[Fedora-directory-commits] adminserver/admserv/newinst/src AdminMigration.pm.in, 1.4, 1.5
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/adminserver/admserv/newinst/src
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22001
Modified Files:
AdminMigration.pm.in
Log Message:
Resolves: #252190
Summary: 7.1 to 8.0 Migration Bug (comment #18)
Index: AdminMigration.pm.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/AdminMigration.pm.in,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- AdminMigration.pm.in 15 Aug 2007 22:08:14 -0000 1.4
+++ AdminMigration.pm.in 16 Aug 2007 00:34:04 -0000 1.5
@@ -84,16 +84,17 @@
close(DBSWITCH);
}
if (!defined($mig->{inf}->{General}->{ConfigDirectoryAdminID})) {
- if (!open(LDAPCONF, $mig->{oldsroot} . "/shared/config/ldap.conf")) {
- $mig->msg('error_opening_ldapconf', $mig->{oldsroot} . "/shared/config/ldap.conf", $!);
+ if (!open(ADMPW, $mig->{oldsroot} . "/admin-serv/config/admpw")) {
+ $mig->msg('error_opening_ldapconf', $mig->{oldsroot} . "/admin-serv/config/admpw", $!);
return 0;
}
- while (<LDAPCONF>) {
- if (/^admnm\s+(.*)$/) {
+ while (<ADMPW>) {
+ next if (/^#/);
+ if (/^(.*):.*$/) {
$mig->{inf}->{General}->{ConfigDirectoryAdminID} = $1;
}
}
- close(LDAPCONF);
+ close(ADMPW);
}
if (!defined($mig->{inf}->{General}->{SuiteSpotGroup}) or
!defined($mig->{inf}->{General}->{SuiteSpotUserID})) {
@@ -140,7 +141,7 @@
# This is how we extract the sie and isie as the as entries are
# being added
sub migratecb {
- my ($context, $entry, $errs) = @_;
+ my ($context, $entry, $errs) = @_;
my @arycontext = ($context);
# always replace the tasks and commands with the new ones
@@ -233,7 +234,7 @@
}
sub updateconinfocb {
- my ($context, $entry, $errs) = @_;
+ my ($context, $entry, $errs) = @_;
my @arycontext = ($context);
# add or update all of the entries except for the UserDirectory
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] adminserver/admserv/newinst/src updateconsoleinfo.map.in, NONE, 1.1
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/adminserver/admserv/newinst/src
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv15379
Added Files:
updateconsoleinfo.map.in
Log Message:
Resolves: bug 252190
Bug Description: 7.1 to 8.0 Migration Bug
Reviewed by: nhosoi (Thanks!)
Fix Description: Lots of issues
1) Instead of using Net::Domain::hostname() for the hostname to use for server identifiers, we must use the leftmost component of the FullMachineName specified by the user. One of the reasons is that hostname() and hostfqdn() can give different results such that hostname() is not the leftmost component of hostfqdn(). And we should just use whatever the user specifies. This required several changes to the mapfiles, and a change to the maptable processing, to process the perl code to eval last, so that we can use token substitutions from the inf file and from hard coded strings.
2) We need to add the global preferences stuff, during migration, in order for the console to function. We cannot rely on the migrated o=NetscapeRoot data because we have to make sure we specify the new jar files to use. In addition, we need to migrate over any customizations that the user has made to these preferences. This is handled by the new updateConsoleInfo function called during admin server migration.
3) There were several resources for messages missing. These have been added.
4) With the new perl only ds instance creation code, there will actually be data in the database even though the server is not started. This is what I believe was causing the error_removing_temp_db_files error. So now, the code will only attempt to remove plain files, not directories that could be globbed.
5) Use /opt/brand-ds for the old server root instead of /opt/pkgname.
6) The migration log should use [Migration} not [Setup]
7) migration should not report a fatal error upon success
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
--- NEW FILE updateconsoleinfo.map.in ---
# BEGIN COPYRIGHT BLOCK
# This Program is free software; you can redistribute it and/or modify it under
# the terms of the GNU General Public License as published by the Free Software
# Foundation; version 2 of the License.
#
# This Program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA.
#
# Copyright (C) 2007 Red Hat, Inc.
# All rights reserved.
# END COPYRIGHT BLOCK
#
# Use this map with 02globalpreferences.ldif.tmpl, to
# update/migrate console information.
# tells how to replace %...% tokens in those ldif.tmpl files.
#
# [Parameter resolution rules]
# * If the right-hand value is in ` (backquote), the value is eval'ed by perl.
# The output should be stored in $returnvalue to pass to the internal hash.
# * If the right-hand value is in " (doublequote), the value is passed as is.
# * If the right-hand value is not in any quote, the value should be found
# in either of the setup inf file (static) or the install inf file (dynamic).
# * The right-hand value could have the format Key:"default_value".
# In this case, Key is searched in the inf files first.
# If the Key is not found, the default_value is set.
# * Variables surrounded by @ (e.g., @configdir@) are replaced with the
# system path at the compile time.
# * The right-hand value can contain variables surrounded by % (e.g., %asid%)
# which refers the right-hand value (key) of this map file.
#
domain = AdminDomain
brand = Brand
normbrand = NormBrand
as_baseversion = BaseVersion
ds_baseversion = BaseVersion
console_version = ConsoleVersion
ds_console_jar = "%normbrand%-ds-%ds_baseversion%.jar"
fqdn = "not_used_for_updateconsoleinfo"
ds_port = "not_used_for_updateconsoleinfo"
ds_suffix = "not_used_for_updateconsoleinfo"
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] adminserver/admserv/newinst/src AdminMigration.pm.in, 1.3, 1.4 adminserver.map.in, 1.8, 1.9 asmigrate.map.in, 1.3, 1.4 configdsroot.map.in, 1.7, 1.8 dirserver.map.in, 1.7, 1.8 migrate-ds-admin.res.in, 1.1, 1.2 register_param.map.in, 1.9, 1.10
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/adminserver/admserv/newinst/src
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6416/adminserver/admserv/newinst/src
Modified Files:
AdminMigration.pm.in adminserver.map.in asmigrate.map.in
configdsroot.map.in dirserver.map.in migrate-ds-admin.res.in
register_param.map.in
Log Message:
Resolves: bug 252190
Bug Description: 7.1 to 8.0 Migration Bug
Reviewed by: nhosoi (Thanks!)
Fix Description: Lots of issues
1) Instead of using Net::Domain::hostname() for the hostname to use for server identifiers, we must use the leftmost component of the FullMachineName specified by the user. One of the reasons is that hostname() and hostfqdn() can give different results such that hostname() is not the leftmost component of hostfqdn(). And we should just use whatever the user specifies. This required several changes to the mapfiles, and a change to the maptable processing, to process the perl code to eval last, so that we can use token substitutions from the inf file and from hard coded strings.
2) We need to add the global preferences stuff, during migration, in order for the console to function. We cannot rely on the migrated o=NetscapeRoot data because we have to make sure we specify the new jar files to use. In addition, we need to migrate over any customizations that the user has made to these preferences. This is handled by the new updateConsoleInfo function called during admin server migration.
3) There were several resources for messages missing. These have been added.
4) With the new perl only ds instance creation code, there will actually be data in the database even though the server is not started. This is what I believe was causing the error_removing_temp_db_files error. So now, the code will only attempt to remove plain files, not directories that could be globbed.
5) Use /opt/brand-ds for the old server root instead of /opt/pkgname.
6) The migration log should use [Migration} not [Setup]
7) migration should not report a fatal error upon success
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: AdminMigration.pm.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/AdminMigration.pm.in,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- AdminMigration.pm.in 24 Jul 2007 20:10:16 -0000 1.3
+++ AdminMigration.pm.in 15 Aug 2007 22:08:14 -0000 1.4
@@ -232,6 +232,105 @@
return 1;
}
+sub updateconinfocb {
+ my ($context, $entry, $errs) = @_;
+
+ my @arycontext = ($context);
+ # add or update all of the entries except for the UserDirectory
+ my $dn = $entry->getDN();
+ if (($entry->getDN() =~ /^cn=UserDirectory/i)) {
+ return 1; # return true, continue
+ }
+
+ my $rc = check_and_add_entry(\@arycontext, $entry, $errs);
+
+ return $rc;
+}
+
+# this updates any information in the configDS that pertains
+# to the console being upgraded
+sub updateConsoleInfo {
+ my $mig = shift;
+ my $configdir = shift;
+ my $inf = $mig->{inf};
+ my @errs;
+
+ my $conn = getConfigDSConn($inf->{General}->{ConfigDirectoryLdapURL},
+ $inf->{General}->{ConfigDirectoryAdminID},
+ $inf->{General}->{ConfigDirectoryAdminPwd},
+ $configdir, \@errs);
+
+ if (@errs) {
+ $mig->msg($FATAL, @errs);
+ return 0;
+ }
+
+ # update the console info
+ my @ldiffiles = ("@ldifdir(a)/02globalpreferences.ldif.tmpl"
+ );
+ my $setupinf = new Inf("@infdir(a)/setup.inf");
+ my $admininf = new Inf("@infdir(a)/admin.inf");
+ my $dsinf = new Inf("@infdir(a)/slapd.inf");
+
+ my $mapper = new Inf("@infdir(a)/updateconsoleinfo.map");
+
+ $mapper = process_maptbl($mapper, \@errs, $inf, $admininf, $dsinf, $setupinf);
+ if (!$mapper) {
+ $conn->close();
+ $mig->msg(@errs);
+ $mig->msg($FATAL, 'error_creating_updateconsole_maptbl');
+ return 0;
+ }
+
+ # update isie and sie
+ getMappedEntries($mapper, \@ldiffiles, \@errs, \&updateconinfocb, $conn);
+ if (@errs) {
+ $conn->close();
+ $mig->msg(@errs);
+ return 0;
+ }
+
+ # now, copy over any customization entries
+ my $basedn = "ou=Admin, ou=Global Preferences, ou=" .
+ $inf->{General}->{AdminDomain} . ", o=NetscapeRoot";
+ my $versents = $conn->search($basedn, "sub", "(objectclass=*)", 0, qw(* aci));
+ if (!$versents) {
+ $mig->msg($FATAL, 'error_migrating_console_entries', $basedn, $conn->getErrorString());
+ $conn->close();
+ return 0;
+ }
+
+ my @oldents = ();
+ for ($versents; $versents; $versents = $conn->nextEntry()) {
+ push @oldents, $versents;
+ }
+
+ for (@oldents) {
+ my $olddn = $_->getDN();
+ if (($olddn =~ /ou=(\d.\d)/) && ($1 ne $admininf->{admin}->{ConsoleVersion})) {
+ my $newdn = $olddn;
+ $newdn =~ s/ou=$1/ou=$admininf->{admin}->{ConsoleVersion}/;
+ my $newent = $_;
+ $newent->setDN($newdn);
+ $conn->add($newent);
+ if ($conn->getErrorCode() == LDAP_SUCCESS) {
+ debug(3, "Added new console customization entry $newdn\n");
+ } elsif ($conn->getErrorCode() == LDAP_ALREADY_EXISTS) {
+ debug(3, "Console customization entry $newdn already exists, skipping\n");
+ } else {
+ $mig->msg($FATAL, 'error_adding_console_entries', $newdn, $conn->getErrorString());
+ $conn->close();
+ return 0;
+ }
+ } else {
+ debug(3, "Skipping entry $olddn - do not need to migrate it\n");
+ }
+ }
+
+ $conn->close();
+ return 1;
+}
+
sub migrateSecurityFiles {
my $mig = shift;
my $configdir = shift;
@@ -390,6 +489,10 @@
return 0;
}
+ if (!updateConsoleInfo($mig, $configdir)) {
+ return 0;
+ }
+
if (!migrateAdmpw($mig, $configdir)) {
return 0;
}
Index: adminserver.map.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/adminserver.map.in,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- adminserver.map.in 10 Aug 2007 02:23:29 -0000 1.8
+++ adminserver.map.in 15 Aug 2007 22:08:14 -0000 1.9
@@ -40,11 +40,11 @@
domain = AdminDomain
brand = Brand
normbrand = NormBrand
-hostname = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+hostname = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
vendor = Vendor
timestamp = `use Time::gmtime; my $gm = gmtime; $returnvalue = sprintf ("%04d%02d%02d%02d%02d%02dZ", 1900+$gm->year, 1+$gm->mon, $gm->mday, $gm->hour, $gm->min, $gm->sec);`
-asid = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+asid = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
as_port = Port
admpw = "@configdir@/admpw"
as_error = "@logdir@/error"
Index: asmigrate.map.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/asmigrate.map.in,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- asmigrate.map.in 10 Aug 2007 02:23:29 -0000 1.3
+++ asmigrate.map.in 15 Aug 2007 22:08:14 -0000 1.4
@@ -37,11 +37,11 @@
domain = AdminDomain
brand = Brand
normbrand = NormBrand
-hostname = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+hostname = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
vendor = Vendor
timestamp = `use Time::gmtime; my $gm = gmtime; $returnvalue = sprintf ("%04d%02d%02d%02d%02d%02dZ", 1900+$gm->year, 1+$gm->mon, $gm->mday, $gm->hour, $gm->min, $gm->sec);`
-asid = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+asid = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
as_port = Port
admpw = "@configdir@/admpw"
as_error = "@logdir@/errors"
Index: configdsroot.map.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/configdsroot.map.in,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- configdsroot.map.in 10 Aug 2007 02:23:29 -0000 1.7
+++ configdsroot.map.in 15 Aug 2007 22:08:14 -0000 1.8
@@ -42,7 +42,7 @@
as_uid = ServerAdminID
as_passwd = ServerAdminPwd
-asid = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+asid = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
as_version = Version
as_baseversion = BaseVersion
ds_version = Version
Index: dirserver.map.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/dirserver.map.in,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- dirserver.map.in 24 Jul 2007 20:10:16 -0000 1.7
+++ dirserver.map.in 15 Aug 2007 22:08:14 -0000 1.8
@@ -43,7 +43,7 @@
vendor = Vendor
timestamp = `use Time::gmtime; my $gm = gmtime; $returnvalue = sprintf ("%04d%02d%02d%02d%02d%02dZ", 1900+$gm->year, 1+$gm->mon, $gm->mday, $gm->hour, $gm->min, $gm->sec);`
-asid = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+asid = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
as_sie = "cn=admin-serv-%asid%, cn=%brand% Administration Server, cn=Server Group, cn=%fqdn%, ou=%domain%, o=NetscapeRoot"
ds_version = Version
ds_baseversion = BaseVersion
Index: migrate-ds-admin.res.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/migrate-ds-admin.res.in,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- migrate-ds-admin.res.in 29 Jun 2007 21:29:05 -0000 1.1
+++ migrate-ds-admin.res.in 15 Aug 2007 22:08:14 -0000 1.2
@@ -19,3 +19,7 @@
error_opening_nssconf = Error: could not open NSS config file %s. Error: %s\n
error_writing_nssconf = Error: could not write NSS config file %s. Error: %s\n
registering_dirserver_instances = Registering the migrated directory server instances with the configuration directory server . . .\n
+error_creating_asmigration_maptbl = Error: could not create maptable for use in admin server migration.\n
+error_creating_updateconsole_maptbl = Error: could not create maptable for use in admin server console migration.\n
+error_migrating_console_entries = Error: Could not find the console customization entries under '%s'. Error: %s\n
+error_adding_console_entries = Error: Could not add console customization entry '%s'. Error: %s\n
Index: register_param.map.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/register_param.map.in,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- register_param.map.in 10 Aug 2007 02:23:29 -0000 1.9
+++ register_param.map.in 15 Aug 2007 22:08:14 -0000 1.10
@@ -40,7 +40,7 @@
domain = `use Net::Domain qw(hostdomain); $returnvalue = hostdomain();`
brand = Brand
normbrand = NormBrand
-hostname = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+hostname = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
vendor = Vendor
uname_a = `open(UNAMEA, "uname -a |"); $returnvalue = <UNAMEA>; chomp $returnvalue; close(UNAMEA);`
uname_m = `open(UNAMEM, "uname -m |"); $returnvalue = <UNAMEM>; chomp $returnvalue; close(UNAMEM);`
@@ -48,7 +48,7 @@
as_uid = ServerAdminID
as_passwd = ServerAdminPwd
-asid = `use Net::Domain qw(hostname); $returnvalue = hostname();`
+asid = `$returnvalue = $mapper->{fqdn}; $returnvalue =~ s/\..*$//;`
as_port = Port
admpw = "@configdir@/admpw"
as_error = "@logdir@/error"
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] adminserver Makefile.am, 1.30, 1.31 aclocal.m4, 1.28, 1.29 configure, 1.31, 1.32 missing, 1.19, 1.20 install-sh, 1.19, 1.20 depcomp, 1.19, 1.20 config.sub, 1.19, 1.20 config.guess, 1.19, 1.20 compile, 1.18, 1.19 Makefile.in, 1.34, 1.35
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/adminserver
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6416/adminserver
Modified Files:
Makefile.am aclocal.m4 configure missing install-sh depcomp
config.sub config.guess compile Makefile.in
Log Message:
Resolves: bug 252190
Bug Description: 7.1 to 8.0 Migration Bug
Reviewed by: nhosoi (Thanks!)
Fix Description: Lots of issues
1) Instead of using Net::Domain::hostname() for the hostname to use for server identifiers, we must use the leftmost component of the FullMachineName specified by the user. One of the reasons is that hostname() and hostfqdn() can give different results such that hostname() is not the leftmost component of hostfqdn(). And we should just use whatever the user specifies. This required several changes to the mapfiles, and a change to the maptable processing, to process the perl code to eval last, so that we can use token substitutions from the inf file and from hard coded strings.
2) We need to add the global preferences stuff, during migration, in order for the console to function. We cannot rely on the migrated o=NetscapeRoot data because we have to make sure we specify the new jar files to use. In addition, we need to migrate over any customizations that the user has made to these preferences. This is handled by the new updateConsoleInfo function called during admin server migration.
3) There were several resources for messages missing. These have been added.
4) With the new perl only ds instance creation code, there will actually be data in the database even though the server is not started. This is what I believe was causing the error_removing_temp_db_files error. So now, the code will only attempt to remove plain files, not directories that could be globbed.
5) Use /opt/brand-ds for the old server root instead of /opt/pkgname.
6) The migration log should use [Migration} not [Setup]
7) migration should not report a fatal error upon success
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: Makefile.am
===================================================================
RCS file: /cvs/dirsec/adminserver/Makefile.am,v
retrieving revision 1.30
retrieving revision 1.31
diff -u -r1.30 -r1.31
--- Makefile.am 6 Aug 2007 19:54:25 -0000 1.30
+++ Makefile.am 15 Aug 2007 22:08:13 -0000 1.31
@@ -163,7 +163,8 @@
admserv/newinst/src/configdsroot.map \
admserv/newinst/src/adminserver.map \
admserv/newinst/src/dirserver.map \
- admserv/newinst/src/asmigrate.map
+ admserv/newinst/src/asmigrate.map \
+ admserv/newinst/src/updateconsoleinfo.map
cgibin_PROGRAMS = admpw security ugdsconfig ReadLog start_config_ds \
config statpingserv viewdata dsconfig monreplication restartsrv \
Index: Makefile.in
===================================================================
RCS file: /cvs/dirsec/adminserver/Makefile.in,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- Makefile.in 13 Aug 2007 15:40:48 -0000 1.34
+++ Makefile.in 15 Aug 2007 22:08:13 -0000 1.35
@@ -605,7 +605,8 @@
admserv/newinst/src/configdsroot.map \
admserv/newinst/src/adminserver.map \
admserv/newinst/src/dirserver.map \
- admserv/newinst/src/asmigrate.map
+ admserv/newinst/src/asmigrate.map \
+ admserv/newinst/src/updateconsoleinfo.map
cgibin_SCRIPTS = admserv/cgi-src40/ds_create \
admserv/cgi-src40/ds_remove \
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/admin/src/scripts DSDialogs.pm, 1.4, 1.5 DSMigration.pm.in, 1.4, 1.5 Migration.pm.in, 1.4, 1.5 Util.pm.in, 1.10, 1.11
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/admin/src/scripts
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6311/ldapserver/ldap/admin/src/scripts
Modified Files:
DSDialogs.pm DSMigration.pm.in Migration.pm.in Util.pm.in
Log Message:
Resolves: bug 252190
Bug Description: 7.1 to 8.0 Migration Bug
Reviewed by: nhosoi (Thanks!)
Fix Description: Lots of issues
1) Instead of using Net::Domain::hostname() for the hostname to use for server identifiers, we must use the leftmost component of the FullMachineName specified by the user. One of the reasons is that hostname() and hostfqdn() can give different results such that hostname() is not the leftmost component of hostfqdn(). And we should just use whatever the user specifies. This required several changes to the mapfiles, and a change to the maptable processing, to process the perl code to eval last, so that we can use token substitutions from the inf file and from hard coded strings.
