Procedure

1. Select the Directory Server instance.

2. Click the Actions button and select the action to execute:

   • Start Instance
   • Stop Instance

   • Restart Instance

     

Procedure

1. Optionally: Display the current port numbers for the instance:

   # dsconf <instance_name> config get nsslapd-port nsslapd-securePort

   Copy code to clipboard

2. Change the LDAP port:

   1. Set the new port for the LDAP protocol. For example, to set it to 1389, run:

      # dsconf <instance_name> config replace nsslapd-port=1389

      Copy code to clipboard

   2. Set the ldap_port_t type for the LDAP port you assigned in the previous step:

      # semanage port -a -t ldap_port_t -p tcp 1389

      Copy code to clipboard

3. Change the LDAPS port:

   1. Set the new port for the LDAPS protocol. For example, to set it to 1636, run:

      # dsconf <instance_name> config replace nsslapd-securePort=1636

      Copy code to clipboard

   2. Set the ldap_port_t type for the LDAPS port you assigned in the previous step:

      # semanage port -a -t ldap_port_t -p tcp 1636

      Copy code to clipboard

4. Restart the instance:

   # dsctl <instance_name> restart

   Copy code to clipboard

Verification

1. Verify that Directory Server now uses the new LDAP port by the command:

   # dsconf <instance_name> config get nsslapd-port

   Copy code to clipboard

2. Verify that Directory Server now uses the new LDAPS port number by the command:

   # dsconf <instance_name> config get nsslapd-securePort

   Copy code to clipboard

Procedure

1. Change the LDAP port:

   1. Open the Server Setting menu.
   2. On the Server Setting tab, enter the new port number into the LDAP Port field.
2. Click Save.

3. Change the LDAPS port:

   1. Open the Server Setting menu.
   2. On the General Settings tab, enter the new port number into the LDAPS Port field.
   3. Click Save.
4. Restart the instance by clicking Action and selecting Restart Instance.

Verification

1. Verify in the server setting that the changed port is reflected .

1. The Directory Server considers the ~/.dsrc file as a remote connection and checks whether the /etc/openldap/ldap.conf configuration file and system-wide settings contain both the instance name and the LDAP URL.
2. The Directory Server considers the ~/.dsrc file as a local connection and uses the nsslapd-certdir setting from the local dse.ldif file to secure the connection if the ~/.dsrc file contains only the specified instance name, or if the ~/.dsrc file does not exist. The server uses the default path /etc/dirsrv/slapd-<instance_name>/ to store the Network Security Services (NSS) database of the instance if nsslapd-certdir is not present.

Procedure

1. Use the dsconf backend export command to export data to an LDIF file.

   For example, to export the userRoot database:

   # dsconf <instance_name> backend export userRoot
   The export task has finished successfully

   Copy code to clipboard

   By default, dsconf stores the export in a file called instance_name_database_name-time_stamp.ldif in the /var/lib/dirsrv/slapd-<instance_name>/ldif/ directory. Alternatively, add the -l file_name option to the command to specify a different location.

   To display all additional settings that you can use to export data, see the output of the dsconf <instance_name> backend export --help command.

2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the export.

Procedure

1. Use the dsctl db2ldif command to export data to an LDIF file. For example, to export the userRoot database to the /var/lib/dirsrv/slapd-<instance_name>/ldif/example.ldif file:

   # dsctl <instance_name> db2ldif userRoot /var/lib/dirsrv/slapd-<instance_name>/ldif/example.ldif
   OK group dirsrv exists
   OK user dirsrv exists
   ldiffile: /var/lib/dirsrv/slapd-<instance_name>/example.ldif
   [18/Jul/2021:10:46:03.353656777 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000
   [18/Jul/2021:10:46:03.383101305 +0200] - INFO - ldbm_back_ldbm2ldif - export userRoot: Processed 160 entries (100%).
   [18/Jul/2021:10:46:03.391553963 +0200] - INFO - dblayer_pre_close - All database threads now stopped
   db2ldif successful

   Copy code to clipboard

   To display all additional settings that you can use to import data, see the output of the dsctl db2ldif --help command.

2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the export.

3. Optional: Start the instance:

   # dsctl <instance_name> start

   Copy code to clipboard

Procedure

1. Open the Database menu.
2. Select the suffix entry.
3. Click Suffix Tasks, and select Export Suffix.
4. Enter the name of the LDIF file in which you want to store the export. Directory Server will store the file in the /var/lib/dirsrv/slapd-<instance_name>/ldif/ directory using the specified file name.
5. Click Export Database.
6. To check the log for problems during the export, open the Monitoring → Logging → Errors Log menu.

