Netscape NETSCAPE DIRECTORY SERVER 6.02 -... Service manual

Administrator’s Guide
Netscape Directory Server
Version6.02
May 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
ListofFigures .................................................................15
ListofTables..................................................................17
Introduction ...................................................................21
DirectoryServerOverview .............................................................. 21
PrerequisiteReading ................................................................... 22
ConventionsUsedinThisBook .......................................................... 23
RelatedInformation .................................................................... 23
Part 1 AdministeringNetscapeDirectoryServer................................. 25
Chapter 1 IntroductiontoNetscapeDirectoryServer ...............................27
OverviewofDirectoryServerManagement................................................ 28
UsingtheDirectoryServerConsole....................................................... 28
CopyingEntryDNstotheClipboard................................................... 29
ConfiguringtheDirectoryManager ...................................................... 30
BindingtotheDirectoryFromNetscapeConsole ........................................... 30
StartingandStoppingtheDirectoryServer ................................................ 31
ConfiguringLDAPParameters........................................................... 33
StartingtheServerwithSSLEnabled ..................................................... 36
CloningaDirectoryServer .............................................................. 37
StartingtheServerinReferralMode ...................................................... 38
Chapter 2 CreatingDirectoryEntries.............................................41
ManagingEntriesFromtheDirectoryConsole ............................................. 41
ManagingEntriesFromtheCommandLine ............................................... 50
ProvidingInputFromtheCommandLine .............................................. 51
Adding and Modifying Entries Using ldapmodify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

4 Netscape Directory Server Administrator’s Guide • May 2002
LDIFUpdateStatements ................................................................ 58
ANoteonRenamingEntries ....................................................... 62
AddingAttributestoExistingEntriesUsingLDIF ..................................... 63
DeletinganEntryUsingLDIF......................................................... 67
MaintainingReferentialIntegrity......................................................... 68
HowReferentialIntegrityWorks ...................................................... 68
UsingReferentialIntegritywithReplication............................................. 69
ConfiguringtheSupplierServer .................................................... 70
FromtheDirectoryServerConsole .................................................. 70
FromtheDirectoryServerConsole .................................................. 71
FromtheDirectoryServerConsole .................................................. 72
FromtheDirectoryServerConsole .................................................. 72
Chapter 3 Configuring Directory Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
CreatingandMaintainingSuffixes........................................................ 75
CreatingSuffixes .................................................................... 76
MaintainingSuffixes ................................................................. 83
CreatingandMaintainingDatabases...................................................... 85
CreatingDatabases .................................................................. 86
MaintainingDirectoryDatabases ...................................................... 91
CreatingandMaintainingDatabaseLinks ................................................. 92
ConfiguringtheChainingPolicy ...................................................... 93
CreatingaNewDatabaseLink ........................................................ 98
ChainingUsingSSL................................................................. 109
MaintainingDatabaseLinks ......................................................... 110
DatabaseLinksandAccessControlEvaluation ......................................... 111
AdvancedFeature:TuningDatabaseLinkPerformance.................................. 112
DetectingErrorsDuringNormalProcessing ......................................... 115
ManagingThreadedOperations ................................................... 116
AdvancedFeature:ConfiguringCascadingChaining.................................... 117
OverviewofCascadingChaining .................................................. 117
SummaryofCascadingChainingConfigurationAttributes............................ 125
CascadingChainingConfigurationExample ........................................ 125
UsingReferrals ....................................................................... 132
SettingDefaultReferrals............................................................. 132
CreatingSmartReferrals ............................................................ 133
CreatingSuffixReferrals ............................................................ 136
Chapter 4 PopulatingDirectoryDatabases...................................... 139
ImportingData ....................................................................... 139
ImportingFromtheCommandLine .................................................. 143
ExportingData ....................................................................... 146

