Netscape NETSCAPE DIRECTORY SERVER 6.01 -... Service manual

Administrator’s Guide
Netscape Directory Server
Version6.01
January 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
ListofFigures .................................................................15
ListofTables..................................................................17
Introduction ...................................................................21
DirectoryServerOverview .............................................................. 21
PrerequisiteReading ................................................................... 22
ConventionsUsedinThisBook .......................................................... 23
RelatedInformation .................................................................... 23
Part 1 AdministeringNetscapeDirectoryServer................................. 25
Chapter 1 IntroductiontoNetscapeDirectoryServer ...............................27
OverviewofDirectoryServerManagement................................................ 28
UsingtheDirectoryServerConsole....................................................... 28
CopyingEntryDNstotheClipboard................................................... 29
ConfiguringtheDirectoryManager ...................................................... 29
BindingtotheDirectoryFromNetscapeConsole ........................................... 30
StartingandStoppingtheDirectoryServer ................................................ 31
ConfiguringLDAPParameters........................................................... 33
StartingtheServerwithSSLEnabled ..................................................... 36
CloningaDirectoryServer .............................................................. 37
StartingtheServerinReferralMode ...................................................... 38
Chapter 2 CreatingDirectoryEntries.............................................41
ManagingEntriesFromtheDirectoryConsole ............................................. 41
ManagingEntriesFromtheCommandLine ............................................... 50
ProvidingInputFromtheCommandLine .............................................. 51
Adding and Modifying Entries Using ldapmodify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

4 Netscape Directory Server Administrator’s Guide • January 2002
LDIFUpdateStatements ................................................................ 58
ANoteonRenamingEntries ....................................................... 62
AddingAttributestoExistingEntriesUsingLDIF ..................................... 63
DeletinganEntryUsingLDIF......................................................... 67
MaintainingReferentialIntegrity......................................................... 68
HowReferentialIntegrityWorks ...................................................... 68
UsingReferentialIntegritywithReplication............................................. 69
ConfiguringtheSupplierServer .................................................... 69
FromtheDirectoryServerConsole .................................................. 70
FromtheDirectoryServerConsole .................................................. 70
FromtheDirectoryServerConsole .................................................. 71
FromtheDirectoryServerConsole .................................................. 72
Chapter 3 Configuring Directory Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
CreatingandMaintainingSuffixes........................................................ 73
CreatingSuffixes .................................................................... 74
MaintainingSuffixes ................................................................. 81
CreatingandMaintainingDatabases...................................................... 83
CreatingDatabases .................................................................. 84
MaintainingDirectoryDatabases ...................................................... 89
CreatingandMaintainingDatabaseLinks ................................................. 90
ConfiguringtheChainingPolicy ...................................................... 91
CreatingaNewDatabaseLink ........................................................ 96
ChainingUsingSSL................................................................. 107
MaintainingDatabaseLinks ......................................................... 108
DatabaseLinksandAccessControlEvaluation ......................................... 109
AdvancedFeature:TuningDatabaseLinkPerformance.................................. 110
DetectingErrorsDuringNormalProcessing ......................................... 113
ManagingThreadedOperations ................................................... 114
AdvancedFeature:ConfiguringCascadingChaining.................................... 115
OverviewofCascadingChaining .................................................. 115
SummaryofCascadingChainingConfigurationAttributes............................ 123
CascadingChainingConfigurationExample ........................................ 123
UsingReferrals ....................................................................... 130
SettingDefaultReferrals............................................................. 130
CreatingSmartReferrals ............................................................ 131
CreatingSuffixReferrals ............................................................ 134
Chapter 4 PopulatingDirectoryDatabases...................................... 137
ImportingData ....................................................................... 137
ImportingFromtheCommandLine .................................................. 141
ExportingData ....................................................................... 144