2) We need to add the global preferences stuff, during migration, in order for the console to function. We cannot rely on the migrated o=NetscapeRoot data because we have to make sure we specify the new jar files to use. In addition, we need to migrate over any customizations that the user has made to these preferences. This is handled by the new updateConsoleInfo function called during admin server migration.
3) There were several resources for messages missing. These have been added.
4) With the new perl only ds instance creation code, there will actually be data in the database even though the server is not started. This is what I believe was causing the error_removing_temp_db_files error. So now, the code will only attempt to remove plain files, not directories that could be globbed.
5) Use /opt/brand-ds for the old server root instead of /opt/pkgname.
6) The migration log should use [Migration} not [Setup]
7) migration should not report a fatal error upon success
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: DSDialogs.pm
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/DSDialogs.pm,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- DSDialogs.pm 25 Jul 2007 22:05:26 -0000 1.4
+++ DSDialogs.pm 15 Aug 2007 22:04:31 -0000 1.5
@@ -86,10 +86,10 @@
if (!defined($serverid)) {
$serverid = $self->{manager}->{inf}->{General}->{FullMachineName};
if (!defined($serverid)) {
- $serverid = hostname;
- } else { # strip out the leftmost domain component
- $serverid =~ s/\..*$//;
+ $serverid = hostfqdn;
}
+ # strip out the leftmost domain component
+ $serverid =~ s/\..*$//;
}
return $serverid;
},
Index: DSMigration.pm.in
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/DSMigration.pm.in,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- DSMigration.pm.in 13 Jul 2007 18:35:32 -0000 1.4
+++ DSMigration.pm.in 15 Aug 2007 22:04:31 -0000 1.5
@@ -191,9 +191,12 @@
debug(1, "The destination directory $destdir already exists, copying files/dirs individually\n");
$! = 0;
debug(1, "Removing any existing db files in $destdir\n");
- unlink glob("$destdir/*");
- if ($!) {
- return ("error_removing_temp_db_files", $destdir, $!);
+ foreach my $file (glob("$destdir/*")) {
+ next if (! -f $file);
+ unlink($file);
+ if ($!) {
+ return ("error_removing_temp_db_files", $destdir, $!);
+ }
}
foreach my $file (glob("$srcdir/*")) {
if (-f $file) {
Index: Migration.pm.in
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/Migration.pm.in,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- Migration.pm.in 15 Aug 2007 02:51:50 -0000 1.4
+++ Migration.pm.in 15 Aug 2007 22:04:31 -0000 1.5
@@ -213,7 +213,7 @@
if ($pkgname =~ /-(core|base)$/) {
$pkgname =~ s/-(core|base)$//;
}
- my $oldpkgname = $pkgname;
+ my $oldpkgname = "@brand@-ds";
$self->{pkgname} = $pkgname;
$self->{oldsroot} = $oldsroot || "/opt/$oldpkgname";
@@ -274,10 +274,26 @@
$self->{instances} = \@instances;
}
+# log only goes the the logfile
+sub log {
+ my $self = shift;
+ my $level = shift;
+ $self->{log}->logMessage($level, "Migration", @_);
+}
+
sub doExit {
my $self = shift;
- $self->msg($FATAL, 'migration_exiting', $self->{log}->{filename});
- exit 1;
+ my $code = shift;
+ if (!defined($code)) {
+ $code = 1;
+ }
+
+ if ($code) {
+ $self->msg($FATAL, 'migration_exiting', $self->{log}->{filename});
+ } else {
+ $self->msg($SUCCESS, 'migration_exiting', $self->{log}->{filename});
+ }
+ exit $code;
}
sub migrateSecurityFiles {
Index: Util.pm.in
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/Util.pm.in,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- Util.pm.in 19 Jul 2007 00:23:40 -0000 1.10
+++ Util.pm.in 15 Aug 2007 22:04:31 -0000 1.11
@@ -697,6 +697,7 @@
sub process_maptbl
{
my ($mapper, $errs, @infdata) = @_;
+ my @deferredkeys = ();
if (defined($mapper->{""})) {
$mapper = $mapper->{""}; # side effect of Inf with no sections
@@ -712,10 +713,7 @@
}
elsif ($value =~ /^\`/)
{
- $value =~ tr/\`//d; # value is a perl expression to eval
- my $returnvalue; # set in eval expression
- eval $value;
- $mapper->{$key} = $returnvalue; # perl expression sets $returnvalue
+ push @deferredkeys, $key; # process these last
}
else
{
@@ -751,6 +749,18 @@
}
}
}
+
+ # we have to process the perl expressions to eval last, because those
+ # expressions may use mappings defined elsewhere in the file, and we are not
+ # guaranteed of the order in which hash keys are enumerated
+ foreach my $key (@deferredkeys) {
+ my $value = $mapper->{$key};
+ $value =~ tr/\`//d; # value is a perl expression to eval
+ my $returnvalue; # set in eval expression
+ eval $value;
+ $mapper->{$key} = $returnvalue; # perl expression sets $returnvalue
+ }
+
return $mapper;
}
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/admin/src/scripts Migration.pm.in, 1.3, 1.4 migrate-ds.res, 1.3, 1.4
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/admin/src/scripts
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv12992/ldapserver/ldap/admin/src/scripts
Modified Files:
Migration.pm.in migrate-ds.res
Log Message:
Resolves: bug 252190
Bug Description: 7.1 to 8.0 Migration Bug
Reviewed by: nhosoi (Thanks!)
Files: see diff
Branch: HEAD
Fix Description: Although the directory server always creates key/cert databases, the admin server does not. So, just log a message and skip if they do not exist. Also was missing some message resources for various errors.
Platforms tested: RHEL4
Flag Day: no
Doc impact: no
Index: Migration.pm.in
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/Migration.pm.in,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- Migration.pm.in 13 Jul 2007 18:35:32 -0000 1.3
+++ Migration.pm.in 15 Aug 2007 02:51:50 -0000 1.4
@@ -293,24 +293,39 @@
$self->msg('new_secdir_error', $destdir, $!);
return 0;
} else {
- $self->log($INFO, "Copying $oldroot/alias/$inst-cert8.db to $destdir/cert8.db\n");
- if (system ("cp -p $oldroot/alias/$inst-cert8.db $destdir/cert8.db")) {
- $self->msg($FATAL, 'error_copying_certdb', "$oldroot/alias/$inst-cert8.db",
- "$destdir/cert8.db", $!);
- return 0;
+ if (-f "$oldroot/alias/$inst-cert8.db") {
+ $self->log($INFO, "Copying $oldroot/alias/$inst-cert8.db to $destdir/cert8.db\n");
+ if (system ("cp -p $oldroot/alias/$inst-cert8.db $destdir/cert8.db")) {
+ $self->msg($FATAL, 'error_copying_certdb', "$oldroot/alias/$inst-cert8.db",
+ "$destdir/cert8.db", $!);
+ return 0;
+ }
+ } else {
+ $self->log($DEBUG, "No file to migrate: $oldroot/alias/$inst-cert8.db\n");
}
- $self->log($INFO, "Copying $oldroot/alias/$inst-key3.db to $destdir/key3.db\n");
- if (system ("cp -p $oldroot/alias/$inst-key3.db $destdir/key3.db")) {
- $self->msg($FATAL, 'error_copying_keydb', "$oldroot/alias/$inst-key3.db",
- "$destdir/key3.db", $!);
- return 0;
+
+ if (-f "$oldroot/alias/$inst-key3.db") {
+ $self->log($INFO, "Copying $oldroot/alias/$inst-key3.db to $destdir/key3.db\n");
+ if (system ("cp -p $oldroot/alias/$inst-key3.db $destdir/key3.db")) {
+ $self->msg($FATAL, 'error_copying_keydb', "$oldroot/alias/$inst-key3.db",
+ "$destdir/key3.db", $!);
+ return 0;
+ }
+ } else {
+ $self->log($DEBUG, "No file to migrate: $oldroot/alias/$inst-key3.db\n");
}
- $self->log($INFO, "Copying $oldroot/alias/secmod.db to $destdir/secmod.db\n");
- if (system ("cp -p $oldroot/alias/secmod.db $destdir/secmod.db")) {
- $self->msg($FATAL, 'error_copying_secmoddb', "$oldroot/alias/secmod.db",
- "$destdir/secmod.db", $!);
- return 0;
+
+ if (-f "$oldroot/alias/secmod.db") {
+ $self->log($INFO, "Copying $oldroot/alias/secmod.db to $destdir/secmod.db\n");
+ if (system ("cp -p $oldroot/alias/secmod.db $destdir/secmod.db")) {
+ $self->msg($FATAL, 'error_copying_secmoddb', "$oldroot/alias/secmod.db",
+ "$destdir/secmod.db", $!);
+ return 0;
+ }
+ } else {
+ $self->log($DEBUG, "No file to migrate: $oldroot/alias/secmod.db\n");
}
+
if (-f "$oldroot/alias/$inst-pin.txt") {
$self->log($INFO, "Copying $oldroot/alias/$inst-pin.txt to $destdir/pin.txt\n");
if (system ("cp -p $oldroot/alias/$inst-pin.txt $destdir/pin.txt")) {
Index: migrate-ds.res
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/admin/src/scripts/migrate-ds.res,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- migrate-ds.res 13 Jul 2007 18:35:32 -0000 1.3
+++ migrate-ds.res 15 Aug 2007 02:51:50 -0000 1.4
@@ -12,3 +12,8 @@
error_dbsrcdir_not_exist = Could not copy from the database source directory '%s' because it does not exist. Please check your configuration.\n
error_no_instances = Could not find any instances in the old directory '%s' to migrate.\n
error_removing_temp_db_files = Could not remove the temporary db files in '%s' to clear the directory in preparation for the migrated db files. Error: %s\n
+error_copying_certdb = Could not copy the certificate database file '%s' to '%s'. Error: %s\n
+error_copying_keydb = Could not copy the private key database file '%s' to '%s'. Error: %s\n
+error_copying_secmoddb = Could not copy the security module database file '%s' to '%s'. Error: %s\n
+error_copying_pinfile = Could not copy the key database PIN file '%s' to '%s'. Error: %s\n
+error_copying_certmap = Could not copy the client certificate mapping file '%s' to '%s'. Error: %s\n
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] coolkey/src/coolkey machdep.cpp,1.5,1.6
by Doctor Conrad
Author: rrelyea
Update of /cvs/dirsec/coolkey/src/coolkey
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29424
Modified Files:
machdep.cpp
Log Message:
Use a less obscure name for the cache file.
Don't try to initialize the file if we couldn't open it.
Index: machdep.cpp
===================================================================
RCS file: /cvs/dirsec/coolkey/src/coolkey/machdep.cpp,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- machdep.cpp 14 Aug 2007 23:04:08 -0000 1.5
+++ machdep.cpp 15 Aug 2007 00:34:17 -0000 1.6
@@ -195,10 +195,10 @@
#ifdef FULL_CLEANUP
#define RESERVED_OFFSET 256
-#define MEMSEGPATH BASEPATH"/pk11ipc"
+#define MEMSEGPATH BASEPATH"/coolkey-lock"
#else
#define RESERVED_OFFSET 0
-#define MEMSEGPATH BASEPATH"/pk11ipc1"
+#define MEMSEGPATH BASEPATH"/coolkey"
#endif
struct SHMemData {
@@ -273,10 +273,7 @@
shmemData->fd = open(shmemData->path,
O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, mode);
- if ((shmemData->fd < 0) && errno == EEXIST) {
- needInit = false;
- shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK|O_NOFOLLOW, mode);
- } else {
+ if (shmemData->fd >= 0) {
char *buf;
int len = size+RESERVED_OFFSET;
@@ -291,6 +288,9 @@
}
write(shmemData->fd,buf,len);
free(buf);
+ } else if (errno == EEXIST) {
+ needInit = false;
+ shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK|O_NOFOLLOW, mode);
}
if (shmemData->fd < 0) {
delete shmemData;
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] coolkey/src/coolkey machdep.cpp,1.4,1.5
by Doctor Conrad
Author: rrelyea
Update of /cvs/dirsec/coolkey/src/coolkey
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19367
Modified Files:
machdep.cpp
Log Message:
Move the cache to /var/cache where the coolkey package can own and control
the directory better.
Index: machdep.cpp
===================================================================
RCS file: /cvs/dirsec/coolkey/src/coolkey/machdep.cpp,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- machdep.cpp 14 Feb 2007 00:46:28 -0000 1.4
+++ machdep.cpp 14 Aug 2007 23:04:08 -0000 1.5
@@ -185,12 +185,20 @@
#define MAP_INHERIT 0
#endif
+#ifndef BASEPATH
+#ifdef MAC
+#define BASEPATH "/var"
+#else
+#define BASEPATH "/var/cache"
+#endif
+#endif
+
#ifdef FULL_CLEANUP
#define RESERVED_OFFSET 256
-#define MEMSEGPATH "/tmp/.pk11ipc"
+#define MEMSEGPATH BASEPATH"/pk11ipc"
#else
#define RESERVED_OFFSET 0
-#define MEMSEGPATH "/tmp/.pk11ipc1"
+#define MEMSEGPATH BASEPATH"/pk11ipc1"
#endif
struct SHMemData {
@@ -208,11 +216,6 @@
#ifdef FULL_CLEANUP
flock(fd,LOCK_EX);
unsigned long ref = --(*(unsigned long *)addr);
-#ifdef notdef
- if (ref == 0) {
- unlink(path);
- }
-#endif
flock(fd, LOCK_UN);
#endif
munmap(addr,size+RESERVED_OFFSET);
@@ -248,7 +251,7 @@
return NULL;
}
int mask = umask(0);
- int ret = mkdir (MEMSEGPATH, 0777);
+ int ret = mkdir (MEMSEGPATH, 1777);
umask(mask);
if ((ret == -1) && (errno != EEXIST)) {
delete shmemData;
@@ -264,18 +267,15 @@
shmemData->path[sizeof(MEMSEGPATH)-1] = '/';
strcpy(&shmemData->path[sizeof(MEMSEGPATH)],name);
- int mode = 0777;
- if (strcmp(name,"token_names") != 0) {
- /* each user gets his own uid array */
- sprintf(uid_str, "-%u",getuid());
- strcat(shmemData->path,uid_str);
- mode = 0700;
- }
+ sprintf(uid_str, "-%u",getuid());
+ strcat(shmemData->path,uid_str);
+ int mode = 0600;
+
shmemData->fd = open(shmemData->path,
O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, mode);
- if (shmemData->fd < 0) {
+ if ((shmemData->fd < 0) && errno == EEXIST) {
needInit = false;
- shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK, mode);
+ shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK|O_NOFOLLOW, mode);
} else {
char *buf;
int len = size+RESERVED_OFFSET;
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] coolkey coolkey.spec,1.7,1.8
by Doctor Conrad
Author: rrelyea
Update of /cvs/dirsec/coolkey
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19333
Modified Files:
coolkey.spec
Log Message:
update the spec file for a new release (1.1.0)
Index: coolkey.spec
===================================================================
RCS file: /cvs/dirsec/coolkey/coolkey.spec,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- coolkey.spec 14 Feb 2007 00:46:28 -0000 1.7
+++ coolkey.spec 14 Aug 2007 23:03:19 -0000 1.8
@@ -18,7 +18,7 @@
# END COPYRIGHT BLOCK
Name: coolkey
-Version: 1.1.0
+Version: 1.1.1
Release: 1
Summary: CoolKey PKCS #11 module
License: LGPL
@@ -57,6 +57,8 @@
rm -rf $RPM_BUILD_ROOT
make install DESTDIR=$RPM_BUILD_ROOT
ln -s pkcs11/libcoolkeypk11.so $RPM_BUILD_ROOT/%{_libdir}
+mkdir -p $RPM_BUILD_ROOT/var/cache/pk11ipc1
+
%clean
rm -rf $RPM_BUILD_ROOT
@@ -72,6 +74,7 @@
%{_libdir}/pkcs11/libcoolkeypk11.so
%{_libdir}/libckyapplet.so.1
%{_libdir}/libckyapplet.so.1.0.0
+%attr(1777, root,root) /var/cache/pk11ipc1
%files devel
%{_libdir}/libckyapplet.so
@@ -80,6 +83,12 @@
%changelog
+* Tue Aug 14 2007 Bob Relyea <rrelyea(a)redhat.com> - 1.1.1
+- Move cache to /var/cache. Make the package own it's
+ cache directory.
+- Allow formatting applications like ESC to open access
+ tokens which may not have a recognized ATR.
+
* Wed Feb 14 2007 Bob Relyea <rrelyea(a)redhat.com> - 1.1.0
- Clear any logout rests after a successful login.
- Don't grab the CUID on cac's. Reseting the card causes it to
16 years, 8 months
- 1
- 0
[Fedora-directory-commits] directoryconsole/help/en/help account_mgmt.html, NONE, 1.1 adv_search.html, NONE, 1.1 configtab_chaindb.html, NONE, 1.1 configtab_chaindb2.html, NONE, 1.1 configtab_chaindb3.html, NONE, 1.1 configtab_chaindb4.html, NONE, 1.1 configtab_chaindb5.html, NONE, 1.1 configtab_chaindb6.html, NONE, 1.1 configtab_chaindb7.html, NONE, 1.1 configtab_db.html, NONE, 1.1 configtab_db10.html, NONE, 1.1 configtab_db11.html, NONE, 1.1 configtab_db12.html, NONE, 1.1 configtab_db13.html, NONE, 1.1 co
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/directoryconsole/help/en/help
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29173/help/en/help
Added Files:
account_mgmt.html adv_search.html configtab_chaindb.html
configtab_chaindb2.html configtab_chaindb3.html
configtab_chaindb4.html configtab_chaindb5.html
configtab_chaindb6.html configtab_chaindb7.html
configtab_db.html configtab_db10.html configtab_db11.html
configtab_db12.html configtab_db13.html configtab_db14.html
configtab_db15.html configtab_db2.html configtab_db3.html
configtab_db4.html configtab_db5.html configtab_db6.html
configtab_db7.html configtab_db8.html configtab_db9.html
configtab_ldbmdb.html configtab_logs.html configtab_logs2.html
configtab_logs3.html configtab_maptree.html
configtab_maptree2.html configtab_maptree3.html
configtab_maptree4.html configtab_maptree5.html
configtab_maptree6.html configtab_maptree7.html
configtab_plugins.html configtab_replication.html
configtab_replication2.html configtab_replication3.html
configtab_replication4.html configtab_replication5.html
configtab_replication6.html configtab_replication7.html
configtab_replication8.html configtab_rootnode.html
configtab_rootnode2.html configtab_rootnode3.html
configtab_rootnode4.html configtab_rootnode5.html
configtab_rootnode6.html configtab_rootnode7.html
configtab_rootnode8.html configtab_rootnode9.html
configtab_schema.html configtab_schema2.html
configtab_schema3.html configtab_schema4.html
configtab_schema5.html configtab_synchronization1.html
configtab_synchronization2.html
configtab_synchronization3.html dir_browser.html
dir_browser2.html dir_browser3.html dir_browser4.html
dirtab_cos.html dirtab_cos2.html dirtab_cos3.html
dirtab_role.html dirtab_role2.html dirtab_role3.html
dirtab_role4.html dirtab_role5.html dirtab_role6.html
dirtab_role7.html helpmenu.html ldapurl.html new_instance.html
property_editor.html property_editor2.html
property_editor3.html property_editor4.html
replication_wizard.html replication_wizard2.html
replication_wizard3.html replication_wizard4.html
replication_wizard5.html replication_wizard6.html
statustab_general.html statustab_logs.html
statustab_logs2.html statustab_logs3.html
statustab_performance.html statustab_performance2.html
statustab_replication.html synchronization_wizard1.html
synchronization_wizard2.html synchronization_wizard3.html
taskstab_bkup_restore.html taskstab_bkup_restore2.html
Log Message:
Resolves: 252036
Summary: Added online help files to fedora-ds-console package.
--- NEW FILE account_mgmt.html ---
<p class="topic">
<a name="User Account"> </a>
User Account
</p>
<p class="text">
Use this tab to manage the user account. You can use it to inactivate or activate a user account, as well as set resource limits for a particular user.
</p>
<p class="text">
<b>Activation. </b>This section provides information about whether the account is active or inactive. If the account is active, you can click the Inactivate button to inactivate it. If the account is inactive, click the Activate button to activate it.
</p>
<p class="text">
<b>Resource limits.</b> This section lets you set resource limits for a particular user.
</p>
<ul>
<li>
<b>Look through limit. </b>Specifies how many entries can be examined for a search operation.
<img src="/manual/en/slapd/help/pixel.gif" align="top" height="22" alt="" />
</li>
<li>
<b>Size limit. </b>Specifies the maximum number of entries the server returns to a client application in response to a search operation.