5
BackingUpandRestoringData ......................................................... 150
BackingUpAllDatabases ........................................................... 150
BackingUpthedse.ldifConfigurationFile ............................................. 153
RestoringAllDatabases ............................................................. 153
RestoringDatabasesthatIncludeReplicatedEntries..................................... 156
Restoringthedse.ldifConfigurationFile............................................... 157
EnablingandDisablingRead-OnlyMode ................................................ 157
Chapter 5 AdvancedEntryManagement.........................................159
UsingGroups......................................................................... 159
ManagingStaticGroups............................................................. 160
ManagingDynamicGroups.......................................................... 161
UsingRoles .......................................................................... 162
AboutRoles ....................................................................... 162
ManagingRolesUsingtheConsole ................................................... 163
ManagingRolesUsingtheCommandLine............................................. 168
Examples:ManagedRoleDefinition................................................ 169
Example:FilteredRoleDefinition .................................................. 170
Example:NestedRoleDefinition................................................... 171
UsingRolesSecurely................................................................ 171
AssigningClassofService.............................................................. 172
AboutCoS......................................................................... 173
AbouttheCoSDefinitionEntry.................................................... 173
AbouttheCoSTemplateEntry .................................................... 174
HowaPointerCoSWorks ........................................................ 175
HowanIndirectCoSWorks....................................................... 175
HowaClassicCoSWorks......................................................... 176
ManagingCoSUsingtheConsole..................................................... 177
ManagingCoSFromtheCommandLine .............................................. 180
ExampleofaPointerCoS ......................................................... 184
ExampleofanIndirectCoS........................................................ 185
ExampleofaClassicCoS ......................................................... 186
CreatingRole-BasedAttributes....................................................... 187
AccessControlandCoS ............................................................. 188
Chapter 6 Managing Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
AccessControlPrinciples .............................................................. 190
ACIStructure ...................................................................... 190
ACIPlacement ..................................................................... 191
ACIEvaluation..................................................................... 191
ACILimitations .................................................................... 192
DefaultACIs ......................................................................... 193

6 Netscape Directory Server Administrator’s Guide • May 2002
CreatingACIsManually ............................................................... 194
TheACISyntax .................................................................... 194
ExampleACI.................................................................... 195
TargetingAttributes.............................................................. 198
RightsRequiredforLDAPOperations .............................................. 204
PermissionsSyntax .............................................................. 205
BindRules ........................................................................... 206
BindRuleSyntax ................................................................... 206
AnonymousAccess(anyoneKeyword) ............................................. 208
GeneralAccess(allKeyword) ..................................................... 209
SelfAccess(selfKeyword) ........................................................ 209
ParentAccess(parentKeyword) ................................................... 209
LDAPURLs..................................................................... 209
Wildcards....................................................................... 210
Examples ....................................................................... 210
Examples ....................................................................... 212
Examples ....................................................................... 221
Examples ....................................................................... 223
CreatingACIsFromtheConsole ........................................................ 224
AccessControlUsageExamples......................................................... 229
GrantingAnonymousAccess...................................................... 231
GrantingWriteAccesstoPersonalEntries........................................... 233
RestrictingAccesstoKeyRoles .................................................... 236
GrantingaGroupFullAccesstoaSuffix ............................................ 238
GrantingRightstoAddandDeleteGroupEntries.................................... 239
GrantingConditionalAccesstoaGrouporRole ..................................... 241
DenyingAccess.................................................................. 243
SettingaTargetUsingFiltering .................................................... 246
AllowingUserstoAddorRemoveThemselvesFromaGroup ......................... 246
DefiningPermissionsforDNsThatContainaComma................................... 247
ProxiedAuthorizationACIExample .................................................. 248
ViewingtheACIsforanEntry .......................................................... 249
AdvancedAccessControl:UsingMacroACIs............................................. 249
MacroACIExample ................................................................ 250
MacroACISyntax .................................................................. 252
MacroMatchingfor($dn)......................................................... 253
MacroMatchingfor[$dn]......................................................... 254
Macro Matching for ($attr.attrName)................................................ 255
AccessControlandReplication ......................................................... 256
LoggingAccessControlInformation..................................................... 256
CompatibilitywithEarlierReleases...................................................... 257

