Netscape NETSCAPE DIRECTORY SERVER 6.1 -... Service manual

Administrator’s Guide
Netscape Directory Server
Version6.1
August 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
ListofFigures .................................................................19
ListofTables..................................................................21
Introduction ...................................................................25
DirectoryServerOverview .............................................................. 25
PrerequisiteReading ................................................................... 26
ConventionsUsedinThisBook .......................................................... 27
RelatedInformation .................................................................... 28
Part 1 AdministeringNetscapeDirectoryServer................................. 29
Chapter 1 IntroductiontoNetscapeDirectoryServer ...............................31
OverviewofDirectoryServerManagement................................................ 32
UsingtheDirectoryServerConsole....................................................... 32
StartingDirectoryServerConsole...................................................... 32
CopyingEntryDNstotheClipboard................................................... 33
ConfiguringtheDirectoryManager ...................................................... 34
BindingtotheDirectoryFromNetscapeConsole ........................................... 34
ChangingLoginIdentity ............................................................. 35
ViewingtheCurrentBindDNFromtheConsole ........................................ 35
StartingandStoppingtheDirectoryServer ................................................ 35
Starting/StoppingtheServerFromtheConsole......................................... 36
Starting/StoppingtheServerFromtheCommandLine.................................. 37
ConfiguringLDAPParameters........................................................... 37
ChangingDirectoryServerPortNumbers .............................................. 37
PlacingtheEntireDirectoryServerinRead-OnlyMode................................... 38
TrackingModificationstoDirectoryEntries............................................. 39
StartingtheServerwithSSLEnabled ..................................................... 40

4 Netscape Directory Server Administrator’s Guide • August 2002
CloningaDirectoryServer .............................................................. 41
CreatingaNewDirectoryServerInstance .............................................. 41
CloningtheDirectoryConfiguration ................................................... 42
StartingtheServerinReferralMode ...................................................... 42
UsingthereferCommand ............................................................ 43
Chapter 2 CreatingDirectoryEntries............................................ 45
ManagingEntriesFromtheDirectoryConsole ............................................. 45
CreatingaRootEntry ................................................................ 46
CreatingDirectoryEntries ............................................................ 47
CreatinganEntryUsingaPredefinedTemplate....................................... 48
CreatingOtherTypesofEntries..................................................... 48
ModifyingDirectoryEntries .......................................................... 49
DisplayingthePropertyEditor ..................................................... 50
AddinganObjectClasstoanEntry ................................................. 50
RemovinganObjectClass.......................................................... 50
AddinganAttributetoanEntry .................................................... 51
AddingAttributeValues........................................................... 51
RemovinganAttributeValue....................................................... 52
AddinganAttributeSubtype....................................................... 52
DeletingDirectoryEntries ............................................................ 54
ManagingEntriesFromtheCommandLine ............................................... 54
ProvidingInputFromtheCommandLine .............................................. 55
CreatingaRootEntryFromtheCommandLine ......................................... 56
Adding Entries Using LDIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Adding and Modifying Entries Using ldapmodify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
AddingEntriesUsingldapmodify .................................................. 58
ModifyingEntriesUsingldapmodify ................................................ 59
DeletingEntriesUsingldapdelete ..................................................... 60
UsingSpecialCharacters ............................................................. 61
LDIFUpdateStatements ................................................................ 62
Adding an Entry Using LDIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
RenaminganEntryUsingLDIF ....................................................... 65
ANoteonRenamingEntries ....................................................... 66
ModifyinganEntryUsingLDIF ....................................................... 67
AddingAttributestoExistingEntriesUsingLDIF ..................................... 67
ChanginganAttributeValueUsingLDIF ............................................ 69
DeletingAllValuesofanAttributeUsingLDIF ....................................... 70
DeletingaSpecificAttributeValueUsingLDIF ....................................... 70
DeletinganEntryUsingLDIF......................................................... 71
ModifyinganEntryinanInternationalizedDirectory .................................... 72
MaintainingReferentialIntegrity......................................................... 72
HowReferentialIntegrityWorks ...................................................... 72