Procedure

1. Optional: By default, Directory Server sets the entry update sequence numbers (USNs) of all imported entries to 0. To set an alternative initial USN value, set the nsslapd-entryusn-import-initval parameter. For example, to set USN for all imported values to 12345, enter:

   # dsconf <instance_name> config replace nsslapd-entryusn-import-initval=12345

   Copy code to clipboard

2. If you copied the file you want to import to /var/lib/dirsrv/slapd-<instance_name>/ldif/, reset the SELinux context on that file:

   # restorecon -Rv /var/lib/dirsrv/slapd-instance_name/ldif/example.ldif

   Copy code to clipboard

3. Use the dsconf backend import command to import data from an LDIF file.

   For example, to import the /var/lib/dirsrv/slapd-<instance_name>/ldif/example.ldif file into the userRoot database:

   # dsconf <instance_name> backend import userRoot /var/lib/dirsrv/slapd-instance_name/ldif/example.ldif
   The import task has finished successfully

   Copy code to clipboard
4. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the import.

Procedure

1. Optional: By default, Directory Server sets the entry update sequence numbers (USNs) of all imported entries to 0. To set an alternative initial USN value, set the nsslapd-entryusn-import-initval parameter. For example, to set USN for all imported values to 12345, enter:

   # dsconf <instance_name> config replace nsslapd-entryusn-import-initval=12345

   Copy code to clipboard

2. If you copied the file you want to import to /var/lib/dirsrv/slapd-<instance_name>/ldif/, reset the SELinux context on that file:

   # restorecon -Rv /var/lib/dirsrv/slapd-instance_name/ldif/example.ldif

   Copy code to clipboard

3. Use the dsctl ldif2db command to import data from an LDIF file. For example, to import the /var/lib/dirsrv/slapd-<instance_name>/ldif/example.ldif file into the userRoot database:

   # dsctl <instance_name> ldif2db userRoot /var/lib/dirsrv/slapd-instance_name/ldif/example.ldif
   OK group dirsrv exists
   OK user dirsrv exists
   [17/Jul/2021:13:42:42.015554231 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000
   ...
   [17/Jul/2021:13:42:44.302630629 +0200] - INFO - import_main_offline - import userRoot: Import complete.  Processed 160 entries in 2 seconds. (80.00 entries/sec)
   ldif2db successful

   Copy code to clipboard

   To display all additional settings that you can use to import data, see the output of the dsctl ldif2db --help command.

4. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the import.

5. Optional: Start the instance:

   # dsctl <instance_name> start

   Copy code to clipboard

Procedure

1. In the web console, open the Database menu.
2. Select the suffix entry.
3. Click Suffix Tasks, and select Initialize Suffix.
4. Click the Import button next to the LDIF file you want to import. If the LDIF file is stored in a directory different than /var/lib/dirsrv/slapd-<instance_name>/ldif/, enter the full path to the file and click the Import button.
5. Select Yes, I am sure, and click Initialize Database to confirm.
6. To check the log for problems during the import, open the Monitoring → Logging → Errors Log menu.

Verification

1. Search for entries under the imported suffix, for example dc=example,dc=com:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -b "dc=example,dc=com" -s sub -x

   Copy code to clipboard

Procedure

1. Create the cn=export_users,ou=groups,dc=example,dc=com group:

   # dsidm <instance_name> -b "dc=example,dc=com" group create --cn export_users

   Copy code to clipboard

2. Add an access control instruction (ACI) that allows members of the cn=export_users,ou=groups,dc=example,dc=com group to create export tasks:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com
   
   dn: cn=config
   changetype: modify
   add: aci
   aci: (target = "ldap:///cn=export,cn=tasks,cn=config")
    (targetattr="*") (version 3.0 ; acl "permission:
     Allow export_users group to export data" ;
     allow (add, read, search) groupdn
     = "ldap:///cn=export_users,ou=groups,dc=example,dc=com";)
   -
   add: aci
   aci: (target = "ldap:///cn=config")(targetattr =
     "objectclass || cn || nsslapd-suffix || nsslapd-ldifdir")
     (version 3.0 ; acl "permission: Allow export_users
     group to access ldifdir attribute" ; allow
     (read,search) groupdn = "ldap:///cn=export_users,ou=groups,dc=example,dc=com";)

   Copy code to clipboard

3. Create a user:

   1. Create a user account:

      # dsidm <instance_name> -b "dc=example,dc=com" user create --uid="example" --cn="example" --uidNumber="1000" --gidNumber="1000" --homeDirectory="/home/example/" --displayName="Example User"

      Copy code to clipboard

   2. Set a password on the user account:

      # dsidm <instance_name> -b "dc=example,dc=com" account reset_password "uid=example,ou=People,dc=example,dc=com" "password"

      Copy code to clipboard

4. Add the uid=example,ou=People,dc=example,dc=com user to the cn=export_users,ou=groups,dc=example,dc=com group:

   # dsidm <instance_name> -b "dc=example,dc=com" group add_member export_users uid=example,ou=People,dc=example,dc=com

   Copy code to clipboard

Procedure

1. Back up all databases:

   # dsconf <instance_name> backup create
   The backup create task has finished successfully

   Copy code to clipboard

   By default, dsconf stores the backup in a subdirectory called <instance_name>-YYYY_MM_DD_hh_mm_ss in the /var/lib/dirsrv/slapd-<instance_name>/bak/ directory. To specify a different location, append a directory name to the command.