7
Chapter 7 UserAccountManagement...........................................259
ManagingthePasswordPolicy.......................................................... 259
ConfiguringthePasswordPolicy ..................................................... 260
ConfiguringthePasswordPolicyUsingtheConsole.................................. 260
ConfiguringthePasswordPolicyUsingtheCommand-Line ........................... 262
SettingUserPasswords ............................................................. 264
ConfiguringtheAccountLockoutPolicy .............................................. 265
ConfiguringtheAccountLockoutPolicyUsingtheConsole ........................... 265
ConfiguringtheAccountLockoutPolicyUsingtheCommandLine .................... 266
ManagingthePasswordPolicyinaReplicatedEnvironment ............................. 267
InactivatingUsersandRoles............................................................ 268
InactivatingUserandRolesUsingtheConsole ......................................... 269
InactivatingUserandRolesUsingtheCommandLine .................................. 269
ActivatingUserandRolesUsingtheConsole .......................................... 270
ActivatingUserandRolesUsingtheCommandLine.................................... 271
SettingResourceLimitsBasedontheBindDN ............................................ 271
SettingResourceLimitsUsingtheConsole............................................. 272
SettingResourceLimitsUsingtheCommandLine ...................................... 272
Chapter 8 Managing Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
ReplicationOverview.................................................................. 276
Read-WriteReplica/Read-OnlyReplica ............................................... 276
Supplier/Consumer ................................................................ 276
ChangeLog........................................................................ 277
UnitofReplication.................................................................. 277
ReplicationIdentity................................................................. 278
ReplicationAgreement.............................................................. 279
Compatibility with Earlier Versions of Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
ReplicationScenarios .................................................................. 280
Single-MasterReplication ........................................................... 280
Multi-MasterReplication ............................................................ 281
CascadingReplication............................................................... 283
SummaryofStepsforComplexReplicationConfigurations................................. 285
DetailedReplicationTasks ............................................................. 286
CreatingtheSupplierBindDNEntry ................................................. 286
ConfiguringSupplierSettings........................................................ 287
ConfiguringaRead-WriteReplica .................................................... 288
ConfiguringaRead-OnlyReplica..................................................... 289
ConfiguringaHubSupplier ......................................................... 290
CreatingaReplicationAgreement .................................................... 291
ConfiguringSingle-MasterReplication................................................... 292
ConfiguringtheRead-OnlyReplicaontheConsumerServer ............................. 292
ConfiguringtheRead-WriteReplicaontheSupplierServer .............................. 294

8 Netscape Directory Server Administrator’s Guide • May 2002
InitializingtheReplicasforSingle-MasterReplication ................................... 296
ConfiguringMulti-MasterReplication ................................................... 296
ConfiguringtheRead-OnlyReplicasontheConsumerServers ........................... 296
ConfiguringtheRead-WriteReplicasontheSupplierServers ............................ 298
InitializingtheReplicasforMulti-MasterReplication.................................... 301
ConfiguringCascadingReplication...................................................... 301
ConfiguringtheRead-OnlyReplicaontheConsumerServer ............................. 302
ConfiguringtheRead-OnlyReplicaontheHubSupplier ................................ 304
ConfiguringtheRead-WriteReplicaontheSupplierServer .............................. 306
InitializingtheReplicasforCascadingReplication ...................................... 307
MakingaReplicaUpdatable............................................................ 307
DeletingtheChangeLog ............................................................... 308
RemovingtheChangeLog........................................................... 308
MovingtheChangeLogtoaNewLocation ............................................ 309
InitializingConsumers................................................................. 309
WhentoInitializeaConsumer ....................................................... 309
OnlineConsumerInitializationUsingtheConsole ...................................... 310
PerformingOnlineConsumerInitialization ......................................... 310
ManualConsumerInitializationUsingtheCommandLine............................... 311
ManualConsumerInitializationOverview .......................................... 311
ExportingaReplicatoLDIF ....................................................... 312
ImportingtheLDIFFiletotheConsumerServer ..................................... 312
ForcingReplicationUpdates............................................................ 312
ForcingReplicationUpdatesFromtheConsole ......................................... 313
ForcingReplicationUpdatesFromtheCommandLine .................................. 313
ReplicationOverSSL .................................................................. 316
ConfiguringReplicationOverSSLUsingtheReplicationWizard ......................... 317
ConfiguringReplicationOverSSLUsingtheConsole ................................... 317
ReplicationwithEarlierReleases ........................................................ 318
ConfiguringDirectoryServerasaConsumerofaLegacyDirectoryServer ................. 319
UsingtheRetroChangeLogPlug-In..................................................... 320
EnablingtheRetroChangeLogPlug-In ............................................... 321
TrimmingtheRetroChangeLog ..................................................... 322
SearchingandModifyingtheRetroChangeLog ........................................ 322
RetroChangeLogandtheAccessControlPolicy ....................................... 323
MonitoringReplicationStatus .......................................................... 323
SolvingCommonReplicationConflicts................................................... 324
SolvingNamingConflicts ........................................................... 325
SolvingOrphanEntryConflicts ...................................................... 327
Solving Potential Interoperability Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Chapter 9 ExtendingtheDirectorySchema ..................................... 331
OverviewofExtendingSchema ......................................................... 331