5
BackingUpandRestoringData ......................................................... 148
BackingUpAllDatabases ........................................................... 148
BackingUpthedse.ldifConfigurationFile ............................................. 151
RestoringAllDatabases ............................................................. 151
RestoringDatabasesthatIncludeReplicatedEntries..................................... 154
Restoringthedse.ldifConfigurationFile............................................... 155
EnablingandDisablingRead-OnlyMode ................................................ 155
Chapter 5 AdvancedEntryManagement.........................................157
UsingGroups......................................................................... 157
ManagingStaticGroups............................................................. 158
ManagingDynamicGroups.......................................................... 159
UsingRoles .......................................................................... 160
AboutRoles ....................................................................... 160
ManagingRolesUsingtheConsole ................................................... 161
ManagingRolesUsingtheCommandLine............................................. 166
Examples:ManagedRoleDefinition................................................ 167
Example:FilteredRoleDefinition .................................................. 168
Example:NestedRoleDefinition................................................... 169
UsingRolesSecurely................................................................ 169
AssigningClassofService.............................................................. 170
AboutCoS......................................................................... 171
AbouttheCoSDefinitionEntry.................................................... 171
AbouttheCoSTemplateEntry .................................................... 172
HowaPointerCoSWorks ........................................................ 173
HowanIndirectCoSWorks....................................................... 173
HowaClassicCoSWorks......................................................... 174
ManagingCoSUsingtheConsole..................................................... 175
ManagingCoSFromtheCommandLine .............................................. 178
ExampleofaPointerCoS ......................................................... 182
ExampleofanIndirectCoS........................................................ 183
ExampleofaClassicCoS ......................................................... 184
CreatingRole-BasedAttributes....................................................... 185
AccessControlandCoS ............................................................. 186
Chapter 6 Managing Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
AccessControlPrinciples .............................................................. 188
ACIStructure ...................................................................... 188
ACIPlacement ..................................................................... 189
ACIEvaluation..................................................................... 189
ACILimitations .................................................................... 190
DefaultACIs ......................................................................... 191

6 Netscape Directory Server Administrator’s Guide • January 2002
CreatingACIsManually ............................................................... 192
TheACISyntax .................................................................... 192
ExampleACI.................................................................... 193
TargetingAttributes.............................................................. 196
RightsRequiredforLDAPOperations .............................................. 202
PermissionsSyntax .............................................................. 203
BindRules ........................................................................... 203
BindRuleSyntax ................................................................... 204
AnonymousAccess(anyoneKeyword) ............................................. 206
GeneralAccess(allKeyword) ..................................................... 206
SelfAccess(selfKeyword) ........................................................ 207
ParentAccess(parentKeyword) ................................................... 207
LDAPURLs..................................................................... 207
Wildcards....................................................................... 207
Examples ....................................................................... 207
Examples ....................................................................... 210
Examples ....................................................................... 218
Examples ....................................................................... 220
CreatingACIsFromtheConsole ........................................................ 222
AccessControlUsageExamples......................................................... 227
GrantingAnonymousAccess...................................................... 228
GrantingWriteAccesstoPersonalEntries........................................... 230
RestrictingAccesstoKeyRoles .................................................... 234
GrantingaGroupFullAccesstoaSuffix ............................................ 235
GrantingRightstoAddandDeleteGroupEntries.................................... 236
GrantingConditionalAccesstoaGrouporRole ..................................... 239
DenyingAccess.................................................................. 241
SettingaTargetUsingFiltering .................................................... 244
AllowingUserstoAddorRemoveThemselvesFromaGroup ......................... 244
DefiningPermissionsforDNsThatContainaComma................................... 245
ProxiedAuthorizationACIExample .................................................. 246
ViewingtheACIsforanEntry .......................................................... 247
AdvancedAccessControl:UsingMacroACIs............................................. 247
MacroACIExample ................................................................ 248
MacroACISyntax .................................................................. 250
MacroMatchingfor($dn)......................................................... 251
MacroMatchingfor[$dn]......................................................... 252
Macro Matching for ($attr.attrName)................................................ 253
AccessControlandReplication ......................................................... 254
LoggingAccessControlInformation..................................................... 254
CompatibilitywithEarlierReleases...................................................... 255

