Page 3 - Contents; Preface
Contents Preface ...................................................................................................................................................15 1 Overview of the Migration Process for Directory Server .............................................................. 25 Before You...
Page 4 - Removal of the
Migrating the Schema Manually ........................................................................................................ 38 Migrating Configuration Data Manually ......................................................................................... 38 Migration of Specific Configura...
Page 5 - Migrating Directory Proxy Server
New Plug-Ins in Directory Server 6.0 ........................................................................................ 77 Plug-Ins Deprecated in Directory Server 6.0 ............................................................................ 78 Changes to the Plug-In API .......................
Page 6 - Migrating Identity Synchronization for Windows
Load Balancing Property ............................................................................................................. 99 Search Size Limit Property ........................................................................................................ 101 Log Property .................
Page 7 - Index
Index ................................................................................................................................................... 145 Contents 7 Sun Confidential: Registered
Page 9 - Figures
Figures FIGURE 4–1 Existing version 5 Topology ..................................................................................... 55 FIGURE 4–2 Isolating the Consumer From the Topology .......................................................... 55 FIGURE 4–3 Migrating the version 5 Consumer .........
Page 11 - Tables; Directory Server 5 and 6 Commands (Subcommands of the
Tables TABLE 1–1 Migration Matrix Showing Support for Automated Migration ........................... 28 TABLE 3–1 Change Log Attribute Name Changes .................................................................... 41 TABLE 3–2 Fractional Replication Attribute Name Changes ..........................
Page 13 - Examples
Examples EXAMPLE 7–1 Sample Export Configuration File ......................................................................... 109 13 Sun Confidential: Registered
Page 15 - This; Who Should Use This Book; and the; How This Book Is Organized; describes the steps involved in migrating to Directory Server 6.0.
Preface This Migration Guide describes how to migrate the components of Directory Server Enterprise Edition to version 6.0. The guide provides migration instructions for Directory Server,Directory Proxy Server, and Identity Synchronization for Windows. Who Should Use This Book This guide is intended...
Page 16 - Directory Server Enterprise Edition Documentation Set
Directory Server Enterprise Edition Documentation Set This Directory Server Enterprise Edition documentation set explains how to use Sun JavaSystem Directory Server Enterprise Edition to evaluate, design, deploy, and administerdirectory services. In addition, it shows how to develop client applicati...
Page 17 - Related Reading; The SLAMD Distributed Load Generation Engine (SLAMD) is a Java; application that is
TABLE P–1 Directory Server Enterprise Edition Documentation (Continued) Document Title Contents Sun Java System Directory Server EnterpriseEdition 6.0 Administration Guide Provides command-line instructions for administering Directory ServerEnterprise Edition. For hints and instructions on using the...
Page 18 - Redistributable Files; Default Paths; Sun
Enterprise System is a software infrastructure that supports enterprise applications distributedacross a network or Internet environment. If Directory Server Enterprise Edition was licensedas a component of Java Enterprise System, you should be familiar with the systemdocumentation at http://docs.su...
Page 22 - Shell Prompts in Command Examples
TABLE P–4 Typographic Conventions (Continued) Typeface Meaning Example AaBbCc123 Book titles, new terms, and terms to beemphasized (note that some emphasizeditems appear bold online) Read Chapter 6 in the User's Guide . A cache is a copy that is stored locally. Do not save the file. Shell Prompts in...
Page 23 - Third-Party Web Site References; Searching Sun Product Documentation; For example, to search for
TABLE P–6 Symbol Conventions (Continued) Symbol Description Example Meaning + Joins consecutive multiplekeystrokes. Ctrl+A+N Press the Control key, release it, andthen press the subsequent keys. → Indicates menu itemselection in a graphical userinterface. File → New → Templates From the File menu, c...
Page 24 - Sun Welcomes Your Comments; and click Send Comments.
Sun Welcomes Your Comments Sun is interested in improving its documentation and welcomes your comments andsuggestions. To share your comments, go to http://docs.sun.com and click Send Comments. In the online form, provide the full document title and part number. The part number is a7-digit or 9-digi...
Page 25 - Before You Migrate; Chapter 5
Overview of the Migration Process for DirectoryServer This chapter describes the steps involved in migrating to Directory Server 6.0. Directory Server6.0 provides a migration tool, dsmig , that automates aspects of the migration for certain platform/version combinations. If servers within your topol...
Page 27 - Deciding on the New Product Distribution; Directory Server 6.0 is provided in two distributions:; dsmig
Deciding on the New Product Distribution Directory Server 6.0 is provided in two distributions: ■ Java Enterprise System distribution. This distribution takes the form of operatingsystem-specific packages, such as pkg for Solaris and rpm for Linux. ■ Compressed archive (zip) distribution. There are ...
Page 28 - This section provides a table that shows when you can use; Chapter 2
Deciding on Automatic or Manual Migration This section provides a table that shows when you can use dsmig and when you need to migrate manually. It is based on the migration steps described in the previous section. TABLE 1–1 Migration Matrix Showing Support for Automated Migration From To Migration ...
Page 29 - per instance; About the Automatic Migration Tool; migration
Automated Migration Using the dsmig Command Directory Server 6.0 provides a command-line migration tool to help you migrate from aDirectory Server 5.2 instance to a Directory Server 6.0 instance. You can only use the migrationtool if your deployment satisfies the requirements for automatic migration...
Page 30 - old instance; Using; to Migrate the Schema; serverRoot
Prerequisites for Running dsmig In this section, old instance refers to the 5.2 instance and new instance refers to the Directory Server 6.0 instance. Before you use dsmig to migrate an instance, ensure that the following tasks have been performed: ■ The Directory Server 6.0 packages (either zip, or...
Page 31 - best effort; to Migrate Security Data; to Migrate Configuration Data
When you run this command, any custom schema defined in the 99user.ldif file are copied to the new instance. If the new instance is already in production, and you have already modifiedthe 99user.ldif file of the new instance, dsmig performs a best effort merge of the two files. Custom schema defined...
Page 32 - “Migration of Specific Configuration Attributes” on page 38; Plug-in Configuration Data; not; Chained Suffix Configuration Data
Note – By default, StartTLS is not enabled on Windows. If you are running dsmig on Windows, use the -e or -–unsecured option to specify an unsecure connection. Alternatively, use the -Z or --use-secure-port option to specify a secure connection over SSL. If you do not use either of these options on ...
Page 33 - Replication Configuration Data
Configuration Data For Suffixes With MultipleBackends Configuration data for suffixes with multiple backends is not migrated. If dsmig detects that a suffix has more than one backend, it does not migrate any of the configuration entries thatbelong to that suffix. This includes configuration entries ...
Page 35 - to Migrate User Data; isMemberOf
Using dsmig to Migrate User Data In Directory Server 5.2, data is stored in serverRoot /slapd- instance-name /db . Directory Server 6.0 stores user data in instance-path /db . To migrate data automatically, run the following command: $ dsmig migrate-data old-instance-path new-instance-path All suffi...
Page 37 - Migrating Directory Server Manually; Before You Start a Manual Migration
Migrating Directory Server Manually If your deployment does not satisfy the requirements for automatic migration described in “Deciding on Automatic or Manual Migration” on page 28 , you must migrate the servers manually. This chapter describes the process for manual migration of each part of the se...
Page 38 - Migrating Configuration Data Manually; Migration of Specific Configuration Attributes
■ The old instance has been stopped correctly. A disorderly shutdown of the old instance will cause problems during migration. Even if theold and new instances are on different machines, the old instance must be stopped beforemigration is started. Migrating the Schema Manually Directory Server 5 sch...
Page 39 - Global Configuration Attributes; rootDSE
Global Configuration Attributes The implementation of global scope ACIs requires all ACIs specific to the rootDSE to have a targetscope field, with a value of base ( targetscope=”base” ). ACIs held in the rootDSE are specific to each Directory Server instance and are not replicated. Therefore there ...
Page 40 - aci; Mapping Tree Configuration Attributes
nsslapd-infolog-area nsslapd-infolog-level nsslapd-ioblocktimeout nsslapd-lastmod nsslapd-listenhost nsslapd-maxbersize nsslapd-maxconnections nsslapd-maxdescriptors nsslapd-maxpsearch nsslapd-maxthreadsperconn nsslapd-nagle nsslapd-readonly nsslapd-referral nsslapd-referralmode nsslapd-reservedescr...
Page 41 - must be; Replication Configuration Attributes; Change Log Attributes; In addition, these attributes must be moved from; Fractional Replication Configuration Attributes; Replica Configuration Attributes
The Netscape Root database has been deprecated in Directory Server 6.0. If your old instancemade specific use of the Netscape Root database, the attributes under o=netscaperoot must be migrated. Otherwise, they can be ignored. Replication Configuration Attributes Before migrating replication configu...
Page 42 - Replication Agreement Configuration; “Manual Reset of Replication Credentials” on page 53; Password Policy Configuration Attributes; Sun Java System
nsDS5ReplicaId nsDS5ReplicaLegacyConsumer nsDS5ReplicaName nsDS5ReplicaPurgeDelay nsDS5ReplicaReferral nsDS5ReplicaRoot nsDS5ReplicaTombstonePurgeInterval aci The dschangelogmaxage and dschangelogmaaxentries attributes are added to the replica entry. Replication Agreement Configuration The values of...
Page 44 - SNMP Attributes; Sun Java System Directory Server Enterprise; UniqueID Generator Configuration Attributes; nsState; Database Configuration Attributes; database instance
TABLE 3–3 Mapping Between 5 and 6.0 Password Policy Attributes (Continued) Legacy Directory Server Attribute Directory Server 6.0 Attribute passwordResetFailureCount pwdFailureCountInterval passwordUnlock - SNMP Attributes The entry cn=SNMP,cn=config does not exist in Directory Server 6.0. All attri...
Page 45 - Chained Suffix Attributes
nsslapd-suffix nsslapd-cachesize nsslapd-cachememsize nsslapd-readonly nsslapd-require-index If your deployment uses the NetscapeRoot suffix, you must migrate the attributes under cn=netscapeRoot,cn=ldbm database,cn=plugins,cn=config . You must also replace the database location ( nsslapd-directory ...
Page 46 - Plug-In Configuration Attributes; Class of Service Plug-In; DSML Frontend Plug-In
nsProxiedAuthorization nsReferralOnScopedSearch nsslapd-sizelimit nsslapd-timelimit Plug-In Configuration Attributes If you have changed the configuration of any standard plug-in, you must update thatconfiguration. You must also update the configuration of all custom plug-ins. At a minimum,you must ...
Page 47 - cn=Referential Integrity; Retro Change Log Plug-In
ds-hdsml-soapschemalocation ds-hdsml-dsmlschemalocation nsslapd-pluginenabled Pass Through Authentication Plug-In The configuration of this plug-in is stored under cn=Pass Through Authentication,cn=plugins,cn=config . The following attribute must be migrated: nsslapd-pluginenabled The nsslapd-plugin...
Page 49 - db2ldif; dsadm import
Migrating User Data Manually If your topology does not support automatic data migration, you must migrate the datamanually. This involves exporting the data from the existing instance and re-importing it to thenew instance. To migrate data manually from an existing version 5 instance, perform the fo...
Page 50 - Tasks to be Performed After Manual Migration; If the migrated server was part of a replicated topology, see
Note – During data migration, Directory Server checks whether nested group definitions exceed 30 levels. Deep nesting can signify a circular group definition, where a nested group contains agroup that is also its parent. When a group with more than 30 nesting levels is encountered,Directory Server s...
Page 51 - Migrating a Replicated Topology; “Overview of Migrating Replicated Servers” on page 51; Overview of Migrating Replicated Servers; Sun Java System Directory
Migrating a Replicated Topology Directory Server Enterprise Edition 6.0 does not provide a way to migrate an entire replicatedtopology automatically. Migrating a replicated topology involves migrating each serverindividually. Usually, however, you should be able to migrate your entire topology witho...
Page 52 - