value ofthis object will always be 0 (as no updates arecurrently performed).

dsCopyEntries The number of directory entries for which thisdirectory contains a copy.The value of this objectwill always be 0 (as no updates are currentlyperformed).

dsCacheEntries The number of entries cached in the directory.

dsCacheHits The number of operations serviced from thelocally held cache since application startup.

dsSlaveHits The number of operations that were servicedfrom locally held replications (shadow entries).The value of this object will always be 0.

Table 15.2. Entries Table: Managed Objects and Descriptions

15.6.3. Entity TableThe Entity Table contains identifying information about the Directory Server instance. Thevalues for the Entity Table are set in the Directory Server Console, as described in Section 15.5,“Configuring the Directory Server for SNMP”.

Table 15.3, “Entity Table: Managed Objects and Descriptions” describes the managed objects storedin the Entity Table of the redhat-directory.mib file.

Page 614: Red Hat Directory Server 5.1

Chapter 15. Monitoring Directory Server Using SNMP

594

Managed Object Description

dsEntityDescr The description set for the Directory Serverinstance.

dsEntityVers The Directory Server version number of theDirectory Server instance.

dsEntityOrg The organization responsible for the DirectoryServer instance.

dsEntityLocation The physical location of the Directory Serverinstance.

dsEntityContact The name and contact information for the personresponsible for the Directory Server instance.

dsEntityName The name of the Directory Server instance.

Table 15.3. Entity Table: Managed Objects and Descriptions

15.6.4. Interaction Table

NOTEThe Interaction Table is not supported by the subagent. The subagent can querythe table, but it will not ever be updated with valid data.

Table 15.4, “Interaction Table: Managed Objects and Descriptions” describes the managed objectsstored in the Interaction Table of the redhat-directory.mib file.

Managed Object Description

dsIntTable Details, in each row of the table, related tothe history of the interaction of the monitoredDirectory Servers with their respective peerDirectory Servers.

dsIntEntry The entry containing interaction details of aDirectory Server with a peer Directory Server.

dsIntIndex Part of the unique key, together withapplIndex, to identify the conceptual row whichcontains useful information on the (attempted)interaction between the Directory Server(referred to by applIndex) and a peer DirectoryServer.

dsName The distinguished name (DN) of the peerDirectory Server to which this entry belongs.

dsTimeOfCreation The value of sysUpTime when this row wascreated. If the entry was created before thenetwork management subsystem was initialized,this object will contain a value of zero.

dsTimeOfLastAttempt The value of sysUpTime when the last attemptwas made to contact this Directory Server. If

Page 615: Red Hat Directory Server 5.1

Interaction Table

595

Managed Object Descriptionthe last attempt was made before the networkmanagement subsystem was initialized, thisobject will contain a value of zero.

dsTimeOfLastSuccess The value of sysUpTime when the last attemptmade to contact this Directory Server wassuccessful. This entry will have a value of zeroif there have been no successful attempts or ifthe last successful attempt was made before thenetwork management subsystem was initialized.

dsFailuresSinceLastSuccess The number of failures since the last time anattempt to contact this Directory Server wassuccessful. If there has been no successfulattempts, this counter will contain the number offailures since this entry was created.

dsFailures Cumulative failures since the creation of thisentry.

dsSuccesses Cumulative successes since the creation of thisentry.

dsURL The URL of the Directory Server application.

Table 15.4. Interaction Table: Managed Objects and Descriptions

Page 616: Red Hat Directory Server 5.1

596

Page 617: Red Hat Directory Server 5.1

Chapter 16.

597

Tuning Directory Server PerformanceThis chapter describes the tools provided with Red Hat Directory Server to help optimize performance.It also provides tips to improve the performance of the directory.

16.1. Tuning Server PerformanceThe server's performance can be managed and improved by limiting the amount of resources theserver uses to process client search requests, which is done by defining four settings:

• The maximum number of entries the server returns to the client in response to a search operation(size limit attribute).

• The maximum amount of real time (in seconds) for the server to spend performing a search request(time limit attribute).

• The time (in seconds) during which the server maintains an idle connection before terminating it(idle timeout attribute).

• The maximum number of file descriptors available to the Directory Server (max number of filedescriptors attribute).

To configure Directory Server to optimize performance:

1. In the Directory Server Console, select the Configuration tab, and then select the topmost entryin the navigation tree in the left pane.

2. Select the Performance tab in the right pane.

The current server performance settings appear.

3. Set the maximum number of entries the server will return to the client in response to a searchoperation by entering a new value in the Size Limit text box.

To keep from setting a limit, type -1 in this text box.

4. Enter the maximum amount of real time (in seconds) for the server to spend performing a searchrequest in the Time Limit text box.

To keep from setting a limit, type -1 in this text box.

5. Enter the time (in seconds) for the server to maintain an idle connection before terminating it in theIdle Timeout text box.

To keep from setting a limit, type zero (0) in this text box.

6. Set the maximum number of file descriptors available to the Directory Server in the Max Numberof File Descriptors text box. For more information on this parameter, see the Directory ServerConfiguration, Command, and File Reference.

For a better understanding of how these parameters impact the server's search performance, seeSection 11.1, “About Indexes”.

Page 618: Red Hat Directory Server 5.1

Chapter 16. Tuning Directory Server Performance

598

16.2. Tuning Database PerformanceThis section is divided into the following parts which describe methods for tuning databaseperformance:

• Section 16.2.1, “Optimizing Search Performance”

• Section 16.2.2, “Tuning Transaction Logging”

• Section 16.2.3, “Changing the Location of the Database Transaction Log”

• Section 16.2.4, “Changing the Database Checkpoint Interval”

• Section 16.2.5, “Disabling Durable Transactions”

• Section 16.2.6, “Specifying Transaction Batching”

16.2.1. Optimizing Search PerformanceThe Directory Server maintains two kinds of database caches, one for the default database cache andthe other for the entry cache. The server has one default database cache per server, and one entrycache per database.

The database attributes that affect search performance mainly define the amount of memory availableto the server. The maximum values that can be set for the database's cache size attributes dependson the amount of real memory on the machine. Roughly, the amount of available memory on themachine should always be greater than sum total of the default database cache size and sum of eachentry cache size.

Use caution when changing these cache sizing attributes. The ability to improve server performancewith these attributes depends on the size of the database, the amount of physical memory available onthe machine, and whether directory searches are random (that is, if the directory clients are searchingfor random and widely scattered directory data).

If the database does not fit into memory and if searches are random, attempting to increase the valuesset on these attributes does not help directory performance. In fact, changing these attributes mayharm overall performance.

16.2.1.1. Tuning the Database Cache for SearchesThe attributes of each database used to store directory data, including the server configuration data inthe NetscapeRoot database, can be resized.

To improve the cache hit ratio on search operations, increase the amount of data that the DirectoryServer maintains in the database cache, as described in Section 16.3.2, “Tuning Database Cache”, byediting the values for the nsslapd-dbcachesize attribute.

16.2.1.2. Tuning the Database Settings for SearchesThe Directory Server Console only shows the databases that contain the directory data and theNetscapeRoot database. However, the server uses another database to manage these. On thisdatabase, the following attributes can be changed to improve performance:

• The amount of memory to make available for all databases (maximum cache size), which isdescribed in Section 16.3.1, “Tuning Entry Cache”.

Page 619: Red Hat Directory Server 5.1

Tuning Transaction Logging

599

• The maximum number of entries for the server to verify in response to a search request (look-through limit).

• The amount of memory to make available for import (import cache size).

To configure the default database attributes that apply to all other database instances:

1. In the Directory Server Console, select the Configuration tab; then, in the navigation tree, expandthe Data icon, and highlight the Database Settings node.

2. Select the LDBM Plug-in Settings tab in the right pane.

This tab contains the database attributes for all databases stored on this server.

3. In the Maximum Cache Size field, enter a value corresponding to the amount of memory tomake available for all databases. This values is for the total of the entire backend, meaning alldatabases cumulatively, the amount per single database instance.

4. In the Look-Through Limit field, enter the maximum number of entries for the server to check inresponse to a search request.

5. There are two ways to set the amount of memory in bytes to make available for import. The defaultis to have auto cache sizing, meaning 50% of the free memory is allocated for the import cache.It is also possible to set the import cache size manually by deselecting the Use Cache Auto-Sizecheckbox and then setting the value in the Import Cache Size field. For creating a very largedatabase from LDIF, set this attribute as large as possible, depending on the memory available onthe machine. The larger this parameter, the faster the database is created.

WARNINGSetting this value too high can cause import failures because of a lack of memory.

16.2.2. Tuning Transaction LoggingEvery Directory Server contains a transaction log which writes operations for all the databases itmanages. Whenever a directory database operation such as a modify is performed, the serverlogs the operation to the transaction log. For best performance, the directory does not perform the

Page 620: Red Hat Directory Server 5.1

Chapter 16. Tuning Directory Server Performance

600

operation immediately. Instead, the operation is stored in a temporary memory cache on the DirectoryServer until the operation is completed.

If the server experiences a failure, such as a power outage, and shuts down abnormally, theinformation about recent directory changes that were stored in the cache is lost. However, whenthe server restarts, the directory automatically detects the error condition and uses the databasetransaction log to recover the database.

Although database transaction logging and database recovery are automatic processes that requireno intervention, it can be advisable to tune some of the database transaction logging attributes tooptimize performance.

WARNINGThe transaction logging attributes are provided only for system modifications anddiagnostics. These settings should be changed only with the guidance of Red HatProfessional Services or Red Hat Technical Support.Setting these attributes and otherconfiguration attributes inconsistently may cause the directory to be unstable.

16.2.3. Changing the Location of the Database Transaction LogBy default, the database transaction log file is stored in the /var/lib/dirsrv/slapd-instance_name/db directory along with the database files themselves. Because thepurpose of the transaction log is to aid in the recovery of a directory database that was shut downabnormally, it is a good idea to store the database transaction log on a different disk from the onecontaining the directory database. Storing the database transaction log on a separate physical diskmay also improve directory performance.

To change the location of the database transaction logfile, use the following procedure:

1. Stop Directory Server.

service dirsrv stop [instance_name]

2. Edit the dse.ldif file and change the nsslapd-db-logdirectory attribute to show the newlog file location. Provide the full path to the log directory in the attribute.

For information on the nsslapd-db-logdirectory attribute syntax, see the Directory ServerConfiguration, Command, and File Reference.

3. Copy the existing transaction logs and the DBVERSION file into the new transaction log directory.

cp /var/lib/dirsrv/slapd-instance_name/db/{log.*,DBVERSION} /path/to/newdirectory

4. Restart Directory Server.

service dirsrv start [instance_name]

Page 621: Red Hat Directory Server 5.1

Changing the Database Checkpoint Interval

601

16.2.4. Changing the Database Checkpoint IntervalAt regular intervals, the Directory Server writes operations logged in the transaction log to the disk andlogs a checkpoint entry in the database transaction log. By indicating which changes have alreadybeen written to the directory, checkpoint entries indicate where to begin recovery from the transactionlog, thus speeding up the recovery process.

By default, the Directory Server is set up to send a checkpoint entry to the database transaction logevery 60 seconds. Increasing the checkpoint interval may increase the performance of directory writeoperations. However, increasing the checkpoint interval may also increase the amount of time requiredto recover directory databases after a disorderly shutdown and require more disk space due to largedatabase transaction log files. Therefore, only modify this attribute if you are familiar with databaseoptimization and can fully assess the effect of the change.

To modify the checkpoint interval while the server is running, use the ldapmodify command-lineutility to add the nsslapd-db-checkpoint-interval attribute to the cn=config,cn=ldbmdatabase,cn=plugins,cn=config entry.

For more information on the syntax of the nsslapd-db-checkpoint-interval attribute, referto the Directory Server Configuration, Command, and File Reference. For instructions on usingldapmodify, see Section 3.2.4, “Adding and Modifying Entries Using ldapmodify”.

16.2.5. Disabling Durable TransactionsDurable transaction logging means that the temporary database transaction log is, in fact, physicallywritten to disk.

When durable transaction logging is disabled, every directory database operation is written to thedatabase transaction log file but may not be physically written to disk immediately. If a directorychange was written to the logical database transaction log file but not physically written to disk at thetime of a system crash, the change cannot be recovered. When durable transactions are disabled, therecovered database is consistent but does not reflect the results of any LDAP write operations thatcompleted just before the system crash.

By default, durable database transaction logging is enabled. To disable durable transaction logging,use the following procedure:

1. Stop the Directory Server.

service dirsrv stop

2. Use the ldapmodify command-line utility to add the nsslapd-db-durable-transactionsattribute to the cn=config,cn=ldbm database,cn=plugins,cn=config entry, and set thevalue of this attribute to off.

For information on the syntax of the nsslapd-db-durable-transactions attribute, seethe Directory Server Configuration, Command, and File Reference. For instructions on usingldapmodify, see Section 3.2.4, “Adding and Modifying Entries Using ldapmodify”.

3. Restart the Directory Server.

Page 622: Red Hat Directory Server 5.1

Chapter 16. Tuning Directory Server Performance

602

16.2.6. Specifying Transaction BatchingTo improve update performance when full transaction durability is not required, use the nsslapd-db-transaction-batch-val attribute to specify how many transactions will be batched before beingcommitted to the transaction log. Setting this attribute to a value of greater than 0 causes the server todelay committing transactions until the number of queued transactions is equal to the attribute value.For transaction batching to be valid, the nsslapd-db-durable-transaction attribute must be setto on.

To specify or modify transaction batching while the server is running, use the ldapmodifycommand-line utility to add the nsslapd-db-transaction-batch-val attribute to thecn=config,cn=ldbm database,cn=plugins,cn=config entry.

For more information on the syntax and values of the nsslapd-db-transaction-batch-valattribute, refer to the Directory Server Configuration, Command, and File Reference. For instructionson using ldapmodify, see Section 3.2.4, “Adding and Modifying Entries Using ldapmodify”.

16.3. Tuning the Database Cache SettingsThe Directory Server directly uses two kinds of cache:

• Entry cache, which contains individual directory entries

• Database cache, which contains database index files (.db4 files)

The entry cache size impacts search and read performance for the server, so high-traffic systemsshould have higher entry cache settings. The database cache size can affect searches againstdatabase indexes.

Both the entry cache and database cache access the system's memory (RAM).

16.3.1. Tuning Entry CacheEntry cache is the memory (RAM) used to store directory entries in the internal representation. Thiscache is referenced for search and read operations by the Directory Server. Good settings for theentry cache can improve search performance in the Directory Server. As a rule of thumb, morememory assigned to the entry cache, the better. At a minimum, the Directory Server entry cache musthave enough memory to handle its regular amount of use with additional memory to cover most spikesin use or other events.

For the best search performance, make the entry cache large enough to contain all entries in thedatabase.

If entry caching is not set, then the Directory Server reads the entry straight from the entry index forthe database (id2entry.db4). This operation involves disk I/O to find the entry and then convertsthe the entry from the on-disk format (LDIF) to the in-memory representation (Slapi_Entry).Keeping an entry cache allows the server to skip the disk I/O and conversion steps in directorysearches.

When setting this value, monitor the entry cache usage as described in Section 14.4, “MonitoringDatabase Activity”.

The BerkeleyDB documentation1 offers a good explanation of what the entry cache is, along withmanagement information like how to monitor the cache with db_stat -m.

1 http://www.oracle.com/technology/documentation/berkeley-db/db/ref/am_conf/cachesize.html

Page 623: Red Hat Directory Server 5.1

Tuning Database Cache

603

To set the entry cache size from the Directory Server Console:

1. Select the Configuration tab and, in the navigation tree, expand the Data icon.

2. Expand the suffix associated with the database, such as dc=example,dc=com, and then selectthe database.

3. In the Database Settings tab in the main window, the Memory available for cache field sets theamount of memory available, in bytes, that is assigned for the entry cache.

This value can be modified from the command line by editing the nsslapd-cachememsize attributevalue for the LDBM plug-in instance for the database. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=database_name, cn=ldbm database, cn=plugins, cn=configchangetype: modifyreplace: nsslapd-cachememsizensslapd-cachememsize: 20971520

16.3.2. Tuning Database CacheThe database cache contains the Berkeley database index files for the database, meaning all of the*.db4 and other files used for attribute indexing by the database. This value is passed to the BerkeleyDB API function set_cachesize.

This cache size has less of an impact on Directory Server performance than the entry cache size, butif there is available RAM after the entry cache size is set, then increase the amount of memory allottedto the database cache.

NOTEThe operating system also has a file system cache which may compete with the databasecache for RAM usage. Refer to the operating system documentation to find information onfile system cache settings and monitoring the file system cache.

The Berkeley database documentation for the set_cachesize2 function gives a good, solid descriptionof the functions and behavior of the database cache parameter, nsslapd-dbcachesize.

