Chapter 4. Plug-in Implemented Server Functionality Reference

This chapter contains reference information on Red Hat Directory Server plug-ins.
The configuration for each part of Directory Server plug-in functionality has its own separate entry and set of attributes under the subtree cn=plugins,cn=config. 
dn: cn=Telephone Syntax,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
objectclass: extensibleObject
cn: Telephone Syntax
nsslapd-pluginPath: libsyntax-plugin
nsslapd-pluginInitfunc: tel_init
nsslapd-pluginType: syntax
nsslapd-pluginEnabled: on
Some of these attributes are common to all plug-ins while others may be particular to a specific plug-in. Check which attributes are currently being used by a given plug-in by performing an ldapsearch on the cn=config subtree.
All plug-ins are instances of the nsSlapdPlugin object class, which in turn inherits from the extensibleObject object class. For plug-in configuration attributes to be taken into account by the server, both of these object classes (in addition to the top object class) must be present in the entry, as shown in the following example: 
dn:cn=ACL Plugin,cn=plugins,cn=config
objectclass:top
objectclass:nsSlapdPlugin
objectclass:extensibleObject

4.1. Server Plug-in Functionality Reference

The following tables provide a quick overview of the plug-ins provided with Directory Server, along with their configurable options, configurable arguments, default setting, dependencies, general performance-related information, and further reading. These tables assist in weighing plug-in performance gains and costs and choose the optimal settings for the deployment. The Further Information section cross-references further reading, where this is available.

4.1.1. 7-bit Check Plug-in

Plug-in Parameter Description
Plug-in ID NS7bitAtt
DN of Configuration Entry cn=7-bit check,cn=plugins,cn=config
Description Checks certain attributes are 7-bit clean
Type preoperation
Configurable Options on | off
Default Setting on
Configurable Arguments List of attributes (uid mail userpassword) followed by "," and then suffixes on which the check is to occur.
Dependencies Database
Performance-Related Information None
Further Information If the Directory Server uses non-ASCII characters, such as Japanese, turn this plug-in off.

4.1.2. ACL Plug-in

Plug-in Parameter Description
Plug-in ID acl
DN of Configuration Entry cn=ACL Plugin,cn=plugins,cn=config
Description ACL access check plug-in
Type accesscontrol
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies Database
Performance-Related Information Access control incurs a minimal performance hit. Leave this plug-in enabled since it is the primary means of access control for the server.
Further Information See the "Managing Access Control" chapter in the Red Hat Directory Server Administration Guide.

4.1.3. ACL Preoperation Plug-in

Plug-in Parameter Description
Plug-in ID acl
DN of Configuration Entry cn=ACL preoperation,cn=plugins,cn=config
Description ACL access check plug-in
Type preoperation
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies Database
Performance-Related Information Access control incurs a minimal performance hit. Leave this plug-in enabled since it is the primary means of access control for the server.
Further Information See the "Managing Access Control" chapter in the Red Hat Directory Server Administration Guide.

4.1.4. Account Policy Plug-in

Plug-in Parameter Description
Plug-in ID none
DN of Configuration Entry cn=Account Policy Plugin,cn=plugins,cn=config
Description Defines a policy to lock user accounts after a certain expiration period or inactivity period.
Type object
Configurable Options on | off
Default Setting off
Configurable Arguments A pointer to a configuration entry which contains the global account policy settings.
Dependencies Database
Performance-Related Information None
Further Information This plug-in configuration points to a configuration entry which is used for server-wide settings on account inactivity and expiration data. Individual (subtree-level or user-level) account policies can be defined as directory entries, as instances of the acctPolicySubentry object class. These configuration entries can then be applied to users or roles through classes of service.