2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the backup.

   To display all additional settings that you can use to back up data, see the output of the dsconf <instance_name> backup create --help command.

Procedure

1. Back up all databases:

   # dsctl <instance_name> db2bak
   db2bak successful

   Copy code to clipboard

   By default, dsctl db2bak stores the backup in the <instance_name>-YYYY_MM_DD_hh_mm_ss__ subdirectory in the /var/lib/dirsrv/slapd-<instance_name>/bak/ directory. To specify a different location, append a directory name to the command.

   Optionally, pass the -v option to the command to display verbose output:

   # dsctl -v <instance_name> db2bak
   ...
   DEBUG: Instance allocated
   DEBUG: systemd status -> True
   ...
   INFO: db2bak successful

   Copy code to clipboard
2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the backup.

3. Optional: Start the instance:

   # dsctl <instance_name> start

   Copy code to clipboard

Procedure

1. Click the Actions button, and select Manage Backups.
2. Click Create Backup.
3. Enter a name for the backup, such as a time stamp to indicate the creation date and time of the backup.
4. Click Create Backup.

5. To check the log for problems during the backup, open the Monitoring → Logging → Errors Log menu.

   The server stores the backup in a subdirectory with the name you entered in the /var/lib/dirsrv/slapd-<instance_name>/bak/ directory.

Procedure

1. Restore all databases from the backup stored in the /var/lib/dirsrv/slapd-<instance_name>/bak/<instance_name>-YYYY_MM_DD_hh_mm_ss directory:

   # dsconf <instance_name> backup restore /var/lib/dirsrv/slapd-<instance_name>/bak/<instance_name>-YYYY_MM_DD_hh_mm_ss
   The backup restore task has finished successfully

   Copy code to clipboard

   To display all additional settings that you can use to restore data, see the output of the dsconf <instance_name> backup restore --help command.

2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the restore.

Procedure

1. Restore all databases from the backup stored in the /var/lib/dirsrv/slapd-<instance_name>/bak/<instance_name>-YYYY_MM_DD_hh_mm_ss directory:

   # dsctl <instance_name> bak2db /var/lib/dirsrv/slapd-<instance_name>/bak/<instance_name>-YYYY_MM_DD_hh_mm_ss/
   bak2db successful

   Copy code to clipboard

   Optionally, pass the -v option to the command to display verbose output:

   # dsctl -v <instance_name> bak2db /var/lib/dirsrv/slapd-<instance_name>/bak/<instance_name>-YYYY_MM_DD_hh_mm_ss/
   ...
   DEBUG: Instance allocated
   DEBUG: OK group dirsrv exists
   DEBUG: OK user dirsrv exists
   DEBUG: systemd status -> True
   ...
   INFO: bak2db successful

   Copy code to clipboard
2. Search the /var/log/dirsrv/slapd-<instance_name>/errors log for problems during the restore.

3. Optional: Start the instance:

   # *dsctl <instance_name> start`

   Copy code to clipboard

Procedure

1. Click the Actions menu, and select Manage Backups. The displayed window lists the available backups in the /var/lib/dirsrv/slapd-<instance_name>/bak/ directory.
2. Open the Actions menu next to the backup you want to restore, and select Restore Backup.
3. Click Yes to confirm.
4. To check the log for problems during the restore, open the Monitoring → Logging → Errors Log menu.

Procedure

1. Copy files you want to restore from the the backup directory to the Directory Server configuration directory. For example, to restore the dse.ldif configuration file, enter:

   # cp /var/lib/dirsrv/slapd-<instance_name>/bak/<example_backup>/config_files/dse.ldif /etc/dirsrv/slapd-<instance_name>/

   Copy code to clipboard

2. Start the instance:

   # dsctl <instance_name> start

   Copy code to clipboard

Procedure

1. Create the cn=backup_users,ou=groups,dc=example,dc=com group:

   # dsidm <instance_name> -b "dc=example,dc=com" group create --cn backup_users

   Copy code to clipboard

2. Add an access control instruction (ACI) that allows members of the cn=backup_users,ou=groups,dc=example,dc=com group to create backup tasks:

   # ldapadd -D "cn=Directory Manager" -W -H ldap://server.example.com
   
   dn: cn=config
   changetype: modify
   add: aci
   aci: (target = "ldap:///cn=backup,cn=tasks,cn=config")(targetattr="*")
    (version 3.0 ; acl "permission: Allow backup_users
     group to create backup tasks" ; allow (add, read, search) groupdn
     = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)
   -
   add: aci
   aci: (target = "ldap:///cn=config")(targetattr = "nsslapd-bakdir ||
     objectClass") (version 3.0 ; acl "permission: Allow backup_users
     group to access bakdir attribute" ; allow (read,search)
     groupdn = "ldap:///cn=backup_users,ou=groups,dc=example,dc=com";)