2 http://www.oracle.com/technology/documentation/berkeley-db/db/api_c/env_set_cachesize.html

Page 624: Red Hat Directory Server 5.1

Chapter 16. Tuning Directory Server Performance

604

When setting the database cache value, monitor the cache usage as described in Table 14.5, “GlobalDatabase Cache Information” in Section 14.3.1, “Monitoring the Server from the Directory ServerConsole”.

To set the database cache size from the Directory Server Console:

1. Select the Configuration tab and, in the navigation tree, expand the Data icon.

2. Select the Database Settings node, and then open the LDBM Plug-in Settings tab.

3. The database cache size is set in the Maximum cache size field. This sets the allotted cache sizefor the entire database and all its index files in bytes.

Attempting to set a value that is not a number or is too big for a 32-bit signed integer returns anLDAP_UNWILLING_TO_PERFORM error message with additional error information explaining theproblem.

4. Restart the server to apply the changes.

service dirsrv restart

This value can be modified from the command line by editing the nsslapd-dbcachesize attributevalue for the LDBM plug-in configuration. For example:

/usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389

dn: cn=config, cn=ldbm database, cn=plugins, cn=configchangetype: modifyreplace: nsslapd-dbcachesizensslapd-dbcachesize: 20971520

Be sure to restart the server to apply the changes.

16.4. Managing Special EntriesThe cn=config entry in the simple, flat dse.ldif configuration file is not stored in the same highlyscalable database as regular entries. As a result, if many entries, particularly entries that are likely tobe updated frequently, are stored under cn=config, performance will probably suffer.

Page 625: Red Hat Directory Server 5.1

Managing Special Entries

605

Although Red Hat recommends that simple user entries not be stored under cn=config forperformance reasons, it can be useful to store special user entries such as the Directory Managerentry or replication manager (supplier bind DN) entry under cn=config since this centralizesconfiguration information.

Page 626: Red Hat Directory Server 5.1

606

Page 627: Red Hat Directory Server 5.1

607

Appendix A. LDAP Data InterchangeFormatRed Hat Directory Server (Directory Server) uses the LDAP Data Interchange Format (LDIF) todescribe a directory and directory entries in text format. LDIF is commonly used to build the initialdirectory database or to add large numbers of entries to the directory all at once. In addition, LDIFis also used to describe changes to directory entries. For this reason, most of Directory Server'scommand-line utilities rely on LDIF for either input or output.

Because LDIF is a text file format, LDIF files can be created using virtually any language. All directorydata is stored using the UTF-8 encoding of Unicode. Therefore, the LDIF files created must also beUTF-8 encoded.

For information on using LDIF to modify directory entries, see Chapter 3, Creating Directory Entries.

A.1. About the LDIF File FormatLDIF consists of one or more directory entries separated by a blank line. Each LDIF entry consists ofan optional entry ID, a required distinguished name, one or more object classes, and multiple attributedefinitions.

The LDIF format is defined in RFC 2849, The LDAP Data Interchange Format (LDIF). Directory Serveris compliant with this standard.

The basic form of a directory entry represented in LDIF is as follows:

dn: distinguished_name objectClass: object_class objectClass: object_class ... attribute_type[;subtype]:attribute_value ...

• Every LDIF entry must have a DN and at least one object class definition.

• Include any attributes required by the object classes defined for the entry.

• All other attributes and object classes are optional.

• Object classes and attributes can be specified in any order.

• The space after the colon is optional.

Table A.1, “LDIF Fields” describes the LDIF fields shown in the previous definition.

Field Definition

[id] Optional. A positive decimal numberrepresenting the entry ID. The database creationtools generate this ID automatically. Never add oredit this value yourself.

Page 628: Red Hat Directory Server 5.1

Appendix A. LDAP Data Interchange Format

608

Field Definition

dn: distinguished_name Specifies the distinguished name for the entry.

objectClass: object_class Specifies an object class to use with this entry.The object class identifies the types of attributes,or schema, allowed and required for the entry.See Chapter 10, Managing the DirectorySchema for information on customizing theschema.

attribute_type Specifies a descriptive attribute to use with theentry. The attribute should be defined either inthe schema. See Chapter 10, Managing theDirectory Schema for information on customizingthe schema.

[subtype] Optional. Specifies subtype, language, binary,or pronunciation. Use this tag to identify thelanguage in which the corresponding attributevalue is expressed or whether the attributevalue is binary or a pronunciation of an attributevalue. For information on attribute subtypes, seeSection 3.1.3.5, “Adding an Attribute Subtype”.For a complete list of the supported subtypestags, see Table D.2, “Supported LanguageSubtypes”.

attribute_value Specifies the attribute value to be used with theattribute type.

Table A.1. LDIF Fields

NOTEThe LDIF syntax for representing a change to an entry in the directory is different fromthe syntax described in Table A.1, “LDIF Fields”. For information on using LDIF to modifydirectory entries, see Chapter 3, Creating Directory Entries.

A.2. Continuing Lines in LDIFIn LDIF files, a line can be broken and continued (called folded) by indenting the continued portion ofthe line by exactly one space. For example, the following two statements are identical:

dn: cn=Jake Lupinski,dc=example,dc=com

dn: cn=Jake Lup inski, dc=exa mple,dc=com

It is not required to break and continue LDIF lines. However, doing so may improve the readability ofthe LDIF file. The usual convention is that an LDIF file does not contain more than 78 columns of text.

Page 629: Red Hat Directory Server 5.1

Representing Binary Data

609

A.3. Representing Binary DataBinary data, such as a JPEG image, is represented in LDIF using one of two methods, standard LDIFnotation or base-64 encoding.

A.3.1. Standard LDIF NotationStandard LDIF notation uses the lesser than (<) symbol to indicate that the data are binary. Forexample:

jpegphoto: < file:/path/to/photo

With this standard notation, it is not necessary to specify the ldapmodify -b parameter. However,standard notation requires that the following line be added to the beginning of the LDIF file or the LDIFupdate statements:

version: 1

For example:

ldapmodify -D userDN -w user_password

version: 1dn: cn=Barney Fife,ou=People,dc=example,dc=comchangetype: modifyadd: usercertificateusercertificate;binary: < file: BarneysCert

A.3.2. Base-64 EncodingBinary data can be converted to base-64, which can be used in LDIF files, for a variety of data, fromimages to SSL certificates. Base 64-encoded data are identified by using the :: symbol. For example:

jpegPhoto::encoded_data

In addition to binary data, other values that must be base-64 encoded include the following:

• Any value that begins with a colon (:) or a space.

• Any value that contains non-ASCII data, including new lines.

Use the ldif command-line utility with the -b parameter to convert binary data to LDIF format:

ldif -b attribute_name

attribute_name is the name of the attribute to which the binary data is supplied. The binary datais read from standard input and the results are written to standard output. Thus, use redirectionoperators to select input and output files.

The ldif command-line utility will take any input and format it with the correct line continuation andappropriate attribute information. The ldif utility also assesses whether the input requires base-64encoding. For example:

ldif -b jpegPhoto < mark.jpg > out.ldif

Page 630: Red Hat Directory Server 5.1

Appendix A. LDAP Data Interchange Format

610

This example takes a binary file containing a JPEG-formatted image and converts it into LDIF formatfor the attribute jpegPhoto. The output is saved to out.ldif.

The -b option specifies that the ldif utility should interpret the entire input as a single binary value. If-b is not present, each line is considered to be a separate input value.

A.4. Specifying Directory Entries Using LDIFMany types of entries can be stored in the directory. This section concentrates on three of the mostcommon types of entries used in a directory: domain, organizational unit, and organizational personentries.

The object classes defined for an entry are what indicate whether the entry represents a domain ordomain component, an organizational unit, an organizational person, or some other type of entry.

A.4.1. Specifying Domain EntriesDirectories often have at least one domain entry. Typically this is the first, or topmost, entry in thedirectory. The domain entry often corresponds to the DNS host and domain name for your directory.For example, if the Directory Server host is called ldap.example.com, then the domain entry for thedirectory is probably named dc=ldap,dc=example,dc=com or simply dc=example,dc=com.

The LDIF entry used to define a domain appears as follows:

dn: distinguished_name objectClass: topobjectClass: domaindc: domain_component_name list_of_optional_attributes ...

The following is a sample domain entry in LDIF format:

dn: dc=example,dc=comobjectclass: topobjectclass: domaindc: exampledescription: Fictional example company

Each element of the LDIF-formatted domain entry is defined in Table A.2, “LDIF Elements in DomainEntries”.

LDIF Element Description

dn: distinguished_name Required. Specifies the distinguished name forthe entry.

objectClass: top Required. Specifies the top object class.

objectClass: domain Specifies the domain object class. This linedefines the entry as a domain or domaincomponent.

dc: domain_component Attribute that specifies the domain's name. Theserver is typically configured during the initialsetup to have a suffix or naming context in the

Page 631: Red Hat Directory Server 5.1

Specifying Organizational Unit Entries

611

LDIF Element Descriptionform dc=hostname,dc=domain,dc=toplevel.For example, dc=ldap,dc=example,dc=com.The domain entry should use the leftmost dcvalue, such as dc: ldap. If the suffix weredc=example,dc=com, the dc value is dc:example. Do not create the entry for dn:dc=com unless the server has been configuredto use that suffix.

list_of_attributes Specifies the list of optional attributes to maintainfor the entry.

Table A.2. LDIF Elements in Domain Entries

A.4.2. Specifying Organizational Unit EntriesOrganizational unit entries are often used to represent major branch points, or subdirectories, in thedirectory tree. They correspond to major, reasonably static entities within the enterprise, such as asubtree that contains people or a subtree that contains groups.

The organizational unit attribute that is contained in the entry may also represent a major organizationwithin the company, such as marketing or engineering. However, this style is discouraged. Red Hatstrongly encourages using a flat directory tree.

There is usually more than one organizational unit, or branch point, within a directory tree.

The LDIF that defines an organizational unit entry must appear as follows:

dn: distinguished_name objectClass: topobjectClass: organizationalUnitou: organizational_unit_name list_of_optional_attributes ...

The following is a sample organizational unit entry in LDIF format:

dn: ou=people, dc=example,dc=comobjectclass: topobjectclass: organizationalUnitou: peopledescription: Fictional example organizational unit

Table A.3, “LDIF Elements in Organizational Unit Entries” defines each element of the LDIF-formattedorganizational unit entry.

LDIF Element Description

dn: distinguished_name Specifies the distinguished name forthe entry. A DN is required. If there is acomma in the DN, the comma must beescaped with a backslash (\), such as dn:ou=people,dc=example,dc=com.

objectClass: top Required. Specifies the top object class.

Page 632: Red Hat Directory Server 5.1

Appendix A. LDAP Data Interchange Format

612

LDIF Element Description

objectClass: organizationalUnit Specifies the organizationalUnit objectclass. This line defines the entry as anorganizational unit.

ou: organizational_unit_name Attribute that specifies the organizational unit'sname.

list_of_attributes Specifies the list of optional attributes to maintainfor the entry.

Table A.3. LDIF Elements in Organizational Unit Entries

A.4.3. Specifying Organizational Person EntriesThe majority of the entries in the directory represent organizational people.

In LDIF, the definition of an organizational person is as follows:

dn: distinguished_name objectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: common_name sn: surname list_of_optional_attributes

The following is an example organizational person entry in LDIF format:

dn: uid=bjensen,ou=people,dc=example,dc=comobjectclass: topobjectclass: personobjectclass: organizationalPersonobjectclass: inetOrgPersoncn: Babs Jensensn: Jensengivenname: Babsuid: bjensenou: peopledescription: Fictional example persontelephoneNumber: 555-5557userPassword: {SSHA}dkfljlk34r2kljdsfk9

Table A.4, “LDIF Elements in Person Entries” defines each aspect of the LDIF person entry.

LDIF Element Description

dn: distinguished_name Required. Specifies the distinguishedname for the entry. For example, dn:uid=bjensen,ou=people,dc=example,dc=com.If there is a comma in the DN, the comma mustbe escaped with a backslash (\).

objectClass: top Required. Specifies the top object class.

objectClass: person Specifies the person object class. This objectclass specification should be included becausemany LDAP clients require it during search

Page 633: Red Hat Directory Server 5.1

Defining Directories Using LDIF

613

LDIF Element Descriptionoperations for a person or an organizationalperson.

objectClass: organizationalPerson Specifies the organizationalPerson objectclass. This object class specification should beincluded because some LDAP clients require itduring search operations for an organizationalperson.

objectClass: inetOrgPerson Specifies the inetOrgPerson object class. TheinetOrgPerson object class is recommendedfor the creation of an organizational person entrybecause this object class includes the widestrange of attributes. The uid attribute is requiredby this object class, and entries that contain thisobject class are named based on the value of theuid attribute.

cn: common_name Specifies the person's common name, which isthe full name commonly used by the person. Forexample, cn: Bill Anderson. At least onecommon name is required.

sn: surname Specifies the person's surname, or last name.For example, sn: Anderson. A surname isrequired.

list_of_attributes Specifies the list of optional attributes to maintainfor the entry.

Table A.4. LDIF Elements in Person Entries

A.5. Defining Directories Using LDIFThe contents of an entire directory can be defined using LDIF. Using LDIF is an efficient method ofdirectory creation when there are many entries to add to the directory.

To create a directory using LDIF, do the following:

1. Create an ASCII file containing the entries to add in LDIF format.

Make sure each entry is separated from the next by an empty line. Use just one line betweenentries, and make sure the first line of the file is not be blank, or else the ldapmodify utility willexit. For more information, refer to Section A.4, “Specifying Directory Entries Using LDIF”.

2. Begin each file with the topmost, or root, entry in the database.

The root entry must represent the suffix or sub-suffix contained by the database. For example,if the database has the suffix dc=example,dc=com, the first entry in the directory must be dn:dc=example,dc=com.

For information on suffixes, see the "Suffix" parameter described in the Directory ServerConfiguration, Command, and File Reference.

3. Make sure that an entry representing a branch point in the LDIF file is placed before the entries tocreate under that branch.

Page 634: Red Hat Directory Server 5.1

Appendix A. LDAP Data Interchange Format

614

For example, to place an entry in a people and a group subtree, create the branch point for thosesubtrees before creating entries within those subtrees.

NOTEThe LDIF file is read in order, so parent entries must be listed before the child entries.

4. Create the directory from the LDIF file using one of the following methods:

• Initializing the database through the Directory Server Console. Use this method if there is asmall database to import (less than 10,000 entries). See Section 4.1.2, “Importing a Databasefrom the Console”.

WARNINGThis method is destructive and will erase any existing data in the suffix.

• ldif2db or ldif2db.pl command-line utility. Use this method if there is a large database to import(more than 10,000 entries). See Section 4.1.4.1, “Importing Using the ldif2db Command-LineScript”.

• ldif2db cannot be used if the server is running.

• ldif2db.pl can only be used if the server is running.

WARNINGThis method is destructive and will erase any existing data in the suffix.

• ldapmodify command-line utility with the -a parameter. Use this method if a new subtree is beingadded to an existing database or there is existing data in the suffix which should not be deleted.Unlike the other methods for creating the directory from an LDIF file, Directory Server must berunning before a subtree can be added using ldapmodify. See Section 3.2.4, “Adding andModifying Entries Using ldapmodify”.

A.5.1. LDIF File ExampleThe following example shows an LDIF file that contains one domain, two organizational units, andthree organizational person entries:

dn: dc=example,dc=comobjectclass: topobjectclass: domaindc: exampledescription: Fictional example domain

dn: ou=People,dc=example,dc=comobjectclass: top

Page 635: Red Hat Directory Server 5.1

Storing Information in Multiple Languages

615

objectclass: organizationalUnitou: Peopledescription: Fictional example organizational unit tel: 555-5559

dn: cn=June Rossi,ou=People,dc=example,dc=comobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: June Rossisn: RossigivenName: Junemail: [email protected]: {sha}KDIE3AL9DKou: Accountingou: peopletelephoneNumber: 2616roomNumber: 220

dn: cn=Marc Chambers,ou=People,dc=example,dc=comobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: Marc Chamberssn: Chambersgivenname: Marcmail: [email protected]: {sha}jdl2alem87dlacz1telephoneNumber: 2652ou: Manufacturingou: PeopleroomNumber: 167

dn: cn=Robert Wong,ou=People,example.com Corp,dc=example,dc=comobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersoncn: Robert Wongcn: Bob Wongsn: Wonggivenname: Robertgivenname: Bobmail: [email protected]: {sha}nn2msx761telephoneNumber: 2881roomNumber: 211ou: Manufacturingou: people

dn: ou=Groups,dc=example,dc=comobjectclass: topobjectclass: organizationalUnitou: groupsdescription: Fictional example organizational unit

A.6. Storing Information in Multiple LanguagesIf the directory contains a single language, it is not necessary to do anything special to add a newentry to the directory. However, if an organization is multinational, it may be necessary to store

Page 636: Red Hat Directory Server 5.1

Appendix A. LDAP Data Interchange Format

616

information in multiple languages so that users in different locales can view directory information intheir own language.