<img src="/manual/en/slapd/help/pixel.gif" align="top" height="22" alt="" />
</li>
<li>
<b>Time limit. </b>Specifies the maximum time the server spends processing a search operation.
</li>
<li>
<b>Idle timeout. </b>Specifies the time a connection to the server can be idle before the connection is dropped.
</li>
</ul>
--- NEW FILE adv_search.html ---
<p class="topic">
<a name="Advanced Search"> </a>
Advanced Search
</p>
<p class="text">
Use this dialog box to search the user directory with a search filter.
</p>
<p class="text">
<b>Search Filter. </b>Enter the search filter you want to use in this text box and then click OK.
</p>
--- NEW FILE configtab_chaindb.html ---
<p class="topic">
Create New Database Link
</p>
<p class="text">
The database link contacts other servers on behalf of a client application and returns the combined results to the client application after finishing the operation. Use the following attributes to configure a new database link:
</p>
<p class="text">
<b>Database link name.</b> Unique name of the database link.
</p>
<p class="text">
<b>Bind DN.</b> DN of an administrative user by the database link to bind to the remote server. If this field is left blank, the database link binds as anonymous. Note that the bind DN cannot be the directory manager.
</p>
<p class="text">
<b>Password.</b> Password for the administrative user, in plain text. If no password is provided, it means that the database link can bind as anonymous.
</p>
<p class="text">
<b>Remote server(s) information. </b>In this section you provide information about the remote data sources used by the database link.
</p>
<p class="text">
<b>Use a secure LDAP connection between servers.</b> Selecting this checkbox indicates that the connection between the server and the remote server is secure.
</p>
<p class="text">
<b>Remote Server.</b> The name of the remote data source.
</p>
<p class="text">
<b>Remote server port.</b> The port number on the remote data source used by the database link.
</p>
<p class="text">
<b>Failover Server(s).</b> You can specify optional servers for failover in the event that the primary remote server is unavailable. This field contains the name of an alternative remote server. Click Add to add the name and port number to the list.
</p>
<p class="text">
<b>Port.</b> Port number of an alternative remote server.
</p>
<p class="text">
<b>LDAP URL. </b>This field contains a dynamically created LDAP URL that combines the server names and port numbers you specified in the remote server information fields.
</p>
--- NEW FILE configtab_chaindb2.html ---
<p class="topic">
<a name="Database Link Settings"> </a>
Database Link Settings
</p>
<p class="text">
Use the Settings tab to set the default settings for all new database links.
</p>
<p class="text">
<b>LDAP controls forwarded by database link.</b> This list contains the OIDs of LDAP controls which are allowed to chain. By default, requests made by the following controls are forwarded to the remote server by the database link:
</p>
<ul>
<li>
Virtual list view (VLV) control. This control provides lists of parts of entries rather than returning all entry information. The OID of this control is 2.16.840.1.113730.3.4.9.
</li>
<li>
Server side sorting control. This control sorts entries according to their attribute values. The OID for this control is 1.2.840.113556.1.4.473.
</li>
<li>
Managed DSA control. This control returns smart referrals as entries rather than following the referral. This allows you to modify or delete the smart referral itself. The OID for this control is 2.16.840.1.113730.3.4.2.
</li>
<li>
Loop detection control. This control contains a count that is decremented each time the server tries to chain. When the server receives a count of 0 it determines that a loop has been detected and notifies the client application. The OID for this control is 1.3.6.1.4.1.1466.29539.12.
</li>
</ul>
<p class="text">
Click Add to select an LDAP control OID from a list.
</p>
<p class="text">
<b>Components allowed to chain.</b> A component is any functional unit in the server that uses internal operations. You may need to control the chaining policy of some components so that they can complete their operations successfully. By default, all internal operations are not chained. You can override this default by specifying components in this list.
</p>
<p class="text">
Click Add and select the component you want to allow to chain from the list.
</p>
--- NEW FILE configtab_chaindb3.html ---
<p class="topic">
<a name="Select Controls to Add"> </a>
Select Controls to Add
</p>
<p class="text">
Select an OID from the list and click OK. The following table describes the OIDs listed in the UI by default:
</p>
<br />
<p class="caption">
<a name="LDAP Control OIDs "> </a>
Table 1 LDAP Control OIDs
</p>
<br/>
<table width="90%" border="1" cellspacing="0" cellpadding="4">
<tr bgcolor="#CCCCCC" align="left" valign="top">
<th valign="top" align="left">
<p class="tablehead">
OID
</p>
</th>
<th valign="top" align="left">
<p class="tablehead">
LDAP Control Description
</p>
</th>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.3
</p></td>
<td valign="top">
<p class="tabletext">
Persistent search control.
</p><p class="tabletext">
This control is used with a search request to indicate that the server should not complete the request when all the matching entries have been returned. Instead, the server should keep the operation active and send results to the client whenever an entry matching the search filter is added, deleted, or modified.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.4
</p></td>
<td valign="top">
<p class="tabletext">
Password expired notification control.
</p><p class="tabletext">
This control notifies a client application that their password has expired.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.5
</p></td>
<td valign="top">
<p class="tabletext">
Password expiring notification control.
</p><p class="tabletext">
This control notifies a client application that their password will expire in a given amount of time.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.16
</p></td>
<td valign="top">
<p class="tabletext">
Authentication request control.
</p><p class="tabletext">
This control can be provided with a bind request to indicate to the server that an authentication response control is desired with the bind response.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.15
</p></td>
<td valign="top">
<p class="tabletext">
Authentication response control.
</p><p class="tabletext">
This control is returned with the client application bind request to provide LDAP clients with the DN and authentication method used (useful when SASL or certificate is employed).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.17
</p></td>
<td valign="top">
<p class="tabletext">
Real attribute only request control.
</p><p class="tabletext">
This control requests that the server return only attributes that are truly contained in the entries returned and that the directory does not try to resolve virtual attributes.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.14
</p></td>
<td valign="top">
<p class="tabletext">
Search on specific database control.
</p><p class="tabletext">
This control can be used with search operations to specify that the search must be done on the database which is named in the control.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.12
</p></td>
<td valign="top">
<p class="tabletext">
Proxied authorization control.
</p><p class="tabletext">
This control allows the client to assume the identity of another entry for the duration of a request.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
2.16.840.1.113730.3.4.13
</p></td>
<td valign="top">
<p class="tabletext">
Replication update information control.
</p><p class="tabletext">
This control carries the universally unique identifier (UUID) and change sequence number (CSN) of a replicated operation.
</p></td>
</tr>
</table>
--- NEW FILE configtab_chaindb4.html ---
<p class="topic">
<a name="Select Components to Add"> </a>
Select Components to Add
</p>
<p class="text">
Select a component from the list. By default, the list contains the following components:
</p>
<br />
<p class="caption">
<a name="Components Available for Chaining "> </a>
Table 2 Components Available for Chaining
</p>
<br/>
<table width="90%" border="1" cellspacing="0" cellpadding="4">
<tr bgcolor="#CCCCCC" align="left" valign="top">
<th valign="top" align="left">
<p class="tablehead">
Component DN
</p>
</th>
<th valign="top" align="left">
<p class="tablehead">
Description
</p>
</th>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=resource limits,<br />cn=components, cn=config
</p></td>
<td valign="top">
<p class="tabletext">
Resource limits plug-in.
</p><p class="tabletext">
Resource limits can be applied to remote users if the resource limit plug-in is allowed to chain.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=certificate-based authentication<br />cn=components, cn=config
</p></td>
<td valign="top">
<p class="tabletext">
Certificate-based authentication plug-in.
</p><p class="tabletext">
This component is used when the SASL-external bind method is used. It retrieves the user certificate from the local remote data source. If you allow this component to chain, certificate-based authentication can work with a database link.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=ACL plugin, cn=plugins, cn=config
</p></td>
<td valign="top">
<p class="tabletext">
ACL plug-in.
</p><p class="tabletext">
Operations used to retrieve and update ACI attributes are not chained because it is not safe to mix local and remote ACI attributes. However, requests used to retrieve user entries may be chained.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=old plugin, cn=plugins, cn=config
</p></td>
<td valign="top">
<p class="tabletext">
Directory Server plug-ins.
</p><p class="tabletext">
All Directory Server plug-ins share the same chaining policy, so selecting this option from the list enables them all to chain.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=referential integrity postoperation,<br />cn=plugins, cn=config
</p></td>
<td valign="top">
<p class="tabletext">
Referential integrity plug-in.
</p><p class="tabletext">
This plug-in ensures that updates made to attributes containing DNs are propagated to all entries that contain pointers to the attribute. For example, if you delete an entry that is a member of a group, the entry is automatically removed from the group.
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
cn=attribute uniqueness, cn=plugins,<br />cn=config
</p></td>
<td valign="top">
<p class="tabletext">
Attribute uniqueness plug-in.
</p><p class="tabletext">
Confirms that the value of a particular attribute is unique across the local server.
</p></td>
</tr>
</table>
--- NEW FILE configtab_chaindb5.html ---
<p class="topic">
Default Creation Parameters
</p>
<p class="text">
Use this dialog box to set the default attributes for all of your database links.
</p>
<p class="text">
<b>Control Client Return.</b> These options help you specify how the database link responds to client application requests.
</p>
<ul>
<li>
<b>Return referral on scoped search.</b> Select this option to return referrals to client applications in response to scoped searches. Choosing to return referrals optimizes directory server performance, as referrals are more efficient than searching for data in remote databases.
</li>
<li>
<b>Size limit X entries.</b> Specifies the number of entries the database link returns in response to a search request. The default size limit is 2000 entries.
</li>
<li>
<b>Time limit X seconds.</b> Specifies the search time limit for the database link. The default value is 3600 seconds.
</li>
</ul>
<p class="text">
<b>Cascading Chaining.</b> Use the following options to configure cascading chaining, when one database link points to another database link.
</p>
<ul>
<li>
<b>Check local ACI.</b> Select this checkbox to enable evaluation of local ACIs on all database links involved in a chaining operation.
</li>
<li>
<b>Maximum hops.</b> Specifies the number of hops, or times one database link contacts another, allowed. When one database link connects to another, this count decrements. Each subsequent database link contacted further decrements the count. If a server receives a count of 0 it determines that a loop has been detected and notifies the client application. The range is 0 to 20.
</li>
<dl>
<dt>
The default maximum hops value is 10.
<br /> </dt> </dl>
</ul>
<p class="text">
<b>Connection Management.</b> Use these options to configure the pool of connections maintained by the database link with the remote server.
</p>
<ul>
<li>
<b>Maximum TCP connection(s).</b> Maximum number of TCP connections the database link establishes with the remote server. The default value is 3 connections. The range is 1 to 50.
</li>
<li>
<b>Bind timeout. </b>Amount of time, in seconds, before the bind attempt times out. The default value is 15 seconds. The range is 0 to 3600 seconds.
</li>
<li>
<b>Maximum binds per connection.</b> Maximum number of outstanding bind operations per TCP connection. The default value is 10 outstanding bind operations. The range is 0 to 25.
</li>
<li>
<b>Timeout before abandon.</b> The number of seconds that pass before the server checks for abandon operations. The default value is 10 second The range is 0 to 2147483647.
</li>
<li>
<b>Maximum LDAP connection(s).</b> Maximum number of LDAP connections the database link establishes with the remote server. The default value is 10 connections. The range is 1 to 50.
</li>
<li>
<b>Maximum bind retries.</b> Number of times a database link attempts to bind with the remote database. A value of zero indicates that the database link will try to bind only once. The default value is 3 attempts. The range of values is 0 to 10.
</li>
<li>
<b>Maximum operations per connection.</b> Maximum number of outstanding operations per connection. The default value is 10 operations per second. The range is 0 to 50.
</li>
<li>
<b>Connection life (sec). </b>You can keep connections between the database link and the remote database open for an unspecified time, or you can close them after a specific period. It is faster to keep the connections open, but it uses more resources.
</li>
<dl>
<dt>
A value of 0 indicates that there is no limit. By default, the value is set to 0. The range is 0 to 2147483647 seconds.
<br /> </dt> </dl>
</ul>
--- NEW FILE configtab_chaindb6.html ---
<p class="topic">
Database Link Limits and Controls
</p>
<p class="text">
Use the Limits and Controls tab to override the defaults set in Default Creation Parameters tab of the Database link Settings node. You can customize how the database link returns data to client applications and manages connection, and you can configure cascading chaining (in which one database link connects to another).
</p>
<p class="text">
<b>Control Client Return. </b>These options help you specify how the database link responds to client application requests.
</p>
<ul>
<li>
<b>Return referral on scoped search.</b> Select this option to return referrals to client applications in response to scoped searches. Choosing to return referrals optimizes directory server performance, as referrals are more efficient than searching for data in remote databases.
</li>
<li>
<b>Size limit X entries.</b> Specifies the number of entries the database link returns in response to a search request. The default size limit is 2000 entries. The range is from -1 (no limit) to 2147483647.
</li>
<li>
<b>Time limit X seconds.</b> Specifies the search time limit for the database link. After the time limit has passed, the connection is timed out. The default value is 3600 seconds. The value range is -1 (for no limit) to 2147483647.
</li>
</ul>
<p class="text">
<b>Cascading Chaining.</b> Use the following options to configure cascading chaining, when one database link points to another database link.
</p>
<ul>
<li>
<b>Check local ACI.</b> Select this checkbox to enable evaluation of local ACIs on all database links involved in a chaining operation.
</li>
<li>
<b>Maximum hops.</b> Specifies the number of hops, or times a database link contacts another, allowed. When one database link connects to another, this count decrements. Each subsequent database link contacted further decrements the count. If a server receives a count of 0 it determines that a loop has been detected and notifies the client application.
</li>
<dl>
<dt>
The default maximum hops value is 10. The range of values is 0 to 20.
<br /> </dt> </dl>
</ul>
<p class="text">
<b>Connection Management.</b> Use these options to configure the pool of connections maintained by the database link with the remote server.
</p>
<ul>
<li>
<b>Maximum TCP connection(s).</b> Maximum number of TCP connections the database link establishes with the remote server. The default value is 3 connections. The value range is 0 to 50.
</li>
<li>
<b>Bind timeout. </b>Amount of time, in seconds, before the bind attempt times out. The default value is 15 seconds.
</li>
<li>
<b>Maximum binds per connection.</b> Maximum number of outstanding bind operations per TCP connection. The default value is 10 outstanding bind operations. The range of values is from 1 to 25.
</li>
<li>
<b>Timeout before abandon.</b> The number of seconds that pass before the server checks for abandon operations. The default value is 10 seconds. The range is 0 to 2147483647.
</li>
<li>
<b>Maximum LDAP connection(s).</b> Maximum number of LDAP connections the database link establishes with the remote server. The default value is 10 connections. The value range is 1 to 50.
</li>
<li>
<b>Maximum bind retries.</b> Number of times a database link attempts to bind with the remote database. A value of zero indicates that the database link will try to bind only once. The default value is 3 attempts. The range is from 0 to 10.
</li>
<li>
<b>Maximum operations per connection.</b> Maximum number of outstanding operations per connection. The default value is 10 operations per second. The range is from 0 to 50.
</li>
<li>
<b>Connection life (sec).</b> You can keep connections between the database link and the remote database open for an unspecified time, or you can close them after a specific period. It is faster to keep the connections open, but it uses more resources. The range is from 0 (no limit) to 2147483647 seconds.
</li>
</ul>
--- NEW FILE configtab_chaindb7.html ---
<p class="topic">
Database Link Authentication
</p>
<p class="text">
Use the authentication tab to set the attributes required for your new database link to connect with a remote data source on another server.
</p>
<p class="text">
<b>Suffix managed by this database link. </b>The suffix of your directory information tree managed by this database link.
</p>
<p class="text">
<b>Remote server URL. </b>The LDAP URL of the remote server to which this database link connects. The LDAP URL syntax is <br><code>ldap://</code><span class="variable">server</span><code>:[</code><span class="variable">port</span><code>][</code> <span class="variable">server</span><code>[:</code><span class="variable">port</span><code>]]/</code>
</p>
<p class="text">
<b>Database link bind DN. </b>The DN used by the database link to bind with the remote server. This DN cannot be the directory manager.
</p>
<p class="text">
<b>Database link password.</b> Password used by the database link to bind with the remote server.
</p>
<p class="text">
<b>Confirm database link password.</b> Confirm the remote password.
</p>
<p class="text">
<b>Remote server checklist. </b>Lists what you need to configure on the remote server for database link to successfully chain operations.
</p>
<ul>
<li>
<b>User entry. </b>You need to create an entry in the remote database that corresponds to the DN you specified as the remote server bind DN for the database link.
</li>
<li>
<b>Suffix. </b>The suffix associated with the database link must be present on the remote server.
</li>
<li>
<b>ACI. </b>Provides a sample proxy authorization ACI that need to be added to the naming context on the remote database to which the database link points. This ACI gives the proxy administrative user access only to the data contained within the subtree on which it is specified.
</li>
</ul>
--- NEW FILE configtab_db.html ---
<p class="topic">
Indexes
</p>
<p class="text">
Use the tables contained by this tab to set up the indexes for your database. Browsing indexes are set up on the Directory tab of the Directory Server Console.
</p>
<p class="text">
This tab displays two sets of indexes, system indexes and additional indexes.
</p>
<p class="text">
<b>System Indexes (Read-Only).</b> Directory Server creates system indexes by default. They are used internally by the server and cannot be removed.
</p>
<p class="text">
<b>Additional Indexes</b>. You can specify a standard set of indexes for Directory Server to maintain.
</p>
<ul>
<li>
<b>Attribute name. </b>Contains the name of the attribute to be indexed.
</li>
<li>
<b>Approximate.</b> Select this checkbox to configure the server to create and maintain an approximate, or "sounds-like," index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</li>
<li>
<b>Equality.</b> Select this checkbox to configure the server to create and maintain an equality index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</li>
<li>
<b>Presence.</b> Select this checkbox to configure the server to create and maintain a presence index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</li>
<li>
<b>Substring.</b> Select this checkbox to configure the server to create and maintain a substring index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</li>
<li>
<b>Matching rule.</b> Enter the matching rule OID (if any) you want the server to use when client applications search the directory using this attribute.
</li>
</ul>
<p class="text">
<b>Add attribute.</b> If the attribute you want to index is not listed in the table, click the "Add Attribute" button. This brings up the Select Attribute dialog box. Select the attribute you want to add and click OK.
</p>
<p class="text">
<b>Delete attribute.</b> To remove all of the indexes for a particular attribute, select the attribute in the table, click Delete Attribute, and then click Save.
</p>
--- NEW FILE configtab_db10.html ---
<p class="topic">
Export Single Database
</p>
<p class="text">
Use this dialog box to export a single database to LDIF.
</p>
<p class="text">
<b>LDIF file (on remote machine). </b>Enter the full path to the LDIF file. Click Browse to locate it on your machine. By default, if you are running the console locally, the file is stored in the current directory.
</p>
<p class="text">
When the Browse button is not enabled, by default the file is stored in /<code>opt/<span class="variable">productID</span>/slapd-</code><span class="variable">serverID</span><code>/ldif</code>
</p>
--- NEW FILE configtab_db11.html ---
<p class="topic">
LDBM Plug-in Settings
</p>
<p class="text">
Use this tab to configure general database settings.
</p>
<p class="text">
<b>Maximum cache size.</b> Memory available on disk for all indexes. By default, the value is 10000000 bytes.
</p>
<p class="text">
<b>Look-through limit. </b>Maximum number of entries the directory checks in response to a search request. The default value is 5000 entries.
</p>
<p class="text">
<b>Database mode files.</b> Specific permissions applied to the database, in octal.
</p>
<p class="text">
<b>Import cache size.</b> Memory available on disk for the database to cache information during an import operation, in bytes.
</p>
--- NEW FILE configtab_db12.html ---
<p class="topic">
Default Indexes
</p>
<p class="text">
Use this tab to configure the default indexes for your databases.
</p>
<p class="text">
<b>Attribute name. </b>Contains the name of the attribute to be indexed.
</p>
<p class="text">
<b>Approximate.</b> Select this checkbox to configure the server to create and maintain an approximate, or "sounds-like," index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</p>
<p class="text">
<b>Equality.</b> Select this checkbox to configure the server to create and maintain an equality index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</p>
<p class="text">
<b>Presence.</b> Select this checkbox to configure the server to create and maintain a presence index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</p>
<p class="text">
<b>Substring.</b> Select this checkbox to configure the server to create and maintain a substring index for the attribute; clear this checkbox to discontinue indexing on this attribute.
</p>
<p class="text">
<b>Matching rule.</b> Enter the matching rule OID (if any) you want the server to use when client applications search the directory using this attribute.
</p>
<p class="text">
<b>Add attribute.</b> If the attribute you want to index is not listed in the table, click the "Add Attribute" button. This brings up the Select Attribute dialog box. Select the attribute you want to add and click OK.