9
ManagingAttributes .................................................................. 332
ManagingObjectClasses............................................................... 335
TurningSchemaCheckingOnandOff ................................................... 339
Chapter 10 ManagingIndexes .................................................341
AboutIndexes ........................................................................ 341
AboutIndexTypes ................................................................. 342
AboutDefault,System,andStandardIndexes .......................................... 343
OverviewofDefaultIndexes ...................................................... 343
OverviewofSystemIndexes ...................................................... 344
OverviewofStandardIndexes..................................................... 345
OverviewoftheSearchingAlgorithm ................................................. 345
BalancingtheBenefitsofIndexing .................................................... 348
CreatingIndexes ...................................................................... 350
CreatingIndexesFromtheServerConsole ............................................. 350
CreatingIndexesFromtheCommandLine ............................................ 351
AddinganIndexEntry ........................................................... 352
Runningthedb2index.plScript .................................................... 354
CreatingBrowsingIndexesFromtheServerConsole .................................... 355
CreatingBrowsingIndexesfromtheCommandLine.................................... 356
AddingaBrowsingIndexEntry ................................................... 356
RunningthevlvindexScript....................................................... 358
DeletingIndexes ...................................................................... 359
DeletingIndexesFromtheServerConsole ............................................. 360
DeletingIndexesFromtheCommandLine ............................................ 361
DeletinganIndexEntry .......................................................... 361
Runningthedb2index.plScript .................................................... 362
DeletingBrowsingIndexesFromtheServerConsole .................................... 363
DeletingBrowsingIndexesFromtheCommandLine.................................... 364
DeletingaBrowsingIndexEntry................................................... 364
RunningthevlvindexScript....................................................... 366
ManagingIndexes..................................................................... 367
BenefitsoftheAllIDsMechanism .................................................... 367
DrawbacksoftheAllIDsMechanism ................................................. 367
WhenAllIDsThresholdisTooLow................................................ 368
WhenAllIDsThresholdisTooHigh ............................................... 368
AllIDsThresholdTuningAdviceforSingle-EnterpriseDirectories ....................... 368
AllIDsThresholdTuningAdviceforServiceProvidersandExtranets ..................... 370
DefaultAllIDsThresholdValue...................................................... 370
SymptomsofanInappropriateAllIDsThresholdValue ................................. 370
ChangingtheAllIDsThresholdValue ................................................ 371
AttributeNameQuickReferenceTable................................................... 372

10 Netscape Directory Server Administrator’s Guide • May 2002
Chapter 11 ManagingSSL.................................................... 375
IntroductiontoSSLintheDirectoryServer ............................................... 375
ObtainingandInstallingServerCertificates............................................... 377
ActivatingSSL........................................................................ 381
SettingSecurityPreferences ............................................................ 383
UsingCertificate-BasedAuthentication .................................................. 385
ConfiguringLDAPClientstoUseSSL ................................................... 386
Chapter 12 MonitoringServerandDatabaseActivity ............................. 391
ViewingandConfiguringLogFiles...................................................... 391
DefiningaLogFileRotationPolicy ................................................... 392
DefiningaLogFileDeletionPolicy ................................................... 392
AccessLog ........................................................................ 393
ViewingtheAccessLog .......................................................... 393
ConfiguringtheAccessLog ....................................................... 393
ErrorLog.......................................................................... 394
ViewingtheErrorLog............................................................ 394
ConfiguringtheErrorLog ........................................................ 395
AuditLog ......................................................................... 396
ViewingtheAuditLog ........................................................... 396
ConfiguringtheAuditLog ........................................................ 396
ManualLogFileRotation .............................................................. 397
MonitoringServerActivity ............................................................. 398
MonitoringYourServerFromtheDirectoryServerConsole.............................. 398
ViewingtheServerPerformanceMonitor ........................................... 398
OverviewofServerPerformanceMonitorInformation................................ 398
GeneralInformation(Server) ...................................................... 399
ResourceSummary .............................................................. 399
CurrentResourceUsage .......................................................... 400
ConnectionStatus................................................................ 401
GlobalDatabaseCacheInformation ................................................ 402
MonitoringYourServerFromtheCommandLine ...................................... 402
MonitoringDatabaseActivity........................................................... 404
MonitoringDatabaseActivityFromtheServerConsole.................................. 404
ViewingDatabasePerformanceMonitors ........................................... 405
OverviewofDatabasePerformanceMonitorInformation ............................. 405
GeneralInformation(Database).................................................... 405
SummaryInformationTable ...................................................... 405
DatabaseCacheInformationTable ................................................. 406
DatabaseFile-SpecificTable ....................................................... 407
MonitoringDatabasesFromtheCommandLine ........................................ 408
MonitoringDatabaseLinkActivity ...................................................... 410