When information in the directory is represented in multiple languages, the server associates languagetags with attribute values. When a new entry is added, the attribute values used in the RDN (relativedistinguished name, the naming attribute) must be provided without any language codes.

Multiple languages can be stored for a single attribute. In this case, the attribute types are the same,but each value has a different language code.

For a list of the languages supported by Directory Server and their associated language tags, seeSection D.2, “Identifying Supported Locales”.

NOTEThe language tag has no effect on how the string is stored within the directory. All objectclass and attribute strings are stored using UTF-8. The user is responsible for convertingthe data used in the LDIF to UTF-8. The iconv or uconv command provided by mostoperating systems can be used to convert data from the native characterset into UTF-8.

For example, Example Corporation has offices in the United States and France and wants employeesto be able to view directory information in their native language. When adding directory entries, thedirectory administrator chooses to provide attribute values in both English and French. When adding adirectory entry for a new employee, Babs Jensen, the administrator does the following:

1. The administrator creates a file, street.txt, with the French street address value:

1 rue de l'Université

2. The file contents are then converted to UTF-8:

iconv -t UTF-8 -o output.txt street.txt

3. The following LDIF entry is created using the UTF-8 value of the street address value forstreetAddress;lang-fr.

dn: uid=bjensen,ou=people,dc=example,dc=comobjectclass: topobjectclass: personobjectclass: organizationalPersonname: Babs Jensencn: Babs Jensensn: Jensenuid: bjensenstreetAddress: 1 University StreetstreetAddress;lang-en: 1 University StreetstreetAddress;lang-fr:: AasljdoaAJASI023909jaASJaonasd0ADSpreferredLanguage: fr

The double colons after the attribute name and subtype indicate that the value is binary base-64encoded.

Page 637: Red Hat Directory Server 5.1

Storing Information in Multiple Languages

617

Users accessing this directory entry with an LDAP client with the preferred language set to English willsee the address 1 University Street. Users accessing the directory with an LDAP client with thepreferred language set to French will see the address 1 rue de l'Université.

Page 638: Red Hat Directory Server 5.1

618

Page 639: Red Hat Directory Server 5.1

619

Appendix B. Finding Directory EntriesEntries in the directory can be searched for and found using any LDAP client. Most clients providesome form of search interface so that the directory can be searched easily and entry information canbe easily retrieved.

NOTEUsers cannot search the directory unless the appropriate access control has been set inthe directory. For information on setting access control in the directory, see Chapter 6,Managing Access Control.

B.1. Finding Entries Using the Directory Server ConsoleUsers can browse the Directory tab of the Directory Server Console to see the contents of thedirectory tree and search for specific entries in the directory.

Figure B.1. Browsing Entries in the Directory Tab

Depending on the DN used to authenticate to the directory, this tab displays the contents of thedirectory that the user account has access permissions to view. Browse through the contents of thetree, or right-click an entry, and select Search from the pop-up menu.

Page 640: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

620

Figure B.2. Searching for Entries

WARNINGDo not modify the contents of the o=NetscapeRoot suffix using the Directory tab unlessinstructed to do so by Red Hat technical support.

B.2. Using ldapsearchThe ldapsearch command-line utility can locate and retrieve directory entries. This utility opens aconnection to the specified server using the specified distinguished name and password and locatesentries based on a specified search filter. The search scope can include a single entry, an entry'simmediate subentries, or an entire tree or subtree.

Search results are returned in LDIF format.

Red Hat Directory Server uses Mozilla LDAP tools, including ldapsearch. The MozLDAP toolsare installed with Directory Server and are located in the /usr/lib/mozldap directory for RedHat Enterprise Linux i386, in the /usr/lib64/mozldap directory on 64-bit versions of Red HatEnterprise Linux and in the /opt/dirsrv/bin/mozldap/ directory on HP-UX. When running anyLDAP command, make sure to use the MozLDAP utilities, otherwise the command will return errors.

NOTEFor most Linux systems, OpenLDAP tools are already installed in the /usr/bin/directory. These OpenLDAP tools will not work for Directory Server operations.

This section contains information about the following topics:

• Section B.2.1, “Using Special Characters”

Page 641: Red Hat Directory Server 5.1

Using Special Characters

621

• Section B.2.2, “ldapsearch Command-Line Format”

• Section B.2.3, “Commonly Used ldapsearch Options”

• Section B.2.4, “ldapsearch Examples”

B.2.1. Using Special CharactersWhen using the ldapsearch command-line utility, it may be necessary to specify values that containcharacters that have special meaning to the command-line interpreter, such as space ( ), asterisk(*), or backslash (\). Enclose the value which has the special character in quotation marks (""). Forexample:

-D "cn=Barbara Jensen,ou=Product Development,dc=example,dc=com"

Depending on the command-line interpreter, use either single or double quotation marks. In general,use single quotation marks (') to enclose values. Use double quotation marks (") to allow variableinterpolation if there are shell variables. Refer to the operating system documentation for moreinformation.

B.2.2. ldapsearch Command-Line FormatThe ldapsearch command must use the following format:

ldapsearch [optional_options] [optional_search_filter] [optional_list_of_attributes]

• optional_options is a series of command-line options. These must be specified before the searchfilter, if any are used.

• optional_search_filter is an LDAP search filter as described in Section B.3, “LDAP Search Filters”.Do not specify a separate search filter if search filters are specified in a file using the -f option.

• optional_list_of_attributes is a list of attributes separated by a space. Specifying a list of attributesreduces the number of attributes returned in the search results. This list of attributes must appearafter the search filter. For an example, see Section B.2.4.6, “Displaying Subsets of Attributes”. If alist of attributes is not specified, the search returns values for all attributes permitted by the accesscontrol set in the directory (with the exception of operational attributes).

NOTEFor operational attributes to be returned as a result of a search operation, they must beexplicitly specified in the search command. To retrieve regular attributes in addition toexplicitly specified operational attributes, use an asterisk (*) in the list of attributes in theldapsearch command. To retrieve no attributes, just a list of the matching DNs, usethe special attribute 1.1. This is useful, for example, to get a list of DNs to pass to theldapdelete command.

B.2.3. Commonly Used ldapsearch OptionsThe following table lists the most commonly used ldapsearch command-line options. If a specifiedvalue contains a space ( ), the value should be surrounded by single or double quotation marks, suchas -b "ou=groups, dc=example,dc=com".

Page 642: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

622

Option Description

-b Specifies the starting point for the search. Thevalue specified here must be a distinguishedname that currently exists in the database. Thisis optional if the LDAP_BASEDN environmentvariable has been set to a base DN. The valuespecified in this option should be provided insingle or double quotation marks. For example:

-b "cn=Barbara Jensen, ou=Product Development,dc=example,dc=com"

To search the root DSE entry, specify an emptystring here, such as -b "" .

-D Specifies the distinguished name with whichto authenticate to the server. This is optional ifanonymous access is supported by the server. Ifspecified, this value must be a DN recognized bythe Directory Server, and it must also have theauthority to search for the entries. For example,-D "uid=bjensen, dc=example,dc=com".

-h Specifies the hostname or IP address of themachine on which the Directory Server isinstalled. For example, -h mozilla. If a host isnot specified, ldapsearch uses the localhost.

NOTEDirectory Server supports both IPv4and IPv6 IP addresses.

-l Specifies the maximum number of secondsto wait for a search request to complete.For example, -l 300. The default value forthe nsslapd-timelimit attribute is 3600seconds. Regardless of the value specified,ldapsearch will never wait longer than isallowed by the server's nsslapd-timelimitattribute.

-p Specifies the TCP port number that the DirectoryServer uses. For example, -p 1049. The defaultis 389. If -Z is used, the default is 636.

-s Specifies the scope of the search. The scopecan be one of the following:base searches only the entry specified in the-b option or defined by the LDAP_BASEDNenvironment variable.one searches only the immediate children of theentry specified in the -b option. Only the children

Page 643: Red Hat Directory Server 5.1

ldapsearch Examples

623

Option Descriptionare searched; the actual entry specified in the -boption is not searched.sub searches the entry specified in the -b optionand all of its descendants; that is, perform asubtree search starting at the point identified inthe -b option. This is the default.

-w Gives the password associated with thedistinguished name that is specified in the -Doption. If this option is not specified, anonymousaccess is used. For example, -w diner892.

-x Specifies that the search results are sorted onthe server rather than on the client. This is usefulfor sorting according to a matching rule, as withan international search. In general, it is faster tosort on the server rather than on the client.

-z Sets the maximum number of entries to returnin response to a search request. For example,-z 1000. Normally, regardless of the valuespecified here, ldapsearch never returns moreentries than the number allowed by the server'snsslapd-sizelimit attribute. However,this limitation can be overridden by bindingas the root DN when using this command-lineargument. When binding as the root DN, thisoption defaults to zero (0). The default valuefor the nsslapd-sizelimit attribute is 2000entries.

For detailed information on all ldapsearch utility options, refer to the Directory Server Configuration,Command, and File Reference.

B.2.4. ldapsearch ExamplesThe next set of examples assumes the following:

• The search is for all entries in the directory.

• The directory is configured to support anonymous access for search and read. This means thatno bind information has to be supplied in order to perform the search. For more information onanonymous access, see Section 6.4.2, “Defining User Access - userdn Keyword”.

• The server is located on a host named mozilla.

• The server uses port number 389. Since this is the default port, the port number does not have tobe sent in the search request.

• SSL is enabled for the server on port 636(the default SSL port number).

• The suffix under which all data is stored is dc=example,dc=com.

Page 644: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

624

B.2.4.1. Returning All EntriesGiven the previous information, the following call will return all entries in the directory (subject to theconfigured size and time resource limits):

ldapsearch -h mozilla -b "dc=example,dc=com" -s sub "objectclass=*"

"objectclass=*" is a search filter that matches any entry in the directory. Since every entry musthave an object class, and the objectclass attribute is always indexed, this is a useful search filter toreturn every entry.

B.2.4.2. Specifying Search Filters on the Command LineA search filter can be specified directly on the command line as long as the filter is enclosed inquotation marks ("filter"). If the filter is supplied with the command, do not specify the -f option. Forexample:

ldapsearch -h mozilla -b "dc=example,dc=com" "cn=babs jensen"

B.2.4.3. Searching the Root DSE EntryThe root DSE is a special entry that contains a list of all the suffixes supported by the local DirectoryServer. This entry can be searched by supplying a search base of "", a search scope of base, and afilter of "objectclass=*". For example:

ldapsearch -h mozilla -b "" -s base "objectclass=*"

B.2.4.4. Searching the Schema EntryDirectory Server stores all directory server schema in the special cn=schema entry. This entrycontains information on every object class and attribute defined for the Directory Server. The followingcommand searches the contents of the cn=schema entry:

ldapsearch -h mozilla -b "cn=schema" -s base "objectclass=*"

B.2.4.5. Using LDAP_BASEDNTo make searching easier, it is possible to set the search base using the LDAP_BASEDN environmentvariable. Doing this means that the search base does not have to be set with the -b option. Forinformation on how to set environment variables, see the documentation for the operating system.

Typically, set LDAP_BASEDN to the directory's suffix value. Since the directory suffix is equal to theroot, or topmost, entry in the directory, this causes all searches to begin from the directory's root entry.

For example, suppose LDAP_BASEDN is set to dc=example,dc=com. Then to search for cn=babsjensen in the directory, use the following command-line call:

ldapsearch -h mozilla "cn=babs jensen"

In this example, the default scope of sub is used because the -s option was not used to specify thescope.

Page 645: Red Hat Directory Server 5.1

ldapsearch Examples

625

B.2.4.6. Displaying Subsets of AttributesThe ldapsearch command returns all search results in LDIF format. By default, ldapsearchreturns the entry's distinguished name and all of the attributes that a user is allowed to read. Thedirectory access control can be set such that users are allowed to read only a subset of the attributeson any given directory entry. Only operational attributes are not returned. For operational attributes tobe returned as a result of a search operation, explicitly specify them in the search command.

It may not be necessary to have all of the attributes for an entry returned in the search results. Thereturned attributes can be limited to just a few specific attributes by specifying the desired ones on thecommand line immediately after the search filter. For example, to show the cn and sn attributes forevery entry in the directory, use the following command-line call:

ldapsearch -h mozilla "objectclass=*" sn cn

This example assumes the search base is set with LDAP_BASEDN.

B.2.4.7. Searching for Operational AttributesOperational attributes are special attributes set by the Directory Server itself that are used by theserver to perform maintenance tasks, like processing access control instructions. They also showspecific information about the entry, like the time it was initially created and the name of the user whocreated it. Operational attributes are available for use on every entry in the directory, regardless ofwhether the attribute is specifically defined for the object class of the entry.

Operational attributes are not returned in regular ldapsearches, so to return operational attributes,they have to be explicitly specified in the ldapsearch request.

/usr/lib/mozldap/ldapsearch -D "cn=directory manager" -w secret -p 389 -h server.example.com -b "dc=example,dc=com" -s sub "(objectclass=*)" creatorsName createTimestamp modifiersName modifyTimestamp

The complete list of operational attributes is in the "Operational Attributes and Object Classes" chapterin the Schema Reference

B.2.4.8. Specifying Search Filters Using a FileSearch filters can be entered into a file instead of entering them on the command line. In this case,specify each search filter on a separate line in the file. The ldapsearch command runs each searchin the order in which it appears in the file.

For example:

sn=Francisgivenname=Richard

ldapsearch first finds all the entries with the surname Francis, then all the entries with thegivenname Richard. If an entry is found that matches both search criteria, then the entry is returnedtwice.

For example, suppose the previous search filters were specified in a file named searchdb, and thesearch base is set using LDAP_BASEDN. Then the following returns all the entries that match eithersearch filter:

Page 646: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

626

ldapsearch -h mozilla -f searchdb

The set of attributes returned here can be limited by specifying the attribute names at the end of thesearch line. For example, the following ldapsearch command performs both searches but returnsonly the DN and the givenname and sn attributes of each entry:

ldapsearch -h mozilla -f searchdb sn givenname

B.2.4.9. Specifying DNs That Contain Commas in Search FiltersWhen a DN within a search filter contains a comma as part of its value, the comma must be escapedwith a backslash (\). For example, to find everyone in the example.com Bolivia, S.A. subtree,use the following command:

ldapsearch -h mozilla -s base -b "l=Bolivia\,S.A.,dc=example,dc=com" "objectclass=*"

B.2.4.10. Using Client Authentication When SearchingThis example shows user bjensen searching the directory using client authentication:

ldapsearch -h mozilla -p 636 -b "dc=example,dc=com" -N "bjensenscertname" -Z -W certdbpassword -P /home/bjensen/certdb/cert8.db "givenname=Richard"

B.3. LDAP Search FiltersSearch filters select the entries to be returned for a search operation. They are most commonly usedwith the ldapsearch command-line utility. When using ldapsearch, there can be multiple searchfilters in a file, with each filter on a separate line in the file, or a search filter can be specified directly onthe command line.

For example, the following filter specifies a search for the common name Babs Jensen:

cn=babs jensen

This search filter returns all entries that contain the common name Babs Jensen. Searches forcommon name values are not case sensitive.

When the common name attribute has values associated with a language tag, all of the values arereturned. Thus, the following two attribute values both match this filter:

cn: babs jensen cn;lang-fr: babs jensen

For a list of all the supported language tags, see Table D.1, “Supported Locales”.

The basic syntax of a search filter is:

attribute operator value

For example:

Page 647: Red Hat Directory Server 5.1

Using Attributes in Search Filters

627

buildingname>=alpha

In this example, buildingname is the attribute, >= is the operator, and alpha is the value. Filterscan also be defined that use different attributes combined together with Boolean operators.

Search filters are described in detail in the following sections:

• Section B.3.1, “Using Attributes in Search Filters”

• Section B.3.2, “Using Operators in Search Filters”

• Section B.3.3, “Using Compound Search Filters”

• Section B.3.4, “Search Filter Examples”

B.3.1. Using Attributes in Search FiltersWhen searching for an entry, the attributes associated with that type of entry can be specified, such asusing the cn attribute to search for people with a specific common name.

Examples of attributes that people entries include are the following:

• cn for the person's common name.

• sn for the person's surname, last name, or family name.

• telephoneNumber for the person's telephone number.

• buildingname for the name of the building in which the person resides.

• l for the physical location of the person.

For a listing of the attributes associated with types of entries, see the Directory Server SchemaReference.

B.3.2. Using Operators in Search FiltersThe operators that can be used in search filters are listed in Table B.1, “Search Filter Operators”.In addition to these search filters, special filters can be specified to work with a preferred languagecollation order. For information on how to search a directory with international charactersets, seeSection B.5, “Searching an Internationalized Directory”.

