5.4. Assigning and Managing Unique Numeric Attribute Values
gidNumber. The Directory Server can automatically generate and supply unique numbers for specified attributes using the Distributed Numeric Assignment (DNA) Plug-in.
5.4.1. About Dynamic Number Assignments
188.8.131.52. Filters, Searches, and Target Entries
184.108.40.206. Ranges and Assigning Numbers
- In the simplest case, a user entry is added to the directory with an object class which requires the unique-number attribute, but without the attribute present. Adding an entry with no value for the managed attribute triggers the DNA Plug-in to assign a value. This option only works if the DNA Plug-in has been configured to assign unique values to a single attribute.
- A similar and more manageable option is to use a magic number. This magic number is a template value for the managed attribute, something outside the server's range, a number or even a word, that the plug-in recognizes it needs to replace with a new assigned value. When an entry is added with the magic value and the entry is within the scope and filter of the configured DNA Plug-in, then using the magic number automatically triggers the plug-in to generate a new value. For example, this uses 0 as a magic number:
-a-D "cn=directory manager" -W -p 389 -h server.example.com -x dn: uid=jsmith,ou=people,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: posixAccount uid: jsmith cn: John Smith
220.127.116.11. Multiple Attributes in the Same Range
- A single number assigned to a single attribute type from a single range of unique numbers.
- The same unique number assigned to two attributes for a single entry.
- Two different attributes assigned two different numbers from the same range of unique numbers.
employeeIDto a new employee entry, it is important each employee entry is assigned a unique
posixAccountentry, the DNA Plug-in will assign the same number to both attributes. To do this, then pass both managed attributes to the modify operation, specifying the magic value.
[root@server ~]# ldapmodify -D "cn=directory manager" -W -x dn: uid=jsmith,ou=people,dc=example,dc=com changetype: modify add: uidNumber uidNumber: 0 - add:gidNumber gidNumber: 0
posixGroupobject class does not allow a
uidNumberattribute but it does allow
gidNumber. If the DNA Plug-in manages both
gidNumber, then when a
posixGroupentry is created, a unique number for
gidNumberis assigned from the same range as the
gidNumberattributes. Using the same pool for all attributes manged by the plug-in keeps the assignment of unique numbers aligned and prevents situations where a
gidNumberon different entries are assigned from different ranges and result in the same unique number.
[root@server ~]# ldapmodify -D "cn=directory manager" -W -x dn: uid=jsmith,ou=people,dc=example,dc=com changetype: modify add: uidNumber uidNumber: 0 ^D [root@server ~]# ldapmodify -D "cn=directory manager" -W -x dn: uid=jsmith,ou=people,dc=example,dc=com changetype: modify add: employeeId employeeId: magic
Example 5.5. DNA and Unique Bank Account Numbers
customerIDattributes. The Example Bank administrator configured the DNA Plug-in to assign unique values for both attributes from the same range.
secondaryAccountattribute, but will only add the
secondaryAccountattribute to an entry after the entry is created and the
customerIDattributes are assigned. This ensures that
customerIDshare the same unique number, and any
secondaryAccountnumbers are entirely unique but still from the same range of numbers.
5.4.2. Looking at the DNA Plug-in Syntax
- The attribute that value is being managed, is set in the
- The entry DN to use as the base to search for entries, set in the
- The search filter to use to identify entries to manage, set in the
- The next available value to assign, set in the
dnaNextValueattribute (after the entry is created, this is handled by the plug-in)
dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config objectClass: top objectClass: dnaPluginConfig cn: Account UIDs dnatype: uidNumber dnafilter: (objectclass=posixAccount) dnascope: ou=people,dc=example,dc=com dnaNextValue: 1
- The maximum number that the server can assign; this sets the upward bound for the range, which is logically required when multiple servers are assigning numbers. This is set in the
- The threshold where the range is low enough to trigger a range transfer, set in the
dnaThresholdattribute. If this is not set, the default value is
- A timeout period so that the server does not hang waiting for a transfer, set in the
dnaRangeRequestTimeoutattribute. If this is not set, the default value is
10, meaning 10 seconds.
