Netscape NETSCAPE DIRECTORY SERVER 6.1 -... Service-Handbuch

Administrator’s Guide

Netscape Directory Server

Version6.1

August 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by

Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed

by the license agreement for the Software and applicable copyright law.

Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is

prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without

notice.

THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE

LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY

ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,

PROFITS, USE, OR DATA.

rights reserved.

Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and

other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications

Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their

respective owners.

The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full

compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation

to the U.S. government is with restricted rights as described in the license agreement for that Software.

Contents

ListofFigures .................................................................19

ListofTables..................................................................21

Introduction ...................................................................25

DirectoryServerOverview .............................................................. 25

PrerequisiteReading ................................................................... 26

ConventionsUsedinThisBook .......................................................... 27

RelatedInformation .................................................................... 28

Part 1 AdministeringNetscapeDirectoryServer................................. 29

Chapter 1 IntroductiontoNetscapeDirectoryServer ...............................31

OverviewofDirectoryServerManagement................................................ 32

UsingtheDirectoryServerConsole....................................................... 32

StartingDirectoryServerConsole...................................................... 32

CopyingEntryDNstotheClipboard................................................... 33

ConfiguringtheDirectoryManager ...................................................... 34

BindingtotheDirectoryFromNetscapeConsole ........................................... 34

ChangingLoginIdentity ............................................................. 35

ViewingtheCurrentBindDNFromtheConsole ........................................ 35

StartingandStoppingtheDirectoryServer ................................................ 35

Starting/StoppingtheServerFromtheConsole......................................... 36

Starting/StoppingtheServerFromtheCommandLine.................................. 37

ConfiguringLDAPParameters........................................................... 37

ChangingDirectoryServerPortNumbers .............................................. 37

PlacingtheEntireDirectoryServerinRead-OnlyMode................................... 38

TrackingModificationstoDirectoryEntries............................................. 39

StartingtheServerwithSSLEnabled ..................................................... 40

4 Netscape Directory Server Administrator’s Guide • August 2002

CloningaDirectoryServer .............................................................. 41

CreatingaNewDirectoryServerInstance .............................................. 41

CloningtheDirectoryConfiguration ................................................... 42

StartingtheServerinReferralMode ...................................................... 42

UsingthereferCommand ............................................................ 43

Chapter 2 CreatingDirectoryEntries............................................ 45

ManagingEntriesFromtheDirectoryConsole ............................................. 45

CreatingaRootEntry ................................................................ 46

CreatingDirectoryEntries ............................................................ 47

CreatinganEntryUsingaPredefinedTemplate....................................... 48

CreatingOtherTypesofEntries..................................................... 48

ModifyingDirectoryEntries .......................................................... 49

DisplayingthePropertyEditor ..................................................... 50

AddinganObjectClasstoanEntry ................................................. 50

RemovinganObjectClass.......................................................... 50

AddinganAttributetoanEntry .................................................... 51

AddingAttributeValues........................................................... 51

RemovinganAttributeValue....................................................... 52

AddinganAttributeSubtype....................................................... 52

DeletingDirectoryEntries ............................................................ 54

ManagingEntriesFromtheCommandLine ............................................... 54

ProvidingInputFromtheCommandLine .............................................. 55

CreatingaRootEntryFromtheCommandLine ......................................... 56

Adding Entries Using LDIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Adding and Modifying Entries Using ldapmodify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

AddingEntriesUsingldapmodify .................................................. 58

ModifyingEntriesUsingldapmodify ................................................ 59

DeletingEntriesUsingldapdelete ..................................................... 60

UsingSpecialCharacters ............................................................. 61

LDIFUpdateStatements ................................................................ 62

Adding an Entry Using LDIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

RenaminganEntryUsingLDIF ....................................................... 65

ANoteonRenamingEntries ....................................................... 66

ModifyinganEntryUsingLDIF ....................................................... 67

AddingAttributestoExistingEntriesUsingLDIF ..................................... 67

ChanginganAttributeValueUsingLDIF ............................................ 69

DeletingAllValuesofanAttributeUsingLDIF ....................................... 70