Search Type Operator Description

Equality = Returns entries containingattribute values that exactlymatch the specified value. Forexample, cn=Bob Johnson

Substring =string* string Returns entries containingattributes containingthe specified substring.For example, cn=Bob*cn=*Johnson cn=*John*

Page 648: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

628

Search Type Operator Descriptioncn=B*John. The asterisk(*) indicates zero (0) or morecharacters.

Greater than or equal to >= Returns entries containingattributes that are greater thanor equal to the specified value.For example, buildingname>= alpha.

Less than or equal to <= Returns entries containingattributes that are less than orequal to the specified value.For example, buildingname<= alpha.

Presence =* Returns entries containing oneor more values for the specifiedattribute. For example, cn=*telephoneNumber=*manager=*.

Approximate ~= Returns entries containingthe specified attribute with avalue that is approximatelyequal to the value specifiedin the search filter. Forexample, cn~=suretl~=san fransico couldreturn cn=sarette l=sanfrancisco.

Table B.1. Search Filter Operators

B.3.3. Using Compound Search FiltersMultiple search filter components can be combined using Boolean operators expressed in prefixnotation as follows:

(Boolean-operator(filter)(filter)(filter)...)

Boolean-operator is any one of the Boolean operators listed in Table B.2, “Search Filter BooleanOperators”.

Boolean operators can be combined and nested together to form complex expressions, such as:

(Boolean-operator(filter)((Boolean-operator(filter)(filter)))

The Boolean operators available for use with search filters include the following:

Operator Symbol Description

AND & All specified filters must be truefor the statement to be true.

Page 649: Red Hat Directory Server 5.1

Search Filter Examples

629

Operator Symbol DescriptionFor example, (&(filter)(filter)(filter)...).

OR | At least one specified filter mustbe true for the statement to betrue. For example, (|(filter)(filter)(filter)...)

NOT ! The specified statement mustnot be true for the statementto be true. Only one filter isaffected by the NOT operator.For example, (!(filter)).

Table B.2. Search Filter Boolean Operators

Boolean expressions are evaluated in the following order:

• Innermost to outermost parenthetical expressions first.

• All expressions from left to right.

B.3.4. Search Filter ExamplesThe following filter searches for entries containing one or more values for the manager attribute. Thisis also known as a presence search:

manager=*

The following filter searches for entries containing the common name Ray Kultgen. This is alsoknown as an equality search:

cn=Ray Kultgen

The following filter returns all entries that do not contain the common name Ray Kultgen:

(!(cn=Ray Kultgen))

The following filter returns all entries that contain a description attribute that contains the substringX.500:

description=*X.500*

The following filter returns all entries whose organizational unit is Marketing and whose descriptionfield does not contain the substring X.500:

(&(ou=Marketing)(!(description=*X.500*)))

The following filter returns all entries whose organizational unit is Marketing and that have JulieFulmer or Cindy Zwaska as a manager:

(&(ou=Marketing)(|(manager=cn=Julie Fulmer,ou=Marketing,dc=example,dc=com) (manager=cn=Cindy Zwaska,ou=Marketing,dc=example,dc=com)))

Page 650: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

630

The following filter returns all entries that do not represent a person:

(!(objectClass=person))

The following filter returns all entries that do not represent a person and whose common name issimilar to printer3b:

(&(!(objectClass=person))(cn~=printer3b))

B.4. Using Persistent SearchA persistent search is an ldapsearch which remains open even after the initial search results arereturned.

Persistent searches are especially useful for applications or clients which access the Directory Serverand provide two important benefits:

• Keep a consistent and current local cache.

Any client will query local cache before trying to connect to and query the directory. Persistentsearches provide the local cache necessary to improve performance for these clients.

• Automatically initiate directory actions.

The persistent cache can be automatically updated as entries are modified, and the persistentsearch results can display what kind of modification was performed on the entry. Another applicationcan use that output to update entries automatically, such as automatically creating an email accounton a mail server for new users or generating a unique user ID number.

There are some performance considerations when running persistent searches, as well:

• The ldapsearch does not send a notification when the client disconnects, and the changenotifications are not sent for any changes made while the search is disconnected. This means thatthe client's cache will not be updated if it is ever disconnected and there is no good way to updatethe cache with any new, modified, or deleted entries that were changed while it was disconnected.

• An attacker could open a large number of persistent searches to launch a denial of service attack.

• A persistent search requires leaving open a TCP connection between the Directory Server andclient. This should only be done if the server is configured to allow a lot of client connections andhas a way to close idle connections.

B.4.1. An Overview of Persistent SearchesThe purpose of a persistent search is to provide a continuous list of changes to the directory entriesas well as the complete entries themselves, something like a hybrid search and changelog. Therefore,the search command must specify what entries to return (the search parameters) and what changescause an entry to be returned (entry change parameters).

The persistent search command sets the change information in three aspects:

• Whether to return all of the currently matching entries and then update the cache with changedentries or whether to only send changed entries which match the search parameters. This is thechangesOnly setting.

Page 651: Red Hat Directory Server 5.1

Running a Persistent Search

631

• What kinds of changes, such as adds or modifies, to entries are returned. This is the changetypesetting.

• Whether to display within the entry what kind of modification was performed. This is theentryChanges setting.

The persistent search command, then, has the following format:

/usr/lib/mozldap/ldapsearch -r -C PS:changetype:changesOnly:entryChanges -b baseDN -s scope -D bindDN -w password -p port -h host (filter)

A persistent ldapsearch takes the normal ldapsearch options, such as the server connectioninformation and bind credentials.

Additionally, the -C argument and the PS: signal that this is a persistent search. The -r argument isa recommended ldapsearch argument that prints the entries immediately to the screen as soon asthey enter the buffer; this prevents the search command from hanging.

The term changetype:changesOnly:entryChanges is what defines the entry change parameters.

• The only required term is the changetype, which sets what kinds of changes are returned in thepersistent search. The possible values are add, modify, modrdn (for modrdn operations), delete,and any.

• changesOnly is optional. If this value is true (1), then no entries are returned in the initial search,and entries are only returned as they are modified. If it is false (0), then all matching entries arereturned in the initial search, as well as sending updated entries. The default is true.

• entryChanges is also optional. If this value is true (1), then the type of modification is included in achangetype line in the returned entry. For example:

dn: uid=scarter,ou=People, dc=example, dc=com persistentSearch-changetype: modify

If the value is false (0), then only the entry is returned, without the type of change being noted. Thedefault is true.

B.4.2. Running a Persistent SearchTo run a persistent search, simply run an ldapsearch with the -C and -r arguments and the changeparameters for the search. If no bind credentials are given, the Directory Server is accessed by theanonymous user.

/usr/lib/mozldap/ldapsearch -r -C PS:any:1:0 -b dc=example,dc=com objectclass=person

The search, if the changesOnly setting is false (0), will return every matching entry in the directory, aswith a normal ldapsearch. Then, as entries are modified, the persistent search returns the newlyupdated entry with, optionally, the type of operation which updated it (changeType).

version: 1dn: uid=scarter,ou=People, dc=example, dc=compersistentSearch-changetype: modifytitle: manager

Page 652: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

632

mail: [email protected]: testuid: scartergivenname: scottobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetorgpersonsn: cartercn: scott carter

In the access logs, a persistent search is identifies with the tag options=persistent.

[12/Jan/2009:12:51:54 -0500] conn=19636710736396323 op=0 SRCH base="dc=example,dc=com" scope=2 filter="(objectClass=person)" attrs=ALL options=persistent

B.5. Searching an Internationalized DirectoryWhen performing search operations, the Directory Server can sort the results based on any languagefor which the server has a supporting collation order. For a listing of the collation orders supported bythe directory, see Section D.2, “Identifying Supported Locales”.

NOTEAn LDAPv3 search is required to perform internationalized searches. Therefore, do notspecify the -V2 option on the call for ldapsearch.

This section focuses on the matching rule filter portion of the ldapsearch syntax. For moreinformation on general ldapsearch syntax, see Section B.3, “LDAP Search Filters”. For informationon searching internationalized directories using the Users and Groups portion of the Red HatConsole, see the online help.

This section covers the following topics:

• Section B.5.1, “Matching Rule Filter Syntax”

• Section B.5.2, “Supported Search Types”

• Section B.5.3, “International Search Examples”

B.5.1. Matching Rule Filter SyntaxA matching rule provides special guidelines for how the directory compares strings during asearch operation. In an international search, the matching rule tells the system what collation orderand operator to use when performing the search operation. For example, a matching rule in aninternational search might tell the server to search for attribute values that come at or after llama inthe Spanish collation order. The syntax of the matching rule filter is as follows:

attr:matchingRule:=value

• attr is an attribute belonging to entries being searched, such as cn or mail.

Page 653: Red Hat Directory Server 5.1

Matching Rule Filter Syntax

633

• matchingRule is a string that identifies either the collation order or the collation order and a relationaloperator, depending on the preferred format. For a discussion of matching rule formats, seeSection B.5.1.1, “Matching Rule Formats”.

• value is either the attribute value to search for or a relational operator plus the attribute value tosearch for. The syntax of the value portion of the filter depends on the matching rule format used.

B.5.1.1. Matching Rule FormatsThe matching rule portion of a search filter can be represented in any several ways, and which oneshould be used is a matter of preference:

• As the OID of the collation order for the locale on which to base the search.

• As the language tag associated with the collation order on which to base the search.

• As the OID of the collation order and a suffix that represents a relational operator.

• As the language tag associated with the collation order and a suffix that represents a relationaloperator.

The syntax for each of these options is discussed in the following sections:

• Section B.5.1.1.1, “Using an OID for the Matching Rule”

• Section B.5.1.1.2, “Using a Language Tag for the Matching Rule”

• Section B.5.1.1.3, “Using an OID and Suffix for the Matching Rule”

• Section B.5.1.1.4, “Using a Language Tag and Suffix for the Matching Rule”

B.5.1.1.1. Using an OID for the Matching RuleEach locale supported by the Directory Server has an associated collation order OID. For a list oflocales supported by the directory server and their associated OIDs, see Table D.1, “SupportedLocales”.

The collation order OID can be used in the matching rule portion of the matching rule filter as follows:

attr:OID:=(relational_operator value)

The relational operator is included in the value portion of the string, separated from the value by asingle space. For example, to search for all departmentNumber attributes that are at or after N4709in the Swedish collation order, use the following filter:

departmentNumber:2.16.840.1.113730.3.3.2.46.1:=>= N4709

B.5.1.1.2. Using a Language Tag for the Matching RuleEach locale supported by the Directory Server has an associated language tag. For a list of localessupported by the directory server and their associated language tags, see Table D.1, “SupportedLocales”.

The language tag can be used in the matching rule portion of the matching rule filter as follows:

Page 654: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

634

attr:language-tag:=(relational_operator value)

The relational operator is included in the value portion of the string, separated from the value bya single space. For example, to search the directory for all description attributes with a value ofestudiante using the Spanish collation order, use the following filter:

cn:es:== estudiante

B.5.1.1.3. Using an OID and Suffix for the Matching RuleAs an alternative to using a relational operator-value pair, append a suffix that represents a specificoperator to the OID in the matching rule portion of the filter. Combine the OID and suffix as follows:

attr: OID+suffix:=value

For example, to search for businessCategory attributes with the value softwareprodukte in theGerman collation order, use the following filter:

businessCategory:2.16.840.1.113730.3.3.2.7.1.3:=softwareprodukte

The .3 in the previous example is the equality suffix.

For a list of locales supported by the Directory Server and their associated OIDs, see Table D.1,“Supported Locales”. For a list of relational operators and their equivalent suffixes, see Table B.3,“Search Types, Operators, and Suffixes”.

B.5.1.1.4. Using a Language Tag and Suffix for the Matching RuleAs an alternative to using a relational operator-value pair, append a suffix that represents a specificoperator to the language tag in the matching rule portion of the filter. Combine the language tag andsuffix as follows:

attr: language-tag+suffix:=value

For example, to search for all surnames that come at or after La Salle in the French collation order,use the following filter:

sn:fr.4:=La Salle

For a list of locales supported by the Directory Server and their associated language tags, seeTable D.1, “Supported Locales”. For a list of relational operators and their equivalent suffixes, refer toTable B.3, “Search Types, Operators, and Suffixes”.

B.5.1.2. Using Wildcards in Matching Rule FiltersWhen performing a substring search using a matching rule filter, use the asterisk (*) character as awildcard to represent zero or more characters.

For example, to search for an attribute value that starts with the letter l and ends with the lettern, enter a l*n in the value portion of the search filter. Similarly, to search for all attribute valuesbeginning with the letter u, enter a value of u* in the value portion of the search filter.

Page 655: Red Hat Directory Server 5.1

Supported Search Types

635

To search for a value that contains the asterisk (*) character, the asterisk must be escapedwith the designated escape sequence, \5c2a. For example, to search for all employees withbusinessCategory attribute values of Example*Net product line, enter the following value inthe search filter:

Example\5c2a*Net product line

B.5.2. Supported Search TypesThe Directory Server supports the following types of international searches:

• equality (=)

• substring (*)

• greater-than (>)

• greater-than or equal-to (>=)

• less-than (<)

• less-than or equal-to (<=)

Approximate, or phonetic, and presence searches are supported only in English.

As with a regular ldapsearch search operation, an international search uses operators to define thetype of search. However, when invoking an international search, either use the standard operators(=, >=, >, <, <=) in the value portion of the search string, or use a special type of operator, called asuffix (not to be confused with the directory suffix), in the matching rule portion of the filter. Table B.3,“Search Types, Operators, and Suffixes” summarizes each type of search, the operator, and theequivalent suffix.

Search Type Operator Suffix

Less-than < .1

Less-than or equal-to <= .2

Equality = .3

Greater-than or equal-to >= .4

Greater-than > .5

Substring * .6

Table B.3. Search Types, Operators, and Suffixes

B.5.3. International Search ExamplesThe following sections show examples of how to perform international searches on directory data.Each example gives all the possible matching rule filter formats so that you can become familiar withthe formats and select the one that works best.

B.5.3.1. Less-Than ExamplePerforming a locale-specific search using the less-than operator (<), or suffix (.1) searches for allattribute values that come before the given attribute in a specific collation order.

Page 656: Red Hat Directory Server 5.1

Appendix B. Finding Directory Entries

636

For example, to search for all surnames that come before the surname Marquez in the Spanishcollation order, any of the following matching rule filters would work:

sn:2.16.840.1.113730.3.3.2.15.1:=< Marquez...sn:es:=< Marquez...sn:2.16.840.1.113730.3.3.2.15.1.1:=Marquez...sn:es.1:=Marquez

B.5.3.2. Less-Than or Equal-to ExamplePerforming a locale-specific search using the less-than or equal-to operator (<=), or suffix (.2)searches for all attribute values that come at or before the given attribute in a specific collation order.

For example, to search for all room numbers that come at or before room number CZ422 in theHungarian collation order, any of the following matching rule filters would work:

roomNumber:2.16.840.1.113730.3.3.2.23.1:=<= CZ422...roomNumber:hu:=<= CZ422...roomNumber:2.16.840.1.113730.3.3.2.23.1.2:=CZ422...roomNumber:hu.2:=CZ422

B.5.3.3. Equality ExamplePerforming a locale-specific search using the equal to operator (=), or suffix (.3) searches for allattribute values that match the given attribute in a specific collation order.

For example, to search for all businessCategory attributes with the value softwareprodukte inthe German collation order, any of the following matching rule filters would work:

businessCategory:2.16.840.1.113730.3.3.2.7.1:==softwareprodukte...businessCategory:de:== softwareprodukte...businessCategory:2.16.840.1.113730.3.3.2.7.1.3:=softwareprodukte...businessCategory:de.3:=softwareprodukte

B.5.3.4. Greater-Than or Equal-to ExamplePerforming a locale-specific search using the greater-than or equal-to operator (>=), or suffix (.4)searches for all attribute values that come at or after the given attribute in a specific collation order.

For example, to search for all localities that come at or after Québec in the French collation order, anyof the following matching rule filters would work:

locality:2.16.840.1.113730.3.3.2.18.1:=>= Québec...locality:fr:=>= Québec...

Page 657: Red Hat Directory Server 5.1

International Search Examples

637

locality:2.16.840.1.113730.3.3.2.18.1.4:=Québec...locality:fr.4:=Québec

B.5.3.5. Greater-Than ExamplePerforming a locale-specific search using the greater-than operator (>), or suffix (.5) searches for allattribute values that come at or before the given attribute in a specific collation order.

For example, to search for all mail hosts that come after host schranka4 in the Czechoslovakiancollation order, any of the following matching rule filters would work:

mailHost:2.16.840.1.113730.3.3.2.5.1:=> schranka4...mailHost:cs:=> schranka4...mailHost:2.16.840.1.113730.3.3.2.5.1.5:=schranka4...mailHost:cs.5:=schranka4

B.5.3.6. Substring ExamplePerforming an international substring search searches for all values that match the given pattern in thespecified collation order.