7
Chapter 7 UserAccountManagement...........................................257
ManagingthePasswordPolicy.......................................................... 257
ConfiguringthePasswordPolicy ..................................................... 258
ConfiguringthePasswordPolicyUsingtheConsole.................................. 258
ConfiguringthePasswordPolicyUsingtheCommand-Line ........................... 260
SettingUserPasswords ............................................................. 262
ConfiguringtheAccountLockoutPolicy .............................................. 263
ConfiguringtheAccountLockoutPolicyUsingtheConsole ........................... 263
ConfiguringtheAccountLockoutPolicyUsingtheCommandLine .................... 264
ManagingthePasswordPolicyinaReplicatedEnvironment ............................. 265
InactivatingUsersandRoles............................................................ 266
InactivatingUserandRolesUsingtheConsole ......................................... 267
InactivatingUserandRolesUsingtheCommandLine .................................. 267
ActivatingUserandRolesUsingtheConsole .......................................... 268
ActivatingUserandRolesUsingtheCommandLine.................................... 269
SettingResourceLimitsBasedontheBindDN ............................................ 269
SettingResourceLimitsUsingtheConsole............................................. 270
SettingResourceLimitsUsingtheCommandLine ...................................... 270
Chapter 8 Managing Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
ReplicationOverview.................................................................. 274
Read-WriteReplica/Read-OnlyReplica ............................................... 274
Supplier/Consumer ................................................................ 274
ChangeLog........................................................................ 275
UnitofReplication.................................................................. 275
ReplicationIdentity................................................................. 276
ReplicationAgreement.............................................................. 277
Compatibility with Earlier Versions of Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
ReplicationScenarios .................................................................. 278
Single-MasterReplication ........................................................... 278
Multi-MasterReplication ............................................................ 279
CascadingReplication............................................................... 281
SummaryofStepsforComplexReplicationConfigurations................................. 283
DetailedReplicationTasks ............................................................. 284
ConfiguringSingle-MasterReplication................................................... 290
ConfiguringMulti-MasterReplication ................................................... 294
ConfiguringCascadingReplication...................................................... 300
DeletingtheChangeLog ............................................................... 306
InitializingConsumers................................................................. 307
ForcingReplicationUpdates............................................................ 310
ReplicationoverSSL................................................................... 314
ReplicationwithEarlierReleases ........................................................ 316
UsingtheRetroChangeLogPlug-In..................................................... 318

8 Netscape Directory Server Administrator’s Guide • January 2002
MonitoringReplicationStatus .......................................................... 322
SolvingCommonReplicationConflicts................................................... 323
Chapter 9 ExtendingtheDirectorySchema ..................................... 329
OverviewofExtendingSchema ......................................................... 329
ManagingAttributes .................................................................. 330
ManagingObjectClasses............................................................... 333
TurningSchemaCheckingOnandOff ................................................... 337
Chapter 10 ManagingIndexes ................................................ 339
AboutIndexes ........................................................................ 339
AboutIndexTypes ................................................................. 340
AboutDefault,System,andStandardIndexes .......................................... 341
OverviewofDefaultIndexes ...................................................... 341
OverviewofSystemIndexes ...................................................... 342
OverviewofStandardIndexes..................................................... 343
OverviewoftheSearchingAlgorithm ................................................. 343
BalancingtheBenefitsofIndexing .................................................... 346
CreatingIndexes ...................................................................... 348
CreatingIndexesFromtheServerConsole ............................................. 348
CreatingIndexesFromtheCommandLine ............................................ 349
AddinganIndexEntry ........................................................... 350
Runningthedb2index.plScript .................................................... 352
CreatingBrowsingIndexesFromtheServerConsole .................................... 353
CreatingBrowsingIndexesfromtheCommandLine .................................... 354
AddingaBrowsingIndexEntry ................................................... 354
RunningthevlvindexScript....................................................... 356
DeletingIndexes ...................................................................... 357
DeletingIndexesFromtheServerConsole ............................................. 358
DeletingIndexesFromtheCommandLine............................................. 359
DeletinganIndexEntry .......................................................... 359
Runningthedb2index.plScript .................................................... 360
DeletingBrowsingIndexesFromtheServerConsole .................................... 361
DeletingBrowsingIndexesFromtheCommandLine.................................... 362
DeletingaBrowsingIndexEntry................................................... 362
RunningthevlvindexScript....................................................... 364
ManagingIndexes..................................................................... 365
BenefitsoftheAllIDsMechanism .................................................... 365
DrawbacksoftheAllIDsMechanism ................................................. 366
WhenAllIDsThresholdisTooLow................................................ 366
WhenAllIDsThresholdisTooHigh ............................................... 367
AllIDsThresholdTuningAdviceforSingle-EnterpriseDirectories ....................... 367

9
AllIDsThresholdTuningAdviceforServiceProvidersandExtranets ..................... 368
DefaultAllIDsThresholdValue...................................................... 369
SymptomsofanInappropriateAllIDsThresholdValue ................................. 369
ChangingtheAllIDsThresholdValue ................................................ 370
AttributeNameQuickReferenceTable................................................... 371
Chapter 11 ManagingSSL ....................................................373
IntroductiontoSSLintheDirectoryServer ............................................... 373
ObtainingandInstallingServerCertificates............................................... 375
ActivatingSSL........................................................................ 379
SettingSecurityPreferences ............................................................ 381
UsingCertificate-BasedAuthentication .................................................. 383
ConfiguringLDAPClientstoUseSSL ................................................... 384
Chapter 12 MonitoringServerandDatabaseActivity ..............................389
ViewingandConfiguringLogFiles...................................................... 389
AccessLog ........................................................................ 391
ErrorLog.......................................................................... 392
AuditLog ......................................................................... 394
ManualLogFileRotation .............................................................. 396
MonitoringServerActivity ............................................................. 396
ViewingtheServerPerformanceMonitor ........................................... 397
OverviewofServerPerformanceMonitorInformation................................ 397
GeneralInformation(Server) ...................................................... 397
ResourceSummary .............................................................. 398
CurrentResourceUsage .......................................................... 398
ConnectionStatus................................................................ 399
GlobalDatabaseCacheInformation ................................................ 400
MonitoringDatabaseActivity........................................................... 403
ViewingDatabasePerformanceMonitors ........................................... 403
OverviewofDatabasePerformanceMonitorInformation ............................. 403
GeneralInformation(Database).................................................... 404
SummaryInformationTable ...................................................... 404
DatabaseCacheInformationTable ................................................. 405
DatabaseFile-SpecificTable ....................................................... 406
MonitoringDatabaseLinkActivity ...................................................... 408
Chapter 13 MonitoringDirectoryServerUsingSNMP..............................411
AboutSNMP ......................................................................... 412
SNMPOverview ................................................................... 412
NMS-InitiatedCommunication .................................................... 413
ManagedDevice-InitiatedCommunication.......................................... 413

10 Netscape Directory Server Administrator’s Guide • January 2002
OverviewoftheDirectoryServerManagementInformationBase............................ 414
AbouttheOperationsTable.......................................................... 414
TheEntriesTable ................................................................... 416
SettingUpSNMP ..................................................................... 417
SettingUpSNMPonWindowsNT ................................................... 417
SettingUpSNMPonUNIX .......................................................... 417
ConfiguringtheAIXSNMPDaemon.................................................. 418
StartingandStoppingtheSNMPSubagentonUNIX....................................... 419
StartingandStoppingtheSNMPServiceonWindowsNT .................................. 419
ConfiguringSNMPfortheDirectoryServer .............................................. 420
Chapter 14 Tuning Directory Server Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421
TuningServerPerformance............................................................. 421
TuningDatabasePerformance .......................................................... 422
OptimizingSearchPerformance ...................................................... 423
TuningTransactionLogging ......................................................... 425
ChangingtheLocationoftheDatabaseTransactionLog ................................. 426
ChangingtheDatabaseCheckpointInterval............................................ 426
DisablingDurableTransactions ...................................................... 427
SpecifyingTransactionBatching...................................................... 428
MiscellaneousTuningTips ............................................................. 428
Avoid Creating Entries Under the cn=config Entry in the dse.ldif File . . . . . . . . . . . . . . . . . . . . . 429
Part 2 Plug-InsReference ...................................................431
Chapter 15 Administering Directory Server Plug-Ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
ServerPlug-inFunctionalityReference ................................................... 433
7-bitCheckPlug-In............................................................... 433
ACLPlug-In .................................................................... 434
ACLPreoperationPlug-In ........................................................ 435
BinarySyntaxPlug-In ............................................................ 435
BooleanSyntaxPlug-In ........................................................... 436
CaseExactStringSyntaxPlug-In................................................... 436
CaseIgnoreStringSyntaxPlug-In.................................................. 437
ChainingDatabasePlug-In........................................................ 437
ClassofServicePlug-In........................................................... 438
CountryStringSyntaxPlug-In..................................................... 438
DistinguishedNameSyntaxPlug-In................................................ 439
GeneralizedTimeSyntaxPlug-In .................................................. 439
IntegerSyntaxPlug-In............................................................ 440
InternationalizationPlug-In ....................................................... 440

11
ldbmDatabasePlug-In ........................................................... 441
LegacyReplicationPlug-In........................................................ 442
MultimasterReplicationPlug-In ................................................... 442
OctetStringSyntaxPlug-in........................................................ 443
CLEARPasswordStoragePlug-In ................................................. 443
CRYPTPasswordStoragePlug-In.................................................. 444
NS-MTA-MD5PasswordStoragePlug-In ........................................... 444
SHAPasswordStoragePlug-In .................................................... 445
SSHAPasswordStoragePlug-In ................................................... 445
PostalAddressStringSyntaxPlug-In ............................................... 446
PTAPlug-In..................................................................... 447
ReferentialIntegrityPostoperationPlug-In .......................................... 447
RetroChangeLogPlug-In ........................................................ 449
RolesPlug-In.................................................................... 449
TelephoneSyntaxPlug-In......................................................... 450
UIDUniquenessPlug-in .......................................................... 450
URIPlug-in ..................................................................... 452
EnablingandDisablingPlug-InsFromtheServerConsole.................................. 452
Chapter 16 UsingthePass-ThroughAuthenticationPlug-In ........................453
HowDirectoryServerUsesPTA ........................................................ 453
PTAPlug-InSyntax ................................................................... 455
ConfiguringthePTAPlug-In ........................................................... 457
PTAPlug-InSyntaxExamples .......................................................... 463
SpecifyingOneAuthenticatingDirectoryServerandOneSubtree ...................... 463
SpecifyingMultipleAuthenticatingDirectoryServers ................................ 463
SpecifyingOneAuthenticatingDirectoryServerandMultipleSubtrees ................. 464
UsingNon-DefaultParameterValues............................................... 464
SpecifyingDifferentOptionalParametersandSubtreesforDifferentAuthenticatingDirectoryServers
465
Chapter 17 Using the Attribute Uniqueness Plug-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
OverviewoftheAttributeUniquenessPlug-In ............................................ 467
OverviewoftheUIDUniquenessPlug-in ................................................ 469
AttributeUniquenessPlug-InSyntax .................................................... 469
CreatinganInstanceoftheAttributeUniquenessPlug-In................................... 472
ConfiguringAttributeUniquenessPlug-Ins............................................... 473
ConfiguringAttributeUniquenessPlug-InsFromtheDirectoryServerConsole............. 473
AttributeUniquenessPlug-InSyntaxExamples ........................................... 477
ReplicationandtheAttributeUniquenessPlug-In ......................................... 479
SimpleReplicationScenario.......................................................... 479
Multi-MasterReplicationScenario .................................................... 479