DeletingaSpecificAttributeValueUsingLDIF ....................................... 70

DeletinganEntryUsingLDIF......................................................... 71

ModifyinganEntryinanInternationalizedDirectory .................................... 72

MaintainingReferentialIntegrity......................................................... 72

HowReferentialIntegrityWorks ...................................................... 72

UsingReferentialIntegritywithReplication............................................. 73

ConfiguringtheSupplierServer .................................................... 74

Enabling/DisablingReferentialIntegrity ............................................... 74

FromtheDirectoryServerConsole .................................................. 74

RecordingUpdatesintheChangeLog ................................................. 75

FromtheDirectoryServerConsole .................................................. 75

ModifyingtheUpdateInterval ........................................................ 75

FromtheDirectoryServerConsole .................................................. 76

ModifyingtheAttributeList .......................................................... 76

FromtheDirectoryServerConsole .................................................. 76

Chapter 3 Configuring Directory Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

CreatingandMaintainingSuffixes........................................................ 79

CreatingSuffixes .................................................................... 80

CreatingaNewRootSuffixUsingtheConsole........................................ 82

CreatingaNewSubSuffixUsingtheConsole ........................................ 83

CreatingRootandSubSuffixesFromtheCommandLine .............................. 84

MaintainingSuffixes ................................................................. 87

UsingReferralsinaSuffix.......................................................... 87

EnablingReferralsOnlyDuringUpdateOperations ................................... 88

DisablingaSuffix ................................................................. 88

DeletingaSuffix .................................................................. 89

CreatingandMaintainingDatabases...................................................... 89

CreatingDatabases .................................................................. 90

CreatingaNewDatabaseforanExistingSuffixUsingtheConsole ...................... 92

CreatingaNewDatabaseforaSingleSuffixFromtheCommandLine ................... 92

AddingMultipleDatabasesforaSingleSuffix ........................................ 93

AddingtheCustomDistributionFunctiontoaSuffix .................................. 94

MaintainingDirectoryDatabases ...................................................... 95

PlacingaDatabaseinRead-OnlyMode .............................................. 95

DeletingaDatabase ............................................................... 96

CreatingandMaintainingDatabaseLinks ................................................. 96

ConfiguringtheChainingPolicy ...................................................... 97

ChainingComponentOperations ................................................... 97

ChainingLDAPControls ......................................................... 101

CreatingaNewDatabaseLink ....................................................... 102

CreatingaNewDatabaseLinkUsingtheConsole .................................... 103

CreatingaDatabaseLinkFromtheCommandLine .................................. 104

ChainingUsingSSL................................................................. 113

MaintainingDatabaseLinks ......................................................... 114

UpdatingRemoteServerAuthenticationInformation................................. 114

DeletingDatabaseLinks .......................................................... 114

DatabaseLinksandAccessControlEvaluation ......................................... 115

6 Netscape Directory Server Administrator’s Guide • August 2002

AdvancedFeature:TuningDatabaseLinkPerformance.................................. 116

ManagingConnectionstotheRemoteServer ........................................ 117

DetectingErrorsDuringNormalProcessing ......................................... 119

ManagingThreadedOperations ................................................... 120

AdvancedFeature:ConfiguringCascadingChaining.................................... 121

OverviewofCascadingChaining .................................................. 121

ConfiguringCascadingChainingDefaultsUsingtheConsole.......................... 124

ConfiguringCascadingChainingUsingtheConsole.................................. 125

ConfiguringCascadingChainingFromtheCommandLine ........................... 126

SummaryofCascadingChainingConfigurationAttributes............................ 129

CascadingChainingConfigurationExample ........................................ 129

ConfiguringServerOne .......................................................... 130

ConfiguringServerTwo .......................................................... 132

ConfiguringServerThree ......................................................... 134

UsingReferrals ....................................................................... 136

SettingDefaultReferrals............................................................. 136

SettingaDefaultReferralUsingtheConsole......................................... 136

SettingaDefaultReferralFromtheCommandLine .................................. 137

CreatingSmartReferrals ............................................................ 137

CreatingSmartReferralsUsingtheDirectoryServerConsole .......................... 138