For example, to search for all user IDs that end in ming in the Chinese collation order, any of thefollowing matching rule filters would work:

uid:2.16.840.1.113730.3.3.2.49.1:=* *ming...uid:zh:=* *ming...uid:2.16.840.1.113730.3.3.2.49.1.6:=* *ming..uid:zh.6:=* *ming

Substring search filters that use DN-valued attributes, such as modifiersName or memberOf, do notalways match entries correctly if the filter contains one or more space characters.

To work around this problem, use the entire DN in the filter instead of a substring, or ensure that theDN substring in the filter begins at an RDN boundary; that is, make sure it starts with the type= part ofthe DN. For example, this filter should not be used:

(memberOf=*Domain Administrators*)

But either one of these will work correctly:

(memberOf=cn=Domain Administrators*)...(memberOf=cn=Domain Administrators,ou=Groups,dc=example,dc=com)

Page 658: Red Hat Directory Server 5.1

638

Page 659: Red Hat Directory Server 5.1

639

Appendix C. LDAP URLsLDAP URLs identify the Red Hat Directory Server instance, similarly to the way site URLs identify aspecific website or web page. There are three common times when the LDAP URL of the DirectoryServer instance is used:

• The LDAP URL is used to identify the specific Directory Server instance when the Directory Serveris accessed using a web-based client.

• LDAP URLs are used to configure Directory Server referrals.

• LDAP URLs are used to configure access control instructions.

NOTEThe LDAP URL format is described in RFC 4516, which is available at http://www.ietf.org/rfc/rfc4516.txt.

C.1. Components of an LDAP URLLDAP URLs have the following syntax:

ldap[s]://hostname:port/base_dn?attributes?scope?filter

The ldap:// protocol is used to connect to LDAP servers over unsecured connections, and theldaps:// protocol is used to connect to LDAP servers over TLS/SSL connections. Table C.1, “LDAPURL Components” lists the components of an LDAP URL.

NOTEThe LDAP URL format is described in RFC 4516, which is available at http://www.ietf.org/rfc/rfc4516.txt.

Component Description

hostname Name (or IP address in dotted format)of the LDAP server. For example,ldap.example.com or 192.202.185.90.

port Port number of the LDAP server (for example,696). If no port is specified, the standard LDAPport (389) or LDAPS port (636) is used.

base_dn Distinguished name (DN) of an entry in thedirectory. This DN identifies the entry that isthe starting point of the search. If no base DNis specified, the search starts at the root of thedirectory tree.

attributes The attributes to be returned. To specifymore than one attribute, use commasto separate the attributes; for example,

Page 660: Red Hat Directory Server 5.1

Appendix C. LDAP URLs

640

Component Descriptioncn,mail,telephoneNumber. If no attributesare specified in the URL, all attributes arereturned.

scope The scope of the search, which can be one ofthese values:base retrieves information only about thedistinguished name (base_dn) specified in theURL.one retrieves information about entries onelevel below the distinguished name (base_dn)specified in the URL. The base entry is notincluded in this scope.sub retrieves information about entries at alllevels below the distinguished name (base_dn)specified in the URL. The base entry is includedin this scope.

If no scope is specified, the server performs abase search.

filter Search filter to apply to entries withinthe specified scope of the search. If nofilter is specified, the server uses the filter(objectClass=*).

Table C.1. LDAP URL Components

The attributes, scope, and filter components are identified by their positions in the URL. Even if noattributes are specified, the question marks still must be included to delimit that field.

For example, to specify a subtree search starting from dc=example,dc=com that returns all attributesfor entries matching (sn=Jensen), use the following LDAP URL:

ldap://ldap.example.com/dc=example,dc=com??sub?(sn=Jensen)

The two consecutive question marks, ??, indicate that no attributes have been specified. Since nospecific attributes are identified in the URL, all attributes are returned in the search.

C.2. Escaping Unsafe CharactersAny unsafe characters in the URL need to be escaped, or substituted with a special sequence ofcharacters.

For example, a space is an unsafe character that must be represented as %20 within the URL. Thus,the distinguished name o=example.com corporation must be encoded as o=example.com%20corporation.

The following table lists the characters that are considered unsafe within URLs and provides theassociated escape characters to use in place of the unsafe character:

Unsafe Character Escape Characters

space %20

Page 661: Red Hat Directory Server 5.1

Examples of LDAP URLs

641

Unsafe Character Escape Characters

< %3c

> %3e

" %22

# %23

% %25

{ %7b

} %7d

| %7c

\ %5c

^ %5e

~ %7e

[ %5b

] %5d

` %60

C.3. Examples of LDAP URLs

NOTEThe LDAP URL format is described in RFC 4516, which is available at http://www.ietf.org/rfc/rfc4516.txt.

Example 1The following LDAP URL specifies a base search for the entry with the distinguished namedc=example,dc=com.

ldap://ldap.example.com/dc=example,dc=com

• Because no port number is specified, the standard LDAP port number (389) is used.

• Because no attributes are specified, the search returns all attributes.

• Because no search scope is specified, the search is restricted to the base entrydc=example,dc=com.

• Because no filter is specified, the directory uses the default filter (objectclass=*).

Example 2The following LDAP URL retrieves the postalAddress attribute of the entry with the DNdc=example,dc=com:

ldap://ldap.example.com/dc=example,dc=com?postalAddress

Page 662: Red Hat Directory Server 5.1

Appendix C. LDAP URLs

642

• Because no search scope is specified, the search is restricted to the base entrydc=example,dc=com.

• Because no filter is specified, the directory uses the default filter (objectclass=*).

Example 3The following LDAP URL retrieves the cn, mail, and telephoneNumber attributes of the entry forBarbara Jensen:

ldap://ldap.example.com/cn=Barbara%20Jensen,dc=example,dc=com?cn,mail,telephoneNumber

• Because no search scope is specified, the search is restricted to the base entry cn=BarbaraJensen,dc=example,dc=com.

• Because no filter is specified, the directory uses the default filter (objectclass=*).

Example 4The following LDAP URL specifies a search for entries that have the surname Jensen and are at anylevel under dc=example,dc=com:

ldap://ldap.example.com/dc=example,dc=com??sub?(sn=Jensen)

• Because no attributes are specified, the search returns all attributes.

• Because the search scope is sub, the search encompasses the base entry dc=example,dc=comand entries at all levels under the base entry.

Example 5The following LDAP URL specifies a search for the object class for all entries one level underdc=example,dc=com:

ldap://ldap.example.com/dc=example,dc=com?objectClass?one

• Because the search scope is one, the search encompasses all entries one level under the baseentry dc=example,dc=com. The search scope does not include the base entry.

• Because no filter is specified, the directory uses the default filter (objectclass=*).

NOTEThe syntax for LDAP URLs does not include any means for specifying credentials orpasswords. Search requests initiated through LDAP URLs are unauthenticated, unless theLDAP client that supports LDAP URLs provides an authentication mechanism.

Page 663: Red Hat Directory Server 5.1

643

Appendix D. InternationalizationRed Hat Directory Server allows users to store, manage, and search for entries and their associatedattributes in a number of different languages. An internationalized directory can be an invaluablecorporate resource, providing employees and business partners with immediate access to theinformation they need in languages they understand.

Directory Server supports all international charactersets by default because directory data is storedin UTF-8. Further, Directory Server can use specified matching rules and collation orders based onlanguage preferences in search operations.

NOTEASCII characters are required for attribute and object class names.

D.1. About LocalesDirectory Server provides support for multiple languages through the use of locales. A locale identifieslanguage-specific information about how users of a specific region, culture, or custom expect data tobe presented, including how data of a given language is interpreted and how data is to be sorted, orcollated.

In addition, the locale information indicates what code page should be used to represent a givenlanguage. A code page is an internal table that the operating system uses to relate keyboard keys tocharacter font screen displays.

More specifically, a locale defines four things:

• Collation order. The collation order provides language and cultural-specific information about howthe characters of a given language are to be sorted. It identifies things like the sequence of theletters in the alphabet, how to compare letters with accents to letters without accents, and if thereare any characters that can be ignored when comparing strings. The collation order also takes intoaccount culture-specific information about a language, such as the direction in which the language isread (left to right, right to left, or up and down).

• Character type. The character type distinguishes alphabetic characters from numeric or othercharacters. For example, in some languages, the pipe (|) character is considered punctuation whilein others it is considered alphabetic. In addition, it defines the mapping of upper-case to lower-caseletters.

• Monetary format. The monetary format specifies the monetary symbol used by a specific region,whether the symbol goes before or after its value, and how monetary units are represented.

• Time/date format. The time and date format indicates the customary formatting for times and datesin the region. The time and date format indicates whether dates are customarily represented inthe mm/dd/yy (month, day, year) or dd/mm/yy (day, month, year) format and specifies what thedays of the week and month are in a given language. For example, the date January 10, 1996, isrepresented as 10.leden 1996 in Czechoslovakian and 10 janvier 1996 in French.

Page 664: Red Hat Directory Server 5.1

Appendix D. Internationalization

644

Because a locale describes cultural, customary, and regional differences in addition to mechanicallanguage differences, the directory data can both be translated into the specific languages understoodby users as well as be presented in a way that users in a given region expect.

D.2. Identifying Supported LocalesWhen performing directory operations that require that a locale be specified, such as a searchoperation, use a language tag or a collation order object identifier (OID).

A language tag is a string that begins with the two-character lowercase language code that identifiesthe language, as defined in ISO Standard 639. If necessary to distinguish regional differences inlanguage, the language tag may also contain a two-character string for the country code, as defined inISO Standard 3166. The language code and country code are separated by a hyphen. For example,the language tag used to identify the British English locale is en-GB.

An object identifier (OID) is a decimal number used to uniquely identify an object, such asan attribute or object class. The OIDs for searching or indexing an internationalized directoryidentify specific collation orders supported by the Directory Server. For example, the OID2.16.840.1.113730.3.3.2.17.1 identifies the Finnish collation order.

When performing an international search in the directory, use either the language tag or the OID toidentify the collation order to use. However, when setting up an international index, the OIDs must beused. For more information on indexing, see Chapter 11, Managing Indexes.

Table D.1, “Supported Locales” lists each locale supported by Directory Server and identifies theassociated language tags and OIDs.

Locale Language Tag Collation Order ObjectIdentifiers (OIDs)

Albanian sq 2.16.840.1.113730.3.3.2.44.1

Arabic ar 2.16.840.1.113730.3.3.2.1.1

Belorussian be 2.16.840.1.113730.3.3.2.2.1

Bulgarian bg 2.16.840.1.113730.3.3.2.3.1

Catalan ca 2.16.840.1.113730.3.3.2.4.1

Chinese (Simplified) zh 2.16.840.1.113730.3.3.2.49.1

Chinese (Traditional) zh-TW 2.16.840.1.113730.3.3.2.50.1

Croatian hr 2.16.840.1.113730.3.3.2.22.1

Czechoslovakian cs 2.16.840.1.113730.3.3.2.5.1

Danish da 2.16.840.1.113730.3.3.2.6.1

English (US) en or en-US 2.16.840.1.113730.3.3.2.11.1

Estonian et 2.16.840.1.113730.3.3.2.16.1

Finnish fi 2.16.840.1.113730.3.3.2.17.1

French fr or fr-FR 2.16.840.1.113730.3.3.2.18.1

German de 2.16.840.1.113730.3.3.2.7.1

Greek el 2.16.840.1.113730.3.3.2.10.1

Page 665: Red Hat Directory Server 5.1

Supported Language Subtypes

645

Locale Language Tag Collation Order ObjectIdentifiers (OIDs)

Hebrew iw 2.16.840.1.113730.3.3.2.27.1

Hungarian hu 2.16.840.1.113730.3.3.2.23.1

Icelandic is 2.16.840.1.113730.3.3.2.24.1

Japanese ja 2.16.840.1.113730.3.3.2.28.1

Korean ko 2.16.840.1.113730.3.3.2.29.1

Latvian, Lettish lv 2.16.840.1.113730.3.3.2.31.1

Lithuanian lt 2.16.840.1.113730.3.3.2.30.1

Macedonian mk 2.16.840.1.113730.3.3.2.32.1

Norwegian no 2.16.840.1.113730.3.3.2.35.1

Polish pl 2.16.840.1.113730.3.3.2.38.1

Romanian ro 2.16.840.1.113730.3.3.2.39.1

Russian ru 2.16.840.1.113730.3.3.2.40.1

Serbian (Cyrillic) sr 2.16.840.1.113730.3.3.2.45.1

Serbian (Latin) sh 2.16.840.1.113730.3.3.2.41.1

Slovakian sk 2.16.840.1.113730.3.3.2.42.1

Slovenian sl 2.16.840.1.113730.3.3.2.43.1

Spanish es or es-ES 2.16.840.1.113730.3.3.2.15.1

Swedish sv 2.16.840.1.113730.3.3.2.46.1

Turkish tr 2.16.840.1.113730.3.3.2.47.1

Ukrainian uk 2.16.840.1.113730.3.3.2.48.1

Table D.1. Supported Locales

D.3. Supported Language SubtypesLanguage subtypes can be used by clients to determine specific values for which to search. Formore information on using language subtypes, see Section 3.1.3.5, “Adding an Attribute Subtype”.Table D.2, “Supported Language Subtypes” lists the supported language subtypes for DirectoryServer.

Language Tag Language

af Afrikaans

be Belorussian

bg Bulgarian

ca Catalan

cs Czechoslovakian

da Danish

de German

el Greek

en English

Page 666: Red Hat Directory Server 5.1

Appendix D. Internationalization

646

Language Tag Language

es Spanish

eu Basque

fi Finnish

fo Faroese

fr French

ga Irish

gl Galician

hr Croatian

hu Hungarian

id Indonesian

is Icelandic

it Italian

ja Japanese

ko Korean

nl Dutch

no Norwegian

pl Polish

pt Portuguese

ro Romanian

ru Russian

sk Slovakian

sl Slovenian

sq Albanian

sr Serbian

sv Swedish

tr Turkish

uk Ukrainian

zh Chinese

Table D.2. Supported Language Subtypes

D.4. Troubleshooting Matching RulesInternational collation order matching rules may not behave consistently. Some forms of matching-ruleinvocation do not work correctly, producing incorrect search results. For example, the following rulesdo not work:

ldapsearch -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:2.16.840.1.113730.3.3.2.7.1:=passin"

ldapsearch -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret

Page 667: Red Hat Directory Server 5.1

Troubleshooting Matching Rules

647

-b "dc=example,dc=com" "sn:de:=passin"

However, the rules listed below will work (note the .3 before the passin value):

ldapsearch -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:2.16.840.1.113730.3.3.2.7.1.3:=passin"

ldapsearch -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:de.3:=passin"

Page 668: Red Hat Directory Server 5.1

648

Page 669: Red Hat Directory Server 5.1

649

GlossaryAaccess control instruction See ACI.

access control list See ACL.

access rights In the context of access control, specify the level of access grantedor denied. Access rights are related to the type of operation that canbe performed on the directory. The following rights can be granted ordenied: read, write, add, delete, search, compare, selfwrite, proxy andall.

account inactivation Disables a user account, group of accounts, or an entire domain sothat all authentication attempts are automatically rejected.

ACI An instruction that grants or denies permissions to entries in thedirectory.

See Also access control instruction.

ACL The mechanism for controlling access to your directory.

See Also access control list.

All IDs Threshold Replaced with the ID list scan limit in Directory Server version 7.1.A size limit which is globally applied to every index key managed bythe server. When the size of an individual ID list reaches this limit, theserver replaces that ID list with an All IDs token.

See Also ID list scan limit.

All IDs token A mechanism which causes the server to assume that all directoryentries match the index key. In effect, the All IDs token causes theserver to behave as if no index was available for the search request.

anonymous access When granted, allows anyone to access directory information withoutproviding credentials, and regardless of the conditions of the bind.

approximate index Allows for efficient approximate or "sounds-like" searches.

attribute Holds descriptive information about an entry. Attributes have a labeland a value. Each attribute also follows a standard syntax for the typeof information that can be stored as the attribute value.

attribute list A list of required and optional attributes for a given entry type orobject class.

authenticating directoryserver

In pass-through authentication (PTA), the authenticating DirectoryServer is the Directory Server that contains the authenticationcredentials of the requesting client. The PTA-enabled host sends PTArequests it receives from clients to the host.

Page 670: Red Hat Directory Server 5.1

Glossary

650

authentication (1) Process of proving the identity of the client user to the DirectoryServer. Users must provide a bind DN and either the correspondingpassword or certificate in order to be granted access to the directory.Directory Server allows the user to perform functions or access filesand directories based on the permissions granted to that user by thedirectory administrator.

(2) Allows a client to make sure they are connected to a secureserver, preventing another computer from impersonating the server orattempting to appear secure when it is not.

authentication certificate Digital file that is not transferable and not forgeable and is issued by athird party. Authentication certificates are sent from server to client orclient to server in order to verify and authenticate the other party.