</p>
<p class="text">
<b>Delete attribute.</b> To remove all of the indexes for a particular attribute, select the attribute in the table, click Delete Attribute, and then click Save.
</p>
--- NEW FILE configtab_db13.html ---
<p class="topic">
Attribute Encryption Tab
</p>
<p class="text">
By configuring attribute encryption, or database encryption, it is possible to encrypt highly sensitive information as it is stored within the database. The values of these attributes are encrypted and can only be read during a secure session. Use this tab to select attributes to encrypt.
</p>
<p class="text">
<b>Encrypted Attributes.</b> Text box of encrypted attributes.
</p>
<ul>
<li>
<b>Attribute name.</b> The name of the attribute that is encrypted.
</li>
<li>
<b>Encryption Algorithm.</b> The encryption cipher used to encrypt that attribute.
</li>
</ul>
<p class="text">
<b>Add attribute.</b> Brings up a list of all system attributes that can be encrypted.
</p>
<p class="text">
<b>Delete attribute.</b> Deletes an encrypted attribute. This does not delete the attribute or its value; it disables encryption.
</p>
--- NEW FILE configtab_db14.html ---
<p class="topic">
Attribute Encryption - Add Attribute Button
</p>
<p class="text">
A list of all system attributes that can be encrypted, in the "Select Attribute to Encrypt" box.
</p>
<p class="text">
Select an attribute you wish to encrypt, and click OK. This will bring up the "Select Encryption Method" box.
</p>
--- NEW FILE configtab_db15.html ---
<p class="topic">
Attribute Encryption - Select Encryption Method Box
</p>
<p class="text">
After selecting an attribute to encrypt and clicking okay, the "Select Encryption Method" box comes up, with a list of encryption ciphers available for attribute encryption.
</p>
<p class="text">
There are currently two supported ciphers:
</p>
<ul>
<li>AES</li>
<li>3DES</li>
</ul>
<p class="text">
You may only select one. Click OK to add a cipher and complete the encrypted attribute or cancel to close out the selection.
</p>
--- NEW FILE configtab_db2.html ---
<p class="topic">
Passwords Tab
</p>
<p class="text">
Use this tab to set up a password policy for the directory.
</p>
<p class="text">
<b>Enable fine-grained password policy. </b>When selected, enables the fine-grained (subtree and user level) password policy.
</p>
<p class="text">
<b>User must change password after reset. </b>When selected, users must change their passwords when they first log in or after the administrator resets the passwords.
</p>
<p class="text">
<b>User may change password.</b> When selected, allows users to change their own passwords.
</p>
<p class="text">
<b>Allow changes in X day(s). </b>Defines how often users can change their password. Use this value in conjunction with "Keep password history" to discourage users from recycling old passwords.
</p>
<p class="text">
<b>Keep password history.</b> Specifies that the server keep a list of user passwords. Use this in conjunction with "Allow changes in X day(s)" to discourage users from reusing old passwords. If you select this option, enter the number of passwords users must cycle through before they can reuse a password.
</p>
<p class="text">
<b>Remember X passwords. </b>If the server is keeping a password history, this option specifies how many old passwords the server should store in the history list. The valid value range is from 2 to 24. The default value is 6.
</p>
<p class="text">
<b>Password never expires.</b> Select this if you do not require users to change their passwords periodically.
</p>
<p class="text">
<b>Password expires after X days. </b>Select this if you want users to change their passwords periodically. If you select the option, in the text box, you must enter the number of days in which the password will expire.
</p>
<p class="text">
Note that the maximum value for the password age is derived by subtracting January 18, 2038 from today's date. The value you enter must not be set to the maximum value or too close to the maximum value. If you set the value to the maximum value, Directory Server may fail to start because the number of seconds will go past the epoch date. In such an event, the error log will indicate that the password maximum age is invalid. To resolve this problem, you must correct the <code>paswordMaxAge</code> attribute value in the <code>dse.ldif</code> file.
</p>
<p class="text">
A common policy is to have passwords expire every 30 to 90 days. By default, the password maximum age is set to 8640000 seconds (100 days).
</p>
<p class="text">
<b>Send warning X day(s) before password expires.</b> Indicates the number of days before a user's password is due to expire that the user will be sent a warning message. The valid value range is from 1 to 24,855 days. The default value is 1 day.
</p>
<p class="text">
<b>Allow up to X login attempt(s) after password expires.</b> Indicates the number of grace logins permitted after a user's password has expired. Grace logins are not permitted by default.
</p>
<p class="text">
<b>Check password syntax.</b> Select this checkbox to enforce password syntax checking. Syntax checking ensures that the password strings conform to the syntax guidelines, such as minimum password length.
</p>
<p class="text">
<b>Password minimum length. </b>If syntax checking is on, this option specifies the minimum number of characters that must be used in directory server passwords. The valid value range is from 2 to 512 characters. The default value is 6.
</p>
<p class="text">
<b>Password encryption. </b>Identifies how user passwords are stored in the directory. You can specify one of the following encryption formats:
</p>
<ul>
<li>
Salted Secure Hashing Algorithm (SSHA). This method is recommended as the most secure. SSHA is the default encryption method.
</li>
<li>
UNIX crypt algorithm (CRYPT). Provided for compatibility with UNIX passwords.
</li>
<li>
Secure Hashing Algorithm (SHA). A one-way has algorithm that is the default encryption schema in Directory Server 4.x.
</li>
<li>
No encryption (CLEAR). This encryption type indicates that the password will appear in plain text.
</li>
</ul>
<p class="text">
Passwords stored using SSHA, CRYPT, or SHA formats cannot be used for secure login through SASL Digest MD5.
</p>
--- NEW FILE configtab_db3.html ---
<p class="topic">
Account Lockout Tab
</p>
<p class="text">
You can set up a account lockout policy for the directory using the Account Lockout tab.
</p>
<p class="text">
<b>Accounts may be locked out. </b>Select this option to enable account lockout because of repeated login failures. Clear this checkbox if you do not want users to be locked out of the directory after a series of failed bind attempts.
</p>
<p class="text">
<b>Lockout account after X login failures.</b> Specify the number of times a user can fail to bind before they are locked out of the directory. Valid values are 1 to 32,767 attempts. This option is available only if account lockout is enabled.
</p>
<p class="text">
<b>Reset failure count after X minutes. </b>Indicates the amount of time that must elapse before the failure counter is reset. This option is available only if account lockout is enabled. Valid values are 1 to 35,791,394 minutes.
</p>
<p class="text">
<b>Lockout forever.</b> Select this option to indicate that user accounts that have been locked must be reset by the administrator before users can access the directory. If you select this option, you cannot set a lockout duration.
</p>
<p class="text">
<b>Lockout duration X minutes. </b>Select this option to indicate the amount of time a user will be locked out of the directory after a series of failed bind attempts. If you select this option, you must enter a number of minutes in the text box. Valid values are 1 to 35,791,394 minutes. This option is available only if account lockout is enabled.
</p>
--- NEW FILE configtab_db4.html ---
<p class="topic">
Select Attribute
</p>
<p class="text">
Use this dialog box to specify an attribute for which you want the server to maintain an index.
</p>
<p class="text">
<b>Attributes list.</b> This list contains all of the attributes currently in the directory schema. Select the attribute for which you want to maintain an index and click OK.
</p>
--- NEW FILE configtab_db5.html ---
<p class="topic">
Database Settings
</p>
<p class="text">
Use this tab to configure the settings for a particular database instance. These settings take precedent over the default settings you have described for databases in general.
</p>
<p class="text">
<b>Suffix</b>. Suffix maintained by this database.
</p>
<p class="text">
<b>Database location. </b>Full path to the database location on the server.
</p>
<p class="text">
<b>Maximum entries in cache. </b>Maximum number of entries stored in the database cache for processing client search requests. A value of -1 indicates no limit. For performance tuning purposes.
</p>
<p class="text">
<b>Memory available for cache.</b> Maximum memory available to the database for storing cached entries, in bytes. For performance tuning purposes.
</p>
<p class="text">
<b>Database is read-only. </b>Select this checkbox to make the database read-only.
</p>
--- NEW FILE configtab_db6.html ---
<p class="topic">
Import Database
</p>
<p class="text">
Use this dialog box to append data to all of your databases using LDAP. You can also use this option to modify and delete entries.
</p>
<p class="text">
<b>LDIF file (on Console's machine). </b>Enter the full path to the LDIF file you want to import. Click Browse to select the file you want to import. By default, the console uses your current path.
</p>
<p class="text">
<b>Add only. </b>The LDIF file may contain modify and delete instructions in addition to the default add instructions. If you want the server to ignore operations other than add, select this checkbox.
</p>
<p class="text">
<b>Continue on error. </b>Select this checkbox if you want the server to continue with the import even if errors occur. For example, use this option if you are importing an LDIF file that contains some entries that already exist in the database in addition to new ones. The server notes existing entries in the rejects file while adding all new entries.
</p>
<p class="text">
<b>File for rejects. </b>Enter the full path to the file in which you want the server to record all entries it cannot import. For example, the server cannot import an entry that already exists in the database or an entry that has no parent object. By default, the server creates the rejects file in the current directory.
</p>
--- NEW FILE configtab_db7.html ---
<p class="topic">
Import
</p>
<p class="text">
Use this dialog box to import data to one database or all of your databases. This method overwrites any data contained by the database.
</p>
<p class="text">
<b>LDIF file. </b>Enter the full path to the LDIF file you want to import. Click Browse to locate the file on your machine.
</p>
<p class="text">
The following two options apply only if you operate the console from a machine remote to the server containing the LDIF file.
</p>
<p class="text">
<b>From local machine. </b>Select this radio button to indicate that the LDIF file is located on the local server. By default, the console looks for a file stored in the current directory.
</p>
<p class="text">
<b>From server machine. </b>Select this radio button to indicate that the LDIF file is located on a remote server. By default, the console looks for the file in the following directory: <code>/opt/<span class="variable">productID</span>/slapd-</code><span class="variable">serverID</span><code>/ldif</code>.
</p>
--- NEW FILE configtab_db8.html ---
<p class="topic">
Initialize Database
</p>
<p class="text">
Use this dialog box to overwrite any existing data in your database by importing a file from LDIF.
</p>
<p class="text">
<b>LDIF file. </b>Enter the full path to the LDIF file you want to import. Click Browse to locate it on your machine.
</p>
<p class="text">
If you are operating the console from a machine remote to the server containing the LDIF file, select one of the following options:
</p>
<ul>
<li>
<b>From local machine. </b>Indicates that the LDIF file is located on the local server. By default, the console looks in the current directory for the LDIF file.
</li>
<li>
<b>From server machine. </b>Indicates that the LDIF file is located on a remote server.
</li>
</ul>
--- NEW FILE configtab_db9.html ---
<p class="topic">
Export Databases
</p>
<p class="text">
Use this dialog box to export your databases to LDIF.
</p>
<p class="text">
<b>LDIF File. </b>Enter the name you want the server to use for the LDIF file. If you are running Directory Server Console on the server's host machine, click Browse to select the file to which you want to export.
</p>
<p class="text">
<b>To Local Machine. </b>Choose this option to export the database to a local file. This option is not visible if you are running Directory Server Console on the directory's host.
</p>
<p class="text">
<b>To Server Machine. </b>Choose this option to export the database to a file on the server's host machine. If you choose this option, you cannot Browse to select a different file. This option is not visible if you are running Directory Server Console on the directory's host.
</p>
<p class="text">
<b>All Databases. </b>Select this option to export the all of your databases to LDIF.
</p>
<p class="text">
<b>Subtree. </b>Select this option if you want the server to export only a portion of the directory to LDIF. If you choose this option, you must also select the subtree you want the server to export.
</p>
<p class="text">
<b>Subtree text box. </b>If you selected the Subtree radio button, you can enter the subtree you want the server to export to LDIF in this text box. You can also click Browse to browse the directory and select a subtree.
</p>
--- NEW FILE configtab_ldbmdb.html ---
<p class="topic">
Create New Database
</p>
<p class="text">
Use this dialog box to create a new database.
</p>
<p class="text">
<b>Suffix Name.</b> This field appears only when you create a new database in an existing suffix. Gives the name of the suffix contained by the database.
</p>
<p class="text">
<b>Database information.</b> Use these options to specify the database name and location.
</p>
<p class="text">
<b>Database Name.</b> Enter a unique name for the database. This value cannot contain commas or equals signs (=).
</p>
<p class="text">
<b>Create database in. </b>Enter the full path to the location on your machine where you want the new database to reside. Click Browse to locate a directory.
</p>
--- NEW FILE configtab_logs.html ---
<p class="topic">
Access Log
</p>
<p class="text">
Use this tab to configure various settings for the directory's access log. The access log contains detailed information about client connections to the directory.
</p>
<p class="text">
<b>Enable logging.</b> Select this checkbox to configure the server to keep an access log; clear this checkbox to disable access logging.
</p>
<p class="text">
<b>View Log. </b>Click this button to view the access log for the directory.
</p>
<p class="text">
<b>Log File. </b>Contains the full path and name of the access log file. By default, the value is:
</p>
<p class="code">
<code><span class="variable">serverRoot</span>/slapd-<span class="variable">serverID</span>/logs/access</code>
</p>
<p class="text">
<b>Creation Policy. </b>These options allow you to specify how often the server archives the current access log and starts a new log file.
</p>
<p class="text">
<b>Access mode. </b>Indicates the access mode or UNIX file permissions with which log files are to be created. The default value is 600.
</p>
<p class="text">
The valid values are any combination of 000 to 777, as they mirror <em>numbered</em> or <em>absolute</em> UNIX file permissions. That is, the value must be a combination of a 3-digit number, the digits varying from 0 through 7:
</p>
<p class="text">
0 - None<br />1 - Execute only<br />2 - Write only<br />3 - Write and execute<br />4 - Read only<br />5 - Read and execute<br />6 - Read and write<br />7 - Read, write, and execute
</p>
<p class="text">
In the 3-digit number, the first digit represents the owner's permissions, the second digit represents the group's permissions, and the third digit represents everyone's permissions. When changing the default value, keep in mind that 000 will not allow access to the logs and allowing <em>write</em> permissions to <em>everyone</em> can result in the logs being overwritten or deleted by anyone.
</p>
<p class="text">
Note that the newly configured access mode will only affect new logs that are created; the mode will be set when the log rotates to a new file.
</p>
<p class="text">
<b>Maximum number of logs. </b>The number of logs to archive per directory. When the server exceeds this amount, it deletes old archive logs. The default value is 10.
</p>
<p class="text">
<b>File size for each log. </b>The maximum file size (in MB) for active access log files. Once a file reaches the size you specify, the server archives the file and starts a new one. To specify no maximum, enter a value of -1.
</p>
<p class="text">
<b>Create a new log every. </b>How often you want the server to start a new access log. The server archives a log file if the size of the file reaches the maximum file size or the specified time limit has elapsed, whichever comes first.
</p>
<p class="text">
<b>Deletion Policy. </b>These options allow you to configure the server to delete unneeded archived access log files.
</p>
<p class="text">
<b>When total log exceeds. </b>The server will delete the oldest archived access log once the total of all the logs reaches this amount. The value is given in MB.
</p>
<p class="text">
<b>When free disk space is less than. </b>The server will delete the oldest archived access log if the available disk space is less than this amount. The value is given in MB.
</p>
<p class="text">
<b>When a file is older than. </b>The server will delete an archived access log when the file is older than the age you specify.
</p>
--- NEW FILE configtab_logs2.html ---
<p class="topic">
Error Log
</p>
<p class="text">
Use this tab to configure the directory's error log. The error log contains detailed messages about errors and events the server experiences during normal operations.
</p>
<p class="text">
<b>Enable logging. </b>Select this checkbox to configure the server to keep an error log; clear this checkbox to disable error logging.
</p>
<p class="text">
<b>View Log. </b>Click this button to view the error log for the directory.
</p>
<p class="text">
<b>Log File. </b>Contains the full path and filename of the error log. By default, the value is:
</p>
<p class="code">
<span class="variable">serverRoot</span>/slapd-</font><span class="variable">serverID</span>/logs/errors
</font>
</p>
<p class="text">
<b>Creation Policy. </b>These options allow you to specify how often the server archives the current error log and starts a new log file.
</p>
<p class="text">
<b>Access mode. </b>Indicates the access mode or UNIX file permissions with which log files are to be created. The default value is 600.
</p>
<p class="text">
The valid values are any combination of 000 to 777, as they mirror <em>numbered</em> or <em>absolute</em> UNIX file permissions. That is, the value must be a combination of a 3-digit number, the digits varying from 0 through 7:
</p>
<p class="text">
0 - None<br />1 - Execute only<br />2 - Write only<br />3 - Write and execute<br />4 - Read only<br />5 - Read and execute<br />6 - Read and write<br />7 - Read, write, and execute
</p>
<p class="text">
In the 3-digit number, the first digit represents the owner's permissions, the second digit represents the group's permissions, and the third digit represents everyone's permissions. When changing the default value, keep in mind that 000 will not allow access to the logs and allowing <em>write</em> permissions to <em>everyone</em> can result in the logs being overwritten or deleted by anyone.
</p>
<p class="text">
Note that the newly configured access mode will only affect new logs that are created; the mode will be set when the log rotates to a new file.
</p>
<p class="text">
<b>Maximum number of logs. </b>The number of logs to archive per directory. The default value is 1 log, meaning that the server does not rotate the log and it grows indefinitely.
</p>
<p class="text">
<b>File size for each log. </b>The maximum file size (in MB) for active error log files. Once a file reaches the size you specify, the server archives the file and starts a new one.
</p>
<p class="text">
<b>Create a new log every. </b>How often you want the server to start a new error log. The server archives a log file if the size of the file reaches the maximum file size or the specified time limit has elapsed, whichever comes first.
</p>
<p class="text">
<b>Deletion Policy. </b>These options allow you to configure the server to delete unneeded archived error log files.
</p>
<p class="text">
<b>When total log exceeds. </b>The server will delete the oldest archived error log once the total of all the logs reaches this amount.
</p>
<p class="text">
<b>When free disk space is less than. </b>The server will delete the oldest archived error log if the available disk space is less than this amount.
</p>
<p class="text">
<b>When a file is older than. </b>The server will delete an archived error log when the file is older than the age you specify.
</p>
<p class="text">
<b>Log Level. </b>Specifies the kinds of error and event messages the server should store in the error log. By default, no options are selected. Selecting any option will cause the error log to grow very rapidly because additional information is written for every request the server receives.
</p>
--- NEW FILE configtab_logs3.html ---
<p class="topic">
Audit Log
</p>
<p class="text">
Use this tab to configure the directory's audit log. The audit log contains detailed information about changes made to each database as well as to the overall server configuration.
</p>
<p class="text">
<b>Enable logging. </b>Select this checkbox to configure the server to keep an audit log; clear this checkbox to disable audit logging.
</p>
<p class="text">
<b>View Log. </b>Click this button to view the audit log for the directory.
</p>
<p class="text">
<b>Log File. </b>Contains the full path and name of the audit log. By default, the value is:
</p>
<p class="code">
<span class="variable">serverRoot</span>/slapd-<span class="variable">serverID</span>/logs/audit
</p>
<p class="text">
<b>Creation Policy. </b>These options allow you to specify how often the server archives the current audit log and starts a new log file.
</p>
<p class="text">
<b>Access mode. </b>Indicates the access mode or UNIX file permissions with which log files are to be created. The default value is 600.
</p>
<p class="text">
The valid values are any combination of 000 to 777, as they mirror <em>numbered</em> or <em>absolute</em> UNIX file permissions. That is, the value must be a combination of a 3-digit number, the digits varying from 0 through 7:
</p>
<p class="text">
0 - None<br />1 - Execute only<br />2 - Write only<br />3 - Write and execute<br />4 - Read only<br />5 - Read and execute<br />6 - Read and write<br />7 - Read, write, and execute
</p>
<p class="text">
In the 3-digit number, the first digit represents the owner's permissions, the second digit represents the group's permissions, and the third digit represents everyone's permissions. When changing the default value, keep in mind that 000 will not allow access to the logs and allowing <em>write</em> permissions to <em>everyone</em> can result in the logs being overwritten or deleted by anyone.
</p>
<p class="text">
Note that the newly configured access mode will only affect new logs that are created; the mode will be set when the log rotates to a new file.
</p>
<p class="text">
<b>Maximum number of logs. </b>The number of logs to archive per directory.
</p>
<p class="text">
<b>File size for each log. </b>The maximum file size (in MB) for active audit log files. Once a file reaches the size you specify, the server archives the file and starts a new one.
</p>
<p class="text">
<b>Create a new log every. </b>How often you want the server to start a new audit log. The server archives a log file if the size of the file reaches the maximum file size or the specified time limit has elapsed, whichever comes first.
</p>
<p class="text">
<b>Deletion Policy. </b>These options allow you to configure the server to delete unneeded archived audit log files.
