An eDirectory installation creates an LDAP Server object and an LDAP Group object. The default configuration for LDAP Services is located in the directory on these two objects. You can modify the default configuration by using either the ConsoleOne LDAP snap-in or the LDAP Management task in Novell iManager.
The LDAP Server object represents server-specific configuration data.
The LDAP Group object contains configuration information that can be conveniently shared among multiple LDAP servers. This object provides common configuration data and represents a group of LDAP servers. The servers have common data.
You can associate multiple LDAP Server objects with one LDAP Group object. All the associated LDAP servers then get their server-specific configuration from their LDAP Server object but get common or shared information from the LDAP Group object.
By default, the eDirectory installation program installs a single LDAP Group object and a single LDAP Server object for each nldap.nlm or nldap.dlm. Later, you can associate multiple LDAP Server objects with a single LDAP Group object.
IMPORTANT: Although it is possible to associate newer versions of an LDAP Server object with older versions of LDAP Group objects, we recommend that you don't mix versions. For example, avoid associating an LDAP Group object in eDirectory 8.5 with an LDAP Server object in eDirectory 8.6.
The amount of common information held in an LDAP Group object is limited. LDAP doesn't need to read many attributes because the data contained in the attributes is incredibly common. Many LDAP servers will need to use the same data. Without a common or shared Group object, you would have to replicate that data across each LDAP server.
The LDAP Server object allows more server-specific configuration options and data than the LDAP Group object allows.
Both objects have DN-syntax attributes that point to each other.
An additional association must be made so that the LDAP server can find its configuration data. This association is through the NCPTM server, which holds the customary eDirectory configuration data. The eDirectory installation program automatically makes the association.
Every eDirectory server has an NCP Server object. In the following figure, server Lundi illustrates this object as displayed in iManager:
This object has an LDAP Server attribute, which points to the LDAP Server object for a particular host eDirectory server. The following figure illustrates this attribute:
Typically, the LDAP Server object, the LDAP Group object, and the NCP Server object are located in the same container. You name this container during the eDirectory installation, when you name the server and Admin context.
If you move the LDAP Server object, you must place it in a writable replica.
The LDAP configuration utility is ldapconfig. You can use ldapconfig on Linux, Solaris, AIX, or HP-UX systems to modify, view, and refresh the attributes of LDAP Server and LDAP Group objects.
Use the following syntax to view LDAP attribute values on Linux, Solaris, AIX, and HP-UX systems:
ldapconfig get [...] | set attribute-value-list [-t treename | -p hostname[:port]] [-w password] [-a user FDN] [-f]
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a user FDN] [-V] [-R] [-H] [-f] -v attribute,attribute2...
Use the following syntax to modify values of LDAP attributes on Linux, Solaris, AIX, and HP-UX systems:
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a admin_FDN] -s attribute=value,...
Parameter | Description |
---|---|
-t treename |
Name of the eDirectory tree where the component will be installed. |
-p hostname |
The name of the host. You could specify the DNS name or IP address also. |
-w |
The password of the user having administration rights. |
-a |
The fully distinguished name of the user having administration rights. For example: cn=user.o=org1 |
get | -V |
Lets you view all LDAP server/group attributes. |
get | -v attribute list |
Displays the current values of the attributes in the attribute list. |
set | -s attribute-value pairs |
Sets the attributes to the specified values. |
-v |
Lets you view the value of the LDAP attribute. |
-s |
Sets a value for an attribute of the installed components. |
-R |
Refreshes the LDAP server. |
-V |
Lets you view the current LDAP configuration settings. |
-H |
Lets you view the usage and help strings. |
-f |
Allows operations on a filtered replica. |
attribute |
A configurable LDAP server or group attribute name. For more information, see Attributes on the LDAP Server Object and Attributes on the LDAP Group Object. |
To view the value of the attribute in the attribute list, enter the following command:
ldapconfig [-t tree_name | -p host_name[:port]]
[-w password] [-a user_FDN] -v "Require TLS for simple binds with password","searchTimeLimit"
To configure the LDAP TCP port number and search size limit to 1000, enter the following command:
ldapconfig [-t tree_name | -p host_name[:port]]
[-w password] [-a admin_FDN] -s "LDAP TCP Port=389","searchSizeLimit=1000"
Use the LDAP Server object to set up and manage the Novell LDAP server properties.
The following table provides a description of the LDAP server attributes:
Use the LDAP Group object to set up and manage the way LDAP clients access and use the information on the Novell LDAP server.
To require TLS for simple binds, see Requiring TLS for Simple Binds with Passwords. This attribute specifies whether the LDAP server allows transmission of passwords in clear text from an LDAP client. Values=0 (no) or 1 (yes).
To specify a default referral as well as how LDAP servers process LDAP referrals, see Using Referrals.