Bbase distinguished name See base DN.

base DN Base distinguished name. A search operation is performed on thebase DN, the DN of the entry and all entries below it in the directorytree.

bind distinguished name See bind DN.

bind DN Distinguished name used to authenticate to Directory Server whenperforming an operation.

bind rule In the context of access control, the bind rule specifies the credentialsand conditions that a particular user or client must satisfy in order toget access to directory information.

branch entry An entry that represents the top of a subtree in the directory.

browser Software, such as Mozilla Firefox, used to request and view WorldWide Web material stored as HTML files. The browser uses the HTTPprotocol to communicate with the host server.

browsing index Speeds up the display of entries in the Directory Server Console.Browsing indexes can be created on any branch point in the directorytree to improve display performance.

See Also virtual list view index .

CCA See Certificate Authority.

cascading replication In a cascading replication scenario, one server, often called the hubsupplier, acts both as a consumer and a supplier for a particularreplica. It holds a read-only replica and maintains a changelog. Itreceives updates from the supplier server that holds the master copyof the data and in turn supplies those updates to the consumer.

Page 671: Red Hat Directory Server 5.1

651

certificate A collection of data that associates the public keys of a network userwith their DN in the directory. The certificate is stored in the directoryas user object attributes.

Certificate Authority Company or organization that sells and issues authenticationcertificates. You may purchase an authentication certificate from aCertification Authority that you trust. Also known as a CA.

CGI Common Gateway Interface. An interface for external programs tocommunicate with the HTTP server. Programs written to use CGI arecalled CGI programs or CGI scripts and can be written in many of thecommon programming languages. CGI programs handle forms orperform output parsing that is not done by the server itself.

chaining A method for relaying requests to another server. Results for therequest are collected, compiled, and then returned to the client.

changelog A changelog is a record that describes the modifications that haveoccurred on a replica. The supplier server then replays thesemodifications on the replicas stored on replica servers or on othermasters, in the case of multi-master replication.

character type Distinguishes alphabetic characters from numeric or other charactersand the mapping of upper-case to lower-case letters.

ciphertext Encrypted information that cannot be read by anyone without theproper key to decrypt the information.

class definition Specifies the information needed to create an instance of a particularobject and determines how the object works in relation to otherobjects in the directory.

class of service See CoS.

classic CoS A classic CoS identifies the template entry by both its DN and thevalue of one of the target entry's attributes.

client See LDAP client.

code page An internal table used by a locale in the context of theinternationalization plug-in that the operating system uses to relatekeyboard keys to character font screen displays.

collation order Provides language and cultural-specific information about how thecharacters of a given language are to be sorted. This informationmight include the sequence of letters in the alphabet or how tocompare letters with accents to letters without accents.

consumer Server containing replicated directory trees or subtrees from asupplier server.

consumer server In the context of replication, a server that holds a replica that is copiedfrom a different server is called a consumer for that replica.

Page 672: Red Hat Directory Server 5.1

Glossary

652

CoS A method for sharing attributes between entries in a way that isinvisible to applications.

CoS definition entry Identifies the type of CoS you are using. It is stored as an LDAPsubentry below the branch it affects.

CoS template entry Contains a list of the shared attribute values.

See Also template entry.

Ddaemon A background process on a Unix machine that is responsible for

a particular system task. Daemon processes do not need humanintervention to continue functioning.

DAP Directory Access Protocol. The ISO X.500 standard protocol thatprovides client access to the directory.

data master The server that is the master source of a particular piece of data.

database link An implementation of chaining. The database link behaves like adatabase but has no persistent storage. Instead, it points to datastored remotely.

default index One of a set of default indexes created per database instance.Default indexes can be modified, although care should be takenbefore removing them, as certain plug-ins may depend on them.

definition entry See CoS definition entry.

Directory Access Protocol See DAP.

Directory Manager The privileged database administrator, comparable to the root user inUNIX. Access control does not apply to the Directory Manager.

directory service A database application designed to manage descriptive, attribute-based information about people and resources within an organization.

directory tree The logical representation of the information stored in the directory. Itmirrors the tree model used by most filesystems, with the tree's rootpoint appearing at the top of the hierarchy. Also known as DIT.

distinguished name String representation of an entry's name and location in an LDAPdirectory.

DIT See directory tree.

DM See Directory Manager.

DN See distinguished name.

DNS Domain Name System. The system used by machines on a networkto associate standard IP addresses (such as 198.93.93.10) withhostnames (such as www.example.com). Machines normally get the

Page 673: Red Hat Directory Server 5.1

653

IP address for a hostname from a DNS server, or they look it up intables maintained on their systems.

DNS alias A DNS alias is a hostname that the DNS server knows points to adifferent host�specifically a DNS CNAME record. Machines alwayshave one real name, but they can have one or more aliases. Forexample, an alias such as www.yourdomain.domain might point toa real machine called realthing.yourdomain.domain where theserver currently exists.

Eentry A group of lines in the LDIF file that contains information about an

object.

entry distribution Method of distributing directory entries across more than one serverin order to scale to support large numbers of entries.

entry ID list Each index that the directory uses is composed of a table of indexkeys and matching entry ID lists. The entry ID list is used by thedirectory to build a list of candidate entries that may match the clientapplication's search request.

equality index Allows you to search efficiently for entries containing a specificattribute value.

Ffile extension The section of a filename after the period or dot (.) that typically

defines the type of file (for example, .GIF and .HTML). In the filenameindex.html the file extension is html.

file type The format of a given file. For example, graphics files are oftensaved in GIF format, while a text file is usually saved as ASCII textformat. File types are usually identified by the file extension (forexample, .GIF or .HTML).

filter A constraint applied to a directory query that restricts the informationreturned.

filtered role Allows you to assign entries to the role depending upon the attributecontained by each entry. You do this by specifying an LDAP filter.Entries that match the filter are said to possess the role.

Ggeneral access When granted, indicates that all authenticated users can access

directory information.

GSS-API Generic Security Services. The generic access protocol that is thenative way for UNIX-based systems to access and authenticateKerberos services; also supports session encryption.

Page 674: Red Hat Directory Server 5.1

Glossary

654

Hhostname A name for a machine in the form machine.domain.dom, which is

translated into an IP address. For example, www.example.com isthe machine www in the subdomain example and com domain.

HTML Hypertext Markup Language. The formatting language used fordocuments on the World Wide Web. HTML files are plain text fileswith formatting codes that tell browsers such as the Mozilla Firefoxhow to display text, position graphics, and form items and to displaylinks to other pages.

HTTP Hypertext Transfer Protocol. The method for exchanging informationbetween HTTP servers and clients.

HTTPD An abbreviation for the HTTP daemon or service, a program thatserves information using the HTTP protocol. The daemon or serviceis often called an httpd.

HTTPS A secure version of HTTP, implemented using the Secure SocketsLayer, SSL.

hub In the context of replication, a server that holds a replica that is copiedfrom a different server, and, in turn, replicates it to a third server.

See Also cascading replication.

IID list scan limit A size limit which is globally applied to any indexed search operation.

When the size of an individual ID list reaches this limit, the serverreplaces that ID list with an all IDs token.

index key Each index that the directory uses is composed of a table of indexkeys and matching entry ID lists.

indirect CoS An indirect CoS identifies the template entry using the value of one ofthe target entry's attributes.

international index Speeds up searches for information in international directories.

International StandardsOrganization

See ISO.

IP address Also Internet Protocol address. A set of numbers, separated by dots,that specifies the actual location of a machine on the Internet (forexample, 198.93.93.10). Directory Server supports both IPv4 andIPv6 IP addresses.

ISO International Standards Organization.

Kknowledge reference Pointers to directory information stored in different databases.

Page 675: Red Hat Directory Server 5.1

655

LLDAP Lightweight Directory Access Protocol. Directory service protocol

designed to run over TCP/IP and across multiple platforms.

LDAP client Software used to request and view LDAP entries from an LDAPDirectory Server.

See Also browser.

LDAP Data InterchangeFormat

See LDAP Data Interchange Format.

LDAP URL Provides the means of locating Directory Servers using DNS and thencompleting the query via LDAP. A sample LDAP URL is ldap://ldap.example.com.

LDAPv3 Version 3 of the LDAP protocol, upon which Directory Server basesits schema format.

LDBM database A high-performance, disk-based database consisting of a set of largefiles that contain all of the data assigned to it. The primary data storein Directory Server.

LDIF LDAP Data Interchange Format. Format used to represent DirectoryServer entries in text form.

leaf entry An entry under which there are no other entries. A leaf entry cannotbe a branch point in a directory tree.

Lightweight DirectoryAccess Protocol

See LDAP.

locale Identifies the collation order, character type, monetary format andtime / date format used to present data for users of a specific region,culture, and/or custom. This includes information on how data of agiven language is interpreted, stored, or collated. The locale alsoindicates which code page should be used to represent a givenlanguage.

Mmanaged object A standard value which the SNMP agent can access and send to the

NMS. Each managed object is identified with an official name and anumeric identifier expressed in dot-notation.

managed role Allows creation of an explicit enumerated list of members.

management informationbase

See MIB.

mapping tree A data structure that associates the names of suffixes (subtrees) withdatabases.

Page 676: Red Hat Directory Server 5.1

Glossary

656

master See supplier.

master agent See SNMP master agent.

matching rule Provides guidelines for how the server compares strings during asearch operation. In an international search, the matching rule tellsthe server what collation order and operator to use.

MD5 A message digest algorithm by RSA Data Security, Inc., which canbe used to produce a short digest of data that is unique with highprobability and is mathematically extremely hard to produce; a pieceof data that will produce the same message digest.

MD5 signature A message digest produced by the MD5 algorithm.

MIB Management Information Base. All data, or any portion thereof,associated with the SNMP network. We can think of the MIB asa database which contains the definitions of all SNMP managedobjects. The MIB has a tree-like hierarchy, where the top levelcontains the most general information about the network and lowerlevels deal with specific, separate network areas.

MIB namespace Management Information Base namespace. The means for directorydata to be named and referenced. Also called the directory tree.

monetary format Specifies the monetary symbol used by specific region, whether thesymbol goes before or after its value, and how monetary units arerepresented.

multi-master replication An advanced replication scenario in which two servers each holda copy of the same read-write replica. Each server maintains achangelog for the replica. Modifications made on one server areautomatically replicated to the other server. In case of conflict, atime stamp is used to determine which server holds the most recentversion.

multiplexor The server containing the database link that communicates with theremote server.

Nn + 1 directory problem The problem of managing multiple instances of the same information

in different directories, resulting in increased hardware and personnelcosts.

name collisions Multiple entries with the same distinguished name.

nested role Allows the creation of roles that contain other roles.

network managementapplication

Network Management Station component that graphically displaysinformation about SNMP managed devices, such as which device isup or down and which and how many error messages were received.

network managementstation

See NMS.

Page 677: Red Hat Directory Server 5.1

657

NIS Network Information Service. A system of programs and datafiles that Unix machines use to collect, collate, and share specificinformation about machines, users, filesystems, and networkparameters throughout a network of computers.

NMS Powerful workstation with one or more network managementapplications installed. Also network management station.

ns-slapd Red Hat's LDAP Directory Server daemon or service that isresponsible for all actions of the Directory Server.

See Also slapd.

Oobject class Defines an entry type in the directory by defining which attributes are

contained in the entry.

object identifier A string, usually of decimal numbers, that uniquely identifies aschema element, such as an object class or an attribute, in an object-oriented system. Object identifiers are assigned by ANSI, IETF orsimilar organizations.

See Also OID.

OID See object identifier.

operational attribute Contains information used internally by the directory to keep track ofmodifications and subtree properties. Operational attributes are notreturned in response to a search unless explicitly requested.

Pparent access When granted, indicates that users have access to entries below their

own in the directory tree if the bind DN is the parent of the targetedentry.

pass-through authentication See PTA.

pass-through subtree In pass-through authentication, the PTA directory server will passthrough bind requests to the authenticating directory server from allclients whose DN is contained in this subtree.

password file A file on Unix machines that stores Unix user login names,passwords, and user ID numbers. It is also known as /etc/passwdbecause of where it is kept.

password policy A set of rules that governs how passwords are used in a givendirectory.

PDU Encoded messages which form the basis of data exchanges betweenSNMP devices. Also protocol data unit.

Page 678: Red Hat Directory Server 5.1

Glossary

658

permission In the context of access control, permission states whether access tothe directory information is granted or denied and the level of accessthat is granted or denied.

See Also access rights.

pointer CoS A pointer CoS identifies the template entry using the template DNonly.

presence index Allows searches for entries that contain a specific indexed attribute.

protocol A set of rules that describes how devices on a network exchangeinformation.

protocol data unit See PDU.

proxy authentication A special form of authentication where the user requesting access tothe directory does not bind with its own DN but with a proxy DN.

proxy DN Used with proxied authorization. The proxy DN is the DN of anentry that has access permissions to the target on which the client-application is attempting to perform an operation.

PTA Mechanism by which one Directory Server consults another to checkbind credentials. Also pass-through authentication.

PTA directory server In pass-through authentication (PTA), the PTA Directory Server is theserver that sends (passes through) bind requests it receives to theauthenticating directory server.

PTA LDAP URL In pass-through authentication, the URL that defines theauthenticating directory server, pass-through subtree(s), and optionalparameters.

RRAM Random access memory. The physical semiconductor-based memory

in a computer. Information stored in RAM is lost when the computer isshut down.

rc.local A file on Unix machines that describes programs that are run whenthe machine starts. It is also called /etc/rc.local because of itslocation.

RDN The name of the actual entry itself, before the entry's ancestors havebeen appended to the string to form the full distinguished name. Alsorelative distinguished name.

read-only replica A replica that refers all update operations to read-write replicas. Aserver can hold any number of read-only replicas.

read-write replica A replica that contains a master copy of directory information and canbe updated. A server can hold any number of read-write replicas.

Page 679: Red Hat Directory Server 5.1

659

referential integrity Mechanism that ensures that relationships between related entriesare maintained within the directory.

referral (1) When a server receives a search or update request from an LDAPclient that it cannot process, it usually sends back to the client apointer to the LDAP sever that can process the request.

(2) In the context of replication, when a read-only replica receivesan update request, it forwards it to the server that holds thecorresponding read-write replica. This forwarding process is called areferral.

relative distinguished name See RDN.

replica A database that participates in replication.

replica-initiated replication Replication configuration where replica servers, either hub orconsumer servers, pull directory data from supplier servers. Thismethod is available only for legacy replication.

replication Act of copying directory trees or subtrees from supplier servers toreplica servers.

replication agreement Set of configuration parameters that are stored on the supplier serverand identify the databases to replicate, the replica servers to whichthe data is pushed, the times during which replication can occur, theDN and credentials used by the supplier to bind to the consumer, andhow the connection is secured.

RFC Request for Comments. Procedures or standards documentssubmitted to the Internet community. People can send comments onthe technologies before they become accepted standards.

role An entry grouping mechanism. Each role has members, which are theentries that possess the role.

role-based attributes Attributes that appear on an entry because it possesses a particularrole within an associated CoS template.

root The most privileged user available on Unix machines. The root userhas complete access privileges to all files on the machine.

root suffix The parent of one or more sub suffixes. A directory tree can containmore than one root suffix.

SSASL An authentication framework for clients as they attempt to bind to a

directory. Also Simple Authentication and Security Layer .

schema Definitions describing what types of information can be stored asentries in the directory. When information that does not match theschema is stored in the directory, clients attempting to access thedirectory may be unable to display the proper results.

Page 680: Red Hat Directory Server 5.1

Glossary

660

schema checking Ensures that entries added or modified in the directory conform to thedefined schema. Schema checking is on by default, and users willreceive an error if they try to save an entry that does not conform tothe schema.

Secure Sockets Layer See SSL.

self access When granted, indicates that users have access to their own entries ifthe bind DN matches the targeted entry.

Server Console Java-based application that allows you to perform administrativemanagement of your Directory Server from a GUI.

server daemon The server daemon is a process that, once running, listens for andaccepts requests from clients.

Server Selector Interface that allows you select and configure servers using abrowser.

server service A process on Windows that, once running, listens for and acceptsrequests from clients. It is the SMB server on Windows NT.

service A background process on a Windows machine that is responsiblefor a particular system task. Service processes do not need humanintervention to continue functioning.

SIE Server Instance Entry. The ID assigned to an instance of DirectoryServer during installation.

Simple Authentication andSecurity Layer

See SASL.

Simple NetworkManagement Protocol

See SNMP.

single-master replication The most basic replication scenario in which multiple servers, upto four, each hold a copy of the same read-write replicas to replicaservers. In a single-master replication scenario, the supplier servermaintains a changelog.

SIR See supplier-initiated replication.

slapd LDAP Directory Server daemon or service that is responsible for mostfunctions of a directory except replication.

See Also ns-slapd.

SNMP Used to monitor and manage application processes running on theservers by exchanging data about network activity. Also SimpleNetwork Management Protocol.

SNMP master agent Software that exchanges information between the various subagentsand the NMS.