   Copy code to clipboard

3. Create a user:

   1. Create a user account:

      # dsidm <instance_name> -b "dc=example,dc=com" user create --uid="example" --cn="example" --uidNumber="1000" --gidNumber="1000" --homeDirectory="/home/example/" --displayName="Example User"

      Copy code to clipboard

   2. Set a password on the user account:

      # dsidm <instance_name> -b "dc=example,dc=com" account reset_password "uid=example,ou=People,dc=example,dc=com" "password"

      Copy code to clipboard

4. Add the uid=example,ou=People,dc=example,dc=com user to the cn=backup_users,ou=groups,dc=example,dc=com group:

   # dsidm <instance_name> -b "dc=example,dc=com" group add_member backup_users uid=example,ou=People,dc=example,dc=com

   Copy code to clipboard

Procedure

1. Optional: List the suffixes and back-end databases that are already in use:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)

   Copy code to clipboard

   The name in parentheses is the back-end database that stores the data of the corresponding suffix. You cannot use an existing database name when you create the root suffix in the next step.

2. Specify the DN of the root suffix in the --suffix argument and associate it with a new database using the --be-name argument:

   # dsconf <instance_name> backend create --suffix="dc=example,dc=net" --be-name="example"

   Copy code to clipboard

Procedure

1. Under Database, click the Create Suffix button below the configuration tree.
2. Fill in the Suffix DN and Database Name.
3. Select Create The Top Suffix Entry and click Create Suffix.

Procedure

1. Optional: View the current default naming context:

   # dsconf <instance_name> config get nsslapd-defaultnamingcontext
   nsslapd-defaultnamingcontext: dc=example,dc=com

   Copy code to clipboard

2. Replace the value of the nsslapd-defaultnamingcontext parameter with the required naming context:

   # dsconf <instance_name> config replace nsslapd-defaultnamingcontext=dc=example,dc=net

   Copy code to clipboard

Procedure

1. Optional: List the suffixes and back-end databases that are already in use:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)

   Copy code to clipboard

   The name in parentheses is the back-end database that stores the data of the corresponding suffix. You cannot use an existing database name when you create the sub-suffix in the next step.

2. Specify the full DN of the sub-suffix in the --suffix argument, associate it with a new database using the --be-name argument, and specify the parent suffix in the --parent-suffix argument:

   # dsconf <instance_name> backend create --suffix="ou=People,dc=example,dc=com" --be-name="example" --parent-suffix="dc=example,dc=com" --create-suffix

   Copy code to clipboard

   With --create-suffix argument, the command creates the configuration entry for the sub-suffix and the sub-suffix entry ou=People,dc=example,dc=com.

   The --create-suffix argument supports the creation of suffixes with the following RDN attribute types: c, cn, dc, o, and ou. If you want to create a suffix with RDN such as l, you can use the dsconf backend create command without the --create-suffix option and then add the suffix entry by using an LDAP add operation or importing the entry from an LDIF file.

Procedure

1. Under Database, select a suffix from the configuration tree that is the parent of the sub-suffix.
2. Click the Suffix Tasks and select Create Sub-Suffix.
3. Fill in the Sub-Suffix DN, such as ou=People, and Database Name.
4. Select Create The Top Suffix Entry and click Create Sub-Suffix.

Procedure

1. Optional: List the back ends to determine the database to index:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)

   Copy code to clipboard

   Note the selected database name (in parentheses).

2. Create index configuration with the dsconfig utility for the selected back-end database.

   Specify the attribute name, index type, and, optionally, matching rules to set collation order (OID), especially in case of an internationalized instance.

   # dsconf <instance_name> backend index add --attr roomNumber --index-type sub userroot

   Copy code to clipboard

   Repeat this step for each attribute used in the view filter.

3. Reindex the database to apply the new indexes:

   # dsconf <instance_name> backend index reindex userroot

   Copy code to clipboard

Verification

1. Perform a search that is based on the standard directory tree with the same filter that you use in the view:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -x -b dc=example,dc=com (&(objectClass=inetOrgPerson)(roomNumber=*66))
   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -x -b dc=example,dc=com "(&(objectClass=inetOrgPerson)(roomNumber=*66))"

   Copy code to clipboard

2. View the access log in /var/log/dirsrv/slapd-<instance_name>/access.

   The RESULT of your search should not contain note=U or Partially Unindexed Filter in the details.

Procedure

1. Under Database, select a suffix from the configuration tree for which you want to create an index.
2. Navigate to Indexes and Database Indexes.
3. Click the Add Index button.
4. Type the name of the attribute and select the attribute.
5. Select the Index Types that should be created for this attribute.
6. Optionally, add Matching Rules to specify collation order (OID), especially in case of an internationalized instance.
7. Select Index attribute after creation to rebuild the index afterwards.
8. Click Create Index.
9. Repeat the steps for each attribute to be indexed.

Procedure

1. List the suffixes and their corresponding databases:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)
   o=test (test_database)

   Copy code to clipboard

   Note the name or suffix of the database that you want to switch.

2. Enable read-only mode with the --enable-readonly parameter and specify the database either by name or suffix:

   # dsconf <instance_name> backend suffix set --enable-readonly "test_database"

   Copy code to clipboard

Procedure

1. Under Database, select the suffix in the configuration tree.
2. Check the Database Read-Only Mode option.
3. Click Save Configuration.

Procedure

1. Under Server, select the Advanced Settings tab.
2. Check the Server Read-Only option.
3. Click Save.

Procedure

1. List suffixes and their corresponding databases:

   # dsconf <instance_name> backend suffix list
   dc=example,dc=com (userroot)
   o=test (test_database)

   Copy code to clipboard

   Note the name of the database that you want to delete.

2. Enter the dsconf backend delete command and specify the name of the database:

   # dsconf <instance_name> backend delete "test_database"

   Copy code to clipboard

3. Confirm the deletion by typing "Yes I am sure" in the prompt:

   Deleting Backend cn=test_database,cn=ldbm database,cn=plugins,cn=config :
   Type 'Yes I am sure' to continue: Yes I am sure

   Copy code to clipboard

Procedure

1. Under Database, select the suffix that you want to delete.
2. Navigate to Suffix Tasks → Delete Suffix.
3. Select Yes, I am sure..
4. Click Delete Suffix.

Procedure

1. Export the userRoot database:

   # dsconf <instance_name> backend export -E userRoot

   Copy code to clipboard

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. Enable AES encryption for the telephoneNumber attribute:

   # dsconf <instance_name> backend attr-encrypt --add-attr telephoneNumber dc=example,dc=com

   Copy code to clipboard

3. Stop the instance:

   # dsctl <instance_name> stop

   Copy code to clipboard

4. Import the LDIF file:

   # dsctl <instance_name> ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   Copy code to clipboard

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

5. Start the instance:

   # dsctl <instance_name> start

   Copy code to clipboard

Procedure

1. Export the userRoot database:

   # dsconf <instance_name> backend export -E userRoot

   Copy code to clipboard

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. In the web console, navigate to Database → Suffixes → suffix_entry → Encrypted Attributes.
3. Enter the attribute to encrypt, and click Add Attribute.
4. In the Actions menu, select Stop Instance.

5. On the command line, import the LDIF file:

   # dsctl <instance_name> ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   Copy code to clipboard

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

6. In the web console, open the Actions menu, and select Start Instance.

Procedure

1. Export the userRoot database:

   # dsconf <instance_name> backend export -E userRoot

   Copy code to clipboard

   The server stores the export in an LDIF file in the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. The -E option decrypts attributes that are already encrypted during the export.

2. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

     Copy code to clipboard

   • If your host is reachable by multiple names:

     # dsctl <instance_name> tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     Copy code to clipboard

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-<instance_name>/Server-Cert.csr file.

3. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.

4. Import the server certificate issued by the CA to the NSS database:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf <instance_name> security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Copy code to clipboard

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl <instance_name> tls import-server-key-cert /root/server.crt /root/server.key

     Copy code to clipboard

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

5. Import the CA certificate to the NSS database:

   # dsconf <instance_name> security ca-certificate add --file /root/ca.crt --name "Example CA"

   Copy code to clipboard

6. Set the trust flags of the CA certificate:

   # dsconf <instance_name> security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   Copy code to clipboard

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

7. Stop the instance:

   # dsctl <instance_name> stop

   Copy code to clipboard

8. Edit the /etc/dirsrv/slapd-<instance_name>/dse.ldif file, and remove the following entries including their attributes:

   • cn=AES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   • cn=3DES,cn=encrypted attribute keys,cn=database_name,cn=ldbm database,cn=plugins,cn=config
   Important

   Remove the entries for all databases. If any entry that contains the nsSymmetricKey attribute is left in the `/etc/dirsrv/slapd-<instance_name>/dse.ldif file, Directory Server will fail to start.

9. Import the LDIF file:

   # dsctl <instance_name> ldif2db --encrypted userRoot /var/lib/dirsrv/slapd-instance_name/ldif/None-userroot-2022_01_24_10_28_27.ldif

   Copy code to clipboard

   The --encrypted parameter enables the script to encrypt attributes configured for encryption during the import.

10. Start the instance:

    # dsctl <instance_name> start

    Copy code to clipboard

Procedure

1. Create a new database link:

   # dsconf <instance_name> chaining link-create --suffix="ou=Customers,dc=example,dc=com" --server-url="ldap://remote_server.example.com:389" --bind-mech=SIMPLE --bind-dn="cn=proxy_user,cn=config" --bind-pw="password" "example_chain_name"

   Copy code to clipboard

   By using this command, you create the database link named example_chain_name for ou=Customers,dc=example,dc=com which refers to the ldap://remote_server.example.com:389 server and uses the specified bind DN and password to authenticate. You must set bind-mech to SIMPLE (EXTERNAL for certificate based authentication) or GSSAPI for kerberos authentication.