5
UsingReferentialIntegritywithReplication............................................. 73
ConfiguringtheSupplierServer .................................................... 74
Enabling/DisablingReferentialIntegrity ............................................... 74
FromtheDirectoryServerConsole .................................................. 74
RecordingUpdatesintheChangeLog ................................................. 75
FromtheDirectoryServerConsole .................................................. 75
ModifyingtheUpdateInterval ........................................................ 75
FromtheDirectoryServerConsole .................................................. 76
ModifyingtheAttributeList .......................................................... 76
FromtheDirectoryServerConsole .................................................. 76
Chapter 3 Configuring Directory Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
CreatingandMaintainingSuffixes........................................................ 79
CreatingSuffixes .................................................................... 80
CreatingaNewRootSuffixUsingtheConsole........................................ 82
CreatingaNewSubSuffixUsingtheConsole ........................................ 83
CreatingRootandSubSuffixesFromtheCommandLine .............................. 84
MaintainingSuffixes ................................................................. 87
UsingReferralsinaSuffix.......................................................... 87
EnablingReferralsOnlyDuringUpdateOperations ................................... 88
DisablingaSuffix ................................................................. 88
DeletingaSuffix .................................................................. 89
CreatingandMaintainingDatabases...................................................... 89
CreatingDatabases .................................................................. 90
CreatingaNewDatabaseforanExistingSuffixUsingtheConsole ...................... 92
CreatingaNewDatabaseforaSingleSuffixFromtheCommandLine ................... 92
AddingMultipleDatabasesforaSingleSuffix ........................................ 93
AddingtheCustomDistributionFunctiontoaSuffix .................................. 94
MaintainingDirectoryDatabases ...................................................... 95
PlacingaDatabaseinRead-OnlyMode .............................................. 95
DeletingaDatabase ............................................................... 96
CreatingandMaintainingDatabaseLinks ................................................. 96
ConfiguringtheChainingPolicy ...................................................... 97
ChainingComponentOperations ................................................... 97
ChainingLDAPControls ......................................................... 101
CreatingaNewDatabaseLink ....................................................... 102
CreatingaNewDatabaseLinkUsingtheConsole .................................... 103
CreatingaDatabaseLinkFromtheCommandLine .................................. 104
ChainingUsingSSL................................................................. 113
MaintainingDatabaseLinks ......................................................... 114
UpdatingRemoteServerAuthenticationInformation................................. 114
DeletingDatabaseLinks .......................................................... 114
DatabaseLinksandAccessControlEvaluation ......................................... 115

6 Netscape Directory Server Administrator’s Guide • August 2002
AdvancedFeature:TuningDatabaseLinkPerformance.................................. 116
ManagingConnectionstotheRemoteServer ........................................ 117
DetectingErrorsDuringNormalProcessing ......................................... 119
ManagingThreadedOperations ................................................... 120
AdvancedFeature:ConfiguringCascadingChaining.................................... 121
OverviewofCascadingChaining .................................................. 121
ConfiguringCascadingChainingDefaultsUsingtheConsole.......................... 124
ConfiguringCascadingChainingUsingtheConsole.................................. 125
ConfiguringCascadingChainingFromtheCommandLine ........................... 126
SummaryofCascadingChainingConfigurationAttributes............................ 129
CascadingChainingConfigurationExample ........................................ 129
ConfiguringServerOne .......................................................... 130
ConfiguringServerTwo .......................................................... 132
ConfiguringServerThree ......................................................... 134
UsingReferrals ....................................................................... 136
SettingDefaultReferrals............................................................. 136
SettingaDefaultReferralUsingtheConsole......................................... 136
SettingaDefaultReferralFromtheCommandLine .................................. 137
CreatingSmartReferrals ............................................................ 137
CreatingSmartReferralsUsingtheDirectoryServerConsole .......................... 138
CreatingSmartReferralsFromtheCommandLine ................................... 139
CreatingSuffixReferrals ............................................................ 140
CreatingSuffixReferralsUsingtheConsole ......................................... 140
CreatingSuffixReferralsFromtheCommandLine ................................... 140
Chapter 4 PopulatingDirectoryDatabases...................................... 143
ImportingData ....................................................................... 143
PerforminganImportFromtheConsole............................................... 144
InitializingaDatabaseFromtheConsole .............................................. 146
ImportingFromtheCommandLine .................................................. 147
Importing Using the ldif2db Command-Line Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Importing Using the ldif2db.pl Perl Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Importing Using the ldif2ldap Command-Line Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
ExportingData ....................................................................... 150
ExportingDirectoryDatatoLDIFUsingtheConsole .................................... 151
ExportingaSingleDatabasetoLDIFUsingtheConsole ................................. 152
ExportingtoLDIFFromtheCommandLine ........................................... 153
BackingUpandRestoringData ......................................................... 154
BackingUpAllDatabases ........................................................... 154
BackingUpAllDatabasesFromtheServerConsole .................................. 155
BackingUpAllDatabasesFromtheCommandLine.................................. 155
BackingUpaSingleDatabase ........................................................ 156
BackingUpthedse.ldifConfigurationFile ............................................. 156