SNMP subagent Software that gathers information about the managed device andpasses the information to the master agent. Also called a subagent.

Page 681: Red Hat Directory Server 5.1

661

SSL A software library establishing a secure connection between twoparties (client and server) used to implement HTTPS, the secureversion of HTTP. Also called Secure Sockets Layer.

standard index index maintained by default.

sub suffix A branch underneath a root suffix.

subagent See SNMP subagent.

substring index Allows for efficient searching against substrings within entries.Substring indexes are limited to a minimum of two characters for eachentry.

suffix The name of the entry at the top of the directory tree, below whichdata is stored. Multiple suffixes are possible within the same directory.Each database only has one suffix.

superuser The most privileged user available on Unix machines. The superuserhas complete access privileges to all files on the machine. Also calledroot.

supplier Server containing the master copy of directory trees or subtrees thatare replicated to replica servers.

supplier server In the context of replication, a server that holds a replica that is copiedto a different server is called a supplier for that replica.

supplier-initiated replication Replication configuration where supplier servers replicate directorydata to any replica servers.

symmetric encryption Encryption that uses the same key for both encrypting and decrypting.DES is an example of a symmetric encryption algorithm.

system index Cannot be deleted or modified as it is essential to Directory Serveroperations.

Ttarget In the context of access control, the target identifies the directory

information to which a particular ACI applies.

target entry The entries within the scope of a CoS.

TCP/IP Transmission Control Protocol/Internet Protocol. The main networkprotocol for the Internet and for enterprise (company) networks.

template entry See CoS template entry.

time/date format Indicates the customary formatting for times and dates in a specificregion.

TLS The new standard for secure socket layers; a public key basedprotocol. Also Transport Layer Security.

Page 682: Red Hat Directory Server 5.1

Glossary

662

topology The way a directory tree is divided among physical servers and howthese servers link with one another.

Transport Layer Security See TLS.

Uuid A unique number associated with each user on a Unix system.

URL Uniform Resource Locater. The addressing system used by theserver and the client to request documents. It is often called alocation. The format of a URL is protocol://machine:port/document.The port number is necessary only on selected servers, and it is oftenassigned by the server, freeing the user of having to place it in theURL.

Vvirtual list view index Speeds up the display of entries in the Directory Server Console.

Virtual list view indexes can be created on any branch point in thedirectory tree to improve display performance.

See Also browsing index.

XX.500 standard The set of ISO/ITU-T documents outlining the recommended

information model, object classes and attributes used by directoryserver implementation.

Page 683: Red Hat Directory Server 5.1

663

IndexAaccess control

ACI attribute, 243ACI syntax, 246allowing or denying access, 253and replication, 311and schema checking, 249anonymous access, 258bind rules, 256

access at specific time or day, 268access based on value matching, 262general access, 258user and group access, 257

Boolean bind rules, 270compatibility with earlier versions, 311creating from console, 271dynamic targets, 258from specific domain, 267from specific IP address, 266logging information, 290overview, 243permissions, 252placement of ACIs, 244rights, 253roles, 191SASL authentication, 269simple authentication, 269SSL authentication, 269structure of ACIs, 243target DN

containing comma, 248target DN containing comma, 305targeting, 247targeting attribute values, 251targeting attributes, 249targeting entries, 248targeting using filters, 250using the Access Control Editor, 271value matching, 262viewing

Access Control Editor, 279get effective rights, 280

Access Control Editordisplaying, 272

access control instruction (ACI). See ACI, 243access log

configuring, 567manually rotating, 571

turning off, 567turning on, 567viewing, 567

account inactivation, 329from command line, 330from console, 329

account lockout, 326configuration

attributes, 326configuring, 325

using command line, 326using console, 326

disabling, 326enabling, 326lockout duration, 326password failure counter, 326replicating attributes, 409

ACI, 243assessment, 243attribute, 244authmethod keyword, 269bind rules, 246cascading chaining, 76creating from console, 273dayofweek keyword, 268deleting from console, 279dns keyword, 267editing from console, 278evaluation, 244examples of use, 290groupdn keyword, 260inheritance, 265ip keyword, 266local evaluation

cascading chaining, 77name, 246permissions, 246precedence rule, 244proxy rights example, 306replication, 311rights, 253roledn keyword, 262structure, 243syntax, 246targattrfilters keyword, 251target, 246target DN

containing comma, 248target DN containing comma, 305target keywords, 247target overview, 247

Page 684: Red Hat Directory Server 5.1

Index

664

targetattr keyword, 249targetfilter keyword, 250userattr and parent, 265userattr keyword, 262using macro ACIs, 307value-based, 251viewing current, 279wildcard in target, 248wildcards, 259

ACI attributedefault index for, 496overview, 243

ACI placement, 244ACI targets, 248ACL, 243activating accounts

from command line, 331from console, 330

Active Directoryschema differences between Directory Server,447, 454

add right, 253adding directory entries, 112Administration Server

and replication, 412starting and stopping, 5

algorithmmetaphone phonetic algorithm, 498search, 497

All IDs Threshold, 498all keyword, 258allowing access, 253anonymous access, 269

example, 260overview, 258

anyone keyword, 258approximate index, 493

query string codes, 498approximate search, 627attribute

ACI, 243adding, 120adding multiple values, 105adding to entry, 102creating, 478defining in schema, 483, 486deleting, 120, 482deleting using LDIF update statements, 123editing, 482nsslapd-schemacheck, 491passwordChange, 317

passwordExp, 317passwordGraceLimit, 316passwordInHistory, 318passwordMaxRepeats, 319passwordMin8bit, 320passwordMinAlphas, 319passwordMinCategories, 319passwordMinDigits, 319passwordMinLowers, 319passwordMinSpecials, 319passwordMinTokenLength, 320passwordMinUppers, 320passwordMustChange, 316passwordStorageScheme, 320ref, 89removing a value, 106roles, 189searching for, 627standard, 471targeting, 249very large, 105viewing, 476

attribute encryption, 36importing and exporting encrypted databases,41

attribute subtypes, 106adding, 106binary, 108language, 107pronunciation, 108

attribute type field (LDIF), 608attribute uniqueness plug-in, 140

configuring, 144creating an instance of, 143examples, 146markerObjectClass, 145requiredObjectClass, 145syntax, 141

attribute value field (LDIF), 608attribute values

adding, 120deleting, 123modifying, 122replacing, 120

attributesallowed, 472defined, 472required, 472syntax, 475unique number assignments, 132

configuring, 137, 139

Page 685: Red Hat Directory Server 5.1

665

magic number, 134overview, 132, 132syntax, 135, 136usage, 133

attributes valuestargeting, 251

audit logconfiguring, 570disabling, 570enabling, 570viewing, 570

authenticationaccess control and, 269autobind

configuring, 343overview, 341

bind DN, 6certificate-based, 540for database links, 51LDAP URLs, 642over SSL, 530SASL, 553SASL mechanisms, 557

authmethod keyword, 269autobind

configuring, 343overview, 341

Bbacking up data, 162

all, 162cn=tasks, 164db2bak, 163dse.ldif, 165

bak2db script, 166bak2db.pl perl script, 166base 64 encoding, 609base DN, ldapsearch and, 624binary data, LDIF and, 609binary subtype, 108bind credentials

for database links, 48bind DN

accessing the server, 6resource limits based on, 331viewing current, 8

bind rulesaccess at specific time or day, 268access based on authentication method, 269

LDIF example, 270access based on value matching

overview, 262ACI syntax, 246all keyword, 258anonymous access, 258

example, 260LDIF example, 260

anyone keyword, 258authmethod keyword, 269Boolean, 270dayofweek keyword, 268dns keyword, 267general access, 258

example, 260group access, 260group access example, 297groupdn keyword, 260ip keyword, 266LDAP URLs, 258LDIF keywords, 257overview, 256parent keyword, 258role access, 262roledn keyword, 262self keyword, 258timeofday keyword, 268user access

LDIF example, 259parent, 258self, 258

user access example, 293userattr keyword, 262userdn keyword, 257

Boolean bind rulesexample, 270overview, 270

Boolean operators, in search filters, 628browsing index, 494browsing indexes

creatingcn=tasks, 509

Ccache memory size

and import operations, 149cascading chaining

client ACIs, 77configuration attributes, 78configuring from command line, 75configuring from console, 74example, 78local ACI evaluation, 77

Page 686: Red Hat Directory Server 5.1

Index

666

loop detection, 77overview, 72proxy admin user ACI, 76proxy authorization, 76

cascading replicationinitializing the replicas, 383introduction, 351setting up, 377

certificatemapping to a DN, 541password, 535

certificate databasepassword, 519

certificate-based authentication, 540setting up, 540

certificatesfor authenticating to the Directory Server, 541

certmap.confdefined, 542editing, 546examples, 547

chainingcascading, 72component operations, from command line, 61component operations, from console, 60overview, 42using SSL, 45, 50

change operations, 118add, 120delete, 120replace, 120

change typeadd, 118delete, 123LDIF, 117modify, 120

changelog, 346deleting, 402

character type, 643checkpoint interval, 601ciphers

list ofSSLv3, 539TLSv1, 538

none,MD5MD5 message authentication, 540

overview, 537selecting, 537

cl-dump.pl script, 424class of service (CoS), 192

access control, 219

classicexample, 195overview, 195

cosPriority attribute, 217creating, 197definition entry, 212editing, 210indirect

example, 194overview, 194

pointerexample, 194overview, 194

qualifiersoverride, 215

template entrycreating, 201overview, 193

classic CoSexample, 195overview, 195

clientusing to find entries, 619

client authentication, 541cn=memberof task, 241cn=schema reload task, 488cn=task

cn=schema reload task, 488cn=tasks

cn=backup, 164cn=export, 161cn=import, 156cn=memberof task, 241cn=restore, 167creating browsing indexes, 509creating indexes, 505

code page, 643collation order

international index, 503overview, 643search filters and, 632

command lineproviding input from, 110

command-line scriptsdb2bak, 163fixup-memberof.pl, 240schema-reload.pl, 487

command-line utilitiescertificate-based authentication and, 540ldapdelete, 114ldapmodify, 111

Page 687: Red Hat Directory Server 5.1

667

ldapsearch, 626ldif, 609ldif2db, 505

commas, in DNs, 115, 248using ldapsearch with, 626

compare right, 253compatibility

ACIs, 311replication, 347

compound search filters, 628configuration attributes

account lockout, 326cascading chaining, 78password policy, 316suffix, 22

connectionsLDAPI (Unix sockets), 341

configuring, 8monitoring, 574viewing number of, 573

consumer initializationfilesystem replica, 406manual consumer creation, 405online consumer creation, 403

consumer server, 345continued lines

in LDIF, 608in LDIF update statements, 118

CoS definition entryattributes, 213object classes, 212

CoS qualifiersdefault, 216override, 215, 216

CoS template entry, 193creating, 201

CoS. See class of service., 192cosPriority attribute, 217counter, password failures, 326country code, 644creating a database

from the command line, 29from the console, 28

creating a virtual DIT, 219creating the directory, 613custom distribution function

adding to suffix, 30custom distribution logic

adding databases, 29adding to suffix, 30

custom schema files, 485

Ddash, in change operation, 118data consistency

using referential integrity, 124database

and associated suffix, 15backing up

cn=tasks, 164db2bak, 163

backup, 162backup files, 163backup from console, 162creating from command line, 29creating from console, 28creating multiple, 29creating using LDIF, 613deleting, 34export, 156

cn=tasks, 161db2ldif, 160db2ldif.pl, 160encrypted database, 41

export from console, 158import, 149

cn=tasks, 156encrypted database, 41ldif2db, 153ldif2db.pl, 154ldif2ldap, 155

initialization, 151making read-only, 31monitoring from command line, 582monitoring from server console, 578overview, 26read-only mode, 31replication, 345restore, 162restoring, 599

bak2db, 166bak2db.pl, 166cn=tasks, 167

restoring from console, 165selecting for monitoring, 578viewing backend information, 578

database linkcascading

configuring from command line, 75configuring from console, 74overview, 72

chaining with SSL, 45, 50configuration, 43

Page 688: Red Hat Directory Server 5.1

Index

668

configuration attributes, 52configuration example, 52configuring bind and authentication, 51configuring bind credentials, 48configuring defaults, 64configuring failover servers, 50configuring LDAP URL, 50configuring suffix, 47creating from command line, 47creating from console, 43deleting, 65maintaining remote server info, 63overview, 42

database server parametersread-only, 579

database transaction loggingdescribed, 599durable transactions, 601log file location, 600

databasesin Directory Server, 15

date format, 643dayofweek keyword, 268db2bak script, 163db2bak utility, 163db2ldif utility, 160db2ldif.pl, 160debug

and replication timeouts, 411default CoS qualifier, 216default referrals

setting, 84setting from console, 84settings from command line, 85

definingaccess control policy, 271attributes, 478object classes, 480

delete right, 253deleting

ACI, 279attribute values, 123attributes, 120, 482database link, 65entries, 123multiple attributes, 120object classes, 482

deleting directory entries, 114deleting schema elements, 485denying access, 253

precedence rule, 244

directory creation, 613directory entries

adding using LDIF, 111creating, 96deleting, 108managing from command line, 109managing from console, 93modifying, 100moving, 120renaming, 120

Directory Managerattribute, 13configuring, 13privileges, 13

Directory Serverattributes, 13basic administration, 1binding to, 6changing bind DN, 7configuration, 9configuring SASL authentication at startup,563connecting over LDAPI (Unix sockets), 341controlling access, 243creating a root entry, 93creating content, 149creating entries, 96data, 149databases, 15deleting entries, 108file locations, 1importing data, 149international charactersets, 643login, 6managing entries, 93MIB, 591modifying entries, 100monitoring, 565monitoring from command line, 576monitoring with SNMP, 587overview, 1performance counters, 571, 586

64-bit, 571, 578, 591reloading schema, 487

cn=schema reload task, 488schema-reload.pl, 487

starting and stopping, 4starting the Console, 5suffixes, 15supported languages, 644

Directory Server Console

Page 689: Red Hat Directory Server 5.1

669

starting, 5directory trees

finding entries in, 620disabling suffixes, 24disk space

access log and, 567log files and, 571

distributed number assignment, 132about ranges, 132basic example, 135complete example, 135configuring, 137, 139Directory Server behavior, 132for attributes, 133overview, 132scope, 133syntax, 135, 136transfer range example, 134

distribution function, 29dn field (LDIF), 608dns keyword, 267dse.ldif file

backing up, 165restoring, 168

durable transactions, 601dynamic groups, 232

creating, 232modifying, 235

Eediting

attributes, 482object classes, 482

encryptionattribute, 36database, 36

end of file marker, 110entity table, 593entries

adding an object class, 100adding attributes, 102adding using LDIF, 111adding using LDIF update statements, 118adding very large attributes, 105creating, 96

using LDIF, 610deleting, 108

using ldapdelete, 114deleting using LDIF update statements, 123distribution, 27finding, 620

managing, 93managing from command line, 109managing from console, 93modifying, 100

using ldapmodify, 111using LDIF update statements, 120

moving, 120order of creation, 110order of deletion, 114removing an object class, 102renaming, 120root, 613targeting, 248

entry distribution, 27entry ID list, 498environment variables

LDAP_BASEDN, 624EOF marker, 110equality index, 493equality search, 627

example, 629international example, 636

error logaccess control information, 290configuring, 569manually rotating, 571turning off, 569turning on, 569viewing, 568

examplecascading chaining, 78

exporting data, 156cn=tasks, 161db2ldif, 160db2ldif.pl, 160encrypted database, 41using console, 158

extending the directory schema, 471

Ffailover servers

for database links, 50File locations, 1files

access log, 567database backup, 163EOF marker, 110error log, 568id2entry.db4, 496

Filesystem Hierarchy Standard, 1filesystem replica initialization, 406

Page 690: Red Hat Directory Server 5.1

Index

670

filtered rolecreating, 176example, 190

findingattributes, 627entries, 620

fixup-memberof.pl, 240format, LDIF, 607fractional replication, 347

Ggeneral access

example, 260overview, 258

get effective rights, 280return codes, 289

global password policy, 313glue entries, 423greater than or equal to search

international example, 636overview, 627

groupdn keyword, 260LDIF examples, 261

groupdnattr keyword, 262groups

access control, 257access control example, 297access to directory, 260configuring the memberOf plug-in, 238, 238,239differences between Directory Server andActive Directory, 454dynamic, 232

creating, 232modifying, 235

fixup-memberof.pl, 240memberOf

cn=memberof task, 241overview, 228static, 228

creating, 229modifying, 232

GSS-API, 558

Hhub, 346

Iid field (LDIF), 607id2entry.db4 file, 496identity mapping

default, 556importing

buffer size, 149large attributes, 149

importing data, 149cn=tasks, 156encrypted database, 41from console, 149ldif2ldap, 155using ldif2db, 153using ldif2db.pl, 154

inactivating accounts, 329inactivating roles, 172index types, 493

approximate index, 493browsing index, 494equality index, 493international index, 494presence index, 493substring index, 493virtual list view index, 494

indexescreating

cn=tasks, 505creating dynamically, 503dynamic changes to, 503presence, 496

indexing, 493creating indexes from console, 502system indexes, 496

indirect CoSexample, 194overview, 194

init scriptsconfiguring SASL authentication, 563

initializing databases, 151initializing replicas

cascading replication, 383filesystem replica, 406

interaction table, 594international charactersets, 643international index, 494

collation order, 503international searches, 632

equality, 636examples, 635greater than, 637greater than or equal to, 636less than, 635less than or equal to, 636matching rule filter syntax, 632