4.1.5. Account Usability Plug-in

Plug-in Parameter Description
Plug-in ID acctusability
DN of Configuration Entry cn=Account Usability Plugin,cn=plugins,cn=config
Description Checks the authentication status, or usability, of an account without actually authenticating as the given user
Type preoperation
Configurable Options on | off
Default Setting on
Dependencies Database
Performance-Related Information None

4.1.6. AD DN Plug-in

Plug-in Parameter Description
Plug-in ID addn
DN of Configuration Entry cn=addn,cn=plugins,cn=config
Description Enables the usage of Active Directory-formatted user names, such as user_name and user_name@domain, for bind operations.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments addn_default_domain: Sets the default domain that is automatically appended to user names without domain.
Dependencies None
Performance-Related Information None

4.1.7. Attribute Uniqueness Plug-in

Plug-in Parameter Description
Plug-in ID NSUniqueAttr
DN of Configuration Entry cn=Attribute Uniqueness,cn=plugins,cn=config
Description Checks that the values of specified attributes are unique each time a modification occurs on an entry. For example, most sites require that a user ID and email address be unique.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments To check for UID attribute uniqueness in all listed subtrees, enter uid "DN" "DN".... However, to check for UID attribute uniqueness when adding or updating entries with the requiredObjectClass, enter attribute="uid" MarkerObjectclass = "ObjectClassName" and, optionally requiredObjectClass = "ObjectClassName". This starts checking for the required object classes from the parent entry containing the ObjectClass as defined by the MarkerObjectClass attribute.
Dependencies Database
Performance-Related Information
Directory Server provides the UID Uniqueness Plug-in by default. To ensure unique values for other attributes, create instances of the Attribute Uniqueness Plug-in for those attributes. See the "Using the Attribute Uniqueness Plug-in" section in the Red Hat Directory Server Administration Guide for more information about the Attribute Uniqueness Plug-in.
The UID Uniqueness Plug-in is off by default due to operation restrictions that need to be addressed before enabling the plug-in in a multi-master replication environment. Turning the plug-in on may slow down Directory Server performance.
Further Information See the "Using the Attribute Uniqueness Plug-in" section in the Red Hat Directory Server Administration Guide.

4.1.8. Auto Membership Plug-in

Plug-in Parameter Description
Plug-in ID Auto Membership
DN of Configuration Entry cn=Auto Membership,cn=plugins,cn=config
Description Container entry for automember definitions. Automember definitions search new entries and, if they match defined LDAP search filters and regular expression conditions, add the entry to a specified group automatically.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments None for the main plug-in entry. The definition entry must specify an LDAP scope, LDAP filter, default group, and member attribute format. The optional regular expression child entry can specify inclusive and exclusive expressions and a different target group.
Dependencies Database
Performance-Related Information None.
Further Information See the "Automatically Adding Entries to Specified Groups" section in the Red Hat Directory Server Administration Guide.

4.1.9. Binary Syntax Plug-in

Warning

Binary syntax is deprecated. Use Octet String syntax instead.
Plug-in Parameter Description
Plug-in ID bin-syntax
DN of Configuration Entry cn=Binary Syntax,cn=plugins,cn=config
Description Syntax for handling binary data.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information

4.1.10. Bit String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID bitstring-syntax
DN of Configuration Entry cn=Bit String Syntax,cn=plugins,cn=config
Description Supports bit string syntax values and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.11. Bitwise Plug-in

Plug-in Parameter Description
Plug-in ID bitwise
DN of Configuration Entry cn=Bitwise Plugin,cn=plugins,cn=config
Description Matching rule for performing bitwise operations against the LDAP server
Type matchingrule
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information See the "Finding Directory Entries" chapter in the Administration Guide for performing searches using bitwise filters.

4.1.12. Boolean Syntax Plug-in

Plug-in Parameter Description
Plug-in ID boolean-syntax
DN of Configuration Entry cn=Boolean Syntax,cn=plugins,cn=config
Description Supports boolean syntax values (TRUE or FALSE) and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.13. Case Exact String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID ces-syntax
DN of Configuration Entry cn=Case Exact String Syntax,cn=plugins,cn=config
Description Supports case-sensitive matching or Directory String, IA5 String, and related syntaxes. This is not a case-exact syntax; this plug-in provides case-sensitive matching rules for different string syntaxes.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information

4.1.14. Case Ignore String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID directorystring-syntax
DN of Configuration Entry cn=Case Ignore String Syntax,cn=plugins,cn=config
Description Supports case-insensitive matching rules for Directory String, IA5 String, and related syntaxes. This is not a case-insensitive syntax; this plug-in provides case-sensitive matching rules for different string syntaxes.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information

4.1.15. Chaining Database Plug-in

Plug-in Parameter Description
Plug-in ID chaining database
DN of Configuration Entry cn=Chaining database,cn=plugins,cn=config
Description Enables back end databases to be linked
Type database
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information There are many performance related tuning parameters involved with the chaining database. See the "Maintaining Database Links" section in the Red Hat Directory Server Administration Guide.
Further Information A chaining database is also known as a database link. Database links are described in the "Configuring Directory Databases" chapter in the Red Hat Directory Server Administration Guide.