2. Display additional settings that you can set when you create the database link:

   # dsconf <instance_name> chaining link-create --help

   Copy code to clipboard
   Note

   To grant the proxy_user the rights to access data, you must create the proxy ACI entry in the dc=example,dc=com suffix on remote server.

Procedure

1. Open the Database menu.

2. Create a new suffix:

   1. Click Create Suffix button.
   2. Enter the DN suffix and back end name.
   3. Select Create The Top Suffix Entry and click Create Suffix.
3. Select the suffix, click Suffix Tasks button on the right side, and select Create Database Link.
4. Fill the fields with the details about the connection to the remote server.
5. Click Create Database Link.

Procedure

1. Display the current default values of the database link:

   # dsconf <instance_name> chaining config-get-def

   Copy code to clipboard

2. Use the dsconf chaining config-set-def command to change the new database links configuration. For example, to set the response-delay parameter to 30, run:

   # dsconf <instance_name> chaining config-set-def --response-delay 30

   Copy code to clipboard

   The example command sets the default response timeout for all chaining connections. You can overwrite the response timeout for a specific chaining link by using the dsconf instance chaining link-set command.

3. To see the list of all parameters you can set, run:

   # dsconf <instance_name> chaining config-set-def --help

   Copy code to clipboard

Procedure

1. Specify the components to include in chaining:

   # dsconf <instance_name> chaining config-set \ --add-comp="cn=referential integrity postoperation,cn=components,cn=config"

   Copy code to clipboard

2. Restart the instance:

   # dsctl <instance_name> restart

   Copy code to clipboard

3. Create an ACI in the suffix on the remote server to which the operation will be chained:

   # ldapmodify -D "cn=Directory Manager" -W -H 389 remoteserver.example.com -x
    dn: ou=People,dc=example,dc=com
    changetype: modify
    add: aci
    aci: (targetattr = "*")(target="ldap:///ou=customers,ou=People,dc=example,dc=com")
    (version 3.0; acl "RefInt Access for chaining"; allow
    (read,write,search,compare) userdn = "ldap:///cn=referential
    integrity postoperation,cn=plugins,cn=config";)

   Copy code to clipboard

Procedure

1. Open the Database menu.
2. In the navigation on the left, select the Chaining Configuration entry.
3. Click the Add button below the components to Chain field.
4. Select the component that you want to chain, and click Add & Save New Components.

5. Create ACI in the suffix on the remote server to which the operation will be chained:

   # ldapmodify -D "cn=Directory Manager" -W -H 389 remoteserver.example.com -x
    dn: ou=People,dc=example,dc=com
    changetype: modify
    add: aci
    aci: (targetattr = "*")(target="ldap:///ou=customers,ou=People,dc=example,dc=com")
    (version 3.0; acl "RefInt Access for chaining"; allow
    (read,write,search,compare) userdn = "ldap:///cn=referential
    integrity postoperation,cn=plugins,cn=config";)

   Copy code to clipboard

Procedure

1. Chain LDAP controls:

   # dsconf <instance_name> chaining \ config-set --add-control="2.16.840.1.113730.3.4.9"

   Copy code to clipboard

   Add the object identifier (OID) of the custom control if clients of Directory Server create their own controls and chain there operations to remote servers.

Procedure

1. Open the Database menu.
2. Select the Chaining Configuration entry.
3. Click Add button below the Forwarded LDAP Controls field.

4. Select the LDAP control and click Add & Save New Controls button.

   Add the object identifier (OID) of the custom control if clients of Directory Server create their own controls and chain there operations to remote servers.

5. Click Save button.

Procedure

1. Open the LDAP Browser menu to reveal the list of existing suffixes.
2. Using the Tree or Table view, expand the parent entry ou=people,dc=example,dc=com under which you want to create a user.

3. Click the Options menu (⋮) and select New to open the wizard window.

   
4. Select the Create a new User option and click Next.
5. For the user entry, select Posix Account type and click Next.

6. Optional: Select additional attributes, such as userPassword, and click Next. You can view all selected attributes by expanding the drop-down list near the step name.

   

7. Set a value for each attribute:

   1. Click on the pencil button of the attribute and add a value.

      

      Note that a separate menu opens when you set the userPassword value. The value is filled with asterisks (*) to hide the plain text.

   2. Click on the check button to save changes.
   3. Optional: Set an additional attribute value by clicking the Options menu (⋮) → Add Another Value.
   4. After you have set all values, click Next.
8. Verify that all entry details are correct and click Create User. Directory Server creates the entry with mandatory attributes for a POSIX user and sets the password to it. You can click Back to modify entry settings, or click Cancel to cancel the entry creation.
9. View the Result for Entry Creation and click Finish.

Verification

1. Navigate to LDAP Browser → Search.
2. Select the database suffix that contains the entry, such as dc=example,cd=com.
3. Enter your search criteria in the field, such as John, and press Enter.
4. Find the entry you recently created in the list of entries.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to edit, such as cn=John Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Edit to open the wizard window.
4. Optional: In the Select ObjectClasses step, add or delete object classes for the entry. Click Next.