Page 691: Red Hat Directory Server 5.1

671

substring, 637using OIDs, 633

internationalizationcharacter type, 643collation order, 643country code, 644date format, 643language tag, 644locales and, 643location of files, 644matching rule filters, 632modifying entries, 124monetary format, 643object identifiers and, 644of LDIF files, 615search filters and, 632supported locales, 644time format, 643

ip keyword, 266

Jjpeg images, 609

KKerberos, 558, 558

realms, 558

Llanguage code

in LDIF entries, 616list of supported, 644

language subtype, 107language support

language tag, 644searching and, 632specifying using locales, 644

language tagsdescribed, 644in international searches, 633in LDIF update statements, 124

LDAP clientsauthentication over SSL, 541certificate-based authentication and, 540monitoring database with, 582monitoring server with, 576using to find entries, 619

LDAP Data Interchange Format, see LDIF, 117LDAP search filters

DNs with commas and, 626in targets, 250

example, 304

examples, 250LDAP URLs

components of, 639examples, 641for database links, 50in access control, 258security, 642syntax, 639

ldap-agent, 589ldapdelete utility, 111

deleting entries, 114DNs with commas and, 115example, 114

LDAPIenabling, 8overview, 341

ldapmodify utility, 111attributes with language tags, 124creating a root entry, 111creating entries, 112DNs with commas and, 115example, 112example of use, 112modifying entries, 111schema checking and, 112vs. ldapdelete, 111

ldapsearch utilitybase DN and, 624commonly used options, 621DNs with commas and, 621example of use, 623format, 621international searches, 632limiting attributes returned, 625search filters, 626specifying files, 625using, 620

LDAP_BASEDN environment variable, 624LDIF

access control keywordsgroupdnattr, 262userattr, 262

adding entries, 111binary data, 609change type, 117entry format, 607

organization, 610organizational person, 612organizational unit, 611

example, 614internationalization and, 615

Page 692: Red Hat Directory Server 5.1

Index

672

line continuation, 608Server Console and, 111specifying entries

organization, 610organizational person, 612organizational unit, 611

update statements, 117using to create directory, 613

LDIF entriesbinary data in, 609creating, 610

organizational person, 612organizational units, 611organizations, 610

internationalization and, 615LDIF files

continued lines, 608creating directory using, 613creating multiple entries, 111example, 614importing from Server Console, 111internationalization and, 615

LDIF format, 607LDIF update statements, 117

adding attributes, 121adding entries, 118continued lines, 118deleting attribute values, 123deleting attributes, 123deleting entries, 123modifying attribute values, 122modifying entries, 120syntax, 117

ldif utilityconverting binary data to LDIF, 609

ldif2db utility, 153options, 505

ldif2db.pl perl script, 154ldif2ldap utility, 155legacy consumer

configuration, 414legacy replication plug-in

overview, 347less than or equal to search

international example, 636syntax, 627

less than searchinternational example, 635syntax, 627

local password policy, 313locales

defined, 643location of files, 644supported, 644

locked accounts, 326lockout duration, 326log files, 565

access log, 567audit log, 570database transaction, 599deletion policy, 566error log, 568location of, 571manually rotating, 571rotation policy, 565setting file permissions, 565viewing when server is down, 565

loggingfor WinSync, 469

login identitychanging, 7viewing, 8

logstransaction

moving, 35loop detection

cascading chaining, 77

Mmacro ACIs

example, 307overview, 307syntax, 308

managed deviceoverview, 587

managed object, 587managed role

creating, 173example, 190

manually rotating log files, 571markerObjectClass keyword, 145matchingRule format, 633

using language tag, 633using language tag and suffix, 634using OID, 633using OID and suffix, 634

memberOf plug-inconfiguring, 238

from the command line, 239from the console, 238

metaphone phonetic algorithm, 498MIB

Page 693: Red Hat Directory Server 5.1

673

Directory Server, 591redhat-directory.mib, 591

entity table, 593entries table, 593interaction table, 594operations table, 591

modifyingattribute values, 122entries, 120international entries, 124

monetary format, 643monitoring

database from command line, 582database from server console, 578Directory Server, 565from console, 571log files, 565replication status, 418threads, 574with SNMP, 587

monitoring from console, 571moving entries, 120multi-master replication

introduction, 349preventing monopolization of the consumer,376setting up, 364

multiple search filters, 628

Nnaming conflicts

in replication, 421nested role

creating, 181example, 191

NetscapeRootand replication, 412

nsds5ReplicaBusyWaitTime, 376nsds5ReplicaSessionPauseTime, 376nsRole, 172nsslapd-db-checkpoint-interval, 601nsslapd-db-durable-transactions, 601nsslapd-db-logdirectory, 600nsslapd-idlistscanlimit, 497nsslapd-lookthroughlimit attribute

role in searching algorithm, 497nsslapd-maxbersize, 105nsslapd-schemacheck attribute, 491nsslapd-sizelimit attribute

role in searching algorithm, 497nsslapd-timelimit attribute

role in searching algorithm, 497nsview, 219nsviewfilter, 219

Oobject class

adding to an entry, 100allowed attributes, 472creating, 480defined, 471defining in schema, 484, 487deleting, 482editing, 482inheritance, 472parent object class, 472referral, 89removing from an entry, 102required attributes, 472roles, 189standard, 471user-defined, 477viewing, 477

object identifier, 474object identifier (OID), 644

in matchingRule, 633objectClass field (LDIF), 608OID

getting and assigning, 474OID, See object identifier, 644operations, 573operations table, 591operators

Boolean, 628international searches and, 635search filters and, 627suffix, 635

organization, specifying entries for, 610organizational person, specifying entries for, 612organizational unit, specifying entries for, 611override CoS qualifier, 216

Pparent access, 258parent keyword, 258parent object class, 472pass-through authentication (PTA), 333password change extended operation, 324password file

Administration Server, 535SSL certificate, 535

password policy

Page 694: Red Hat Directory Server 5.1

Index

674

account lockout, 326attributes, 316configuring, 313

using command line, 316using console, 314

global, 313lockout duration, 326managing, 313password failure counter, 326replicating account lockout attributes, 409replication, 327subtree level, 313user level, 313

Password Sync, 467installation directory, 437installed files, 437installing, 436modifying, 467setting up SSL, 438starting and stopping, 468uninstalling, 468

passwordChange attribute, 317passwordExp attribute, 317passwordGraceLimit attribute, 316passwordInHistory attribute, 318passwordMaxRepeats attribute, 319passwordMin8bit attribute, 320passwordMinAlphas attribute, 319passwordMinCategories attribute, 319passwordMinDigits attribute, 319passwordMinLowers attribute, 319passwordMinSpecials attribute, 319passwordMinTokenLength attribute, 320passwordMinUppers attribute, 320passwordMustChange attribute, 316passwords

account lockout, 326certificate, 535changing, 324failure counter, 326lockout duration, 326policy

differences between Directory Server andActive Directory, 447

setting, 324syncing with Active Directory, 467

passwordStorageScheme attribute, 320PDUs, 587performance counters, 578

configuring 64-bit, 571, 578, 591configuring 64-bit integers, 586

monitoring the server with, 571server attributes, 586

performance tuningdatabase, 598server, 597

permissionsACI syntax, 246allowing or denying access, 253assigning rights, 253overview, 252precedence rule, 244

plug-insdisabling, 13distributed number assignment, 132

configuring, 137, 139overview, 132syntax, 135, 136

enabling, 13pointer CoS

example, 194overview, 194

port numberDirectory Server configuration, 9for SSL communications, 9

precedence ruleACI, 244

preferencessecurity, 537

presence index, 493defaults, 496

presence searchexample, 629syntax, 627

preventing monopolization of the consumer inmulti-master replication, 376pronunciation subtype, 108Property Editor

displaying, 100protocol data units. See PDUs, 587proxy authorization

ACI example, 306with cascading chaining, 76

proxy DN, 306proxy right, 253PTA plug-in

configuring, 336examples, 339syntax, 334use in Directory Server, 333

Page 695: Red Hat Directory Server 5.1

675

Qquotation marks, in parameter values, 115

Rread right, 253read-only mode, 579

database, 31read-only replica, 345read-write replica, 345redhat-directory.mib, 591

entity table, 593entries table, 593interaction table, 594operations table, 591

ref attribute, 89refer command, 84referential integrity

attributes, 125disabling, 126enabling, 126log file, 125modifying attributes, 130overview, 124with replication, 125

referral mode, 84referral object class, 89referrals

creating smart referrals, 85creating suffix, 90on update, 90setting default, 84suffix, 90

reloading schema, 487cn=schema reload task, 488schema-reload.pl, 487

renaming entriesrestrictions, 120

repl-monitor.pl script, 419replacing attribute values, 120replica

exporting to LDIF, 405read-only, 345read-write, 345

replicate_now.sh script, 408replication

and access control, 311and ou=NetscapeRoot, 412and password policy, 327and referential integrity, 125and SSL, 410and the Administration Server, 412

cascading, 377changelog, 346compatibility with earlier versions, 347configuring from the command line, 390configuring legacy replication, 414configuring SSL, 411consumer server, 345creating the supplier bind DN, 353forcing synchronization, 407fractional, 347hub, 346managing, 345monitoring status, 418multi-master, 364of ACIs, 311overview, 345replicate_now.sh script, 408replicating account lockout attributes, 409replication manager entry, 346single-master, 354solving conflicts, 420supplier bind DN, 346supplier server, 345supplier-initiated, 346timeout periods, 411troubleshooting, 424unit of, 345using cl-dump.pl script, 424using repl-monitor.pl script, 419

replication agreement, 347replication manager, 346requiredObjectClass keyword, 146resource limits, 331

settingusing command line, 332using console, 332

Resource Summaryviewing, 573

resource useconnections, 574monitoring, 574

restoring data, 162bak2db, 166bak2db.pl, 166cn=tasks, 167dse.ldif, 168from console, 165replicated entries, 168

restoring the database, 599retro changelog

and access control, 417

Page 696: Red Hat Directory Server 5.1

Index

676

attributes, 415object class, 415searching, 417trimming, 417

retro changelog plug-inenabling, 416overview, 347

rightslist of, 253

roledn keyword, 262roles, 171

access control, 191access to directory, 262activating, 330attributes, 189editing, 183filtered

creating, 176example, 190

inactivating, 172managed

creating, 173example, 190

nestedcreating, 181example, 191

object classes, 189overview, 171

root DN, see Directory Manager, 13root DSE, 624root entry creation, 613root suffix, 15

creating from command line, 21creating from console, 17

SSASL, 553

authentication, 269configuring

KDC server, 559configuring authentication at startup, 563configuring server to server mappings, 555identity mapping, 554

configuring form the Console, 561configuring from the command line, 562default, 556

KDC serverconfiguration example, 560

Kerberos, 558Kerberos realms, 558mechanisms, 557

CRAM-MD5, 557DIGEST-MD5, 557EXTERNAL, 557GSS-API, 558

overview, 553password change extended operation, 324

schemaadding new attributes, 483, 486assigning OIDs, 474checking, 489creating new attributes, 478creating new object classes, 480custom files, 485deleting attributes, 482deleting elements, 485deleting object classes, 482differences between Directory Server andActive Directory, 447, 454

cn, 447initials, 448street and streetAddress, 448

editing attributes, 482editing object classes, 482extending, 471nsslapd-schemacheck attribute, 491reloading, 487

cn=schema reload task, 488schema-reload.pl, 487

standard, 471viewing attributes, 476viewing object classes, 477

schema checkingand access control, 249ldapmodify and, 112overview, 489turning on or off, 489turning on or off in the command line, 491

schema-reload.pl, 487scripts

cl-dump.pl, 424repl-monitor.pl, 419

search filters, 626Boolean operators, 628contained in file, 625examples, 626matching rule, 632operators in, 627specifying attributes, 627syntax, 626using compound, 628using multiple, 628

Page 697: Red Hat Directory Server 5.1

677

Search Performance, 499search right, 253search types, list of, 627searches

approximate, 627equality, 627example, 623greater than or equal to, 627international, 632international examples, 635less than, 635less than or equal to, 627of directory tree, 620presence, 627specifying scope, 621substring, 627

searching algorithmoverview, 497

Secure Sockets Layer, see SSL, 530security

LDAP URLs, 642setting preferences, 537

self access, 258LDIF example, 259

self keyword, 258selfwrite right, 253

example, 304server parameters

databaseread-only, 579

setting access controls, 271setting passwords, 324simple authentication, 269Simple Authentication and Security Layer, 553Simple Authentication and Security Layer (SASL),269Simple Network Management Protocol. SeeSNMP, 587Simple Sockets Layer. See SSL, 269single-master replication

introduction, 348setting up, 354

smart referralscreating, 85creating from command line, 89creating from console, 85

SNMPconfiguring

Directory Server, 590ldap-agent, 589managed device, 587

managed objects, 587master agent, 587

configuring, 588MIB, 589

entity table, 593entries table, 593interaction table, 594operations table, 591

monitoring the Directory Server, 587overview, 587subagent, 587

configuration file, 588location, 588starting, 589stopping, 589

testing the subagent, 589SSL

Administration Server password file, 535and replication, 410authentication, 530certificate password, 535certificate-based authentication, 540chaining with, 45, 50client authentication, 541configuring clients to use, 541enabling, 530port number, 9setting preferences, 537starting the server with, 530

SSL authentication, 269standard

attributes, 471index files, 496object classes, 471schema, 471

Start TLS, 520Starting and stopping

Directory Server and Administration Server, 3Directory Server Console, 5

starting the Directory Serverwith SSL, 530

static groups, 228creating, 229modifying, 232

sub suffix, 15creating from command line, 21creating from console, 19

substring index, 493substring index limitation, 493substring search, 627

international example, 637

Page 698: Red Hat Directory Server 5.1

Index

678

subtree level password policy, 313subtypes

of attributes, 106suffix

and associated database, 15configuration attributes, 22creating, 93creating from command line, 21creating root suffix, 17creating sub suffix, 19custom distribution function, 30custom distribution logic, 30disabling, 24in Directory Server, 15using referrals, 90

on update only, 90with multiple databases, 29

suffix referralscreating, 90creating from command line, 91creating from console, 90

supplier bind DN, 346supplier server, 345symbols

'', in ldapsearch, 621-, in change operation, 118::, in LDIF statements, 609<, in LDIF statements, 609quotation marks, in ldapmodify commands,115

synchronization agreementchanging, 461

syntaxACI statements, 246LDAP URLs, 639ldapsearch, 621LDIF update statements, 117matching rule filter, 632search filter, 626

system connectionsmonitoring, 574

system indexes, 496system resources

monitoring, 574

Ttargattrfilters keyword, 251target

ACI syntax, 246attribute values, 251attributes, 249

keywords in ACIs, 247overview, 247using LDAP search filters, 250using LDAP URLs, 258

target DNscontaining commas, 248

target keyword, 248targetattr keyword, 249targetfilter keyword, 250targeting

directory entries, 248template entry. See CoS template entry., 193thread

monitoring, 574time format, 643timeofday keyword, 268timeout period

for replication, 411transaction logs

moving, 35tuning performance

database, 598server, 597

Uuser access, 257

example, 293LDIF example, 259to child entries, 258to own entry, 258

LDIF example, 259user and group management

referential integrity, 124user level password policy, 313user passwords, 324user-defined object classes, 477userattr keyword, 262

restriction on add, 266userdn keyword, 257users

activating, 330inactivating, 329

UTF-8, 643

Vvalue-based ACI, 251viewing

access controlget effective rights, 280

attributes, 476object classes, 477

Page 699: Red Hat Directory Server 5.1

679

virtual list view index, 494vlvindex command-line tool, 494

Wwildcard

in LDAP URL, 259in target, 248

wildcardsin international searches, 634in matching rule filters, 634

WinSync, 429about, 429changing the sync agreement, 461checking sync status, 460configuring, 432deleting entries, 457groups, 452logging levels, 469manually updating, 458Password Sync service, 436, 467

modifying, 467setting up SSL, 438starting and stopping, 468uninstalling, 468

resurrecting deleted entries, 458schema differences, 447, 454troubleshooting, 469users, 445

write performance, 498write right, 253

Page 700: Red Hat Directory Server 5.1

680