- A configuration entry DN which is shared among all supplier servers, which stores the range information for each supplier, set in the
dnaNextRangeattribute. This shows the next available range for transfer and is managed automatically by the plug-in, as ranges are assigned or used by the server. This range is just "on deck." It has not yet been assigned to another server and is still available for its local Directory Server to use.
dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config objectClass: top objectClass: dnaPluginConfig cn: Account UIDs dnatype: uidNumber dnafilter: (objectclass=posixAccount) dnascope: ou=People,dc=example,dc=com dnanextvalue: 1 dnaMaxValue: 1300 dnasharedcfgdn: cn=Account UIDs,ou=Ranges,dc=example,dc=com dnathreshold: 100 dnaRangeRequestTimeout: 60 dnaNextRange: 1301-2301
dnaNextRangeattribute should be set explicitly only if a separate, specific range has to be assigned to other servers. Any range set in the
dnaNextRangeattribute must be unique from the available range for the other servers to avoid duplication. If there is no request from the other servers and the server where
dnaNextRangeis set explicitly has reached its set
dnaMaxValue, the next set of values (part of the
dnaNextRange) is allocated from this deck.
dnaNextRangeallocation is also limited by the
dnaThresholdattribute that is set in the DNA configuration. Any range allocated to another server for
dnaNextRangecannot violate the threshold for the server, even if the range is available on the deck of
dnaNextRangeattribute is handled internally if it is not set explicitly. When it is handled automatically, the
dnaMaxValueattribute serves as upper limit for the next range.
dnasharedcfgdn. The configuration entry is replicated to all of the other suppliers, so each supplier can check that configuration to find a server to contact for a new range. For example:
dn: dnaHostname=ldap1.example.com+dnaPortNum=389,cn=Account UIDs,ou=Ranges,dc=example,dc=com objectClass: dnaSharedConfig objectClass: top dnahostname: ldap1.example.com dnaPortNum: 389 dnaSecurePortNum: 636 dnaRemainingValues: 1000
Table 5.3. DNA Entry Attributes
|dnaPluginConfig (object class)||The object class for instances of the DNA Plug-in.|
|cn||Gives a unique name for the plug-in instance.|
Contains the name of the attributes for which unique numbers are assigned.
If a prefix will be prepended to the generated value, then be sure to use an attribute which allows the syntax of the combined attribute value, such as a custom attribute which allows alphanumeric strings. Otherwise, syntax validation will enforce the defined syntax for the value, such as integer for
|dnaScope||Sets the base DN to use to search for entries to which to apply the managed ranges.|
|dnaFilter||Gives an LDAP filter to use to specify the kinds of entries for the plug-in to manage.|
|dnaNextValue||Gives the next available number to assign. This is initially set manually when the entry is created; afterward, it is managed by the plug-in.|
|dnaMaxValue|| Optionally, the upper limit of the range that the server can assign. Defining the range is required when there are multiple servers assigning numbers to entries. The default value is |
|dnaInterval||Optionally, sets an interval to use to increment through numbers in a range. Essentially, this skips numbers at a predefined rate. If the interval is 3 and the first number in the range is 1, then the next number used in the ragen is 4, then 7, then 10, incrementing by three for every new number assignment.|
|dnaThreshold||Sets a limit on the amount of remaining available numbers before the server requests a new range.|
|dnaSharedCfgDN||Specifies the DN of a container entry that each supplier server shares. The plug-in automatically creates an entry for the individual instances underneath this entry which contains their available ranges. The plug-in can use this information to request and transfer ranges as servers consume their available range.|