5. In the Select Attributes step, add telephoneNumber and mail attributes to the entry and click Next. If you do not see an attribute you want to add to the entry it means that you did not add corresponding object class in the previous step.

   Note

   In this step, you can not delete mandatory attributes of the selected object classes.

6. In the Edit Attribute Values step, set telephoneNumber to 556778987 and 556897445, mail to jsmith@example.com and change userPassword value:

   1. Click on the pencil button of the attribute and add or change a new value.
   2. Click on the check button to save changes.
   3. Optional: Set an additional value to an attribute by clicking the Options menu (⋮) → Add Another Value. The telephoneNumber attribute has two values in this example. When you set all values, click Next.
7. Review your changes and click Next.
8. To edit the entry, click Modify Entry. You can click Back to make other changes to the entry, or click Cancel to cancel the entry editing.
9. View the Result for Entry Modification and click Finish.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to modify, such as cn=John Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Rename to open the wizard window.

4. In the Select The Naming Attribute And Value step:

   1. Set a new value Tom Smith for the naming attribute cn and click Next.
   2. Optional: Select another naming attribute from the drop-down menu.
   3. Optional: In case you want to delete the old entry and create a new one using the new RDN, check the Delete the old RDN.
5. In Select The Entry Location step, select the parent entry for the new location, and click Next.
6. Review changes you made to the entry and click Next.
7. If the entry details are correct, click Change Entry Name. You can click Back to make other changes to the entry or click Cancel to cancel the entry modification.
8. View Result for Entry Modification and click Finish.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to delete, such as cn=Tom Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Delete to open the wizard window.
4. Click Next after you review the data about the entry you want to delete.
5. In the Deletion step, toggle the switch to the Yes, I’m sure position and click Delete. You can click Cancel to cancel the entry deletion.
6. View the Result for Entry Deletion and click Finish.

Verification

1. Navigate to LDAP Browser → Search.
2. Select the suffix where the entry previously existed, such as dc=example,cd=com.
3. Enter your search criteria in the field, such as Tom, and press Enter.
4. Verify that the deleted entry is no longer present.

Procedure

1. Create the DNA configuration entry on a supplier:

   #  dsconf <instance_name> plugin dna config "Account UIDs" add --type uidNumber --filter "(objectclass=posixAccount)" --scope ou=People,dc=example,dc=com --next-value 1 --max-value 1300 --shared-config-entry "cn=Account UIDs,ou=Ranges,dc=example,dc=com" --threshold 100 --range-request-timeout 60 --magic-regen 99999
   
   Successfully created the cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config

   Copy code to clipboard

   The command creates the DNA plug-in configuration that sets a unique value to the uidNumber attribute instead of the 99999 magic value in all newly created posixAccount entries under ou=People,dc=example,dc=com. The supplier sets values up to 1300 and requests a range transfer from the second supplier when reaches the value 1200. If the second supplier is unresponsive for 60 seconds, the first supplier requests the range transfer from the third supplier.

   NOTE

   If you create the configuration entry for a server without replication or for a supplier in one-supplier environment, set only the --type, --filter, --scope, --next-value options.

   For details about the DNA plug-in configuration attributes, see This content is not included.Distributed Numeric Assignment Plug-in Attributes and Syntax of the DNA plug-in sections.

2. Optional: Create the configuration entry that is shared among all supplier server:

   # ldapmodify -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   dn: ou=Ranges,dc=example,dc=com
   changetype: add
   objectclass: top
   objectclass: extensibleObject
   objectclass: organizationalUnit
   ou: Ranges
   -
   dn: cn=Account UIDs,ou=Ranges,dc=example,dc=com
   changetype: add
   objectclass: top
   objectclass: extensibleObject
   cn: Account UIDs

   Copy code to clipboard

3. Enable the DNA plug-in:

   #  dsconf <instance_name> plugin dna enable
   
   Enabled plugin 'Distributed Numeric Assignment Plugin'

   Copy code to clipboard

Procedure

1. Select the Directory Server instance.
2. Open the Plugins menu and select the DNA plug-in from the list.
3. Click Add Config button to start the configuration of the new plug-in configuration entry.

4. On the DNA Configuration tab, set the fields.

   For example, you want the plug-in to set a unique value to the uidNumber attribute instead of the 99999 magic value in all newly created posixAccount entries under ou=People,dc=example,dc=com. In addition, you want the supplier to set values up to 1300 and request a range transfer from the second supplier when the unique value reaches the value 1200. In this case, set the following fields:

   • Config Name to Account UIDs
   • DNA Managed Attributes to uidNumber
   • Filter to "(objectclass=posixAccount)"
   • Subtree Scope to ou=People,dc=example,dc=com
   • Next Value to 1
   • Max Value to 1300
   • Magic Regeneration Value to 99999
   • Threshold to 100

   • Range Request Timeout to 60

     NOTE

     If you create the configuration entry for a server without replication or for a supplier in one-supplier environment, set only the DNA Managed Attributes, Filter, Subtree Scope, and Next Value fields.