12 Netscape Directory Server Administrator’s Guide • January 2002
Chapter 18 ConfiguringIMPresenceInformation ................................ 481
OverviewofIMPresenceInformation ................................................... 481
SchemaForthePresencePlug-In ........................................................ 482
Performance-RelatedInformation ....................................................... 483
SettingResourceLimitsBasedonBindDN ............................................ 484
Troubleshooting ...................................................................... 484
Part 3 Appendixes .........................................................485
Appendix A LDAPDataInterchangeFormat..................................... 487
LDIFFileFormat...................................................................... 487
ContinuingLinesinLDIF............................................................ 489
RepresentingBinaryData............................................................ 489
SpecifyingDirectoryEntriesUsingLDIF ................................................. 491
DefiningDirectoriesUsingLDIF ........................................................ 495
LDIFFileExample ............................................................... 497
StoringInformationinMultipleLanguages ............................................... 498
Appendix B Finding Directory Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
FindingEntriesUsingtheServerConsole ................................................ 501
Usingldapsearch...................................................................... 502
UsingSpecialCharacters ............................................................ 502
ldapsearchCommand-LineFormat ................................................... 503
CommonlyUsedldapsearchoptions .................................................. 503
ldapsearchExamples................................................................ 505
ReturningAllEntries............................................................. 506
SpecifyingSearchFiltersontheCommandLine...................................... 506
SearchingtheRootDSEEntry ..................................................... 506
SearchingtheSchemaEntry ....................................................... 506
UsingLDAP_BASEDN ........................................................... 507
DisplayingSubsetsofAttributes ................................................... 507
SpecifyingSearchFiltersUsingaFile ............................................... 507
SpecifyingDNsthatContainCommasinSearchFilters ............................... 508
UsingClientAuthenticationWhenSearching........................................ 508
LDAPSearchFilters ................................................................... 508
SearchFilterSyntax................................................................. 509
UsingAttributesinSearchFilters ..................................................... 509
UsingOperatorsinSearchFilters ..................................................... 510
UsingCompoundSearchFilters ...................................................... 511
SearchFilterExamples .............................................................. 512
SearchinganInternationalizedDirectory ................................................. 513

13
MatchingRuleFilterSyntax.......................................................... 514
MatchingRuleFormats ........................................................... 514
Using Wildcards in Matching Rule Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516
SupportedSearchTypes............................................................. 516
InternationalSearchExamples ....................................................... 517
LessThanExample .............................................................. 517
LessThanorEqualtoExample .................................................... 518
EqualityExample ................................................................ 518
GreaterThanorEqualtoExample ................................................. 518
GreaterThanExample............................................................ 519
SubstringExample ............................................................... 519
Appendix C LDAPURLs ......................................................521
ComponentsofanLDAPURL .......................................................... 521
EscapingUnsafeCharacters ............................................................ 523
ExamplesofLDAPURLs............................................................... 524
Appendix D Internationalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
AboutLocales ........................................................................ 527
IdentifyingSupportedLocales .......................................................... 528
SupportedLanguageSubtypes.......................................................... 530
Glossary.....................................................................533
Index........................................................................549