CreatingSmartReferralsFromtheCommandLine ................................... 139

CreatingSuffixReferrals ............................................................ 140

CreatingSuffixReferralsUsingtheConsole ......................................... 140

CreatingSuffixReferralsFromtheCommandLine ................................... 140

Chapter 4 PopulatingDirectoryDatabases...................................... 143

ImportingData ....................................................................... 143

PerforminganImportFromtheConsole............................................... 144

InitializingaDatabaseFromtheConsole .............................................. 146

ImportingFromtheCommandLine .................................................. 147

Importing Using the ldif2db Command-Line Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Importing Using the ldif2db.pl Perl Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Importing Using the ldif2ldap Command-Line Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

ExportingData ....................................................................... 150

ExportingDirectoryDatatoLDIFUsingtheConsole .................................... 151

ExportingaSingleDatabasetoLDIFUsingtheConsole ................................. 152

ExportingtoLDIFFromtheCommandLine ........................................... 153

BackingUpandRestoringData ......................................................... 154

BackingUpAllDatabases ........................................................... 154

BackingUpAllDatabasesFromtheServerConsole .................................. 155

BackingUpAllDatabasesFromtheCommandLine.................................. 155

BackingUpaSingleDatabase ........................................................ 156

BackingUpthedse.ldifConfigurationFile ............................................. 156

RestoringAllDatabases ............................................................. 157

RestoringAllDatabasesfromtheConsole........................................... 157

RestoringYourDatabaseFromtheCommandLine................................... 158

RestoringaSingleDatabase.......................................................... 159

RestoringDatabasesthatIncludeReplicatedEntries..................................... 159

Restoringthedse.ldifConfigurationFile............................................... 160

EnablingandDisablingRead-OnlyMode ................................................ 161

EnablingRead-OnlyMode........................................................... 161

DisablingRead-OnlyMode .......................................................... 161

Chapter 5 AdvancedEntryManagement.........................................163

UsingGroups......................................................................... 163

ManagingStaticGroups............................................................. 164

AddingaNewStaticGroup ....................................................... 164

ModifyingaStaticGroup ......................................................... 165

ManagingDynamicGroups.......................................................... 165

AddingaNewDynamicGroup.................................................... 165

ModifyingaDynamicGroup ...................................................... 165

UsingRoles .......................................................................... 166

AboutRoles ....................................................................... 166

ManagingRolesUsingtheConsole ................................................... 167

CreatingaManagedRole ......................................................... 168

CreatingaFilteredRole........................................................... 169

CreatingaNestedRole ........................................................... 169

Viewing and Editing an Entry’s Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

ModifyingaRoleEntry ........................................................... 171

MakingaRoleInactive ........................................................... 171

ReactivatingaRole............................................................... 171

DeletingaRole .................................................................. 172

ManagingRolesUsingtheCommandLine............................................. 172

Examples:ManagedRoleDefinition................................................ 173

Example:FilteredRoleDefinition .................................................. 174

Example:NestedRoleDefinition................................................... 175

UsingRolesSecurely................................................................ 175

AssigningClassofService.............................................................. 176

AboutCoS......................................................................... 177

AbouttheCoSDefinitionEntry.................................................... 177

AbouttheCoSTemplateEntry .................................................... 178

HowaPointerCoSWorks ........................................................ 179

HowanIndirectCoSWorks....................................................... 179

HowaClassicCoSWorks......................................................... 180

ManagingCoSUsingtheConsole..................................................... 181

CreatingaNewCoS.............................................................. 181

8 Netscape Directory Server Administrator’s Guide • August 2002

EditinganExistingCoS........................................................... 183

DeletingaCoS................................................................... 183

ManagingCoSFromtheCommandLine .............................................. 184

CreatingtheCoSDefinitionEntryFromtheCommandLine ........................... 184

CreatingtheCoSTemplateEntryFromtheCommandLine............................ 187

ExampleofaPointerCoS ......................................................... 188

ExampleofanIndirectCoS........................................................ 189

ExampleofaClassicCoS ......................................................... 190

CreatingRole-BasedAttributes....................................................... 191

