Red Hat Directory Server 8.2
for managing Directory Server instances
Edition 8.2.8
Copyright © 2010 Red Hat, Inc.
Legal Notice
Copyright © 2010 Red Hat, Inc..
This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
August 2, 2010, updated on April 2, 2012
Abstract
This book is for LDAP administrators.
- Preface
- 1. Basic Red Hat Directory Server Settings
- 1.1. System Requirements
- 1.2. Directory Server File Locations
- 1.3. LDAP Tool Locations
- 1.4. Starting and Stopping Servers
- 1.5. Starting the Console
- 1.6. Enabling LDAPI
- 1.7. Changing Directory Server Port Numbers
- 1.8. Creating a New Directory Server Instance
- 1.9. Setting the Directory Manager Information
- 1.10. Using Directory Server Plug-ins
- 2. Configuring Directory Databases
- 3. Creating Directory Entries
- 4. Populating Directory Databases
- 5. Managing Attributes and Values
- 5.1. Enforcing Attribute Uniqueness
- 5.2. Assigning Class of Service
- 5.2.1. About the CoS Definition Entry
- 5.2.2. About the CoS Template Entry
- 5.2.3. How a Pointer CoS Works
- 5.2.4. How an Indirect CoS Works
- 5.2.5. How a Classic CoS Works
- 5.2.6. Handling Physical Attribute Values
- 5.2.7. Handling Multi-valued Attributes with CoS
- 5.2.8. Searches for CoS-Specified Attributes
- 5.2.9. Access Control and CoS
- 5.2.10. Managing CoS Using the Console
- 5.2.11. Managing CoS from the Command Line
- 5.2.12. Creating Role-Based Attributes
- 5.3. Linking Attributes to Manage Attribute Values
- 5.4. Assigning and Managing Unique Numeric Attribute Values
- 6. Managing the Directory Schema
- 6.1. Overview of Schema
- 6.2. Managing Object Identifiers
- 6.3. Directory Server Attribute Syntaxes
- 6.4. Managing Custom Schema in the Console
- 6.5. Managing Schema Using ldapmodify
- 6.6. Creating Custom Schema Files
- 6.7. Dynamically Reloading Schema
- 6.8. Turning Schema Checking On and Off
- 6.9. Using Syntax Validation
- 7. Managing Indexes
- 8. Finding Directory Entries
- 8.1. Finding Entries Using the Directory Server Console
- 8.2. Using ldapsearch
- 8.3. LDAP Search Filters
- 8.4. Examples of Common ldapsearches
- 8.4.1. Returning All Entries
- 8.4.2. Specifying Search Filters on the Command Line
- 8.4.3. Searching the Root DSE Entry
- 8.4.4. Searching the Schema Entry
- 8.4.5. Using LDAP_BASEDN
- 8.4.6. Displaying Subsets of Attributes
- 8.4.7. Searching for Operational Attributes
- 8.4.8. Specifying Search Filters Using a File
- 8.4.9. Specifying DNs That Contain Commas in Search Filters
- 8.4.10. Using Client Authentication When Searching
- 8.4.11. Searching with Specified Controls
- 8.4.12. Searching with Language Matching Rules
- 8.4.13. Searching for Attributes with Bit Field Values
- 8.5. Using Persistent Search
- 8.6. Performing Dereferencing Searches
- 8.7. Using Simple Paged Results
- 9. Managing Replication
- 9.1. Replication Overview
- 9.1.1. What Directory Units Are Replicated
- 9.1.2. Read-Write and Read-Only Replicas
- 9.1.3. Suppliers and Consumers
- 9.1.4. Changelog
- 9.1.5. Replication Identity
- 9.1.6. Replication Agreement
- 9.1.7. Replicating a Subset of Attributes with Fractional Replication
- 9.1.8. Compatibility with Earlier Versions of Directory Server
- 9.2. Replication Scenarios
- 9.3. Creating the Supplier Bind DN Entry
- 9.4. Configuring Single-Master Replication
- 9.5. Configuring Multi-Master Replication
- 9.6. Configuring Cascading Replication
- 9.7. Configuring Replication from the Command Line
- 9.8. Making a Replica Updatable
- 9.9. Deleting the Changelog
- 9.10. Initializing Consumers
- 9.11. Forcing Replication Updates
- 9.12. Replication over SSL
- 9.13. Setting Replication Timeout Periods
- 9.14. Replicating o=NetscapeRoot for Admin Server Failover
- 9.15. Replication with Earlier Releases
- 9.16. Using the Retro Changelog Plug-in
- 9.17. Monitoring Replication Status
- 9.18. Solving Common Replication Conflicts
- 9.19. Troubleshooting Replication-Related Problems
- 10. Synchronizing Red Hat Directory Server with Microsoft Active Directory
- 10.1. About Windows Sync
- 10.2. Configuring Windows Sync
- 10.2.1. Step 1: Configure SSL on Directory Server
- 10.2.2. Step 2: Configure the Active Directory Domain
- 10.2.3. Step 3: Select or Create the Sync Identity
- 10.2.4. Step 4: Install the Password Sync Service
- 10.2.5. Step 5: Configure the Password Sync Service
- 10.2.6. Step 6: Configure the Directory Server Database for Synchronization
- 10.2.7. Step 7: Create the Synchronization Agreement