14 Netscape Directory Server Administrator’s Guide • January 2002

15
List of Figures
Figure 1-1 ViewingtheBindDN ..................................................... 31
Figure3-1 ASampleDirectoryTreewithOneRootSuffix ................................ 74
Figure3-2 ASampleDirectoryTreewithTwoRootSuffixes ............................. 75
Figure 3-3 A Sample Directory Tree with a Root Suffix Off Limits to Search Operations . . . . . . 75
Figure3-4 ASampleDirectoryTreewithaSubSuffix ................................... 76
Figure4-1 SplittingaDatabaseContentsintoTwoDatabases ............................ 145
Figure5-1 SamplePointerCoS ...................................................... 173
Figure5-2 SampleIndirectCoS ...................................................... 174
Figure5-3 SampleClassicCoS ...................................................... 175
Figure 6-1 Using Inheritance With the userattr Keyword ............................. 215
Figure 6-2 Selecting an Object in the Navigation Tree to Set Access Control l . . . . . . . . . . . . . . . 223
Figure6-3 AccessControlEditorWindow ............................................ 224
Figure6-4 ExampledirectorytreeforMacroACIs ..................................... 249
Figure 8-1 Single-MasterReplication ................................................. 279
Figure 8-2 Multi-MasterReplication ................................................. 280
Figure 8-3 CascadingReplication .................................................... 282

16 Netscape Directory Server Administrator’s Guide • January 2002

17
List of Tables
Table2-1 EntryTemplatesandCorrespondingObjectClasses ........................... 43
Table 2-2 DescriptionofldapmodifyParametersUsedforAddingEntries ................ 54
Table 2-3 Description of ldapmodify Parameters Used for Modifying Entries . . . . . . . . . . . . . 55
Table 2-4 DescriptionofldapdeleteParametersUsedforDeletingEntries ................ 57
Table3-1 SuffixAttributes ......................................................... 79
Table3-2 ComponentsAllowedtoChain ............................................. 92
Table3-3 LDAPControlsandTheirOIDs ............................................ 96
Table3-4 DatabaseLinkConfigurationAttributes .................................... 103
Table3-5 DatabaseLinkConnectionManagementAttributes .......................... 112
Table3-6 DatabaseLinkProcessingErrorDetectionParameters ........................ 114
Table3-7 CascadingChainingConfigurationAttributes ............................... 123
Table4-1 ImportMethodComparison .............................................. 138
Table 5-1 Object Classses and Attributes for Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Table5-2 CoSDefinitionEntryObjectClasses ........................................ 178
Table5-3 CoSDefinitionEntryAttributes ........................................... 179
Table5-4 CoSDefinitions ......................................................... 180
Table6-1 LDIFTargetKeywords ................................................... 194
Table6-2 LDIFBindRuleKeywords ................................................ 205
Table6-3 MacrosinACIKeywords ................................................. 251
Table7-1 PasswordPolicyAttributes ............................................... 260
Table7-2 AccountLockoutPolicyAttributes ........................................ 264
Table 8-1 Replicate_NowVariables ................................................. 314
Table 8-2 AttributesofaRetroChangeLogEntry .................................... 319
Table 8-3 DirectoryServerConsole-StatusTab ...................................... 322
Table9-1 AttributesTabReference ................................................. 330
Table9-2 ObjectClassesTabReference ............................................. 334
Table10-1 Defaultindexes ......................................................... 341