4.1.16. Class of Service Plug-in

Plug-in Parameter Description
Plug-in ID cos
DN of Configuration Entry cn=Class of Service,cn=plugins,cn=config
Description Allows for sharing of attributes between entries
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies
Type: Database
Named: State Change Plug-in
Named: Views Plug-in
Performance-Related Information Do not modify the configuration of this plug-in. Leave this plug-in running at all times.
Further Information See the "Managing Dynamic Attributes" chapter in the Red Hat Directory Server Administration Guide.

4.1.17. Content Synchronization Plug-in

Plug-in Parameter Description
Plug-in ID content-sync-plugin
DN of Configuration Entry cn=Content Synchronization,cn=plugins,cn=config
Description Enables support for the SyncRepl protocol in Directory Server according to RFC 4533.
Type object
Configurable Options on | off
Default Setting off
Configurable Arguments None
Dependencies Retro Changelog Plug-in
Performance-Related Information If you know which back end or subtree clients access to synchronize data, limit the scope of the Retro Changelog plug-in accordingly.
Further Information See the corresponding sections in the Red Hat Directory Administration Guide.

4.1.18. Country String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID countrystring-syntax
DN of Configuration Entry cn=Country String Syntax,cn=plugins,cn=config
Description Supports country naming syntax values and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.19. Delivery Method Syntax Plug-in

Plug-in Parameter Description
Plug-in ID delivery-syntax
DN of Configuration Entry cn=Delivery Method Syntax,cn=plugins,cn=config
Description Supports values that are lists of preferred deliver methods and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.20. deref Plug-in

Plug-in Parameter Description
Plug-in ID Dereference
DN of Configuration Entry cn=deref,cn=plugins,cn=config
Description For dereference controls in directory searches
Type preoperation
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies Database
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information See the "Finding Directory Entries" chapter in the Administration Guide for performing searches using dereference controls.

4.1.21. Distinguished Name Syntax Plug-in

Plug-in Parameter Description
Plug-in ID dn-syntax
DN of Configuration Entry cn=Distinguished Name Syntax,cn=plugins,cn=config
Description Supports DN value syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.22. Distributed Numeric Assignment Plug-in

Plug-in Information Description
Plug-in ID Distributed Numeric Assignment
Configuration Entry DN cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config
Description Distributed Numeric Assignment plugin
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments
Dependencies Database
Performance-Related Information None
Further Information

4.1.23. Enhanced Guide Syntax Plug-in

Plug-in Parameter Description
Plug-in ID enhancedguide-syntax
DN of Configuration Entry cn=Enhanced Guide Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for creating complex criteria, based on attributes and filters, to build searches; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.24. Facsimile Telephone Number Syntax Plug-in

Plug-in Parameter Description
Plug-in ID facsimile-syntax
DN of Configuration Entry cn=Facsimile Telephone Number Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for fax numbers; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.25. Fax Syntax Plug-in

Plug-in Parameter Description
Plug-in ID fax-syntax
DN of Configuration Entry cn=Fax Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for storing images of faxed objects; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.26. Generalized Time Syntax Plug-in

Plug-in Parameter Description
Plug-in ID time-syntax
DN of Configuration Entry cn=Generalized Time Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for dealing with dates, times and time zones; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information
The Generalized Time String consists of a four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second, and a time zone indication. Red Hat strongly recommends using the Z time zone indication, which indicates Greenwich Mean Time.
See also RFC 4517.

4.1.27. Guide Syntax Plug-in

Warning

This syntax is deprecated. Use Enhanced Guide syntax instead.
Plug-in Parameter Description
Plug-in ID guide-syntax
DN of Configuration Entry cn=Guide Syntax,cn=plugins,cn=config
Description Syntax for creating complex criteria, based on attributes and filters, to build searches
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information This syntax is obsolete. The Enhanced Guide Syntax should be used instead.