5. Go to the Shared Config Settings tab and set the Shared Config Entry DN field to, for example, cn=Account UIDs,ou=Ranges,dc=example,dc=com. This shared configuration entry contains information which server to contact for the range transfer if the current server is out of unique values.
6. Click the Save Config button to save the plug-in settings.
7. Toggle the switch to the Plugin is enabled position to enable the plug-in.

Procedure

1. Create a new plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq add "Mail Uniqueness" --attr-name mail --subtree ou=sales,dc=example,dc=com ou=accounting,dc=example,dc=com

   Copy code to clipboard

   The command creates the cn=Mail Uniqueness,cn=plugins,cn=config configuration entry.

   Note

   You can set the plug-in to verify uniqueness of multiple attributes in one configuration entry.

2. Optional: Configure uniqueness across all subtrees configured in this plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --across-all-subtrees on

   Copy code to clipboard

   The command sets the uniqueness-across-all-subtrees plug-in configuration parameter to on. Therefore, the plug-in checks uniqueness of the mail attribute across both the ou=sales,dc=example,dc=com and ou=accounting,dc=example,dc=com subtrees. By default, the plug-in only checks uniqueness across the subtree where the entry is created or updated, which means that if you create or update an entry under ou=sales,dc=example,dc=com, the plug-in checks the mail attribute uniqueness only across this subtree.

3. Optional: Set a subtree that the plug-in must exclude from the attribute uniqueness verification.

   For example, if you want the plug-in to skip the ou=internal,ou=sales,dc=example,dc=com subtree, set the uniqueness-exclude-subtrees multi-valued parameter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --exclude-subtree "ou=internal,ou=sales,dc=example,dc=com"

   Copy code to clipboard

   Successfully changed the cn=Mail Uniqueness,cn=plugins,cn=config

   Copy code to clipboard

4. Optional: If you what the plug-in to verify uniqueness only in entries that contain a specific object class, set this object class as a value for the uniqueness-subtree-entries-oc parameter.

   For example, you want the mail attribute to be unique only in entries that contain the inetOrgPerson object class, enter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --subtree-entries-oc=inetOrgPerson

   Copy code to clipboard

5. Enable the plug-in on the server:

   # dsconf <instance_name> plugin attr-uniq enable "Mail Uniqueness"

   Copy code to clipboard

6. Restart the instance:

   # dsctl <instance_name> restart

   Copy code to clipboard

Procedure

1. Create a new plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq add "Mail Uniqueness with OC" --attr-name mail --top-entry-oc=nsContainer --subtree-entries-oc=inetOrgPerson

   Copy code to clipboard

   The command creates the cn=Mail uniqueness with OC,cn=plugins,cn=config entry with the configured uniqueness-top-entry-oc and uniqueness-subtree-entries-oc plug-in parameters.

2. Optional: Set a subtree that the plug-in must exclude from the attribute uniqueness verification.

   For example, if you want the plug-in to skip the ou=internal,ou=sales,dc=example,dc=com subtree, set the uniqueness-exclude-subtrees multi-valued parameter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness with OC" --exclude-subtree "ou=internal,ou=sales,dc=example,dc=com"

   Copy code to clipboard

   Successfully changed the cn=Mail Uniqueness with OC,cn=plugins,cn=config

   Copy code to clipboard

3. Enable the plug-in on the server:

   # dsconf <instance_name> plugin attr-uniq enable "Mail Uniqueness with OC"

   Copy code to clipboard

   Successfully enabled the cn=Mail Uniqueness with OC,cn=plugins,cn=config

   Copy code to clipboard

4. Restart the instance:

   # dsctl <instance_name> restart

   Copy code to clipboard

Procedure

1. Select the instance, where you want to configure the plug-in.
2. Open the Plugins menu and select the Attribute Uniqueness plug-in from the list.
3. Click Add Config button to start configuring the new configuration entry of the plug-in.
4. Enter the name of the configuration entry in the Config Name field.
5. Select which attributes must be unique in the Attribute Names field. The field sets the uniqueness-attribute-name attribute.

6. Enter the subtrees under which the plug-in checks uniqueness of attributes in the Subtrees field. The field sets the uniqueness-subtrees attribute.

   By default, the plug-in checks uniqueness across only the subtree where the entry is created or updated. To check across all listed subtrees, check the Across All Subtrees checkbox that sets the uniqueness-across-all-subtrees attribute to on.

7. Optional: Enter the subtrees which the plug-in must exclude from the attribute uniqueness verification in the Excluded Subtrees field. For example, you want to exclude ou=eu_department,ou=accounting,dc=example,dc=com. The field sets the uniqueness-exclude-subtrees multi-valued attribute.
8. Toggle the switch to the Configuration is enabled position.

9. Click Add Config button to finish creation of the the plug-in configuration entry.

   Figure 5.1. Configuration example of the Attribute Uniqueness plug-in.

   
10. Restart the instance. For more details, see Starting and stopping a Directory Server instance by using the web console.