</p>
<p class="text">
<b>When total log exceeds. </b>The server will delete the oldest archived audit log once the total of all the logs reaches this amount.
</p>
<p class="text">
<b>When free disk space is less than. </b>The server will delete the oldest archived audit log if the available disk space is less than this amount.
</p>
<p class="text">
<b>When a file is older than. </b>The server will delete an archived audit log when the file is older than the age you specify.
</p>
--- NEW FILE configtab_maptree.html ---
<p class="topic">
Suffix Settings
</p>
<p class="text">
Use this tab to specify settings for a particular root or sub suffix.
</p>
<p class="text">
<b>Suffix name. </b>This field gives the name of the suffix. If the suffix is a root suffix, the console states "This is a root suffix." If the suffix is a sub suffix, the root suffix to which it belongs is named in the "Suffix belongs to" field.
</p>
<p class="text">
<b>Enable this suffix. </b>By default, this checkbox is selected. To disable the suffix (for example, when you take a database down for maintenance), deselect this checkbox.
</p>
<p class="text">
<b>Suffix request processing. </b>These options help you configure how requests from client applications are managed by this suffix.
</p>
<p class="text">
<b>Use the Databases. </b>Select this option if you want the databases and database links to be used for processing all requests made by client applications.
</p>
<p class="text">
<b>Return Referrals for all Operations. </b>Select this option to return a referral in response to all client application requests. For example, you might when a database is taken off line.
</p>
<p class="text">
<b>Return Referrals for Update Operations. </b>Select this option to return a referral only during update requests. This is useful for redirecting client requests made to read-only databases.
</p>
--- NEW FILE configtab_maptree2.html ---
<p class="topic">
Database List
</p>
<p class="text">
This dialog box lists all of the databases in your directory. Select one from the list and click OK. You can highlight multiple databases by holding down the Shift key while you select databases with your mouse.
</p>
--- NEW FILE configtab_maptree3.html ---
<p class="topic">
Databases
</p>
<p class="text">
Use this tab to specify the databases for the suffix.
</p>
<p class="text">
<b>Database information. </b>Enter the database or databases that contain entries for this suffix in this box. Click Add to browse a list of available databases. Click Delete to remove a database from the list.
</p>
<p class="text">
<b>Distribution Logic for Multiple Databases. </b>Use the options in this section to specify custom distribution logic for your directory. You use distribution logic when you distribute a single suffix across multiple databases. You need to specify the following:
</p>
<ul>
<li>
<b>Distribution library. </b>Enter the name of your distribution library. Click Browse to locate a library in a different directory.
</li>
<li>
<b>Function name. </b>Enter the name of your distribution function.
</li>
</ul>
--- NEW FILE configtab_maptree4.html ---
<p class="topic">
Referrals
</p>
<p class="text">
Use this tab to configure the referrals returned by the suffix.
</p>
<p class="text">
<b>Enter a new referral. </b>Enter a referral in LDAP URL format, or click Construct to be guided through the process. Click Add to add the referral to the list.
</p>
<p class="text">
<b>Current referrals for this suffix. </b>Lists the referrals currently in place for this suffix. The entire list of referrals is returned to client applications in response to a request, when you select Referral or Referral on Update in the Suffix Settings tab. Click Delete to remove a referral from the list.
</p>
--- NEW FILE configtab_maptree5.html ---
<p class="topic">
Creating a New Root Suffix
</p>
<p class="text">
Use this dialog box to create a new root suffix.
</p>
<p class="text">
<b>New suffix. </b>Enter a unique name for the new root suffix. The suffix must be named according to dc naming conventions. For example, <code>dc=example,dc=com</code> could be the name of a new root suffix.
</p>
<p class="text">
<b>Create associated database automatically.</b> Select this checkbox to automatically create a database for the new root suffix.
</p>
<p class="text">
<b>Database name. </b>If you select the "Create associated database automatically" checkbox, enter the name of the new database in this field.
</p>
--- NEW FILE configtab_maptree6.html ---
<p class="topic">
Creating a New Sub Suffix
</p>
<p class="text">
Use this dialog box to create a new sub suffix under an already existing root suffix.
</p>
<p class="text">
<b>New suffix. </b>Enter the new sub suffix name in this field. The suffix must be named according to dc naming conventions. For example, <code>o=people</code> could be the name of a new sub suffix.
</p>
<p class="text">
<b>Suffix belongs to. </b>Indicates the root suffix this sub suffix is beneath.
</p>
<p class="text">
<b>Complete suffix name. </b>Combines the new suffix name with the root suffix name.
</p>
<p class="text">
<b>Create associated database automatically.</b> Select this checkbox to automatically create a database for the new sub suffix.
</p>
<p class="text">
<b>Database name. </b>If you select the "Create associated database automatically" checkbox, enter the name of the new database in this field.
</p>
--- NEW FILE configtab_maptree7.html ---
<p class="topic">
Remove Suffix
</p>
<p class="text">
Use this dialog box to delete a suffix and its sub suffixes. Deleting a suffix also deletes the databases and replication agreements of the suffix.
</p>
<p class="text">
<b>Delete this suffix and all of its sub suffixes. </b>Select this option to delete this suffix and all sub suffixes beneath it. Selecting this option also deletes all databases and replication agreements of this suffix.
</p>
<p class="text">
<b>Delete this suffix only. </b>Select this option to delete only this suffix, its associated database and replication agreements. Any sub suffixes beneath this suffix will move up a level after the deletion. For example, if you delete a root suffix only, the sub suffix directly beneath becomes a root suffix after the deletion.
</p>
--- NEW FILE configtab_plugins.html ---
<p class="topic">
Plug-ins
</p>
<p class="text">
When you select a plug-in, the right pane displays basic information about the plug-in. You cannot modify plug-ins from the Directory Server Console.
</p>
<p class="text">
<b>Enable plug-in. </b>Select this checkbox to enable the plug-in; clear the checkbox to disable the plug-in. After enabling or disabling a plug-in, you must restart the directory.
</p>
<p class="text">
<b>Plug-in ID. </b>Gives the name of the plug-in.
</p>
<p class="text">
<b>Description. </b>Contains descriptive text about the plug-in.
</p>
<p class="text">
<b>Version. </b>Gives the version number of the plug-in.
</p>
<p class="text">
<b>Vendor. </b>Identifies the manufacturer of the plug-in.
</p>
<p class="text">
<b>Plug-in type. </b>Defines the type of plug-in, such as preoperational or postoperational.
</p>
<p class="text">
<b>Initialization function. </b>Identifies the function that the server calls to initialize the plug-in.
</p>
<p class="text">
<b>Plug-in module path. </b>Gives the name and path of the shared object or dynamic link library that contains the plug-in.
</p>
<p class="text">
<b>Arguments. </b>Specifies any additional arguments that are passed to the initialization function.
</p>
--- NEW FILE configtab_replication.html ---
<p class="topic">
Legacy Consumer Settings
</p>
<p class="text">
The replication model used in Directory Server 4.1x and the current replication model are different. The former replication model is termed Legacy Replication. Only use this tab if you wish to accept replication updates from a 4.1x Directory Server using legacy replication.
</p>
<p class="text">
<b>Enable Legacy Consumer. </b> Select this checkbox if you want this current Directory Server, to act as a legacy consumer. This means that this server can accept updates from a 4.1x supplier server. You must check this checkbox to activate the other fields in this window.
</p>
<p class="text">
<b>Supplier DN.</b> Use this field to specify the distinguished name that any supplier server must use to bind to this consumer server to send replication updates. The supplier DN must correspond to an entry that is stored on the consumer server. This entry must not be part of the replicated database.
</p>
<p class="text">
<b>New supplier password. </b> If a password is specified, the supplier server uses this password to bind to the consumer server.
</p>
<p class="text">
<b>Confirm new supplier password. </b> Confirms that the password entered in the "New supplier password" field is correct.
</p>
--- NEW FILE configtab_replication2.html ---
<p class="topic">
Supplier Settings
</p>
<p class="text">
Use this tab to configure a server as a supplier server. You must specify supplier attributes on any server that holds the master copy of a directory database.
</p>
<p class="text">
<b>Enable Changelog. </b>Check this box if you want this server to record all update operations in a change log so that these changes can be replayed on a consumer server.
</p>
<p class="text">
<b>Changelog database directory. </b>The directory in which the supplier server stores the change log.
</p>
<p class="text">
<b>Browse. </b>If you want the server to display a file selector so that you can select a directory for storing the change log database, click this button.
</p>
<p class="text">
<b>Use default. </b>If you want the server to suggest a default path name for the change log database, click this button.
</p>
<p class="text">
<b>Max changelog records.</b> The maximum number of entries recorded in the change log. If you select the Unlimited checkbox, no maximum size is set for the change log.
</p>
<p class="text">
<b>Max changelog age. </b>When an entry in the change log reaches the age specified here, the server removes the entry from the change log. If you select the Unlimited checkbox, the server does not remove entries from the change log based on age.
</p>
<p class="text">
To remove a change log database that has grown too big, you must manually delete it.
</p>
--- NEW FILE configtab_replication3.html ---
<p class="topic">
Replica Settings
</p>
<p class="text">
Use this tab to configure replication settings for the database selected in the left navigation tree.
</p>
<p class="text">
<b>Enable Replica. </b>Select this checkbox to enable replication. You must select this checkbox to activate all other fields in the window.
</p>
<p class="text">
<b>Single Master. </b>Select this radio button if you want this Directory Server to act as the single supplier server for this database.
</p>
<p class="text">
<b>Multiple Master. </b>Select this radio button if you want this Directory Server to act as one of the supplier servers that can replicate this database to consumers.
</p>
<p class="text">
<b>Hub. </b>Select this radio button if you want this Directory Server to accept updates from a supplier server, and replicate changes to consumer servers.
</p>
<p class="text">
<b>Dedicated Consumer. </b>Select this radio button if you want this Directory Server to accept updates from a supplier server. A dedicated consumer can service search operations but not update operations. Update operations will be referred to a supplier server.
</p>
<p class="text">
<b>Replica ID. </b>An integer between 1 and 255 that identifies the replica. The replica IDs of the master replicas must be unique. In other words, master replicas involved in the same multi-master configuration must have different replica IDs. However, two master replicas (corresponding to different suffixes) on the same server can have the same replica ID.
</p>
<p class="text">
If the ID is incorrect, the field labels turn red and the Save button is disabled.
</p>
<p class="text">
<b>Purge delay.</b> The delay you specify in these fields determines how often the state information stored in the replicated entries is purged. Check the Never checkbox if you want to save this information indefinitely.
</p>
<p class="text">
<b>Updatable by a 4.x Replica.</b> Check this checkbox if you want this Directory Server to act as a legacy consumer of a 4.x supplier server.
</p>
<p class="text">
<b>Current Supplier DNs.</b> This field lists the supplier bind DNs that supplier servers must use to update this replica. You can now specify multiple supplier bind DNs per replica, but only one supplier DN per replication agreement. Use the "Enter a new Supplier DN" field to specify a new supplier DN and click Add to add it to this list. If you have configured replication over SSL, specify the DN of the entry that contains the supplier's certificate in the "Enter a new Supplier DN" field and click Add to add it to this list.
</p>
<p class="text">
<b>Current URLs for referrals (Optional).</b> Directory Server uses the information contained in the replication agreement to create referrals from the consumer server to the appropriate supplier servers. This field lists the URLs you specify in addition to the automatic URLs which will be set up automatically. If you want the consumer to return an <code>ldaps://</code> URL, so that clients will bind to the supplier servers using SSL, enter the URL in the "Enter a new URL" field and click Add to add it to this list of current URLs. In the same way, if you have a cascading replication scenario and you want the referral returned to clients to point to the original supplier instead of the hub supplier, enter the corresponding URL in the "Enter a new URL" field and click Add to add it to this list of current URLs.
</p>
--- NEW FILE configtab_replication4.html ---
<p class="topic">
Replication Summary
</p>
<p class="text">
You use the replication agreement Summary tab to view status or change the name of the replication agreement.
</p>
<p class="text">
<b>Description. </b>Contains the description of the replication agreement.
</p>
<p class="text">
<b>General. </b>Displays information about:
</p>
<ul>
<li>
Supplier—The name of the supplier server in the agreement.
</li>
<li>
Consumer—The name of the consumer server in the agreement.
</li>
<li>
Replicated subtree—The subtree replicated in the agreement.
</li>
</ul>
<p class="text">
<b>Status. </b>This area displays information about the replication agreement, including the number of the last change sent to the consumer server, current status of the replication agreement, and the replication history.
</p>
--- NEW FILE configtab_replication5.html ---
<p class="topic">
Replication Schedule
</p>
<p class="text">
Use this tab when you modify a replication agreement to identify the time of day and day of week replication occurs. No new replication processes will be started outside the specified replication interval.
</p>
<p class="text">
<b>Always Keep Directories in Sync. </b>Select this option if you do not want to set time restrictions on the replication agreement.
</p>
<p class="text">
<b>Sync on the following days. </b>When selected, you can select the checkbox(es) next to the day(s) of the week when replication can occur. Click All to select every day of the week.
</p>
<p class="text">
<b>Replication will take place between.</b> Enter the hours during which replication takes place in the boxes provided.
</p>
--- NEW FILE configtab_replication6.html ---
<p class="topic">
Replication Connection
</p>
<p class="text">
Use the Connection tab to display the type of connection used by your replica during replication. You can use this tab to modify the user bind name and password. You cannot change the connection type. To change the connection type, re-create the replication agreement.
</p>
<p class="text">
<b>Using Encrypted SSL Connection. </b>When selected, specifies that the supplier and consumer servers use SSL for secure communication.
</p>
<p class="text">
<b>SSL Client Authentication. </b>When selected, this option specifies that the supplier and consumer servers use certificates for secure communication. SSL client authentication is not used unless the "Using Encrypted SSL Connection" checkbox is selected. The Bind As and Password fields are unavailable with this option because the server will use its security certificate to authenticate to the consumer server.
</p>
<p class="text">
To select this option, you must first do the following:
</p>
<ul>
<li>
Configure SSL for both your supplier and consumer server.
</li>
<li>
Configure your consumer server to recognize your supplier server's certificate as the supplier DN.
</li>
</ul>
<p class="text">
<b>Simple Authentication. </b>When selected, this option specifies that the supplier and consumer servers use simple authentication during communication.
</p>
<p class="text">
<b>Bind As. </b>You can update the supplier bind DN in the Bind As text box.
</p>
<p class="text">
<b>Password. </b>You can update the password corresponding to the supplier bind DN in the Password field.
</p>
--- NEW FILE configtab_replication7.html ---
<p class="topic">
Consumer Server Information
</p>
<p class="text">
Use this dialog box to manually enter the host and port number of the consumer server.
</p>
<p class="text">
<b>Host Name. </b>Enter the host name of the supplier or consumer server as appropriate.
</p>
<p class="text">
<b>Port Number. </b>Enter the port number of the supplier or consumer server as appropriate.
</p>
--- NEW FILE configtab_replication8.html ---
<p class="topic">
Export Replica
</p>
<p class="text">
Use this dialog box to export a replica to LDIF.
</p>
<p class="text">
<b>LDIF file (on remote machine). </b>Enter the full path to the LDIF file. Click Browse to locate it on your machine. By default, if you are running the console locally, the file is stored in the current directory.
</p>
<p class="text">
When the Browse button is not enabled, by default the file is stored in the <span class="variable">serverRoot<code>/slapd-</code><span class="variable">serverID</span><code>/ldif</code>
</p>
--- NEW FILE configtab_rootnode.html ---
<p class="topic">
Settings Tab
</p>
<p class="text">
Use this tab to configure the basic LDAP and network settings for your directory.
</p>
<p class="text">
<b>Port.</b> Port number used for non-SSL communications. By default, the port number is 389.
</p>
<p class="text">
<b>Encrypted Port.</b> Port number used for SSL communications. This port number must be different from the port used for non-SSL communications. The default encrypted port number is 636.
</p>
<p class="text">
<b>Referrals to.</b> LDAP URL of the default referral returned to client applications who submit requests based at a DN not maintained by your directory.
</p>
<p class="text">
<b>Make entire server read-only.</b> Causes the server to be placed in read-only mode. Selecting this option also places all databases managed by the server into read-only mode, meaning you cannot create, modify, or delete any entries.
</p>
<p class="text">
<b>Track entry modification times.</b> Specifies whether the directory maintains modification attributes for directory entries. Choosing to track modification times means that new or modified entries will contain the following attributes: <code>modifiersNames</code>, <code>modifyTimestamp</code>, <code>creatorsName</code>, and <code>createTimestamp</code>.
</p>
<p class="text">
<b>Enable schema checking.</b> Specifies that schema checking is performed when directory entries are created or modified.
</p>
--- NEW FILE configtab_rootnode2.html ---
<p class="topic">
Performance Tab
</p>
<p class="text">
Use this tab to tune the performance of your directory.
</p>
<p class="text">
<b>Size limit. </b>The maximum number of entries the directory returns to a client application in response to a search operation. To set no limit, enter<code> -1</code> in the text box.
</p>
<p class="text">
<b>Time limit.</b> The maximum amount of time (in seconds) the server spends performing a search request. To set no limit, enter <code>-1 </code>in the text box.
</p>
<p class="text">
<b>Idle timeout.</b> The time (in seconds) the server maintains an idle connection before terminating the connection. A value of <code>0</code> indicates no limit.
</p>
<p class="text">
<b>Max number of file descriptors.</b> The maximum number of file descriptors available to the directory. This option is not available for Directory Servers running on Windows.
</p>
--- NEW FILE configtab_rootnode3.html ---
<p class="topic">
Encryption Tab
</p>
<p class="text">
Use this tab to configure SSL for your directory.
</p>
<p class="text">
<b>Enable SSL for this server.</b> Select this checkbox to enable SSL communications for the directory. Clear the checkbox to disable SSL.
</p>
<p class="text">
<b>Use this cipher family. </b>Select the checkbox next to the cipher family or families you want the server to use for SSL communications.
</p>
<p class="text">
<b>Security Device.</b> Select the device you want the server to use.
</p>
<p class="text">
<b>Certificate.</b> Select the certificate you want the server to use. You must have a certificate set up on your system to use SSL.
</p>
<p class="text">
<b>Cipher settings. </b>Opens the Encryption Preferences dialog box, where you can select which ciphers you want the server to use from the cipher families you have already selected. By default, Directory Server comes with the following SSL ciphers:
</p>
<br />
<br/>
<table width="90%" border="1" cellspacing="0" cellpadding="4">
<tr>
<td valign="top">
<p class="tablehead">
SSL Cipher
</p></td>
<td valign="top">
<p class="tablehead">
Description
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
None
</p></td>
<td valign="top">
<p class="tabletext">
No encryption, only MD5 message authentication (rsa_null_md5).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
RC4
</p></td>
<td valign="top">
<p class="tabletext">
RC4 cipher with 128-bit encryption and MD5 message authentication (rsa_rc4_128_md5).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
RC4 (Export)
</p></td>
<td valign="top">
<p class="tabletext">
RC4 cipher with 40-bit encryption and MD5 message authentication (rsa_rc4_40_md5).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
RC2 (Export)
</p></td>
<td valign="top">
<p class="tabletext">
RC2 cipher with 40-bit encryption and MD5 message authentication (rsa_rc2_40_md5).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
DES
</p></td>
<td valign="top">
<p class="tabletext">
DES with 56-bit encryption and SHA message authentication (rsa_des_sha).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
DES (FIPS)
</p></td>
<td valign="top">
<p class="tabletext">
FIPS DES with 56-bit encryption and SHA message authentication. This cipher meets the FIPS 140-1 U.S. government standard for implementations of cryptographic modules (rsa_fips_des_sha).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
Triple-DES
</p></td>
<td valign="top">
<p class="tabletext">
Triple DES with 168-bit encryption and SHA message authentication (rsa_3des_sha).
</p></td>
</tr>
<tr>
<td valign="top">
<p class="tabletext">
Triple-DES (FIPS)
</p></td>
<td valign="top">
<p class="tabletext">
FIPS Triple DES with 168-bit encryption and SHA message authentication. This cipher meets the FIPS 140-1 U.S. government standard for implementations of cryptographic modules. (rsa_fips_3des_sha)
</p></td>
</tr>
</table>
<br />
<br />
<p class="text">
<b>Do not allow client authentication.</b> Select this option if you want client applications to connect to the server using only simple authentication.
</p>
<p class="text">
<b>Allow client authentication.</b> Select this option if you want client applications to be able to connect to the server using either simple authentication or client authentication.
</p>
<p class="text">
If you are using certificate-based authentication with replication, then you must select either "Allow client authentication" or "Require client authentication" on the consumer server.
</p>
<p class="text">
<b>Require client authentication. </b>Select this option if you want client applications to connect to the server using client authentication only. If you select this option, simple authentication is not allowed.
</p>
<p class="text">
<b>Use SSL in Management Console.</b> Select this checkbox if you want the communication between the Management Console and the directory to be secured using SSL.
</p>
<p class="text">
If you use this option with client authentication, communication between the Management Console and the server will take place over a secure channel, but without client authentication.
</p>
<p class="text">
<b>Check hostname against name in certificate for outbound SSL connections. </b>Select this check box if you want an SSL-enabled Directory Server (with certificate based client authentication turned on) to verify authenticity of a request by matching the hostname against the value assigned to the Common Name (CN) attribute of the subject name in the certificate being presented.
</p>
<p class="text">
By default, this feature is disabled. If you enable it and if the hostname does not match the CN attribute of the certificate, appropriate error and audit messages are logged. For example, in a replicated environment, messages similar to these are logged in the supplier server's log files if it finds that the peer server's hostname doesn't match the name specified in its certificate:
</p>
<p class="text">
<code>[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81 (runtime error -12276 - Unable to communicate securely with peer: requested domain name does not match the server's certificate.)</code>
</p>
<p class="text">
<code>[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth" (ultra60:1924): Replication bind with SSL client authentication failed: LDAP error 81 (Can't contact LDAP server)</code>
</p>
<p class="text">
It is recommended that you turn this attribute on to protect Directory Server's outbound SSL connections against a Man In The Middle (MITN) attack.
</p>
--- NEW FILE configtab_rootnode4.html ---
<p class="topic">
Cipher Settings
</p>
<p class="text">
Use this dialog box to select specific ciphers to use with SSL. You have to enable SSL to access this dialog box.
</p>
<p class="text">
Select the checkboxes next to the ciphers you want your server to use. The Management Console requires particular ciphers to work with SSL.
</p>
--- NEW FILE configtab_rootnode5.html ---
<p class="topic">
SNMP Tab
</p>
<p class="text">
Use this tab to set up SNMP for the directory.
</p>
<p class="text">
<b>Name. </b> The directory server name. This information is presented to clients viewing SNMP statistics.
</p>
<p class="text">
<b>Description.</b> Describes the directory server instance. This description is presented to clients viewing SNMP statistics.
</p>
<p class="text">
<b>Organization. </b>Organization name presented to clients viewing SNMP statistics.
</p>
<p class="text">
<b>Location.</b> The location of the directory. This information is presented to clients viewing the SNMP statistics.
</p>
<p class="text">
<b>Contact.</b> The email address of the person responsible for maintaining the directory.
</p>
--- NEW FILE configtab_rootnode6.html ---
<p class="topic">
Manager Tab
</p>
<p class="text">
Use this tab to configure the directory manager, the privileged database administrator.
</p>
<p class="text">
<b>Directory Manager DN. </b>Contains the DN for the directory manager. By default, this user is <code>cn=Directory Manager</code>.
</p>
<p class="text">
<b>Manager password encryption.</b> Defines how the directory stores the directory manager password in the directory. By default, the directory gives you the following encryption options:
</p>
<ul>
<li>
Salted Secure Hashing Algorithm (SSHA). This method is recommended as the most secure. SSHA is the default encryption method.
</li>
<li>
UNIX crypt algorithm (CRYPT). Provided for compatibility with UNIX passwords.
</li>
<li>
Secure Hashing Algorithm (SHA). A one-way has algorithm that is the default encryption schema in Directory Server 4.x.
</li>
<li>
No encryption (CLEAR). This encryption type indicates that the password will appear in plain text.
</li>
</ul>
<p class="text">
<b>New password. </b>To change the directory manager password, enter the new password in this text box.
</p>
<p class="text">
<b>Confirm password.</b> Re-enter the new directory manager password in this text box for verification.
</p>
--- NEW FILE configtab_rootnode7.html ---
<p class="topic">
SASL Mapping Tab
</p>
<p class="text">
SASL uses special identities to map a client to an entry or DN in the directory. Use this tab to configure SASL mapping to use SASL for encrypted sessions.
</p>
<p class="text">
<b>Mappings.</b> Text box of SASL identites that have been created. Highlight one of these to modify or delete it.
</p>
<ul>
<li>
<b>Name.</b> The name of the SASL identity.
</li>
<li>
<b>Regular Expression.</b> A regular expression that maps the SASL identity.
</li>
<li>
<b>Search Base DN.</b> The base DN for the SASL mapping identity search.
</li>
<li>
<b>Search Filter.</b> The search filter for the SASL mapping identity search.
</li>
</ul>
<p class="text">
<b>Add.</b> This button will bring up the New SASL Mapping text box to create a new SASL mapping identity.
</p>
<p class="text">
<b>Modify.</b> This will bring up the Modify SASL Mapping text box, which will allow you to modify the search base DN, search filter, and/or regular expression of a SASL mapping identity.
</p>
<p class="text">
<b>Delete.</b> Deletes a SASL mapping identity.
</p>
--- NEW FILE configtab_rootnode8.html ---
<p class="topic">
SASL Mapping - Add Button
</p>
<p class="text">
Use this tab to add a new SASL mapping identity.
</p>
<p class="text">
<b>Name.</b> The name of the new identity.
</p>
<p class="text">
<b>Regular Expression.</b> A regular expression to map the new identity.
</p>
<p class="text">
<b>Search Base DN.</b> The base DN for the SASL mapping identity search.
</p>
<p class="text">
<b>Search Filter.</b> The search filter for the SASL mapping identity search.
</p>
--- NEW FILE configtab_rootnode9.html ---
<p class="topic">
SASL Mapping - Modify Button
</p>
<p class="text">
Use this tab to change a SASL mapping identity.
</p>
<p class="text">
<b>Name.</b> The name of the SASL identity. This field is grayed out, and the name cannot be changed.
</p>
<p class="text">
<b>Regular Expression.</b> A regular expression to map the new identity; this can be changed.
</p>
<p class="text">
<b>Search Base DN.</b> The base DN for the SASL mapping identity search; this can be changed.
</p>
<p class="text">
<b>Search Filter.</b> The search filter for the SASL mapping identity search; this can be changed.
</p>
--- NEW FILE configtab_schema.html ---
<p class="topic">
Object Classes
</p>
<p class="text">
Use this tab to view information about all object classes that currently exist in your directory schema. You can also delete an object class that you have created using this tab. You cannot edit or delete standard object classes.
</p>
<p class="text">
<b>Parent. </b>Identifies the object class from which the object class currently selected in the Object Classes list inherits attributes and structure.
</p>
<p class="text">
<b>OID.</b> Object identifier (OID) for the object class selected in the Object Classes list. An OID is a string, usually of decimal numbers, that uniquely identifies an object, (such as an object class or an attribute) in an object-oriented system. If no OID is assigned, the directory automatically uses <span class="variable">ObjectClass_name</span><code>-oid</code>. For example, if you created the object class <code>division</code> without supplying an OID, the directory automatically uses <code>division-oid</code> as the OID.
</p>
<p class="text">
<b>Object Classes.</b> Contains a list of all the user-defined and standard object classes that currently exist in the schema.
</p>
<p class="text">
<b>Required Attributes. </b>Lists the required attributes for the object class selected in the Object Classes list. When you add an entry to the directory using this object class, you must add values for the required attributes to the entry. The list also includes inherited attributes.
</p>
<p class="text">
<b>Allowed Attributes. </b>Lists the optional attributes for the object class selected in the Object Classes list. When you add an entry to the directory using this object class, you may add values for the allowed attributes to the entry. The list also includes inherited attributes.
</p>
<p class="text">
<b>Create. </b>Click this button to create a new object class.
</p>
<p class="text">
<b>Edit. </b>To edit a user-defined object class, select it in the Object Classes list and then click Edit.
</p>
<p class="text">
<b>Delete. </b>Select a user-defined object class from the Object Classes list and then click Delete to delete it from the schema. You cannot delete the standard object classes that came with the directory.
</p>
--- NEW FILE configtab_schema2.html ---
<p class="topic">
Create Object Class
</p>
<p class="text">
Use this dialog box to create a new or edit an existing object class in your directory. You cannot modify the standard object classes that come with Directory Server. You can modify only those object classes that you define.
</p>
<p class="text">
<b>Name.</b> Enter a unique name for the object class.
</p>
<p class="text">
<b>Parent.</b> Identifies the object class from which the new object class will inherit attributes and structure. You can choose from any existing object class.
</p>
<p class="text">
<b>OID (Optional).</b> Allows you to change the object identifier (OID) for the object class. An OID is a string, usually of decimal numbers, that uniquely identifies an object (such as an object class or an attribute) in an object-oriented system. This field is optional. If you do not specify an OID, the directory automatically uses <span class="variable">ObjectClass_name</span><code>-oid</code>. For example, if you create the object class <code>division</code> without supplying an OID, the directory automatically creates the OID <code>division-oid</code>.
</p>
<p class="text">
<b>Available attributes.</b> Lists all of the attributes in the schema not inherited from the parent object class. You can add attributes to a user-defined object class by selecting the attribute in the list and then clicking the Add button to the left of either the Required Attributes or Allowed Attributes list box.
</p>
<p class="text">
To delete an attribute that you previously added, highlight the attribute in the Required Attributes list or the Allowed Attributes list and then click the corresponding Remove button.
</p>
<p class="text">
<b>Required attributes. </b>Lists the required attributes for the object class including inherited attributes. To add an attribute to the required attributes list, select it in the Available Attributes list and then click the Add button next to the Required Attributes list box.
</p>
<p class="text">
<b>Allowed attributes.</b> Lists the allowed attributes for the object class including inherited attributes. To add an attribute to the allowed attributes list, select it in the Available Attributes list and then click the Add button next to the Allowed Attributes list box.
</p>
--- NEW FILE configtab_schema3.html ---
<p class="topic">
Attributes
</p>
<p class="text">
Use this tab to view information about existing attributes, to create new attributes, or to delete attributes you previously created.
</p>
<p class="text">
<b>Standard Attributes (Read-Only). </b>The Standard Attributes table lists all standard attributes along with their OIDs and corresponding attribute syntax. The alphabetical listing of all available attributes helps you determine whether or not you need to create a new attribute. The information in the table is defined below.
</p>
<ul>
<li>
Name—The unique name of the attribute.
</li>
<li>
OID—The object identifier of the attribute.
</li>
<li>
Syntax—Displays the syntax of the attribute. For example, the syntax type of Case Ignore String indicates that values for this attribute are not case sensitive.
</li>
<li>
Multi—Defines whether the attribute is multi-valued. If the checkbox in this column is selected, the attribute can be multi-valued. The directory allows more than one instance of a multi-valued attribute per entry.
</li>
</ul>
<p class="text">
<b>User Defined Attributes. </b>Table that lists the user-defined attributes in the directory schema. The information displayed for each attribute is the same for user-defined attributes as for standard attributes (see above).
</p>
<p class="text">
<b>Create. </b>Click this button to create a new attribute.
</p>
<p class="text">
<a name="28772"> </a>
<b>Edit. </b>Click this button to edit the currently selected attribute in the tables above.
</p>
<p class="text">
<b>Delete. </b>You can delete user-defined attributes by selecting them from the User Defined Attributes table and then clicking Delete. Make sure that no object classes are using the attribute before you delete it.
</p>
--- NEW FILE configtab_schema4.html ---
<p class="topic">
Create Attribute Dialog Box
</p>
<p class="text">
This dialog box allows you to create new attributes or edit existing ones.
</p>
<p class="text">
<b>Attribute name. </b>A unique string that identifies the attribute you are creating.
</p>
<p class="text">
<b>Attribute OID (optional).</b> The Attribute OID field is an optional field that you can use to supply an object identifier (OID) for the new attribute. If you do not supply an OID, the directory automatically uses <span class="variable">attribute_name</span><code>-oid</code>. For example, if you create a new attribute called <code>birthdate</code>, the default OID is <code>birthdate-oid</code>.
</p>
<p class="text">
<b>Attribute aliases (optional). </b>You can specify a nickname for the new attribute. For example, <code>cn</code> is an alias for the <code>CommonName</code> attribute.
</p>
<p class="text">
<b>Attribute description (optional). </b>Enter a short description of the new attribute.
</p>
<p class="text">
<b>Syntax. </b>Select a syntax that describes the data to be held by the attribute. Available syntaxes are Integer, IA5String, Case Exact String, Case Ignore String, URI, GeneralizedTime, DistinguishedName (DN), TelephoneNumber, Boolean, Binary, DirectoryString, CountryName, PostalAddress, and Octet String. The default value is DirectoryString.
</p>
<p class="text">
<b>Multi-valued. </b>When selected, this option specifies that the attribute you are creating is multi-valued, meaning an entry may contain more than one instance of this attribute.
</p>
--- NEW FILE configtab_schema5.html ---
<p class="topic">
Matching Rules
</p>
<p class="text">
Use the Matching Rules tab to view all the matching rules used by the directory. The table includes matching rules from plug-ins you have created.You cannot edit the standard matching rules.
</p>
<p class="text">
Matching rules provide guidelines for how the server compares strings during a search operation. In an international search, the matching rule tells the server what collation order and operator to use. For example, a matching rule in an international search might tell the server to search for attribute values that come at or after llama in the Spanish collation order.
</p>
<p class="text">
<b>Name. </b>Contains a list of all the user-defined and standard matching rules currently available to the directory. Standard matching rules are named according to the following syntax:
</p>
<p class="text">
<span class="variable">AttributeSyntax SearchType</span>-<code>Lang</code>
</p>
<p class="text">
Where <span class="variable">AttributeSyntax</span> is the type of attribute on which this matching rule may be applied, <span class="variable">SearchType</span> is the type of search for which this matching rule may be applied, and <span class="variable">Lang</span> is the abbreviated code for the locale of the matching rule.
</p>
<p class="text">
The possible name types include:
</p>
<ul>
<li>
caseIgnoreOrderingMatch-(Lang)
</li>
<li>
caseExactOrderingMatch-(Lang)
</li>
<li>
caseIgnoreSubstringMatch-(Lang)
</li>
<li>
caseExactSubstringMatch-(Lang)
</li>
</ul>
<p class="text">
<b>OID. </b>The object identifier of the matching rule's locale. Each locale supported by the directory has an associated collation order OID.
</p>
<p class="text">
<b>Syntax. </b>Displays the syntax of the matching rule's locale. Matching rule syntax is defined as "Directory String" and is used internally by the directory.
</p>
<p class="text">
<b>Description. </b>Contains the two character language tag of the locale. If necessary to distinguish regional differences in language, the language tag may also contain a country code, which is a two-character uppercase string (as defined in ISO standard 3166). The language code and country code are separated by a hyphen. For example, the language tag used to identify the British English locale is en-GB.
</p>
--- NEW FILE configtab_synchronization1.html ---
<p class="topic">
Synchronization Summary
</p>
<p class="text">
You use the synchronization agreement Summary tab to view status or change the name of the synchronization agreement.
</p>
<p class="text">
<b>Description. </b>Contains the text description of the synchronization agreement.
</p>
<p class="text">
<b>General. </b>Displays information about:
</p>
<ul>
<li>
Supplier—The name of the supplier server in the agreement.
</li>
<li>
Consumer—The name of the Windows server in the agreement.
</li>
<li>
Windows Subtree—The Windows subtree synchronized in the agreement.
</li>
<li>
DS Subtree—The Directory Server subtree synchronized in the agreement.
</li>
<li>
Replicated subtree—The Directory Server suffix synchronized in the agreement.
</li>
</ul>
<p class="text">
<b>Status. </b>This area displays information about the synchronization agreement, including the number of the last change sent to the consumer server, current status of the synchronization agreement, and the synchronization history.
</p>
--- NEW FILE configtab_synchronization2.html ---
<p class="topic">
Synchronization Schedule
</p>
<p class="text">
This tab shows the synchronization schedule for a database, which is always in sync at a set interval. Changes to the schedulecannot be saved.
</p>
<p class="text">
<b>Always Keep Directories in Sync. </b>The Directory Server and Windows peer server(s) are always kept in sync at 5 minute intervals.
</p>
<p class="text">
<b>Sync on the following days. </b>This option is not available for synchronization.
</p>
<p class="text">
<b>Replication will take place between.</b> This option is not available for synchronization.
</p>
--- NEW FILE configtab_synchronization3.html ---
<p class="topic">
Synchronization Connection
</p>
<p class="text">
Use the Connection tab to display the type of connection used by your servers during synchronization. You can use this tab to modify the user bind name and password. You cannot change the connection type since this would require changing the port number. To change the connection type, re-create the synchronization agreement.
</p>
<p class="text">
<b>Using Encrypted SSL Connection. </b>When selected, specifies that the supplier and consumer servers use SSL for secure communication.
</p>
<p class="text">
<b>SSL Client Authentication. </b>Client authentication is no used for synchronization; this option is ignored if selected.
</p>
<p class="text">
<b>Simple Authentication. </b>This is the default authentication type for synchronization.
</p>
<p class="text">
<b>Bind As. </b>You can update the bind DN in the Bind As text box.
</p>
<p class="text">
<b>Password. </b>You can update the password corresponding to the bind DN in the Password field.
</p>
--- NEW FILE dir_browser.html ---
<p class="topic">
Directory Browser
</p>
<p class="text">
Use this dialog box to browse through the contents of the directory and select a subtree to export or replicate.
</p>
--- NEW FILE dir_browser2.html ---
<p class="topic">
Passwords Tab
</p>
<p class="text">
Use this tab to set up a password policy for the currently selected subtree or user.
</p>
<p class="text">
<b>Create subtree/user level password policy. </b>The caption of this checkbox reflects whether you opted to create a subtree or user level password policy. Selecting the checkbox adds the attributes required for defining the subtree- or user-level password policy. Once the policy is created, the caption changes to reflect that the existing policy can be modified or deleted. To delete the policy, unselect the checkbox.
</p>
<p class="text">
<b>User must change password after reset. </b>When selected, users must change their passwords when they first log in or after the administrator resets the passwords.
</p>
<p class="text">
<b>User may change password.</b> When selected, allows users to change their own passwords.
</p>
<p class="text">
<b>Allow changes in X day(s). </b>Defines how often users can change their password. Use this value in conjunction with "Keep password history" to discourage users from recycling old passwords.
</p>
<p class="text">
<b>Keep password history.</b> Specifies that the server keep a list of user passwords. Use this in conjunction with "Allow changes in X day(s)" to discourage users from reusing old passwords. If you select this option, enter the number of passwords users must cycle through before they can reuse a password.
</p>
<p class="text">
<b>Remember X passwords. </b>If the server is keeping a password history, this option specifies how many old passwords the server should store in the history list. The valid value range is from 2 to 24. The default value is 6.
</p>
<p class="text">
<b>Password never expires.</b> Select this if you do not require users to change their passwords periodically.
</p>
<p class="text">
<b>Password expires after X days. </b>Select this if you want users to change their passwords periodically. If you select the option, in the text box, you must enter the number of days in which the password will expire.
</p>
<p class="text">
Note that the maximum value for the password age is derived by subtracting January 18, 2038 from today's date. The value you enter must not be set to the maximum value or too close to the maximum value. If you set the value to the maximum value, Directory Server may fail to start because the number of seconds will go past the epoch date. In such an event, the error log will indicate that the password maximum age is invalid. To resolve this problem, you must correct the <code>paswordMaxAge</code> attribute value in the <code>dse.ldif</code> file.
</p>
<p class="text">
A common policy is to have passwords expire every 30 to 90 days. By default, the password maximum age is set to 8640000 seconds (100 days).
</p>
<p class="text">
<b>Send warning X day(s) before password expires.</b> Indicates the number of days before a user's password is due to expire that the user will be sent a warning message. The valid value range is from 1 to 24,855 days. The default value is 1 day.
</p>
<p class="text">
<b>Allow up to X attempt(s) after password expires.</b> Indicates the number of grace logins permitted after a user's password has expired. Grace logins are not permitted by default.
</p>
<p class="text">
<b>Check password syntax.</b> Select this checkbox to enforce password syntax checking. Syntax checking ensures that the password strings conform to the syntax guidelines, such as minimum password length.
</p>
<p class="text">
<b>Password minimum length. </b>If syntax checking is on, this option specifies the minimum number of characters that must be used in directory server passwords. The valid value range is from 2 to 512 characters. The default value is 6.
</p>
<p class="text">
<b>Password encryption. </b>Identifies how user passwords are stored in the directory. You can specify one of the following encryption formats:
</p>
<ul>
<li>
Salted Secure Hashing Algorithm (SSHA). This method is recommended as the most secure. SSHA is the default encryption method.
</li>
<li>
UNIX crypt algorithm (CRYPT). Provided for compatibility with UNIX passwords.
</li>
<li>
Secure Hashing Algorithm (SHA). A one-way has algorithm that is the default encryption schema in Directory Server 4.x.
</li>
<li>
No encryption (CLEAR). This encryption type indicates that the password will appear in plain text.
</li>
</ul>
<p class="text">
Passwords stored using SSHA, CRYPT, or SHA formats cannot be used for secure login through SASL Digest MD5.