4.1.28. HTTP Client Plug-in

Plug-in Parameter Description
Plug-in ID http-client
DN of Configuration Entry cn=HTTP Client,cn=plugins,cn=config
Description HTTP client plug-in
Type preoperation
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies Database
Performance-Related Information
Further Information

4.1.29. Integer Syntax Plug-in

Plug-in Parameter Description
Plug-in ID int-syntax
DN of Configuration Entry cn=Integer Syntax,cn=plugins,cn=config
Description Supports integer syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.30. Internationalization Plug-in

Plug-in Parameter Description
Plug-in ID orderingrule
DN of Configuration Entry cn=Internationalization Plugin,cn=plugins,cn=config
Description Enables internationalized strings to be ordered in the directory
Type matchingrule
Configurable Options on | off
Default Setting on
Configurable Arguments The Internationalization Plug-in has one argument, which must not be modified, which specifies the location of the /etc/dirsrv/config/slapd-collations.conf file. This file stores the collation orders and locales used by the Internationalization Plug-in.
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information See the "Internationalization" appendix and the section on "Searching an Internationalized Directory" in the "Finding Directory Entries" appendix in the Red Hat Directory Server Administration Guide.

4.1.31. JPEG Syntax Plug-in

Plug-in Parameter Description
Plug-in ID jpeg-syntax
DN of Configuration Entry cn=JPEG Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for JPEG image data; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.32. ldbm database Plug-in

Plug-in Parameter Description
Plug-in ID ldbm-backend
DN of Configuration Entry cn=ldbm database,cn=plugins,cn=config
Description Implements local databases
Type database
Configurable Options
Default Setting on
Configurable Arguments None
Dependencies
Syntax
matchingRule
Performance-Related Information See Section 4.4, “Database Plug-in Attributes” for further information on database configuration.
Further Information See the "Configuring Directory Databases" chapter in the Red Hat Directory Server Administration Guide.

4.1.33. Linked Attributes Plug-in

Plug-in Parameter Description
Plug-in ID Linked Attributes
DN of Configuration Entry cn=Linked Attributes,cn=plugins,cn=config
Description Container entry for linked-managed attribute configuration entries. Each configuration entry under the container links one attribute to another, so that when one entry is updated (such as a manager entry), then any entry associated with that entry (such as a custom directReports attribute) are automatically updated with a user-specified corresponding attribute.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments None for the main plug-in entry. Each plug-in instance has three possible attributes:
linkType, which sets the primary attribute for the plug-in to monitor
managedType, which sets the attribute which will be managed dynamically by the plug-in whenever the attribute in linkType is modified
linkScope, which restricts the plug-in activity to a specific subtree within the directory tree
Dependencies Database
Performance-Related Information Any attribute set in linkType must only allow values in a DN format. Any attribute set in managedType must be multi-valued.
Further Information See the "Managing Attributes" chapter in the Red Hat Directory Server Administration Guide and Section 4.11, “Linked Attributes Plug-in Attributes”.

4.1.34. Managed Entries Plug-in

Plug-in Information Description
Plug-in ID Managed Entries
Configuration Entry DN cn=Managed Entries,cn=plugins,cn=config
Description Container entry for automatically generated directory entries. Each configuration entry defines a target subtree and a template entry. When a matching entry in the target subtree is created, then the plug-in automatically creates a new, related entry based on the template.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments None for the main plug-in entry. Each plug-in instance has four possible attributes:
originScope, which sets the search base
originFilter, which sets the search base for matching entries
managedScope, which sets the subtree under which to create new managed entries
managedTemplate, which is the template entry used to create the managed entries
Dependencies Database
Performance-Related Information None
Further Information

4.1.35. MemberOf Plug-in

Plug-in Information Description
Plug-in ID memberOf
Configuration Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Description Manages the memberOf attribute on user entries, based on the member attributes in the group entry.
Type postoperation
Configurable Options on | off
Default Setting off
Configurable Arguments
memberOfAttr sets the attribute to generate in people's entries to show their group membership.
memberOfGroupAttr sets the attribute to use to identify group member's DNs.
Dependencies Database
Performance-Related Information None
Further Information

4.1.36. Multi-master Replication Plug-in

Plug-in Parameter Description
Plug-in ID replication-multimaster
DN of Configuration Entry cn=Multimaster Replication plugin,cn=plugins,cn=config
Description Enables replication between two current Directory Servers
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies
Named: ldbm database
Named: DES
Named: Class of Service
Performance-Related Information
Further Information Turn this plug-in off if one server will never replicate. See the "Managing Replication" chapter in the Red Hat Directory Server Administration Guide.

4.1.37. Name and Optional UID Syntax Plug-in

Plug-in Parameter Description
Plug-in ID nameoptuid-syntax
DN of Configuration Entry cn=Name And Optional UID Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules to store and search for a DN with an optional unique ID; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information
The optional UID is used to distinguish between entries which may have identical DNs or naming attributes.
See also RFC 4517.

4.1.38. Numeric String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID numstr-syntax
DN of Configuration Entry cn=Numeric String Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for strings of numbers and spaces; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.39. Octet String Syntax Plug-in

Note

Use the Octet String syntax instead of Binary, which is deprecated.
Plug-in Parameter Description
Plug-in ID octetstring-syntax
DN of Configuration Entry cn=Octet String Syntax,cn=plugins,cn=config
Description Supports octet string syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.40. OID Syntax Plug-in

Plug-in Parameter Description
Plug-in ID oid-syntax
DN of Configuration Entry cn=OID Syntax,cn=plugins,cn=config
Description Supports object identifier (OID) syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.41. PAM Pass Through Auth Plug-in

Plug-in Parameter Description
Plug-in ID pam_passthruauth
DN of Configuration Entry cn=PAM Pass Through Auth,cn=plugins,cn=config
Description Enables pass-through authentication for PAM, meaning that a PAM service can use the Directory Server as its user authentication store.
Type preoperation
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies Database
Performance-Related Information
Further Information See the "Using PAM Pass-through Authentication" section in the Red Hat Directory Server Administration Guide.

4.1.42. Pass Through Authentication Plug-in

Plug-in Parameter Description
Plug-in ID passthruauth
DN of Configuration Entry cn=Pass Through Authentication,cn=plugins,cn=config
Description Enables pass-through authentication, the mechanism which allows one directory to consult another to authenticate bind requests.
Type preoperation
Configurable Options on | off
Default Setting off
Configurable Arguments ldap://example.com:389/o=example
Dependencies Database
Performance-Related Information Pass-through authentication slows down bind requests a little because they have to make an extra hop to the remote server. See the "Using Pass-through Authentication" chapter in the Red Hat Directory Server Administration Guide.
Further Information See the "Using the Pass-through Authentication Plug-in" chapter in the Red Hat Directory Server Administration Guide.

4.1.43. Password Storage Schemes

Directory Server implements the password storage schemes as plug-ins. However, the cn=Password Storage Schemes,cn=plugins,cn=config entry itself is just a container, not a plug-in entry. All password storage scheme plug-ins are stored as a subentry of this container.
To display all password storage schemes plug-ins, enter: 
# ldapsearch -D "cn=Directory Manager" -W -p 389 -h server.example.com -x \
     -b "cn=Password Storage Schemes,cn=plugins,cn=config" -s sub "(objectclass=*)" dn

Warning

Red Hat recommends not disabling the password scheme plug-ins nor to change the configurations of the plug-ins to prevent unpredictable authentication behavior.

Strong Password Storage Schemes

Red Hat recommends using only the following strong password storage schemes (strongest first):
  • PBKDF2_SHA256
    The password-based key derivation function 2 (PBKDF2) was designed to expend resources to counter brute force attacks. PBKDF2 supports a variable number of iterations to apply the hashing algorithm. Higher iterations improve security but require more hardware resources. In Directory Server, the PBKDF2_SHA256 scheme is implemented using 30,000 iterations to apply the SHA256 algorithm. This value is hard-coded and will be increased in future versions of Directory Server without requiring interaction by an administrator.

    Note

    The network security service (NSS) database in Red Hat Enterprise Linux 6 does not support PBKDF2. Therefore you cannot use this password scheme in a replication topology with Directory Server 9.
  • SSHA512 (default)
    The salted secure hashing algorithm (SSHA) implements an enhanced version of the secure hashing algorithm (SHA), that uses a randomly generated salt to increase the security of the hashed password. SSHA512 implements the hashing algorithm using 512 bits.

Weak Password Storage Schemes

Besides the recommended strong password storage schemes, Directory Server supports the following weak schemes for backward compatibility:
AES
CLEAR
CRYPT
CRYPT-MD5
CRYPT-SHA256
CRYPT-SHA512
DES
MD5
NS-MTA-MD5
[a]
SHA
[b]
SHA256
SHA384
SHA512
SMD5
SSHA
[b]
SSHA256
SSHA384
[a] Directory Server only supports authentication using this scheme. You can no longer use it to encrypt passwords.
[b] 160 bit

Important

Only continue using a weak scheme over a short time frame, as it increases security risks.

4.1.44. Posix Winsync API Plug-in

Plug-in Parameter Description
Plug-in ID posix-winsync-plugin
DN of Configuration Entry cn=Posix Winsync API,cn=plugins,cn=config
Description Enables and configures Windows synchronization for Posix attributes set on Active Directory user and group entries.
Type preoperation
Configurable Arguments
  • on | off
  • memberUID mapping (groups)
  • converting and sorting memberUID values in lower case (groups)
  • memberOf fix-up tasks with sync operations
  • use Windows 2003 Posix schema
Default Setting off
Configurable Arguments None
Dependencies database

4.1.45. Postal Address String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID postaladdress-syntax
DN of Configuration Entry cn=Postal Address Syntax,cn=plugins,cn=config
Description Supports postal address syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.46. Printable String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID printablestring-syntax
DN of Configuration Entry cn=Printable String Syntax,cn=plugins,cn=config
Description Supports syntaxes and matching rules for alphanumeric and select punctuation strings (for strings which conform to printable strings as defined in RFC 4517).
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.47. Referential Integrity Postoperation Plug-in

Plug-in Parameter Description
Plug-in ID referint
DN of Configuration Entry cn=Referential Integrity Postoperation,cn=plugins,cn=config
Description Enables the server to ensure referential integrity
Type postoperation
Configurable Options All configuration and on | off
Default Setting off
Configurable Arguments When enabled, the post-operation Referential Integrity Plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. The plug-in can be configured to perform integrity checks on all other attributes. For details, see the corresponding section in the Directory Server Administration Guide.
Dependencies Database
Performance-Related Information The Referential Integrity Plug-in should be enabled only on one master in a multi-master replication environment to avoid conflict resolution loops. When enabling the plug-in on chained servers, be sure to analyze the performance resource and time needs as well as integrity needs; integrity checks can be time consuming and demanding on memory and CPU. All attributes specified must be indexed for both presence and equality.
Further Information See the "Managing Indexes" chapter for information about how to index attributes used for referential integrity checking and the "Configuring Directory Databases" chapter in the Red Hat Directory Server Administration Guide.

4.1.48. Retro Changelog Plug-in

Plug-in Parameter Description
Plug-in ID retrocl
DN of Configuration Entry cn=Retro Changelog Plugin,cn=plugins,cn=config
Description Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions. Maintains a log of all changes occurring in the Directory Server. The retro changelog offers the same functionality as the changelog in the 4.x versions of Directory Server. This plug-in exposes the cn=changelog suffix to clients, so that clients can use this suffix with or without persistent search for simple sync applications.
Type object
Configurable Options on | off
Default Setting off
Configurable Arguments See Section 4.16, “Retro Changelog Plug-in Attributes” for further information on the two configuration attributes for this plug-in.
Dependencies
Type: Database
Named: Class of Service
Performance-Related Information May slow down Directory Server update performance.
Further Information See the "Managing Replication" chapter in the Red Hat Directory Server Administration Guide.

4.1.49. Roles Plug-in

Plug-in Parameter Description
Plug-in ID roles
DN of Configuration Entry cn=Roles Plugin,cn=plugins,cn=config
Description Enables the use of roles in the Directory Server
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies
Type: Database
Named: State Change Plug-in
Named: Views Plug-in
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information See the "Advanced Entry Management" chapter in the Red Hat Directory Server Administration Guide.