AccessControlandCoS ............................................................. 192

Chapter 6 Managing Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

AccessControlPrinciples .............................................................. 194

ACIStructure ...................................................................... 194

ACIPlacement ..................................................................... 195

ACIEvaluation..................................................................... 195

ACILimitations .................................................................... 196

DefaultACIs ......................................................................... 197

CreatingACIsManually ............................................................... 198

TheACISyntax .................................................................... 198

ExampleACI.................................................................... 199

DefiningTargets ................................................................... 199

TargetingaDirectoryEntry ....................................................... 201

TargetingAttributes.............................................................. 203

TargetingBothanEntryandAttributes ............................................. 204

TargetingEntriesorAttributesUsingLDAPFilters................................... 204

TargetingAttributeValuesUsingLDAPFilters ...................................... 205

TargetingaSingleDirectoryEntry ................................................. 206

DefiningPermissions ............................................................... 207

AllowingorDenyingAccess ...................................................... 207

AssigningRights................................................................. 207

RightsRequiredforLDAPOperations .............................................. 209

PermissionsSyntax .............................................................. 210

BindRules ........................................................................... 210

BindRuleSyntax ................................................................... 211

DefiningUserAccess-userdnKeyword............................................... 213

AnonymousAccess(anyoneKeyword) ............................................. 213

GeneralAccess(allKeyword) ..................................................... 213

SelfAccess(selfKeyword) ........................................................ 214

ParentAccess(parentKeyword) ................................................... 214

LDAPURLs..................................................................... 214

Wildcards....................................................................... 214

Examples ....................................................................... 214

DefiningGroupAccess-groupdnKeyword ........................................... 216

Examples ....................................................................... 217

DefiningRoleAccess-rolednKeyword ............................................... 217

DefiningAccessBasedonValueMatching ............................................. 218

UsingtheuserattrKeyword ....................................................... 218

UsingtheuserattrKeywordWithInheritance........................................ 221

GrantingAddPermissionUsingtheuserattrKeyword................................ 223

DefiningAccessFromaSpecificIPAddress............................................ 224

DefiningAccessfromaSpecificDomain............................................... 224

DefiningAccessataSpecificTimeofDayorDayofWeek ............................... 225

Examples ....................................................................... 226

DefiningAccessBasedonAuthenticationMethod ...................................... 227

Examples ....................................................................... 227

UsingBooleanBindRules ........................................................... 228

CreatingACIsFromtheConsole ........................................................ 229

DisplayingtheAccessControlEditor ................................................. 230

ViewingCurrentACIs .............................................................. 231

CreatingaNewACI ................................................................ 232

EditinganACI ..................................................................... 233

DeletinganACI .................................................................... 234

AccessControlUsageExamples......................................................... 234

GrantingAnonymousAccess...................................................... 235

GrantingWriteAccesstoPersonalEntries........................................... 237

RestrictingAccesstoKeyRoles .................................................... 241

GrantingaGroupFullAccesstoaSuffix ............................................ 242

GrantingRightstoAddandDeleteGroupEntries.................................... 243

GrantingConditionalAccesstoaGrouporRole ..................................... 246

DenyingAccess.................................................................. 248

SettingaTargetUsingFiltering .................................................... 251

AllowingUserstoAddorRemoveThemselvesFromaGroup ......................... 251

DefiningPermissionsforDNsThatContainaComma................................... 252

ProxiedAuthorizationACIExample .................................................. 253

ViewingtheACIsforanEntry .......................................................... 254

AdvancedAccessControl:UsingMacroACIs............................................. 254

MacroACIExample ................................................................ 255

MacroACISyntax .................................................................. 257

MacroMatchingfor($dn)......................................................... 258

MacroMatchingfor[$dn]......................................................... 259

Macro Matching for ($attr.attrName)................................................ 260

AccessControlandReplication ......................................................... 261

LoggingAccessControlInformation..................................................... 261

CompatibilitywithEarlierReleases...................................................... 262

10 Netscape Directory Server Administrator’s Guide • August 2002

Chapter 7 UserAccountManagement.......................................... 263

ManagingthePasswordPolicy.......................................................... 263