11
Chapter 13 MonitoringDirectoryServerUsingSNMP..............................413
AboutSNMP ......................................................................... 414
SNMPOverview ................................................................... 414
NMS-InitiatedCommunication .................................................... 415
ManagedDevice-InitiatedCommunication.......................................... 415
OverviewoftheDirectoryServerManagementInformationBase............................ 416
AbouttheOperationsTable.......................................................... 416
TheEntriesTable ................................................................... 418
SettingUpSNMP ..................................................................... 419
SettingUpSNMPonWindowsNT ................................................... 419
SettingUpSNMPonUNIX .......................................................... 419
ConfiguringtheAIXSNMPDaemon.................................................. 420
StartingandStoppingtheSNMPSubagentonUNIX....................................... 421
StartingandStoppingtheSNMPServiceonWindowsNT .................................. 421
ConfiguringSNMPfortheDirectoryServer .............................................. 422
Chapter 14 Tuning Directory Server Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
TuningServerPerformance............................................................. 423
TuningDatabasePerformance .......................................................... 424
OptimizingSearchPerformance ...................................................... 425
TuningTransactionLogging ......................................................... 427
ChangingtheLocationoftheDatabaseTransactionLog ................................. 428
ChangingtheDatabaseCheckpointInterval............................................ 428
DisablingDurableTransactions ...................................................... 429
SpecifyingTransactionBatching...................................................... 430
MiscellaneousTuningTips ............................................................. 430
AvoidCreatingEntriesUnderthecn=configEntryinthedse.ldifFile ..................... 431
Part 2 Plug-InsReference .................................................. 433
Chapter 15 AdministeringDirectoryServerPlug-Ins...............................435
ServerPlug-inFunctionalityReference................................................... 435
7-bitCheckPlug-In ................................................................. 435
ACLPlug-In ....................................................................... 436
ACLPreoperationPlug-In ........................................................... 437
BinarySyntaxPlug-In............................................................... 437
BooleanSyntaxPlug-In.............................................................. 438
CaseExactStringSyntaxPlug-In ..................................................... 438
CaseIgnoreStringSyntaxPlug-In .................................................... 439
ChainingDatabasePlug-In .......................................................... 439
ClassofServicePlug-In ............................................................. 440