4.1.50. RootDN Access Control Plug-in

Plug-in Parameter Description
Plug-in ID rootdn-access-control
DN of Configuration Entry cn=RootDN Access Control,cn=plugins,cn=config
Description Enables and configures access controls to use for the root DN entry.
Type internalpreoperation
Configurable Options on | off
Default Setting off
Configurable Attributes
  • rootdn-open-time and rootdn-close-time for time-based access controls
  • rootdn-days-allowed for day-based access controls
  • rootdn-allow-host, rootdn-deny-host, rootdn-allow-ip, and rootdn-deny-ip for host-based access controls
Dependencies None
Further Information See the "Access Control" sections in the Red Hat Directory Server Administration Guide.

4.1.51. Schema Reload Plug-in

Plug-in Information Description
Plug-in ID schemareload
Configuration Entry DN cn=Schema Reload,cn=plugins,cn=config
Description Task plug-in to reload schema files
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information
Further Information

4.1.52. Space Insensitive String Syntax Plug-in

Plug-in Parameter Description
Plug-in ID none
DN of Configuration Entry cn=Space Insensitive String Syntax,cn=plugins,cn=config
Description Syntax for handling space-insensitive values
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information
This plug-in enables the Directory Server to support space and case insensitive values. This allows applications to search the directory using entries with ASCII space characters.
For example, a search or compare operation that uses jOHN Doe will match entries that contain johndoe, john doe, and John Doe if the attribute's schema has been configured to use the space insensitive syntax.
For more information about finding directory entries, see the "Finding Directory Entries" chapter in the Red Hat Directory Server Administration Guide.

4.1.53. State Change Plug-in

Plug-in Parameter Description
Plug-in ID statechange
DN of Configuration Entry cn=State Change Plugin,cn=plugins,cn=config
Description Enables state-change-notification service
Type postoperation
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information
Further Information

4.1.54. Syntax Validation Task Plug-in

Plug-in Parameter Description
Plug-in ID none
DN of Configuration Entry cn=Syntax Validation Task,cn=plugins,cn=config
Description Enables syntax validation for attribute values
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information
Further Information This plug-in implements syntax validation tasks. The actual process that carries out syntax validation is performed by each specific syntax plug-in.

4.1.55. Telephone Syntax Plug-in

Plug-in Parameter Description
Plug-in ID tele-syntax
DN of Configuration Entry cn=Telephone Syntax,cn=plugins,cn=config
Description Supports telephone number syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.56. Teletex Terminal Identifier Syntax Plug-in

Plug-in Parameter Description
Plug-in ID teletextermid-syntax
DN of Configuration Entry cn=Teletex Terminal Identifier Syntax,cn=plugins,cn=config
Description Supports international telephone number syntaxes and related matching rules from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.57. Telex Number Syntax Plug-in

Plug-in Parameter Description
Plug-in ID telex-syntax
DN of Configuration Entry cn=Telex Number Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for the telex number, country code, and answerback code of a telex terminal; from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.58. URI Syntax Plug-in

Plug-in Parameter Description
Plug-in ID none
DN of Configuration Entry cn=URI Syntax,cn=plugins,cn=config
Description Supports syntaxes and related matching rules for unique resource identifiers (URIs), including unique resource locators (URLs); from RFC 4517.
Type syntax
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies None
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information RFC 4517

4.1.59. USN Plug-in

Plug-in Parameter Description
Plug-in ID USN
DN of Configuration Entry cn=USN,cn=plugins,cn=config
Description Sets an update sequence number (USN) on an entry, for every entry in the directory, whenever there is a modification, including adding and deleting entries and modifying attribute values.
Type object
Configurable Options on | off
Default Setting off
Configurable Arguments None
Dependencies Database
Performance-Related Information For replication, it is recommended that the entryUSN configuration attribute be excluded using fractional replication.
Further Information

4.1.60. Views Plug-in

Plug-in Parameter Description
Plug-in ID views
DN of Configuration Entry cn=Views,cn=plugins,cn=config
Description Enables the use of views in the Directory Server databases.
Type object
Configurable Options on | off
Default Setting on
Configurable Arguments None
Dependencies
Type: Database
Named: State Change Plug-in
Performance-Related Information Do not modify the configuration of this plug-in. Red Hat recommends leaving this plug-in running at all times.
Further Information