7
RestoringAllDatabases ............................................................. 157
RestoringAllDatabasesfromtheConsole........................................... 157
RestoringYourDatabaseFromtheCommandLine................................... 158
RestoringaSingleDatabase.......................................................... 159
RestoringDatabasesthatIncludeReplicatedEntries..................................... 159
Restoringthedse.ldifConfigurationFile............................................... 160
EnablingandDisablingRead-OnlyMode ................................................ 161
EnablingRead-OnlyMode........................................................... 161
DisablingRead-OnlyMode .......................................................... 161
Chapter 5 AdvancedEntryManagement.........................................163
UsingGroups......................................................................... 163
ManagingStaticGroups............................................................. 164
AddingaNewStaticGroup ....................................................... 164
ModifyingaStaticGroup ......................................................... 165
ManagingDynamicGroups.......................................................... 165
AddingaNewDynamicGroup.................................................... 165
ModifyingaDynamicGroup ...................................................... 165
UsingRoles .......................................................................... 166
AboutRoles ....................................................................... 166
ManagingRolesUsingtheConsole ................................................... 167
CreatingaManagedRole ......................................................... 168
CreatingaFilteredRole........................................................... 169
CreatingaNestedRole ........................................................... 169
Viewing and Editing an Entry’s Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
ModifyingaRoleEntry ........................................................... 171
MakingaRoleInactive ........................................................... 171
ReactivatingaRole............................................................... 171
DeletingaRole .................................................................. 172
ManagingRolesUsingtheCommandLine............................................. 172
Examples:ManagedRoleDefinition................................................ 173
Example:FilteredRoleDefinition .................................................. 174
Example:NestedRoleDefinition................................................... 175
UsingRolesSecurely................................................................ 175
AssigningClassofService.............................................................. 176
AboutCoS......................................................................... 177
AbouttheCoSDefinitionEntry.................................................... 177
AbouttheCoSTemplateEntry .................................................... 178
HowaPointerCoSWorks ........................................................ 179
HowanIndirectCoSWorks....................................................... 179
HowaClassicCoSWorks......................................................... 180
ManagingCoSUsingtheConsole..................................................... 181
CreatingaNewCoS.............................................................. 181

8 Netscape Directory Server Administrator’s Guide • August 2002
EditinganExistingCoS........................................................... 183
DeletingaCoS................................................................... 183
ManagingCoSFromtheCommandLine .............................................. 184
CreatingtheCoSDefinitionEntryFromtheCommandLine ........................... 184
CreatingtheCoSTemplateEntryFromtheCommandLine............................ 187
ExampleofaPointerCoS ......................................................... 188
ExampleofanIndirectCoS........................................................ 189
ExampleofaClassicCoS ......................................................... 190
CreatingRole-BasedAttributes....................................................... 191
AccessControlandCoS ............................................................. 192
Chapter 6 Managing Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
AccessControlPrinciples .............................................................. 194
ACIStructure ...................................................................... 194
ACIPlacement ..................................................................... 195
ACIEvaluation..................................................................... 195
ACILimitations .................................................................... 196
DefaultACIs ......................................................................... 197
CreatingACIsManually ............................................................... 198
TheACISyntax .................................................................... 198
ExampleACI.................................................................... 199
DefiningTargets ................................................................... 199
TargetingaDirectoryEntry ....................................................... 201
TargetingAttributes.............................................................. 203
TargetingBothanEntryandAttributes ............................................. 204
TargetingEntriesorAttributesUsingLDAPFilters................................... 204
TargetingAttributeValuesUsingLDAPFilters ...................................... 205
TargetingaSingleDirectoryEntry ................................................. 206
DefiningPermissions ............................................................... 207
AllowingorDenyingAccess ...................................................... 207
AssigningRights................................................................. 207
RightsRequiredforLDAPOperations .............................................. 209
PermissionsSyntax .............................................................. 210
BindRules ........................................................................... 210
BindRuleSyntax ................................................................... 211
DefiningUserAccess-userdnKeyword............................................... 213
AnonymousAccess(anyoneKeyword) ............................................. 213
GeneralAccess(allKeyword) ..................................................... 213
SelfAccess(selfKeyword) ........................................................ 214
ParentAccess(parentKeyword) ................................................... 214
LDAPURLs..................................................................... 214
Wildcards....................................................................... 214
Examples ....................................................................... 214