12 Netscape Directory Server Administrator’s Guide • May 2002
CountryStringSyntaxPlug-In ....................................................... 440
DistinguishedNameSyntaxPlug-In .................................................. 441
GeneralizedTimeSyntaxPlug-In ..................................................... 441
IntegerSyntaxPlug-In .............................................................. 442
InternationalizationPlug-In.......................................................... 442
ldbmDatabasePlug-In .............................................................. 443
LegacyReplicationPlug-In .......................................................... 444
MultimasterReplicationPlug-In...................................................... 444
OctetStringSyntaxPlug-in .......................................................... 445
CLEARPasswordStoragePlug-In .................................................... 445
CRYPTPasswordStoragePlug-In .................................................... 446
NS-MTA-MD5PasswordStoragePlug-In.............................................. 446
SHAPasswordStoragePlug-In....................................................... 447
SSHAPasswordStoragePlug-In...................................................... 448
PostalAddressStringSyntaxPlug-In.................................................. 448
PTAPlug-In ....................................................................... 449
ReferentialIntegrityPostoperationPlug-In............................................. 449
RetroChangeLogPlug-In ........................................................... 450
RolesPlug-In ...................................................................... 451
TelephoneSyntaxPlug-In ........................................................... 452
UIDUniquenessPlug-in............................................................. 452
URIPlug-in........................................................................ 454
EnablingandDisablingPlug-InsFromtheServerConsole.................................. 454
Chapter 16 Using the Pass-Through Authentication Plug-In . . . . . . . . . . . . . . . . . . . . . . . . 455
HowDirectoryServerUsesPTA ........................................................ 455
PTAPlug-InSyntax ................................................................... 457
ConfiguringthePTAPlug-In ........................................................... 459
PTAPlug-InSyntaxExamples .......................................................... 465
SpecifyingOneAuthenticatingDirectoryServerandOneSubtree ...................... 465
SpecifyingMultipleAuthenticatingDirectoryServers ................................ 465
SpecifyingOneAuthenticatingDirectoryServerandMultipleSubtrees ................. 466
UsingNon-DefaultParameterValues............................................... 466
SpecifyingDifferentOptionalParametersandSubtreesforDifferentAuthenticatingDirectoryServers
467
Chapter 17 Using the Attribute Uniqueness Plug-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
OverviewoftheAttributeUniquenessPlug-In ............................................ 469
OverviewoftheUIDUniquenessPlug-in ................................................ 471
AttributeUniquenessPlug-InSyntax .................................................... 471
CreatinganInstanceoftheAttributeUniquenessPlug-In................................... 474
ConfiguringAttributeUniquenessPlug-Ins............................................... 475

13
ConfiguringAttributeUniquenessPlug-InsFromtheDirectoryServerConsole............. 475
AttributeUniquenessPlug-InSyntaxExamples ........................................... 479
ReplicationandtheAttributeUniquenessPlug-In ......................................... 481
SimpleReplicationScenario.......................................................... 481
Multi-MasterReplicationScenario .................................................... 481
Chapter 18 ConfiguringIMPresenceInformation .................................483
OverviewofIMPresenceInformation ................................................... 483
SchemaForthePresencePlug-In ........................................................ 484
Performance-RelatedInformation ....................................................... 485
SettingResourceLimitsBasedonBindDN ............................................ 486
Troubleshooting ...................................................................... 486
Part 3 Appendixes......................................................... 487
Appendix A LDAPDataInterchangeFormat......................................489
LDIFFileFormat...................................................................... 489
ContinuingLinesinLDIF............................................................ 491
RepresentingBinaryData ........................................................... 491
SpecifyingDirectoryEntriesUsingLDIF ................................................. 493
DefiningDirectoriesUsingLDIF ........................................................ 497
LDIFFileExample ............................................................... 499
StoringInformationinMultipleLanguages ............................................... 500
Appendix B Finding Directory Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
FindingEntriesUsingtheServerConsole ................................................ 503
Usingldapsearch...................................................................... 504
UsingSpecialCharacters ............................................................ 504
ldapsearchCommand-LineFormat ................................................... 505
CommonlyUsedldapsearchOptions ................................................. 505
ldapsearchExamples................................................................ 507
ReturningAllEntries............................................................. 508
SpecifyingSearchFiltersontheCommandLine...................................... 508
SearchingtheRootDSEEntry ..................................................... 508
SearchingtheSchemaEntry ....................................................... 508
UsingLDAP_BASEDN ........................................................... 509
DisplayingSubsetsofAttributes ................................................... 509
SpecifyingSearchFiltersUsingaFile ............................................... 509
SpecifyingDNsthatContainCommasinSearchFilters ............................... 510
UsingClientAuthenticationWhenSearching........................................ 510
LDAPSearchFilters ................................................................... 510

14 Netscape Directory Server Administrator’s Guide • May 2002
SearchFilterSyntax................................................................. 511
UsingAttributesinSearchFilters ..................................................... 511
UsingOperatorsinSearchFilters ..................................................... 512
UsingCompoundSearchFilters ...................................................... 513
SearchFilterExamples .............................................................. 514
SearchinganInternationalizedDirectory ................................................. 515
MatchingRuleFilterSyntax.......................................................... 516
MatchingRuleFormats ........................................................... 516
Using Wildcards in Matching Rule Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 518
SupportedSearchTypes............................................................. 518
InternationalSearchExamples ....................................................... 519
LessThanExample .............................................................. 519
LessThanorEqualtoExample .................................................... 520
EqualityExample ................................................................ 520
GreaterThanorEqualtoExample ................................................. 520
GreaterThanExample............................................................ 521
SubstringExample ............................................................... 521
Appendix C LDAPURLs ..................................................... 523
ComponentsofanLDAPURL .......................................................... 523
EscapingUnsafeCharacters ............................................................ 525
ExamplesofLDAPURLs............................................................... 526
Appendix D Internationalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
AboutLocales ........................................................................ 529
IdentifyingSupportedLocales .......................................................... 530
SupportedLanguageSubtypes.......................................................... 532
Glossary .................................................................... 535
Index ....................................................................... 551