</p>
--- NEW FILE dir_browser3.html ---
<p class="topic">
Account Lockout Tab
</p>
<p class="text">
You can set up a account lockout policy for the directory using the Account Lockout tab.
</p>
<p class="text">
<b>Accounts may be locked out. </b>Select this option to enable account lockout because of repeated login failures. Clear this checkbox if you do not want users to be locked out of the directory after a series of failed bind attempts.
</p>
<p class="text">
<b>Lockout account after X login failures.</b> Specify the number of times a user can fail to bind before they are locked out of the directory. Valid values are 1 to 32,767 attempts. This option is available only if account lockout is enabled.
</p>
<p class="text">
<b>Reset failure count after X minutes. </b>Indicates the amount of time that must elapse before the failure counter is reset. This option is available only if account lockout is enabled. Valid values are 1 to 35,791,394 minutes.
</p>
<p class="text">
<b>Lockout forever.</b> Select this option to indicate that user accounts that have been locked must be reset by the administrator before users can access the directory. If you select this option, you cannot set a lockout duration.
</p>
<p class="text">
<b>Lockout duration X minutes. </b>Select this option to indicate the amount of time a user will be locked out of the directory after a series of failed bind attempts. If you select this option, you must enter a number of minutes in the text box. Valid values are 1 to 35,791,394 minutes. This option is available only if account lockout is enabled.
</p>
--- NEW FILE dir_browser4.html ---
<p class="topic">
Edit Smart Referrals
</p>
<p class="text">
Use this tab to configure <em>smart</em> referrals. Smart referrals allow you to map a directory entry or directory tree to a specific LDAP URL. Using smart referrals, you can refer client applications to a specific server or a specific entry on a specific server.
</p>
<p class="text">
<b>Enable Smart Referrals. </b>Check this option to define smart referrals for the selected entry. Unchecking the option removes all smart referrals from the entry and deletes <code>objectclass: referral</code>.
</p>
<p class="text">
<b>Smart Referral List. </b>Lists the referrals currently in place for the selected entry. The entire list of referrals is returned to client applications in response to a request, when you select Referral or Referral on Update in the Suffix Settings tab.
</p>
<p class="text">
To modify the list, click Edit to edit the selected referral or Delete to delete the selected referral.
</p>
<p class="text">
<b>Enter a new Smart Referral. </b>Enter a referral in the LDAP URL format and then click Add to add the referral to the list. The LDAP URL to which you want to refer client application requests must be in the following format:
</p>
<p class="text">
<code>ldap://</code><span class="variable">hostname</span><code>:</code><span class="variable">portnumber</span><code>/[</code><span class="variable">optional_dn</span><code>]</code>
</p>
<p class="text">
where <span class="variable">[optional_dn]</span> is the explicit DN you want the server to return to the requesting client application. For example, you might enter an LDAP URL as follows:
</p>
<p class="text">
<code>ldap://directory.example.com:389/cn=jdoe,ou=people,dc=example,dc=com</code>
</p>
<p class="text">
You may also click Construct to be guided through the process of adding a referral.
</p>
<p class="text">
To allow a referral to be followed with different authentication, click Authentication and specify the appropriate DN and password. Keep in mind that this authentication remains valid only until the console is closed; then, it's reset to the same authentication used to log into the console.
</p>
--- NEW FILE dirtab_cos.html ---
<p class="topic">
Attribute
</p>
<p class="text">
This dialog box lists the attributes generated by the class of service.
</p>
<p class="text">
<b>Attribute Name. </b>Name of the attributes currently generated on the target entries.
</p>
<p class="text">
<b>Override.</b> Click Override to make the value of the attribute generated by the CoS override the local value.
</p>
<p class="text">
<b>Operational.</b> Click Operational to make the attribute operational, so that it is not visible to client applications unless explicitly requested.
</p>
<p class="text">
<b>Add. </b>Click Add to browse the list of possible attributes and add them to the list.
</p>
<p class="text">
<b>Remove.</b> Click Remove to delete an attribute from the list.
</p>
--- NEW FILE dirtab_cos2.html ---
<p class="topic">
Create New Class of Service
</p>
<p class="text">
Use this dialog box to create a new class of service.
</p>
<p class="text">
<b>Class Name. </b>Enter the name of your new class of service. This field is required.
</p>
<p class="text">
<b>Description. </b>Enter a description of your class of service.
</p>
--- NEW FILE dirtab_cos3.html ---
<p class="topic">
Template
</p>
<p class="text">
Use this tab to configure the CoS template.
</p>
<p class="text">
<b>Choose how the template entry is identified.</b>
</p>
<ul>
<li>
Explicitly by its DN
</li>
<li>
Using the value of an attribute from the target entry
</li>
<li>
Using both a DN and the value of an attribute from the target entry
</li>
</ul>
<p class="text">
<b>Template DN. </b>If you choose to have the template entry identified by its DN, enter the DN of the template in this field. Click Browse to locate a template on your local machine.
</p>
<p class="text">
<b>Attribute Name. </b>If you choose to have the template entry identified by the value of one of the target entry's attributes, enter the attribute name in this field. Be sure to select an attribute which contains DN values.
</p>
--- NEW FILE dirtab_role.html ---
<p class="topic">
Add New Filtered Role Member
</p>
<p class="text">
Use this dialog box to add members to your new filtered role. Filtered roles allow you to assign entries to the role depending upon an attribute contained by each entry. You do this by specifying an LDAP filter. Entries that match the filter are said to possess the role.
</p>
<p class="text">
<b>LDAP filter. </b>Enter the filter in this text field or click Construct to be guided through the construction of an LDAP filter. The Construct dialog box contains the following fields:
</p>
<ul>
<li>
<b>Search. </b>Select whether to search for entries within the base DN, one level below the base DN, or the whole subtree beneath the base DN.
</li>
<li>
<b>For. </b>Select the types of entries you want to filter from this list. You can choose between users, groups, or both.
</li>
<li>
<b>Where. </b>Select an attribute from this drop-down list. The two fields following it allow you to refine your search by selecting one of the qualifiers from the drop-down list (such as contains, does not contain, is, is not). Enter an attribute value in the text box.
</li>
<li>
<b>More. </b>Click this button to add additional filters.
</li>
<li>
<b>Fewer. </b>Click this button to remove unnecessary filters.
</li>
</ul>
<p class="text">
<b>Test. </b>Click this button to try your filter. The entries matching your filter appear in the table. The following information is displayed:
</p>
<ul>
<li>
Name
</li>
<li>
User ID
</li>
<li>
Email
</li>
</ul>
--- NEW FILE dirtab_role2.html ---
<p class="topic">
Add New Managed Role Member
</p>
<p class="text">
Use this dialog box to add members to your new managed role. Managed roles allow you to create an explicit enumerated list of members.
</p>
<p class="text">
<b>Click and entry to select it. </b>Select an entry from the list and click OK. This list contains all entries available for adding to the new managed role.
</p>
<p class="text">
<b>Selected DN. </b>Contains the DN of the selected entry.
</p>
--- NEW FILE dirtab_role3.html ---
<p class="topic">
Add New Nested Role Member
</p>
<p class="text">
Use this dialog box to add members to a new nested role. Nested roles allow you to create roles that contain other roles. Before you can create a nested role, another role must exist.
</p>
<p class="text">
<b>Add. </b>Click Add to add roles to the list. The members of the nested role are members of other existing roles.
</p>
<p class="text">
<b>Remove. </b>Click Remove to remove roles from the list.
</p>
--- NEW FILE dirtab_role4.html ---
<p class="topic">
Role Accounts Tab
</p>
<p class="text">
Use this tab to activate or inactivate a user or role. Once inactivated, all affected users cannot authenticate.
</p>
<p class="text">
<b>Inactivate. </b>Click this button to inactivate the user or role. Inactivating a role means that you have inactivated all of the users who are members of the role.
</p>
<p class="text">
<b>Activate. </b>Click this button to reactive a user or role that has been inactivated.
</p>
--- NEW FILE dirtab_role5.html ---
<p class="topic">
General Tab
</p>
<p class="text">
Use this tab to name and describe your new managed, filtered, or nested role.
</p>
<p class="text">
<b>Role Name. </b>Enter a unique role name. This field is required.
</p>
<p class="text">
<b>Description. </b>Enter a brief description of the role in this field.
</p>
--- NEW FILE dirtab_role6.html ---
<p class="topic">
Set Role
</p>
<p class="text">
Use this dialog box to edit a role of an entry.
</p>
<p class="text">
<b>Managed Roles Tab.</b> This tab displays the managed roles to which this entry belongs. To add a new role, click Add and select an available role from the Role Selector window. To remove a role, select it and click Remove.
</p>
<p class="text">
<b>Other Roles Tab.</b> This tab displays the filtered and nested roles to which the entry belongs. Click Edit to make changes to the filtered or nested roles of the entry.
</p>
--- NEW FILE dirtab_role7.html ---
<p class="topic">
Role Selector
</p>
<p class="text">
Use this dialog box to select an existing role to add roles to the listed of nested roles.
</p>
<p class="text">
<b>Available Roles. </b>This table lists all of the existing roles available for nesting.
</p>
<p class="text">
<b>Name. </b>Unique role name.
</p>
<p class="text">
<b>Description. </b>Description of the role.
</p>
--- NEW FILE helpmenu.html ---
<p class="topic">
Confirmation Preferences
</p>
<p class="text">
Use this dialog box to customize whether Directory Server Console requires confirmation on various operations.
</p>
<p class="text">
Clear the checkbox next to the task(s) for which you do not want the server to require confirmation. The options include:
</p>
<ul>
<li>
Delete object class
</li>
<li>
Delete attribute
</li>
<li>
Delete entry
</li>
<li>
Delete subtree
</li>
<li>
Delete index
</li>
<li>
Delete suffix
</li>
<li>
Delete replication agreement
</li>
<li>
Remove changelog
</li>
<li>
Overwrite database (on import)
</li>
<li>
Stop the server
</li>
</ul>
--- NEW FILE ldapurl.html ---
<p class="topic">
Construct LDAP URL
</p>
<p class="text">
Use the Construct LDAP URL dialog box to be stepped through the creation of an LDAP URL for a referral.
</p>
<p class="text">
<b>LDAP Host. </b>Name of the machine containing the data.
</p>
<p class="text">
<b>LDAP Port. </b>Port number of the machine containing the data.
</p>
<p class="text">
<b>Target DN. </b>The explicit DN you want the server to return to the client application.
</p>
<p class="text">
<b>LDAP URL Results. </b>This field displays the automatically created LDAP URL.
</p>
--- NEW FILE new_instance.html ---
<p class="topic">
New Server Instance
</p>
<p class="text">
Use this dialog box to create a new instance of an existing directory server.
</p>
<p class="text">
<b>Server Identifier. </b>Enter a unique identifier for the server. The prefix <code>slapd-</code> will automatically be added to the identifier you enter here. Do not use spaces in the identifier.
</p>
<p class="text">
<b>Network Port.</b> Type the port number on which you want the directory to listen for incoming requests.
</p>
<p class="text">
<b>Base Suffix.</b> Enter the user directory suffix. For example, the base suffix for the Example Corporation might be <code>dc=example,dc=com</code>.
</p>
<p class="text">
<b>Root DN. </b>Enter the distinguished name of the privileged directory user. For example, enter <code>cn=directory manager</code> for the directory manager.
</p>
<p class="text">
<b>Password for Root DN.</b> Enter the password of the privileged directory user.
</p>
<p class="text">
<b>Confirm Password.</b> Re-enter the password of the privileged directory user.
</p>
<p class="text">
<b>Server Runtime (UNIX) User. </b>If you are running the server on a UNIX host, type the name of the runtime user.
</p>
--- NEW FILE property_editor.html ---
<p class="topic">
Property Editor
</p>
<p class="text">
Use this dialog box to modify the object classes and attributes contained within an entry.
</p>
<p class="text">
<b>Show Attribute Names. </b>Select this option if you want the property editor to display the names of the attributes as they appear in the schema. For example, <code>mail</code> instead of <code>Email address</code>.
</p>
<p class="text">
<b>Show Attribute Descriptions. </b>Select this option if you want the property editor to display the friendly names of the attributes. For example,<code> Email address</code> instead of <code>mail</code>. This option is selected by default.
</p>
<p class="text">
<b>Show All Allowed Attributes. </b>This checkbox controls the list of attributes shown in the property editor -- the list either includes only the attributes with values currently in the entry or all attributes allowed by schema for the selected object. The checkbox is unselected by default, and the attribute list shows only currently present attributes. Select the checkbox if you want the property editor to display all the attributes allowed by schema for the currently selected object.
</p>
<p class="text">
<b>Show DN. </b>Select this checkbox if you want to view the entry's DN.
</p>
<p class="text">
<b>Add Value. </b>If the currently selected attribute is not the <code>objectclass</code> attribute or a binary attribute, you can use this command to insert a blank text box for the currently selected attribute. Enter the new value in the text box.
</p>
<p class="text">
If a value already exists for the attribute and the attribute is not multi-valued, you cannot enter additional values. Attempting to do so results in an object class violation.
</p>
<p class="text">
<b>Delete Value. </b>Use this command to delete the currently selected attribute value. This will not delete the attribute itself.
</p>
<p class="text">
<b>Add Attribute. </b>Use this command to add an attribute to the entry. When you select this command, the Add Attribute dialog box appears. This dialog box lists only those attributes contained within the object classes already assigned to this entry.
</p>
<p class="text">
<b>Delete Attribute. </b>Use this command to delete the currently selected attribute from the entry.
</p>
--- NEW FILE property_editor2.html ---
<p class="topic">
Add Object Class
</p>
<p class="text">
Use this dialog box to add an object class to an existing entry.
</p>
<p class="text">
<b>Object Class List. </b>This list contains all of the object classes currently in the directory schema. Select the object class you want to add to the entry and click OK.
</p>
--- NEW FILE property_editor3.html ---
<p class="topic">
Add Attribute
</p>
<p class="text">
Use this dialog box to add an attribute to an existing entry. Before you can add an attribute, an object class that allows or requires the attribute must exist in the entry.
</p>
<p class="text">
<b>Language. </b>Contains a list of languages that can be assigned to the attribute as subtypes.
</p>
<p class="text">
Sometimes a user's name can be more accurately represented in characters of a language other than the default language. For example, Noriko's name is Japanese, and she has indicated on her hiring forms that she prefers that her name be represented by Japanese characters when possible. You can select Japanese as a language subtype for the <code>givenname</code> attribute so that other users can search for her Japanese name.
</p>
<p class="text">
If you specify a language subtype for an attribute, the subtype is added to the attribute name as follows:
</p>
<p class="text">
<span class="variable">attribute</span><code>;lang-</code><span class="variable">subtype</span>
</p>
<p class="text">
Where <span class="variable">attribute</span> is the attribute you are adding to the entry and <span class="variable">subtype</span> is the two character abbreviation for the language. For example:
</p>
<p class="text">
<code>givenname;lang-ja</code>
</p>
<p class="text">
You can assign only one language subtype per instance of an attribute in an entry. To assign multiple language subtypes, add another instance of the attribute to the entry and then assign the new language subtype to the copy.
</p>
<p class="text">
<b>Subtype.</b> Contains a list of commonly-used subtypes (other than languages) that can be assigned to the attribute as a subtype. The options include:
</p>
<ul>
<li>
Binary—Indicates that the attribute value is binary. For example, <code>userCertificate;binary</code>.
</li>
<li>
Pronunciation—Indicates that the attribute value is a phonetic representation. The subtype is added to the attribute name as follows: <span class="variable">attribute</span><code>;phonetic</code>. This subtype is commonly used in combination with a language subtype for languages that have more than one alphabet, where one is a phonetic representation. You might want to use this with attributes that are expected to contain user names, such as <code>cn</code> or <code>givenname</code>. For example, <code>givenname;lang-ja;phonetic</code> indicates that the attribute value is the phonetic version of the entry's Japanese name.
</li>
</ul>
<p class="text">
<b>Attributes List. </b>This list contains all of the attributes that are allowed within the object classes currently assigned to the entry. To add an attribute to the entry, select it in the list and then click OK.
</p>
--- NEW FILE property_editor4.html ---
<p class="topic">
Add New Object
</p>
<p class="text">
Use this dialog box to add new objects to Directory Server.
</p>
<p class="text">
<b>Show Attribute Names. </b>Select this option if you want the property editor to display the names of the attributes as they appear in the schema. For example, <code>mail</code> instead of <code>Email address</code>.
</p>
<p class="text">
<b>Show Attribute Descriptions. </b>Select this option if you want the property editor to display the friendly names of the attributes. For example,<code> Email address</code> instead of <code>mail</code>. This option is selected by default.
</p>
<p class="text">
<b>Show only Attributes with Values. </b>Select this checkbox if you want the property editor to display only those attributes that have values. This option is selected by default.
</p>
<p class="text">
<b>Show DN. </b>Select this checkbox if you want to view the entry's DN.
</p>
<p class="text">
<b>Add Value. </b>If the currently selected attribute is not the <code>objectclass</code> attribute or a binary attribute, you can use this command to insert a blank text box for the currently selected attribute. Enter the new value in the text box.
</p>
<p class="text">
If a value already exists for the attribute and the attribute is not multi-valued, you cannot enter additional values. Attempting to do so results in an object class violation.
</p>
<p class="text">
<b>Delete Value. </b>Use this command to delete the currently selected attribute value. This will not delete the attribute itself.
</p>
<p class="text">
<b>Add Attribute. </b>Use this command to add an attribute to the entry. When you select this command, the Add Attribute dialog box appears. This dialog box lists only those attributes contained within the object classes already assigned to this entry.
</p>
<p class="text">
<b>Delete Attribute. </b>Use this command to delete the currently selected attribute from the entry.
</p>
<p class="text">
<b>Naming Attribute. </b>Select a naming attribute from the drop-down list. The naming attribute is used to form the DN of the entry.
</p>
<p class="text">
If the naming attribute you want is not present in the list, click the Add Attribute button and add it to the entry. After adding the new attribute, the naming attribute appears in the list.
</p>
<p class="text">
<b>Naming Value. </b>Select a value for your naming attribute from the drop-down list.
</p>
--- NEW FILE replication_wizard.html ---
<p class="topic">
Source and Destination
</p>
<p class="text">
Use this dialog box to identify the consumer to which you will replicate directory entries. In addition, this dialog box allows you to define whether or not SSL is used for the connection, and the content you want replicated.
</p>
<p class="text">
<b>Supplier. </b>This field contains a static display of the name and port number of the supplier server in this agreement.
</p>
<p class="text">
<b>Consumer. </b>Select the consumer server in the replication agreement from this drop-down menu. To ensure that all servers in your deployment appear in this drop-down menu, you must bind as Administrator. If the consumer server you want still does not appear in the list, click Other to enter the host and port of the consumer.
</p>
<p class="text">
<b>Other. </b>Click this button to manually enter the host and port of a consumer server
</p>
<p class="text">
<b>Using Encrypted SSL Connection. </b>If you want the supplier and consumer servers to use SSL for secure communication, select this checkbox. To use this option, you must have first configured your servers to use SSL.
</p>
<p class="text">
<b>SSL Client Authentication. </b>Select this option if you want the supplier and consumer servers to use certificates for secure communication. You cannot use SSL client authentication unless the "Using Encrypted SSL Connection" checkbox is selected. The "Bind As" and Password fields are unavailable with this option because the servers will use security certificates to authenticate to each other.
</p>
<p class="text">
To use this option, you must first do the following:
</p>
<ul>
<li>
Configure SSL for both your supplier and consumer servers.
</li>
<li>
Configure your consumer server to recognize your supplier server's certificate as the supplier DN.
</li>
</ul>
<p class="text">
<b>Simple Authentication. </b>Select this option if you want the supplier and consumer servers to use simple authentication during communication. If you select the "Using Encrypted SSL Connection" checkbox and you specify this option, the simple authentication will take place over a secure channel but without certificates.
</p>
<p class="text">
<b>Bind As. </b>If you are not using SSL, or you are using SSL with simple authentication, enter the supplier bind DN defined on the consumer server in the Bind As text box.
</p>
<p class="text">
<b>Password. </b>If you are not using SSL, or you are using SSL with simple authentication, enter the Supplier DN password in the Password field.
</p>
<p class="text">
<b>Subtree. </b>Identifies the content to be replicated.
</p>
<p class="text">
When you are creating a new replication agreement from the Replication folder, you can choose the subtree you want to replicate. If you are creating a new replication agreement from a database under the Replication folder, the subtree is the same as that contained by the database and cannot be changed.
</p>
--- NEW FILE replication_wizard2.html ---
<p class="topic">
Schedule Replication
</p>
<p class="text">
Use this dialog box to identify the time of day and day of week when replication can occur. No new replication processes will be started outside the specified replication interval.
</p>
<p class="text">
<b>Always keep directories in sync. </b>Select this option if you do not want to set time restrictions on the replication agreement.