9
DefiningGroupAccess-groupdnKeyword ........................................... 216
Examples ....................................................................... 217
DefiningRoleAccess-rolednKeyword ............................................... 217
DefiningAccessBasedonValueMatching ............................................. 218
UsingtheuserattrKeyword ....................................................... 218
UsingtheuserattrKeywordWithInheritance........................................ 221
GrantingAddPermissionUsingtheuserattrKeyword................................ 223
DefiningAccessFromaSpecificIPAddress............................................ 224
DefiningAccessfromaSpecificDomain............................................... 224
DefiningAccessataSpecificTimeofDayorDayofWeek ............................... 225
Examples ....................................................................... 226
DefiningAccessBasedonAuthenticationMethod ...................................... 227
Examples ....................................................................... 227
UsingBooleanBindRules ........................................................... 228
CreatingACIsFromtheConsole ........................................................ 229
DisplayingtheAccessControlEditor ................................................. 230
ViewingCurrentACIs .............................................................. 231
CreatingaNewACI ................................................................ 232
EditinganACI ..................................................................... 233
DeletinganACI .................................................................... 234
AccessControlUsageExamples......................................................... 234
GrantingAnonymousAccess...................................................... 235
GrantingWriteAccesstoPersonalEntries........................................... 237
RestrictingAccesstoKeyRoles .................................................... 241
GrantingaGroupFullAccesstoaSuffix ............................................ 242
GrantingRightstoAddandDeleteGroupEntries.................................... 243
GrantingConditionalAccesstoaGrouporRole ..................................... 246
DenyingAccess.................................................................. 248
SettingaTargetUsingFiltering .................................................... 251
AllowingUserstoAddorRemoveThemselvesFromaGroup ......................... 251
DefiningPermissionsforDNsThatContainaComma................................... 252
ProxiedAuthorizationACIExample .................................................. 253
ViewingtheACIsforanEntry .......................................................... 254
AdvancedAccessControl:UsingMacroACIs............................................. 254
MacroACIExample ................................................................ 255
MacroACISyntax .................................................................. 257
MacroMatchingfor($dn)......................................................... 258
MacroMatchingfor[$dn]......................................................... 259
Macro Matching for ($attr.attrName)................................................ 260
AccessControlandReplication ......................................................... 261
LoggingAccessControlInformation..................................................... 261
CompatibilitywithEarlierReleases...................................................... 262

10 Netscape Directory Server Administrator’s Guide • August 2002
Chapter 7 UserAccountManagement.......................................... 263
ManagingthePasswordPolicy.......................................................... 263
ConfiguringthePasswordPolicy ..................................................... 264
ConfiguringthePasswordPolicyUsingtheConsole.................................. 264
ConfiguringthePasswordPolicyUsingtheCommand-Line ........................... 266
SettingUserPasswords ............................................................. 268
ConfiguringtheAccountLockoutPolicy .............................................. 269
ConfiguringtheAccountLockoutPolicyUsingtheConsole ........................... 269
ConfiguringtheAccountLockoutPolicyUsingtheCommandLine .................... 270
ManagingthePasswordPolicyinaReplicatedEnvironment ............................. 271
InactivatingUsersandRoles............................................................ 272
InactivatingUserandRolesUsingtheConsole ......................................... 273
InactivatingUserandRolesUsingtheCommandLine .................................. 273
ActivatingUserandRolesUsingtheConsole .......................................... 274
ActivatingUserandRolesUsingtheCommandLine.................................... 275
SettingResourceLimitsBasedontheBindDN ............................................ 275
SettingResourceLimitsUsingtheConsole............................................. 276
SettingResourceLimitsUsingtheCommandLine ...................................... 276
Chapter 8 Managing Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
ReplicationOverview.................................................................. 280
Read-WriteReplica/Read-OnlyReplica ............................................... 280
Supplier/Consumer ................................................................ 280
ChangeLog........................................................................ 281
UnitofReplication.................................................................. 281
ReplicationIdentity................................................................. 282
ReplicationAgreement .............................................................. 283
Compatibility with Earlier Versions of Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
ReplicationScenarios .................................................................. 284
Single-MasterReplication............................................................ 284
Multi-MasterReplication ............................................................ 285
CascadingReplication............................................................... 287
SummaryofStepsforComplexReplicationConfigurations................................. 289
DetailedReplicationTasks ............................................................. 290
CreatingtheSupplierBindDNEntry ................................................. 290
ConfiguringSupplierSettings ........................................................ 291
ConfiguringaRead-WriteReplica .................................................... 292
ConfiguringaRead-OnlyReplica..................................................... 293
ConfiguringaHubSupplier ......................................................... 294
CreatingaReplicationAgreement .................................................... 295
ConfiguringSingle-MasterReplication................................................... 296
ConfiguringtheRead-OnlyReplicaontheConsumerServer ............................. 296
ConfiguringtheRead-WriteReplicaontheSupplierServer .............................. 298

