3.2. Managing Entries Using the Directory Console
Note
3.2.1. Creating a Root Entry
- In the Directory Server Console, select the Configuration tab.
- Right-click on the Data entry in the left menu, and select New Root Suffix from the menu.
- Fill in the new suffix and database information.
- In the Directory tab, right-click the top object representing the Directory Server, and choose New Root Object.The secondary menu under New Root Object displays the new suffixes without a corresponding directory entry. Choose the suffix corresponding to the entry to create.
- In the New Object window, select the object class corresponding to the new entry.The object class must contain the attribute used to name the suffix. For example, if the entry corresponds to the suffix
ou=people,dc=example,dc=com
, then choose theorganizationalUnit
object class or another object class that allows theou
attribute. - Clickin the New Object window.
3.2.2. Creating Directory Entries
Table 3.1. Entry Templates and Corresponding Object Classes
Template | Object Class |
---|---|
User | inetOrgPerson |
Group | groupOfUniqueNames |
Organizational Unit | organizationalUnit |
Role | nsRoleDefinition |
Class of Service | cosSuperDefinition |
- In the Directory Server Console, select the Directory tab.
- In the left pane, right-click the main entry to add the new entry, and select the type of entry: User, Group, Organizational Unit, Role, Class of Service, or Other.
- If the new entry type was Other, then a list of object classes opens. Select an object class from the list to define the new entry.
- Supply a value for all the listed attributes. Required attributes are marked with an asterisk (
*
). - To display the full list of attributes available for the object class (entry type), click the Advanced button.In the Property Editor, select any additional attributes, and fill in the attribute values.
- Clickto save the entry. The new entry is listed in the right pane.
3.2.3. Modifying Directory Entries

- From the Directory tab, by right-clicking an entry, and selecting Advanced Properties from the pop-up menu.
- From the Directory tab, by double-clicking an entry and clicking the Advanced button
- From the Create... new entry forms, by clicking the Advanced button
- From the New Object window, by clicking
3.2.3.1. Adding or Removing an Object Class to an Entry
- In the Directory tab of the Directory Server Console, right-click the entry to modify, and select Advanced from the pop-up menu.
- Select the object class field, and click Add Value.The Add Object Class window opens. It shows a list of object classes that can be added to the entry.
- Select the object class to add, and click.
3.2.3.2. Adding an Attribute to an Entry
- In the Directory tab of the Directory Server Console, right-click the entry to modify, and select Advanced from the pop-up menu.
- Click Add Attribute.
- Select the attribute to add from the list, and click.
Note
If the attribute you want to add is not listed, add the object class containing the attribute first, then add the attribute. See Section 3.2.3.1, “Adding or Removing an Object Class to an Entry” for instructions on adding an object class. If you do not know which object class contains the attribute you need, look up the attribute in the Red Hat Directory Server 10 Configuration, Command, and File Reference., which lists the object classes which use that attribute. - Type in the value for the new attribute in the field to the right of the attribute name.
3.2.3.3. Adding Very Large Attributes
nsslapd-maxbersize
sets the maximum size limit for LDAP requests. The default configuration of Directory Server sets this attribute at 2 megabytes. LDAP add or modify operations will fail when attempting to add very large attributes that result in a request that is larger than 2 megabytes. However, the limit is not applied to replication processes.
nsslapd-maxbersize
configuration attribute to a value larger than the largest LDAP request you will make.
- The size of each attribute name in the request
- The size of the values of each of the attributes in the request
- The size of the DN in the request
- Some overhead, usually 10 kilobytes
nsslapd-maxbersize
setting is using attributes which hold CRL values, such as certificateRevocationList
, authorityRevocationList
, and deltaRevocationList
.
nsslapd-maxbersize
attribute, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.
3.2.3.4. Adding Attribute Values
- In the Directory tab of the Directory Server Console, right-click the entry to modify, and select Advanced from the pop-up menu.
- Select the attribute to which to add a value, and then click Add Value.
- Type in the new attribute value.
3.2.3.5. Adding an Attribute Subtype
- In the Directory tab of the Directory Server Console, right-click the entry to modify, and select Properties from the pop-up menu.
- Click Add Attribute, and select the attribute to add from the list.
- Add a language subtype by selecting a value from the Language drop-down list. Add either a binary or pronunciation subtype by selecting a value from the Subtype drop-down list.
Sometimes a user's name can be more accurately represented in characters of a language other than the default language. For example, a user, Noriko, has a name in Japanese and prefers that her name be represented by Japanese characters when possible. You can select Japanese as a language subtype for the givenname
attribute so that other users can search for her name in Japanese as well as English. For example:
givenname;lang-ja
attribute;lang-subtype:attribute value
cn;lang-ja;lang-en-GB
:value
cn;lang-ja
:ja-value cn;lang-en-GB
:value
Assigning the binary subtype to an attribute indicates that the attribute value is binary, such as user certificates (usercertificate;binary
).
binary
subtype (for example, jpegphoto
), the binary
subtype indicates to clients that multiple variants of the attribute type may exist.
Assigning the pronunciation subtype to an attribute indicates that the attribute value is a phonetic representation. The subtype is added to the attribute name as attribute;phonetic
. This subtype is commonly used in combination with a language subtype for languages that have more than one alphabet, where one is a phonetic representation.
cn
or givenname
. For example, givenname;lang-ja;phonetic
indicates that the attribute value is the phonetic version of the user's Japanese name.