15
List of Figures
Figure 1-1 ViewingtheBindDN ..................................................... 31
Figure3-1 ASampleDirectoryTreewithOneRootSuffix ................................ 76
Figure3-2 ASampleDirectoryTreewithTwoRootSuffixes ............................. 77
Figure 3-3 A Sample Directory Tree with a Root Suffix Off Limits to Search Operations . . . . . . 77
Figure3-4 ASampleDirectoryTreewithaSubSuffix ................................... 78
Figure4-1 SplittingaDatabaseContentsintoTwoDatabases ............................ 147
Figure5-1 SamplePointerCoS ...................................................... 175
Figure5-2 SampleIndirectCoS ...................................................... 176
Figure5-3 SampleClassicCoS ...................................................... 177
Figure 6-1 Using Inheritance With the userattr Keyword ............................. 218
Figure 6-2 Selecting an Object in the Navigation Tree to Set Access Control l . . . . . . . . . . . . . . . 226
Figure6-3 AccessControlEditorWindow ............................................ 226
Figure6-4 ExampledirectorytreeforMacroACIs ..................................... 251
Figure 8-1 Single-MasterReplication ................................................. 281
Figure 8-2 Multi-MasterReplication ................................................. 282
Figure 8-3 CascadingReplication .................................................... 284

16 Netscape Directory Server Administrator’s Guide • May 2002

17
List of Tables
Table2-1 EntryTemplatesandCorrespondingObjectClasses ........................... 43
Table 2-2 DescriptionofldapmodifyParametersUsedforAddingEntries ................ 54
Table 2-3 Description of ldapmodify Parameters Used for Modifying Entries . . . . . . . . . . . . . 55
Table 2-4 DescriptionofldapdeleteParametersUsedforDeletingEntries ................ 57
Table3-1 SuffixAttributes ......................................................... 81
Table3-2 ComponentsAllowedtoChain ............................................. 94
Table3-3 LDAPControlsandTheirOIDs ............................................ 98
Table3-4 DatabaseLinkConfigurationAttributes .................................... 105
Table3-5 DatabaseLinkConnectionManagementAttributes .......................... 114
Table3-6 DatabaseLinkProcessingErrorDetectionParameters ........................ 116
Table3-7 CascadingChainingConfigurationAttributes ............................... 125
Table4-1 ImportMethodComparison .............................................. 140
Table 5-1 Object Classses and Attributes for Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Table5-2 CoSDefinitionEntryObjectClasses ........................................ 180
Table5-3 CoSDefinitionEntryAttributes ........................................... 181
Table5-4 CoSDefinitions ......................................................... 182
Table6-1 LDIFTargetKeywords ................................................... 196
Table6-2 LDIFBindRuleKeywords ................................................ 207
Table6-3 MacrosinACIKeywords ................................................. 253
Table7-1 PasswordPolicyAttributes ............................................... 262
Table7-2 AccountLockoutPolicyAttributes ........................................ 266
Table 8-1 Replicate_NowVariables ................................................. 315
Table 8-2 AttributesofaRetroChangeLogEntry .................................... 320
Table 8-3 DirectoryServerConsole-ReplicationStatus ............................... 324
Table9-1 AttributesTabReference ................................................. 332
Table9-2 ObjectClassesTabReference ............................................. 336
Table10-1 Defaultindexes ......................................................... 343