11
InitializingtheReplicasforSingle-MasterReplication ................................... 300
ConfiguringMulti-MasterReplication ................................................... 300
ConfiguringtheRead-OnlyReplicasontheConsumerServers ........................... 300
ConfiguringtheRead-WriteReplicasontheSupplierServers ............................ 302
InitializingtheReplicasforMulti-MasterReplication.................................... 305
ConfiguringCascadingReplication...................................................... 305
ConfiguringtheRead-OnlyReplicaontheConsumerServer ............................. 306
ConfiguringtheRead-OnlyReplicaontheHubSupplier ................................ 308
ConfiguringtheRead-WriteReplicaontheSupplierServer .............................. 310
InitializingtheReplicasforCascadingReplication ...................................... 311
MakingaReplicaUpdatable............................................................ 311
DeletingtheChangeLog ............................................................... 312
RemovingtheChangeLog........................................................... 312
MovingtheChangeLogtoaNewLocation ............................................ 313
InitializingConsumers................................................................. 313
WhentoInitializeaConsumer ....................................................... 313
OnlineConsumerInitializationUsingtheConsole ...................................... 314
PerformingOnlineConsumerInitialization ......................................... 314
ManualConsumerInitializationUsingtheCommandLine............................... 315
ManualConsumerInitializationOverview .......................................... 315
ExportingaReplicatoLDIF ....................................................... 316
ImportingtheLDIFFiletotheConsumerServer ..................................... 316
ForcingReplicationUpdates............................................................ 316
ForcingReplicationUpdatesFromtheConsole ......................................... 317
ForcingReplicationUpdatesFromtheCommandLine .................................. 317
ReplicationOverSSL .................................................................. 320
ConfiguringReplicationOverSSLUsingtheReplicationWizard ......................... 321
ConfiguringReplicationOverSSLUsingtheConsole ................................... 321
ReplicationwithEarlierReleases ........................................................ 322
ConfiguringDirectoryServerasaConsumerofaLegacyDirectoryServer ................. 323
UsingtheRetroChangeLogPlug-In..................................................... 324
EnablingtheRetroChangeLogPlug-In ............................................... 325
TrimmingtheRetroChangeLog ..................................................... 326
SearchingandModifyingtheRetroChangeLog ........................................ 326
RetroChangeLogandtheAccessControlPolicy ....................................... 327
MonitoringReplicationStatus .......................................................... 327
MonitoringReplicationStatusFromtheDirectoryServerConsole ........................ 327
MonitoringReplicationStatusFromAdministrationExpress ............................. 328
SolvingCommonReplicationConflicts................................................... 330
SolvingNamingConflicts ........................................................... 331
RenaminganEntrywithaMulti-ValuedNamingAttribute ........................... 331
RenaminganEntrywithaSingle-ValuedNamingAttribute ........................... 332
SolvingOrphanEntryConflicts ...................................................... 333

12 Netscape Directory Server Administrator’s Guide • August 2002
Solving Potential Interoperability Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
TroubleshootingReplication-RelatedProblems............................................ 335
Chapter 9 ExtendingtheDirectorySchema ..................................... 337
OverviewofExtendingSchema ......................................................... 337
ManagingAttributes .................................................................. 338
ViewingAttributes ................................................................. 338
CreatingAttributes ................................................................. 339
EditingAttributes .................................................................. 340
DeletingAttributes ................................................................. 341
ManagingObjectClasses............................................................... 341
ViewingObjectClasses.............................................................. 342
CreatingObjectClasses ............................................................. 343
EditingObjectClasses............................................................... 344
DeletingObjectClasses.............................................................. 345
TurningSchemaCheckingOnandOff ................................................... 345
Chapter 10 ManagingIndexes ................................................ 347
AboutIndexes ........................................................................ 347
AboutIndexTypes ................................................................. 348
AboutDefault,System,andStandardIndexes .......................................... 349
OverviewofDefaultIndexes ...................................................... 349
OverviewofSystemIndexes ...................................................... 350
OverviewofStandardIndexes..................................................... 351
OverviewoftheSearchingAlgorithm ................................................. 351
BalancingtheBenefitsofIndexing .................................................... 354
CreatingIndexes ...................................................................... 356
CreatingIndexesFromtheServerConsole ............................................. 356
CreatingIndexesFromtheCommandLine ............................................ 357
AddinganIndexEntry ........................................................... 358
Runningthedb2index.plScript .................................................... 360
CreatingBrowsingIndexesFromtheServerConsole .................................... 361
CreatingBrowsingIndexesfromtheCommandLine .................................... 362
AddingaBrowsingIndexEntry ................................................... 363
RunningthevlvindexScript....................................................... 365
SettingAccessControlforVLVInformation ......................................... 366
DeletingIndexes ...................................................................... 366
DeletingIndexesFromtheServerConsole ............................................. 367
DeletingIndexesFromtheCommandLine............................................. 368
DeletinganIndexEntry .......................................................... 368
Runningthedb2index.plScript .................................................... 369
DeletingBrowsingIndexesFromtheServerConsole .................................... 370

13
DeletingBrowsingIndexesFromtheCommandLine.................................... 371
DeletingaBrowsingIndexEntry................................................... 371
RunningthevlvindexScript....................................................... 373
ManagingIndexes..................................................................... 374
BenefitsoftheAllIDsMechanism .................................................... 374
DrawbacksoftheAllIDsMechanism ................................................. 375
WhenAllIDsThresholdisTooLow................................................ 375
WhenAllIDsThresholdisTooHigh ............................................... 375
AllIDsThresholdTuningAdviceforSingle-EnterpriseDirectories ....................... 376
AllIDsThresholdTuningAdviceforServiceProvidersandExtranets ..................... 377
DefaultAllIDsThresholdValue...................................................... 377
SymptomsofanInappropriateAllIDsThresholdValue ................................. 378
ChangingtheAllIDsThresholdValue ................................................ 379
AttributeNameQuickReferenceTable................................................... 380
Chapter 11 ManagingSSL ....................................................381
IntroductiontoSSLintheDirectoryServer ............................................... 381
Enabling SSL: Summary of Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
ObtainingandInstallingServerCertificates............................................... 383
Step1:GenerateaCertificateRequest ................................................. 383
Step2:SendtheCertificateRequest ................................................... 384
Step3:InstalltheCertificate.......................................................... 385
Step4:TrusttheCertificateAuthority ................................................. 386
Step5:ConfirmThatYourNewCertificatesAreInstalled................................ 387
ActivatingSSL........................................................................ 387
SettingSecurityPreferences ............................................................ 389
UsingCertificate-BasedAuthentication .................................................. 391
SettingupCertificate-BasedAuthentication ............................................ 391
Allowing/RequiringClientAuthentication ............................................ 392
ConfiguringLDAPClientstoUseSSL ................................................... 393
Chapter 12 MonitoringServerandDatabaseActivity ..............................397
ViewingandConfiguringLogFiles...................................................... 397
DefiningaLogFileRotationPolicy ................................................... 398
DefiningaLogFileDeletionPolicy ................................................... 398
AccessLog ........................................................................ 399
ViewingtheAccessLog .......................................................... 399
ConfiguringtheAccessLog ....................................................... 400
ErrorLog.......................................................................... 401
ViewingtheErrorLog............................................................ 401
ConfiguringtheErrorLog ........................................................ 401
AuditLog ......................................................................... 402

14 Netscape Directory Server Administrator’s Guide • August 2002
ViewingtheAuditLog ........................................................... 402
ConfiguringtheAuditLog ........................................................ 403
ManualLogFileRotation .............................................................. 404
MonitoringServerActivity ............................................................. 404
MonitoringYourServerFromtheDirectoryServerConsole.............................. 404
ViewingtheServerPerformanceMonitor ........................................... 405
OverviewofServerPerformanceMonitorInformation................................ 405
GeneralInformation(Server) ...................................................... 405
ResourceSummary .............................................................. 406
CurrentResourceUsage .......................................................... 406
ConnectionStatus................................................................ 407
GlobalDatabaseCacheInformation ................................................ 408
MonitoringYourServerFromtheCommandLine ...................................... 409
MonitoringDatabaseActivity........................................................... 411
MonitoringDatabaseActivityFromtheServerConsole.................................. 411
ViewingDatabasePerformanceMonitors ........................................... 411
OverviewofDatabasePerformanceMonitorInformation ............................. 411
GeneralInformation(Database).................................................... 412
SummaryInformationTable ...................................................... 412
DatabaseCacheInformationTable ................................................. 413
DatabaseFile-SpecificTable ....................................................... 414
MonitoringDatabasesFromtheCommandLine ........................................ 414
MonitoringDatabaseLinkActivity ...................................................... 416
Chapter 13 MonitoringDirectoryServerUsingSNMP ............................. 419
AboutSNMP ......................................................................... 420
SNMPOverview ................................................................... 420
NMS-InitiatedCommunication .................................................... 421
ManagedDevice-InitiatedCommunication.......................................... 421
OverviewoftheDirectoryServerManagementInformationBase............................ 422
OperationsTable ................................................................... 422
EntriesTable....................................................................... 424
InteractionTable ................................................................... 425
SettingUpSNMP ..................................................................... 426
SettingUpSNMPonWindowsNT ................................................... 426
SettingUpSNMPonUNIX .......................................................... 427
ConfiguringtheAIXSNMPDaemon.................................................. 427
StartingandStoppingtheSNMPSubagentonUNIX....................................... 428
StartingandStoppingtheSNMPServiceonWindowsNT .................................. 428
ConfiguringSNMPfortheDirectoryServer .............................................. 429