|dnaNextRange|| Shows the next range of numbers which are available to be transferred. This attribute can be set automatically by the plug-in according to the threshold and shared configuration information; this can also be set manually for an administrator to specifically assign an additional range of values to a server. This attribute is always limited by the |
|dnaRangeRequestTimeout||Sets a timeout period for a range request so that a server does not hang indefinitely waiting for a transfer.|
|dnaMagicRegen||Sets a word or number (outside of the assigned range) which automatically triggers the plug-in to assign a number to an attribute. This is a useful default to use for importing entries.|
Sets a string to insert in front of whatever number is assigned. For example, if the prefix is
|dnaSharedConfig (object class)||The object class for shared configuration entries with host information, for servers in multi-master replication.|
|dnaHostname||Identifies the host name of a server in a shared range, as part of the DNA range configuration for that specific host in multi-master replication.|
|dnaPortNum|| Gives the standard port number to use to connect to the host identified in |
|dnaSecurePortNum|| Gives the secure (SSL) port number to use to connect to the host identified in |
|dnaRemainingValues||Contains the number of values that are remaining and available to a server to assign to entries.|
5.4.3. Configuring Unique Number Assignments
18.104.22.168. Configuring Unique Number Assignments
dnaNextvalueis already taken, which requires an equality index on an integer attribute, with the proper ordering matching rule.
- Create the shared container entry in the replicated subtree. For example:
-a-D "cn=directory manager" -W -p 389 -h server.example.com -x dn: ou=Ranges,dc=example,dc=coma changetype: add objectclass: top objectclass: extensibleObject objectclass: organizationalUnit ou: Ranges dn: cn=Account UIDs,ou=Ranges,dc=example,dc=coma changetype: add objectclass: top objectclass: extensibleObject cn: Account UIDs
- Enable the DNA Plug-in. By default, the plug-in entry (which is the container entry) is disabled.
ldapmodify -D "cn=directory manager" -W -p 389 -h server.example.com -x dn: cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on
- Create the new DNA Plug-in instance beneath the container entry. Table 5.3, “DNA Entry Attributes” lists the possible plug-in attributes.
NoteThe plug-in attribute which sets which entry attributes have unique number assignments,
dnaType, is multi-valued. If multiple attributes are set in the same plug-in instance, then their number assignments are taken from the same range. To use different ranges, configure different plug-in instances.
-a-D "cn=directory manager" -W -p 389 -h server.example.com -x dn: cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config changetype: add objectClass: top objectClass: dnaPluginConfig cn: Account UIDs dnatype: uidNumber dnafilter: (objectclass=posixAccount) dnascope: ou=People,dc=example,dc=com dnanextvalue: 1 dnaMaxValue: 1300 dnasharedcfgdn: cn=Account UIDs,ou=Ranges,dc=example,dc=com dnathreshold: 100 dnaRangeRequestTimeout: 60 dnaMagicRegen: magic
- For servers in multi-master replication, create a configuration entry for the host, which specifies its connection information and range.The DN of the entry is a combination of the host name and the port number (
-a-D "cn=directory manager" -W -p 389 -h server.example.com -x dn: dnaHostname=ldap1.example.com+dnaPortNum=389,cn=Account UIDs,ou=Ranges,dc=example,dc=com objectClass: dnaSharedConfig objectClass: top dnahostname: ldap1.example.com dnaPortNum: 389 dnaSecurePortNum: 636 dnaRemainingValues: 1000
- Restart the server to load the new plug-in instance.
service dirsrv restart instance_name
22.214.171.124. Editing the DNA Plug-in in the Console
dnaNextvalueis already taken, which requires an equality index on an integer attribute, with the proper ordering matching rule.
- Click the Directory tab.
- Open the config folder, and then expand the plugins folder.
- Click the Distributed Numeric Assignment plug-in folder. All of the DNA Plug-in instances are listed in the main window.
- Highlight the DNA instance entry, and right-click on the Advanced link to open the property editor.
- Edit the DNA-related attributes.