18 Netscape Directory Server Administrator’s Guide • January 2002
Table10-2 Systemindexes .......................................................... 342
Table10-3 AttributeNameQuickReferenceTable ..................................... 371
Table12-1 ServerPerformanceMonitoring-ResourceSummaryTable ................... 398
Table 12-2 Server Performance Monitoring - Current Resource Usage Table . . . . . . . . . . . . . . . 399
Table12-3 ServerPerformanceMonitoring-ConnectionStatusTable .................... 399
Table 12-4 Server Performance Monitoring - Global Database Cache Table . . . . . . . . . . . . . . . . 400
Table12-5 DatabasePerformanceMonitoring-SummaryInformation ................... 404
Table 12-6 Database Performance Monitoring - Database Cache Information . . . . . . . . . . . . . . 405
Table12-7 DatabasePerformanceMonitoring-DatabaseFile-Specifictable ............... 406
Table12-8 DatabaseLinkMonitoringAttributes ...................................... 409
Table13-1 OperationsTableManagedObjectsandDescriptions ......................... 415
Table13-2 EntriesTableManagedObjectsandDescriptions ............................ 416
Table15-1 Detailsof7-BitCheckPlug-In ............................................. 433
Table15-2 DetailsofACIPlug-In ................................................... 434
Table15-3 DetailsofPreoperationPlug-In ............................................ 435
Table15-4 DetailsofBinarySyntaxPlug-In ........................................... 435
Table15-5 DetailsofBooleanSyntaxPlug-In ......................................... 436
Table15-6 DetailsofCaseExactStringSyntaxPlug-In ................................. 436
Table15-7 DetailsofCaseIgnoreStringSyntaxPlug-In ................................ 437
Table15-8 DetailsofCloningDatabasePlug-In ....................................... 437
Table15-9 DetailsofClassofServicePlug-In ......................................... 438
Table15-10 DetailsofCountryStringPlug-In .......................................... 438
Table15-11 DetailsofDistinguishedNameSyntaxPlug-In .............................. 439
Table15-12 DetailsofGeneralizedTimeSyntaxPlug-In ................................. 439
Table15-13 DetailsofIntegerSyntaxPlug-In .......................................... 440
Table15-14 DetailsofInternationalizationPlug-In ...................................... 440
Table15-15 DetailsofldbmDatabasePlug-In .......................................... 441
Table15-16 DetailsofLegacyReplicationPlug-In ...................................... 442
Table15-17 DetailsofMultimasterReplicationPlug-In .................................. 442
Table15-18 DetailsofOctetStringSyntaxPlug-In ...................................... 443
Table15-19 DetailsofCLEARPasswordStoragePlug-In ................................ 443
Table15-20 DetailsofCRYPTPasswordStoragePlug-In ................................ 444
Table15-21 DetailsofNS-MTA-MD5PasswordStoragePlug-In .......................... 444
Table15-22 DetailsofSHAPasswordStoragePlug-In ................................... 445
Table15-23 DetailsofSSHAPasswordStoragePlug-In ................................. 445
Table15-24 DetailsofPostalAddressStringSyntaxPlug-In ............................. 446
Table15-25 DetailsofPTAPlug-In ................................................... 447

List of Tables 19
Table15-26 DetailsofReferentialIntegrityPostoperationPlug-In ........................ 447
Table15-27 DetailsofRetroChangeLogPlug-In ....................................... 449
Table15-28 DetailsofRolesPlug-In .................................................. 449
Table15-29 DetailsofTelephoneSyntaxPlug-In ....................................... 450
Table15-30 DetailsofUIDUniquenessPlug-In ........................................ 450
Table15-31 DetailsofURIPlug-In .................................................... 452
Table16-1 PTAPlug-InParameters .................................................. 456
Table17-1 AttributeUniquenessPlug-InVariables .................................... 471
Table18-1 AttributesforSettingLimitsOnSearchOperations .......................... 484
TableA-1 LDIFFields ............................................................. 488
TableA-2 LDIFElementsinOrganizationEntries ..................................... 492
TableA-3 LDIFElementsinOrganizationalUnitEntries ............................... 493
TableA-4 LDIFElementsinPersonEntries .......................................... 495
TableB-1 SearchFilterOperators ................................................... 510
TableB-2 SearchFilterBooleanOperators ........................................... 512
TableB-3 SearchTypes,Operators,andSuffixes ...................................... 517
TableC-1 LDAPURLComponents ................................................. 521
TableD-1 SupportedLocales ....................................................... 529
TableD-2 SupportedLanguageSubtypes ............................................ 531

20 Netscape Directory Server Administrator’s Guide • January 2002