15
Chapter 14 Tuning Directory Server Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
TuningServerPerformance............................................................. 431
TuningDatabasePerformance .......................................................... 432
OptimizingSearchPerformance ...................................................... 433
TuningTransactionLogging ......................................................... 435
ChangingtheLocationoftheDatabaseTransactionLog ................................. 436
ChangingtheDatabaseCheckpointInterval............................................ 436
DisablingDurableTransactions ...................................................... 437
SpecifyingTransactionBatching...................................................... 438
MiscellaneousTuningTips ............................................................. 438
AvoidCreatingEntriesUnderthecn=configEntryinthedse.ldifFile ..................... 439
Part 2 Plug-InsReference .................................................. 441
Chapter 15 AdministeringDirectoryServerPlug-Ins...............................443
ServerPlug-inFunctionalityReference................................................... 443
7-bitCheckPlug-In ................................................................. 443
ACLPlug-In ....................................................................... 444
ACLPreoperationPlug-In ........................................................... 445
BinarySyntaxPlug-In............................................................... 445
BooleanSyntaxPlug-In.............................................................. 446
CaseExactStringSyntaxPlug-In ..................................................... 446
CaseIgnoreStringSyntaxPlug-In .................................................... 447
ChainingDatabasePlug-In .......................................................... 447
ClassofServicePlug-In ............................................................. 448
CountryStringSyntaxPlug-In ....................................................... 448
DistinguishedNameSyntaxPlug-In .................................................. 449
GeneralizedTimeSyntaxPlug-In ..................................................... 449
IntegerSyntaxPlug-In .............................................................. 450
InternationalizationPlug-In.......................................................... 450
ldbmDatabasePlug-In .............................................................. 451
LegacyReplicationPlug-In .......................................................... 452
MultimasterReplicationPlug-In...................................................... 452
OctetStringSyntaxPlug-in .......................................................... 453
CLEARPasswordStoragePlug-In .................................................... 453
CRYPTPasswordStoragePlug-In .................................................... 454
NS-MTA-MD5PasswordStoragePlug-In.............................................. 454
SHAPasswordStoragePlug-In....................................................... 455
SSHAPasswordStoragePlug-In...................................................... 456
PostalAddressStringSyntaxPlug-In ................................................. 456
PresencePlug-In ................................................................... 457

16 Netscape Directory Server Administrator’s Guide • August 2002
PTAPlug-In ....................................................................... 457
ReferentialIntegrityPostoperationPlug-In............................................. 458
RetroChangeLogPlug-In ........................................................... 459
RolesPlug-In ...................................................................... 459
SpaceInsensitiveStringSyntaxPlug-in................................................ 460
StateChangePlug-in................................................................ 461
TelephoneSyntaxPlug-In ........................................................... 462
UIDUniquenessPlug-in............................................................. 462
URIPlug-in........................................................................ 464
EnablingandDisablingPlug-InsFromtheServerConsole.................................. 464
Chapter 16 Using the Pass-Through Authentication Plug-In . . . . . . . . . . . . . . . . . . . . . . . . 465
HowDirectoryServerUsesPTA ........................................................ 465
PTAPlug-InSyntax ................................................................... 467
ConfiguringthePTAPlug-In ........................................................... 469
TurningthePlug-inOnorOff........................................................ 470
ConfiguringtheServerstoUseaSecureConnection .................................... 471
SpecifyingtheAuthenticatingDirectoryServer......................................... 472
SpecifyingthePass-ThroughSubtree.................................................. 473
ConfiguringtheOptionalParameters ................................................. 473
PTAPlug-InSyntaxExamples .......................................................... 475
SpecifyingOneAuthenticatingDirectoryServerandOneSubtree ...................... 475
SpecifyingMultipleAuthenticatingDirectoryServers ................................ 475
SpecifyingOneAuthenticatingDirectoryServerandMultipleSubtrees ................. 476
UsingNon-DefaultParameterValues............................................... 476
SpecifyingDifferentOptionalParametersandSubtreesforDifferentAuthenticatingDirectoryServers
477
Chapter 17 Using the Attribute Uniqueness Plug-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479
OverviewoftheAttributeUniquenessPlug-In ............................................ 479
OverviewoftheUIDUniquenessPlug-in ................................................ 481
AttributeUniquenessPlug-InSyntax .................................................... 481
CreatinganInstanceoftheAttributeUniquenessPlug-In................................... 484
ConfiguringAttributeUniquenessPlug-Ins............................................... 485
ViewingPlug-InConfigurationInformation............................................ 485
Configuring Attribute Uniqueness Plug-Ins From the Directory Server Console . . . . . . . . . . . . . 485
ConfiguringAttributeUniquenessPlug-InsfromtheCommandLine ..................... 486
TurningthePlug-inOnorOff ..................................................... 487
SpecifyingaSuffixorSubtree...................................................... 487
UsingthemarkerObjectClassandrequiredObjectClassKeywords ...................... 488
AttributeUniquenessPlug-InSyntaxExamples ........................................... 489
ReplicationandtheAttributeUniquenessPlug-In ......................................... 491

17
SimpleReplicationScenario.......................................................... 491
Multi-MasterReplicationScenario .................................................... 491
Chapter 18 ConfiguringIMPresenceInformation .................................493
OverviewofIMPresenceInformation ................................................... 493
SchemaForthePresencePlug-In ........................................................ 494
Performance-RelatedInformation ....................................................... 495
SettingResourceLimitsBasedonBindDN ............................................ 496
Troubleshooting ...................................................................... 496
Part 3 Appendixes......................................................... 497
Appendix A LDAPDataInterchangeFormat......................................499
LDIFFileFormat...................................................................... 499
ContinuingLinesinLDIF............................................................ 501
RepresentingBinaryData ........................................................... 501
SpecifyingDirectoryEntriesUsingLDIF ................................................. 503
SpecifyingOrganizationEntries ...................................................... 503
SpecifyingOrganizationalUnitEntries ................................................ 505
SpecifyingOrganizationalPersonEntries .............................................. 506
DefiningDirectoriesUsingLDIF ........................................................ 507
LDIFFileExample ............................................................... 509
StoringInformationinMultipleLanguages ............................................... 510
Appendix B Finding Directory Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
FindingEntriesUsingtheServerConsole ................................................ 513
Usingldapsearch...................................................................... 514
UsingSpecialCharacters ............................................................ 514
ldapsearchCommand-LineFormat ................................................... 515
CommonlyUsedldapsearchOptions ................................................. 515
ldapsearchExamples................................................................ 518
ReturningAllEntries............................................................. 518
SpecifyingSearchFiltersontheCommandLine...................................... 518
SearchingtheRootDSEEntry ..................................................... 518
SearchingtheSchemaEntry ....................................................... 519
UsingLDAP_BASEDN ........................................................... 519
DisplayingSubsetsofAttributes ................................................... 519
SpecifyingSearchFiltersUsingaFile ............................................... 520
SpecifyingDNsthatContainCommasinSearchFilters ............................... 520
UsingClientAuthenticationWhenSearching........................................ 520
LDAPSearchFilters ................................................................... 521

18 Netscape Directory Server Administrator’s Guide • August 2002
SearchFilterSyntax................................................................. 521
UsingAttributesinSearchFilters ..................................................... 522
UsingOperatorsinSearchFilters ..................................................... 522
UsingCompoundSearchFilters ...................................................... 523
SearchFilterExamples .............................................................. 524
SearchinganInternationalizedDirectory ................................................. 525
MatchingRuleFilterSyntax.......................................................... 526
MatchingRuleFormats ........................................................... 526
Using Wildcards in Matching Rule Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528
SupportedSearchTypes............................................................. 528
InternationalSearchExamples ....................................................... 529
LessThanExample .............................................................. 529
LessThanorEqualtoExample .................................................... 530
EqualityExample ................................................................ 530
GreaterThanorEqualtoExample ................................................. 530
GreaterThanExample............................................................ 531
SubstringExample ............................................................... 531
Appendix C LDAPURLs ..................................................... 533
ComponentsofanLDAPURL .......................................................... 533
EscapingUnsafeCharacters ............................................................ 535
ExamplesofLDAPURLs............................................................... 536
Appendix D Internationalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
AboutLocales ........................................................................ 539
IdentifyingSupportedLocales .......................................................... 540
SupportedLanguageSubtypes.......................................................... 542
Glossary .................................................................... 545
Index ....................................................................... 561

19
List of Figures
Figure 1-1 ViewingtheBindDN ..................................................... 35
Figure3-1 ASampleDirectoryTreewithOneRootSuffix ................................ 80
Figure3-2 ASampleDirectoryTreewithTwoRootSuffixes ............................. 81
Figure 3-3 A Sample Directory Tree with a Root Suffix Off Limits to Search Operations . . . . . . 81
Figure3-4 ASampleDirectoryTreewithaSubSuffix ................................... 82
Figure4-1 SplittingaDatabaseContentsintoTwoDatabases ............................ 151
Figure5-1 SamplePointerCoS ...................................................... 179
Figure5-2 SampleIndirectCoS ...................................................... 180
Figure5-3 SampleClassicCoS ...................................................... 181
Figure 6-1 Using Inheritance With the userattr Keyword ............................. 222
Figure 6-2 Selecting an Object in the Navigation Tree to Set Access Control l . . . . . . . . . . . . . . . 230
Figure6-3 AccessControlEditorWindow ............................................ 231
Figure6-4 ExampledirectorytreeforMacroACIs ..................................... 256
Figure 8-1 Single-MasterReplication ................................................. 285
Figure 8-2 Multi-MasterReplication ................................................. 286
Figure 8-3 CascadingReplication .................................................... 288

20 Netscape Directory Server Administrator’s Guide • August 2002