18 Netscape Directory Server Administrator’s Guide • May 2002
Table10-2 Systemindexes .......................................................... 344
Table10-3 AttributeNameQuickReferenceTable ..................................... 372
Table12-1 ServerPerformanceMonitoring-ResourceSummary ........................ 399
Table12-2 ServerPerformanceMonitoring-CurrentResourceUsage .................... 400
Table12-3 ServerPerformanceMonitoring-ConnectionStatus ......................... 401
Table12-4 ServerPerformanceMonitoring-GlobalDatabaseCache ..................... 402
Table12-5 DatabasePerformanceMonitoring-SummaryInformation ................... 405
Table 12-6 Database Performance Monitoring - Database Cache Information . . . . . . . . . . . . . . 407
Table12-7 DatabasePerformanceMonitoring-DatabaseFile-Specifictable ............... 407
Table12-8 DatabaseLinkMonitoringAttributes ...................................... 410
Table13-1 OperationsTableManagedObjectsandDescriptions ......................... 417
Table13-2 EntriesTableManagedObjectsandDescriptions ............................ 418
Table15-1 Detailsof7-BitCheckPlug-In ............................................. 435
Table15-2 DetailsofACIPlug-In ................................................... 436
Table15-3 DetailsofPreoperationPlug-In ............................................ 437
Table15-4 DetailsofBinarySyntaxPlug-In ........................................... 437
Table15-5 DetailsofBooleanSyntaxPlug-In ......................................... 438
Table15-6 DetailsofCaseExactStringSyntaxPlug-In ................................. 438
Table15-7 DetailsofCaseIgnoreStringSyntaxPlug-In ................................ 439
Table15-8 DetailsofCloningDatabasePlug-In ....................................... 439
Table15-9 DetailsofClassofServicePlug-In ......................................... 440
Table15-10 DetailsofCountryStringPlug-In .......................................... 440
Table15-11 DetailsofDistinguishedNameSyntaxPlug-In .............................. 441
Table15-12 DetailsofGeneralizedTimeSyntaxPlug-In ................................. 441
Table15-13 DetailsofIntegerSyntaxPlug-In .......................................... 442
Table15-14 DetailsofInternationalizationPlug-In ...................................... 442
Table15-15 DetailsofldbmDatabasePlug-In .......................................... 443
Table15-16 DetailsofLegacyReplicationPlug-In ...................................... 444
Table15-17 DetailsofMultimasterReplicationPlug-In .................................. 444
Table15-18 DetailsofOctetStringSyntaxPlug-In ...................................... 445
Table15-19 DetailsofCLEARPasswordStoragePlug-In ................................ 445
Table15-20 DetailsofCRYPTPasswordStoragePlug-In ................................ 446
Table15-21 DetailsofNS-MTA-MD5PasswordStoragePlug-In .......................... 446
Table15-22 DetailsofSHAPasswordStoragePlug-In ................................... 447
Table15-23 DetailsofSSHAPasswordStoragePlug-In ................................. 448
Table15-24 DetailsofPostalAddressStringSyntaxPlug-In ............................. 448
Table15-25 DetailsofPTAPlug-In ................................................... 449

List of Tables 19
Table15-26 DetailsofReferentialIntegrityPostoperationPlug-In ........................ 449
Table15-27 DetailsofRetroChangeLogPlug-In ....................................... 450
Table15-28 DetailsofRolesPlug-In .................................................. 451
Table15-29 DetailsofTelephoneSyntaxPlug-In ....................................... 452
Table15-30 DetailsofUIDUniquenessPlug-In ........................................ 452
Table15-31 DetailsofURIPlug-In .................................................... 454
Table16-1 PTAPlug-InParameters .................................................. 458
Table17-1 AttributeUniquenessPlug-InVariables .................................... 473
Table18-1 AttributesforSettingLimitsOnSearchOperations .......................... 486
TableA-1 LDIFFields ............................................................. 490
TableA-2 LDIFElementsinOrganizationEntries ..................................... 494
TableA-3 LDIFElementsinOrganizationalUnitEntries ............................... 495
TableA-4 LDIFElementsinPersonEntries .......................................... 497
TableB-1 SearchFilterOperators ................................................... 512
TableB-2 SearchFilterBooleanOperators ........................................... 514
TableB-3 SearchTypes,Operators,andSuffixes ...................................... 519
TableC-1 LDAPURLComponents ................................................. 523
TableD-1 SupportedLocales ....................................................... 531
TableD-2 SupportedLanguageSubtypes ............................................ 533

20 Netscape Directory Server Administrator’s Guide • May 2002