</p>
<p class="text">
<b>Sync on the following days. </b>When selected, you can select the checkbox(es) next to the day(s) of the week on which replication can occur. Click All to sync every day.
</p>
<p class="text">
<b>Replication will take place between. </b>Select specific hours during which replication takes place.
</p>
--- NEW FILE replication_wizard3.html ---
<p class="topic">
Initialize Consumer
</p>
<p class="text">
Use this dialog box to determine if you want to initialize the consumer when the server creates the replication agreement.
</p>
<p class="text">
<b>Do Not Initialize Consumer. </b>Select this radio button if you do not want to initialize the consumer immediately or create an LDIF file. If you are replicating a directory with a large number of entries (>10,000), you should select this option. If you do select this option, you need to initialize the consumer manually before replication can occur.
</p>
<p class="text">
<b>Initialize Consumer Now. </b>Select this if you want the server to initialize the consumer when you finish creating the replication agreement. This is not recommended for databases larger than 10,000 entries.
</p>
<p class="text">
<b>Create Consumer Initialization File. </b>Select this option if you want the server to export the replicated tree to an LDIF file so you can manually import it to the consumer.
</p>
<p class="text">
<b>LDIF Filename. </b>If you choose to generate an LDIF file, supply the LDIF filename in the field provided. Click Browse to locate an LDIF file on your machine.
</p>
--- NEW FILE replication_wizard4.html ---
<p class="topic">
Summary Dialog
</p>
<p class="text">
This dialog box provides a summary of the information you provided to the replication/synchronization agreement wizard. Make sure that the information on the summary dialog box is correct. If any information is incorrect, click Back to step back through the wizard and change the information. When you are finished, click Done.
</p>
<p class="text">
If you selected "Initialize Consumer Now" in the Initialize Consumer dialog box, the consumer is initialized immediately. Synchronization begins immediately.
</p>
--- NEW FILE replication_wizard5.html ---
<p class="topic">
Replication Agreement Name
</p>
<p class="text">
Use this dialog box to name and describe your replication agreement.
</p>
<p class="text">
<b>Name. </b>Enter a meaningful name for the replication agreement. This field is required.
</p>
<p class="text">
<b>Description. </b>Enter a brief description of your replication agreement. This field is required.
</p>
--- NEW FILE replication_wizard6.html ---
<p class="topic">
Replicated Attributes
</p>
<p class="text">
This screen will identify any attributes that will not be replicated to the consumer, called <span style="font-style: italic;">fractional replication</span>. Fractional replication is a way of protecting sensitive information from less secure machines or limiting the amount of information transmitted over slow connections. By default, all attributes should be in the "Included" column on the right, meaning all server attribute are replicated.
</p>
<p class="text">
<b>Enable Fractional Replication.</b> Check the check box to enable fractional replication.
</p>
<p class="text">
<b>Add All. </b>If any or all attributes have been moved to the "Excluded" column on the left, selecting this button will move them back to the "Included" column. This button is grayed out unless the "Enable Fractional Replication" checkbox is selected.
</p>
<p class="text">
<b>Add ->. </b>This button will move the highlight entry/entries from the "Excluded" column on the left to the "Included" column on the right. This button is grayed out unless the "Enable Fractional Replication" checkbox is selected.
</p>
<p class="text">
<b><- Remove. </b>This button will move the highlight entry/entries from the "Included" column on the right to the "Excluded" column on the left. This button is grayed out unless the "Enable Fractional Replication" checkbox is selected.
</p>
<p class="text">
<b>Remove All. </b>This button will move all the attributes from the "Included" column to the "Excluded" column. This button is grayed out unless the "Enable Fractional Replication" checkbox is selected.
</p>
--- NEW FILE statustab_general.html ---
<p class="topic">
Directory Server Status
</p>
<p class="text">
Use this panel to view current server information. You cannot use this panel to edit information about the directory.
</p>
<p class="text">
<b>Server Name. </b>Specifies the name of the server as displayed in the network tree. The server name usually indicates the type of server that is selected. For example, Directory Server.
</p>
<p class="text">
<b>Description. </b>Contains a brief description of this server. For example, Directory Server for the Eastern region sales force.
</p>
<p class="text">
<b>Installation date. </b>Indicates date and time the server was installed.
</p>
<p class="text">
<b>Server root. </b>Indicates the directory where the server binaries are installed.
</p>
<p class="text">
<b>Product name. </b>Indicates the server's official product name.
</p>
<p class="text">
<b>Vendor. </b>Indicates the server software maker or provider.
</p>
<p class="text">
<b>Version. </b>Indicates the server product version number.
</p>
<p class="text">
<b>Build number. </b>Uniquely identifies a particular release of a server version.
</p>
<p class="text">
<b>Revision. </b>Indicates whether this server has been upgraded or patched. If no value is present, this is installation has not been patched.
</p>
<p class="text">
<b>Security level. </b>Indicates whether the server uses domestic (US based, 128-bit ciphers) or export (non-US based, 40-bit ciphers) encryption levels.
</p>
<p class="text">
<b>Server status. </b>Indicates whether the server is on or off.
</p>
--- NEW FILE statustab_logs.html ---
<p class="topic">
Access Log Status
</p>
<p class="text">
Use this dialog box to view the directory's access log.
</p>
<p class="text">
<b>Refresh.</b> Refreshes the currently displayed log file.
</p>
<p class="text">
<b>Continuous refresh.</b> When selected, the server refreshes automatically every 10 seconds.
</p>
<p class="text">
<b>Select Log. </b>Lets you specify which access log to view from the archive.
</p>
<p class="text">
<b>Lines to show. </b>Lets you specify the number of messages to view. If you leave this text box blank, the server displays the 25 most recent messages.
</p>
<p class="text">
<b>Show only lines containing. </b>You can configure the server to display only messages containing a string you specify. Enter the string is this field and click Refresh.
</p>
<p class="text">
<b>Date.</b> Contains the date the error or event occurred in the format <code>DD/Mon/YYYY</code>. For example, 10/Feb/1998.
</p>
<p class="text">
<b>Time. </b>Contains the time the access occurred in GMT.
</p>
<p class="text">
<b>Conn. </b>Connection number.
</p>
<p class="text">
<b>Op. </b>Operation. The number in this field indicates the number of the operation within a single connection.
</p>
<p class="text">
<b>Details. </b>Contains specific information about the log entry.
</p>
--- NEW FILE statustab_logs2.html ---
<p class="topic">
Error Log Status
</p>
<p class="text">
Use this dialog box to view the directory's error log.
</p>
<p class="text">
<b>Refresh. </b>Refreshes the currently displayed log file.
</p>
<p class="text">
<b>Continuous refresh. </b>When selected, this checkbox specifies that the server continuously update the currently displayed log file.
</p>
<p class="text">
<b>Select Log. </b>Lets you specify which archived error log to view.
</p>
<p class="text">
<b>Lines to show. </b>Lets you specify the number of messages to view. If you leave this text box blank, the server displays the 25 most recent messages.
</p>
<p class="text">
<b>Show only lines containing. </b>You can configure the server to display only messages containing a string you specify. Enter the string is this field and click Refresh.
</p>
<p class="text">
<b>Date. </b>Contains the date the error or event occurred in the format <code>DD/Mon/YYYY.</code> For example, 10/Feb/1998.
</p>
<p class="text">
<b>Time. </b>Contains the time the error or event occurred in GMT.
</p>
<p class="text">
<b>Details. </b>Contains specific information about the error or event.
</p>
--- NEW FILE statustab_logs3.html ---
<p class="topic">
Audit Log Status
</p>
<p class="text">
Use this dialog box to view the directory's audit log. The audit log contains detailed information about changes made to each database as well as to the overall server configuration.
</p>
<p class="text">
<b>Refresh. </b>Refreshes the currently displayed log file.
</p>
<p class="text">
<b>Continuous refresh. </b>When selected, this checkbox specifies that the server continuously update the currently displayed log file.
</p>
<p class="text">
<b>Select log.</b> Select an archived audit log from the drop-down list.
</p>
<p class="text">
<b>Lines to show. </b>Lets you specify the number of messages to view. If you leave this text box blank, the server displays the 25 most recent messages.
</p>
<p class="text">
<b>Show only lines containing. </b>You can configure the server to display only messages containing a string you specify. Enter the string is this field and click Refresh.
</p>
--- NEW FILE statustab_performance.html ---
<p class="topic">
Server Performance Counters
</p>
<p class="text">
Use this tab to monitor your server's current activities. If the server is not running, this tab contains no performance monitoring information.
</p>
<p class="text">
<b>Server version. </b>Identifies the current server version.
</p>
<p class="text">
<b>Startup time on server. </b>Date and time the server started.
</p>
<p class="text">
<b>Current time on server. </b>Displays the current date and time on the server.
</p>
<p class="text">
<b>Refresh. </b>Click refresh to update the current display.
</p>
<p class="text">
<b>Continuous refresh. </b>Select this checkbox to continuously update the information display.
</p>
<p class="text">
<b>Resource Summary. </b>This table provides the following resource information:
</p>
<ul>
<li>
Connections. Gives the total number of connections to this server since startup and the average number of connections per minute since startup.
</li>
<li>
Operations Initiated. Gives the total number of operations initiated since server startup and the average number of operations per minute since startup.
</li>
<li>
Operations Completed. Gives the total number of operations completed by the server since startup and the average number of operations per minute since server startup.
</li>
<li>
Entries Sent To Clients. Gives the total number of entries sent to client applications since server startup in response to search requests and the average number of entries sent to client application per minute since server startup.
</li>
<li>
Bytes Sent To Clients. Gives the total number of bytes sent to client applications and the average number of bytes sent to client applications since server startup.
</li>
</ul>
<p class="text">
<b>Current Resource Usage. </b>This table provides the following resource usage information:
</p>
<ul>
<li>
Active Threads. Current number of active threads used for handling requests.
</li>
<li>
Open Connections. Total number of open connections.
</li>
<li>
Remaining Available Connections. Total number of remaining connections that the server can concurrently open.
</li>
<li>
Threads Waiting To Read From Client. Provides the current total. This condition occurs when the server starts to receive a request from a client application and then the transmission is halted. This total generally indicates a slow network or client application.
</li>
<li>
Database In Use. Total number of databases being used by the server.
</li>
</ul>
<p class="text">
<b>Connection Status. </b>This table provides information on the amount of resources in use by each currently open connection. The table contains the following information:
</p>
<ul>
<li>
Time opened. Indicates when the connection was opened.
</li>
<li>
Started. Indicates the number of operations initiated by this connection.
</li>
<li>
Completed. Indicates the number of operations completed by the server for this connection.
</li>
<li>
Bound As. Indicates the DN used by the client application to connect to the server.
</li>
<li>
Read/Write. Indicates whether the server is currently blocked for read or write access by the client application.
</li>
</ul>
<p class="text">
<b>Global Database Cache Information.</b>
</p>
<ul>
<li>
Hits. Indicates the number of times the server could process a request by obtaining data from the cache rather than by going to the disk.
</li>
<li>
Tries. The total number of requests performed on your directory since server startup.
</li>
<li>
Hit Ratio. The ratio of cache tries to successful cache lookups. The closer this number is to 100% the better.
</li>
<li>
Pages read in. Indicates the number of pages read from disk into the cache.
</li>
<li>
Pages written out. Indicates the number of pages written from the cache back to disk.
</li>
<li>
Read-only page evicts. Indicates the number of read-only pages discarded from the cache to make room for new pages. Pages discarded from the cache have to be written to disk, possibly affecting server performance. The lower the number of page evicts the better.
</li>
<li>
Read-write page evicts. Indicates the number of read-write pages discarded from the cache to make room for new pages. This value differs from Pages Written Out in that these are discarded read-write pages that have not been modified.
</li>
<dl>
<dt>
Pages discarded from the cache have to be written to disk, possibly affecting server performance. The lower the number of page evicts the better.
<br /> </dt> </dl>
</ul>
--- NEW FILE statustab_performance2.html ---
<p class="topic">
Database Performance Counter
</p>
<p class="text">
Use this tab to monitor the current activities of a particular database or database link.
</p>
<p class="text">
<b>Database. </b>Identifies the type of database being monitored.
</p>
<p class="text">
<b>Configuration DN. </b>Identifies the distinguished name you can use to obtain these results using the <code>ldapsearch</code> command-line utility.
</p>
<p class="text">
<b>Refresh. </b>Click refresh to update the current display.
</p>
<p class="text">
<b>Continuous refresh. </b>Select this checkbox to continuously update the information display.
</p>
<p class="text">
<b>Summary Information. </b>This table provides the following information:
</p>
<ul>
<li>
Read-only status. Indicates whether the database is currently in read-only mode.
</li>
<li>
Entry cache hits. Indicates the number of times the server could process a search request by obtaining data from the cache rather than by going to the disk.
</li>
<li>
Entry cache tries. The total number of search operations performed against your server since server startup.
</li>
<li>
Entry cache hit ratio. The ratio of entry cache tries to successful entry cache lookups. The closer this number is to 100% the better.
</li>
<li>
Current size of entry cache (in bytes). Total number of bytes currently used by the entry cache.
</li>
<li>
Maximum size of entry cache (in bytes). Maximum number of bytes available to the entry cache.
</li>
</ul>
<p class="text">
<b>Index Information. </b>These tables provide information about the indexes you use for each database. The tables contain the following information:
</p>
<ul>
<li>
Cache hits. Indicates the number of times the server could process a request by obtaining data from the cache rather than by going to the disk.
</li>
<li>
Cache misses. Number of times the cache does not contain the information being requested by the client application.
</li>
<li>
Pages read in. Number of pages read from disk into the database cache.
</li>
<li>
Pages written out. Number of pages written from the cache back to disk.
</li>
</ul>
--- NEW FILE statustab_replication.html ---
<p class="topic">
Replication Status
</p>
<p class="text">
Use this tab to view status about replication agreements configured for the server. You can also use this tab to see the progress of consumer initialization for a particular replication agreement.
</p>
<p class="text">
<b>Refresh.</b> Refreshes the display.
</p>
<p class="text">
<b>Continuous refresh. </b>Select this checkbox to provide continuously updated status.
</p>
<p class="text">
<b>Agreement table. </b>This table contains the name you provided when you set up the replication agreement, the suffix being replicated, and the identity of the consumer server. Select an agreement in the table, and its status is shown in the table below.
</p>
<p class="text">
<b>Replica suffix.</b> Specifies the subtree contained by this replica.
</p>
<p class="text">
<b>Consumer. </b>Specifies the consumer server in the agreement.
</p>
<p class="text">
<b>Supplier.</b> Specifies the supplier server in the agreement.
</p>
<p class="text">
<b>Number of changes. </b>Indicates the number of successfully replicated changes and the number of changes currently in the changelog. For example: <code>[7] - [10]</code> indicates that seven (7) changes have been successfully replicated and that ten (10) changes are listed in the changelog as needing updating.
</p>
<p class="text">
"Unknown" indicates that the server has encountered an error and replication cannot continue or the server could not read the last change number from the supplier.
</p>
<p class="text">
These errors may not indicate a true error condition if no changes have occurred on the supplier or if the consumer has not been initialized.
</p>
<p class="text">
<b>Last replica update began.</b> Specifies the time at which the last replication operation began.
</p>
<p class="text">
<b>Last replica update ended.</b> Specifies the time at which the last replication operation ended.
</p>
<p class="text">
<b>Last update message. </b>Gives the last replication update message received by the server.
</p>
<p class="text">
<b>Consumer initialization.</b> Indicates whether consumer initialization is in progress.
</p>
<p class="text">
<b>Last consumer init. update message.</b> Gives the last consumer initialization update message received by the server.
</p>
<p class="text">
<b>Last consumer initialization began.</b> Specifies the time at which the last consumer initialization operation began.
</p>
<p class="text">
<b>Last consumer initialization ended. </b>Specifies the time at which the last consumer initialization operation ended.
</p>
--- NEW FILE synchronization_wizard1.html ---
<p class="topic">
Synchronization Agreement Name
</p>
<p class="text">
Use this dialog box to name and describe your synchronization agreement.
</p>
<p class="text">
<b>Name. </b>Enter a meaningful name for the synchronization agreement. This field is required.
</p>
<p class="text">
<b>Description. </b>Enter a brief description of your synchronization agreement. This field is optional.
</p>
--- NEW FILE synchronization_wizard2.html ---
<p class="topic">
Source and Destination
</p>
<p class="text">
Use this dialog box to identify the Windows synchronization peer with which you will synchronize directory entries. In addition, this dialog box allows you to define whether SSL is used for the connection and the content you want synchronized.
</p>
<p class="text">
<b>Supplier. </b>This field contains a static display of the name and port number of the Directory Server in this agreement.
</p>
<p class="text">
<b>Windows Domain Name. </b>This is the name of the Windows domain that contains the Windows subtree which you are synchronizing with the Directory Server subtree. For example: <span style="font-family: courier new,courier,monospace;">example.com</span>
</p>
<p class="text">
<b>Sync New Windows Users. </b>Check this checkbox if you want to add new Windows users automatically to the Directory Server.
</p>
<p class="text">
<b>Windows Subtree. </b>This is the Windows subtree which you are synchronizing with the Directory Server subtree. If the subtree which you are synchronizing is <span style="font-family: courier new,courier,monospace;">ou=People</span>, than the Windows subtree is set by default to <span style="font-family: courier new,courier,monospace;">cn=Users</span>, and the remaining information is supplied by the Windows domain information.
</p>
<p class="text">
<b>DS Subtree. </b>The Directory Server subtree that is synchronized. This is set by default depending on the database that you have selected in the agreement.
</p>
<p class="text">
<b>Domain Controller Host. </b>This is the hostname of the domain controller in the Windows domain you wish to use for sync operations. This name must be resolvable and, if SSL is being used, must match the CN of the certificate issued to the domain controller. That is normally the fully qualified DNS name. For example: <span style="font-family: courier new,courier,monospace;">dc01.example.com</span>
</p>
<p class="text">
<b>Port Num. </b>The Windows domain controller port number. By default, this is 389; this is automatically reset to 636 if you check the "Using encrypted SSL connection" checkbox (even if you had previously set a different value).
</p>
<p class="text">
<b>Using Encrypted SSL Connection. </b>If you want the Directory Server and Windows servers to use SSL for secure communication, select this checkbox. To use this option, you must have first configured your servers to use SSL. It is strongly recommended that you use an SSL connection. Passwords will not be synchronized if you do not enable SSL.
</p>
<p class="text">
<b>Bind As. </b>Enter the supplier bind DN defined on the Windows server in the Bind As text box. This must be a valid DN.
</p>
<p class="text">
<b>Password. </b>Enter the supplier DN password in the Password field.
</p>
<p class="text">
When you are creating a new synchronization agreement from the Replication folder, you can choose the subtree you want to synchronize. If you are creating a new synchronization agreement from a database under the Replication folder, the subtree is the same as that contained by the database and cannot be changed.
</p>
--- NEW FILE synchronization_wizard3.html ---
<p class="topic">
Summary Dialog
</p>
<p class="text">
This dialog box provides a summary of the information you provided to the synchronization agreement wizard. Make sure that the information on the summary dialog box is correct. If any information is incorrect, click Back to step back through the wizard and change the information. When you are finished, click Done.
</p>
<p class="text">
The server creates the synchronization agreement and dismisses the synchronization wizard. Synchronization begins immediately.
</p>
--- NEW FILE taskstab_bkup_restore.html ---
<p class="topic">
Backup Directory Dialog Box
</p>
<p class="text">
Use this dialog box to create a backup of your directory.
</p>
<p class="text">
<b>Directory.</b> Enter the full path of the directory where you want the server to store the backup file, or click Browse to browse to an existing directory.
</p>
<p class="text">
<b>Use default.</b> Click this button if you want the server to suggest a path for you. If you choose this option, the server stores the backup file in:
</p>
<p class="text">
<span class="variable">serverRoot</span><code>/slapd-</code><span class="variable">serverID</span><code>/bak/</code><span class="variable">backup_directory</span>
</p>
<p class="text">
where <span class="variable">backup_directory</span> specifies a directory using the name of the backup file. By default, the backup name contains the time and date when the backup was created.
</p>
--- NEW FILE taskstab_bkup_restore2.html ---
<p class="topic">
Restore Directory
</p>
<p class="text">
Use this dialog box to restore your directory from a previously created backup. Directory Server must be shut down before you can restore it from a backup. Restoring your database overwrites any existing database files.
</p>
<p class="text">
<b>Available backups.</b> The Console lists all backups in the default directory (<span class="variable">serverRoot</span><code>/slapd-</code><span class="variable">serverID</span><code>/bak/</code><span class="variable">backup_directory</span>) in this list box.
</p>
<p class="text">
<b>Directory.</b> If no backups appear in the Available Backups list, enter the full path to a location containing a valid backup.
</p>
16 years, 8 months
- 1
- 0