ConfiguringthePasswordPolicy ..................................................... 264

ConfiguringthePasswordPolicyUsingtheConsole.................................. 264

ConfiguringthePasswordPolicyUsingtheCommand-Line ........................... 266

SettingUserPasswords ............................................................. 268

ConfiguringtheAccountLockoutPolicy .............................................. 269

ConfiguringtheAccountLockoutPolicyUsingtheConsole ........................... 269

ConfiguringtheAccountLockoutPolicyUsingtheCommandLine .................... 270

ManagingthePasswordPolicyinaReplicatedEnvironment ............................. 271

InactivatingUsersandRoles............................................................ 272

InactivatingUserandRolesUsingtheConsole ......................................... 273

InactivatingUserandRolesUsingtheCommandLine .................................. 273

ActivatingUserandRolesUsingtheConsole .......................................... 274

ActivatingUserandRolesUsingtheCommandLine.................................... 275

SettingResourceLimitsBasedontheBindDN ............................................ 275

SettingResourceLimitsUsingtheConsole............................................. 276

SettingResourceLimitsUsingtheCommandLine ...................................... 276

Chapter 8 Managing Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

ReplicationOverview.................................................................. 280

Read-WriteReplica/Read-OnlyReplica ............................................... 280

Supplier/Consumer ................................................................ 280

ChangeLog........................................................................ 281

UnitofReplication.................................................................. 281

ReplicationIdentity................................................................. 282

ReplicationAgreement .............................................................. 283

Compatibility with Earlier Versions of Directory Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

ReplicationScenarios .................................................................. 284

Single-MasterReplication............................................................ 284

Multi-MasterReplication ............................................................ 285

CascadingReplication............................................................... 287

SummaryofStepsforComplexReplicationConfigurations................................. 289

DetailedReplicationTasks ............................................................. 290

CreatingtheSupplierBindDNEntry ................................................. 290

ConfiguringSupplierSettings ........................................................ 291

ConfiguringaRead-WriteReplica .................................................... 292

ConfiguringaRead-OnlyReplica..................................................... 293

ConfiguringaHubSupplier ......................................................... 294

CreatingaReplicationAgreement .................................................... 295

ConfiguringSingle-MasterReplication................................................... 296

ConfiguringtheRead-OnlyReplicaontheConsumerServer ............................. 296

ConfiguringtheRead-WriteReplicaontheSupplierServer .............................. 298

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Netscape Server Handbücher

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 - DEPLOYMENT Kurzanleitung

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - PROGRAMMER GUIDE TO... Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 -... Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Bedienungsanleitung

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.0 - NSAPI PROGRAMMER... Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Service-Handbuch

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.0 - PROGRAMMER GUIDE TO... Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 - DEPLOYMENT Kurzanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 - PLUG-IN Bedienungsanleitung

Beliebte Server Handbücher anderer Marken

HP AlphaServer ES47 Bedienungsanleitung

Dell

Dell PowerEdge R410 Bedienungsanleitung

PowerNAS

PowerNAS CMA Bedienungsanleitung

Supero

Supero FatTwin F617R3-FT Bedienungsanleitung

MSI

MSI P1-109N-L70 Bedienungsanleitung

Dell

Dell PowerEdge XE9640 Handbuch

Dell

Dell PS4100 Montageanleitung

EtroVISION

EtroVISION EV3151 Bedienungsanleitung

NEC

NEC Express5800/T110j Bedienungsanleitung

HP ProLiant Gen9 Bedienungsanleitung

Compaq

Compaq ProLiant 3000 Handbuch

Dell

Dell PowerEdge 3YPMN Bedienungsanleitung

iRobo

iRobo IPC2U Bedienungsanleitung

Nortel

Nortel 1000 Con?guration guide Bedienungsanleitung

Asus

Asus AP7500 Bedienungs- und Wartungshandbuch

Avid Technology

Avid Technology AirSpeed 5000 Bedienungsanleitung

HP Integrity rx2600 Installationsanleitung

Milestone

Milestone Husky IVO 350T Bedienungsanleitung