- 10.2.8. Step 8: Configure Directory Server User and Group Entries for Synchronization
- 10.2.9. Step 9: Begin Synchronization
- 10.3. Synchronizing Users
- 10.4. Synchronizing Groups
- 10.4.1. About Windows Group Types
- 10.4.2. Group Attributes Synchronized between Directory Server and Active Directory
- 10.4.3. Group Schema Differences between Red Hat Directory Server and Active Directory
- 10.4.4. Configuring Group Sync for Directory Server Groups
- 10.4.5. Configuring Group Sync for Active Directory Groups
- 10.5. Deleting and Resurrecting Entries
- 10.6. Sending Synchronization Updates
- 10.7. Modifying the Sync Agreement
- 10.8. Configuring Unidirectional Synchronization
- 10.9. Managing the Password Sync Service
- 10.10. Troubleshooting
- 11. Organizing Entries with Groups, Roles, and Views
- 11.1. Using Groups
- 11.2. Using Roles
- 11.2.1. About Roles
- 11.2.2. Creating a Managed Role
- 11.2.3. Creating a Filtered Role
- 11.2.4. Creating a Nested Role
- 11.2.5. Editing and Assigning Roles to an Entry
- 11.2.6. Viewing Roles for an Entry through the Command Line
- 11.2.7. Making a Role Inactive or Active
- 11.2.8. Viewing the Activation Status for Entries
- 11.2.9. About Deleting Roles
- 11.2.10. Using Roles Securely
- 11.3. Using Views
- 12. Managing Access Control
- 12.1. Access Control Principles
- 12.2. Default ACIs
- 12.3. Creating ACIs Manually
- 12.4. Bind Rules
- 12.4.1. Bind Rule Syntax
- 12.4.2. Defining User Access - userdn Keyword
- 12.4.3. Defining Group Access - groupdn Keyword
- 12.4.4. Defining Role Access - roledn Keyword
- 12.4.5. Defining Access Based on Value Matching
- 12.4.6. Defining Access from a Specific IP Address
- 12.4.7. Defining Access from a Specific Domain
- 12.4.8. Requiring a Certain Level of Security in Connections
- 12.4.9. Defining Access at a Specific Time of Day or Day of Week
- 12.4.10. Defining Access Based on Authentication Method
- 12.4.11. Using Boolean Bind Rules
- 12.5. Creating ACIs from the Console
- 12.6. Viewing ACIs
- 12.7. Checking Access Rights on Entries (Get Effective Rights)
- 12.8. Logging Access Control Information
- 12.9. Access Control Usage Examples
- 12.9.1. Granting Anonymous Access
- 12.9.2. Granting Write Access to Personal Entries
- 12.9.3. Restricting Access to Key Roles
- 12.9.4. Granting a Group Full Access to a Suffix
- 12.9.5. Granting Rights to Add and Delete Group Entries
- 12.9.6. Granting Conditional Access to a Group or Role
- 12.9.7. Denying Access
- 12.9.8. Setting a Target Using Filtering
- 12.9.9. Allowing Users to Add or Remove Themselves from a Group
- 12.9.10. Setting an ACI to Require a Certain Security Strength Factor for Some Operations
- 12.9.11. Defining Permissions for DNs That Contain a Comma
- 12.9.12. Proxied Authorization ACI Example
- 12.10. Advanced Access Control: Using Macro ACIs
- 12.11. Access Control and Replication
- 12.12. Compatibility with Earlier Releases
- 13. Managing User Authentication
- 13.1. Managing the Password Policy
- 13.2. Configuring the Account Lockout Policy
- 13.3. Synchronizing Passwords
- 13.4. Setting Resource Limits Based on the Bind DN
- 13.5. Enabling Different Types of Binds
- 13.6. Using Pass-through Authentication
- 13.7. Using PAM for Pass-through Authentication
- 13.8. Inactivating Users and Roles
- 14. Configuring Secure Connections
- 14.1. Requiring Secure Connections
- 14.2. Using TLS/SSL
- 14.2.1. Enabling TLS/SSL: Summary of Steps
- 14.2.2. Obtaining and Installing Server Certificates
- 14.2.3. Configuring the Directory Server to Run in SSL/TLS
- 14.2.4. Command-Line Functions for Start TLS
- 14.2.5. Using certutil
- 14.2.6. Managing Certificates Used by the Directory Server Console
- 14.2.7. Updating Attribute Encryption for New SSL/TLS Certificates
- 14.2.8. Using External Security Devices
- 14.2.9. Setting Security Preferences
- 14.2.10. Using Certificate-Based Authentication
- 14.2.11. Managing Certificates for the Directory Server
- 14.3. Using SASL
- 14.3.1. About SASL Identity Mapping
- 14.3.2. Default SASL Mappings for Directory Server
- 14.3.3. Authentication Mechanisms for SASL in Directory Server
- 14.3.4. About Kerberos with Directory Server
- 14.3.5. Configuring SASL Identity Mapping
- 14.3.6. Configuring SASL Authentication at Directory Server Startup
- 14.3.7. Using an External Keytab
- 15. Monitoring Server and Database Activity
- 16. Monitoring Directory Server Using SNMP
- 17. Planning for Disaster
- A. LDAP Data Interchange Format
- B. LDAP URLs
- C. Internationalization
- Glossary
- Index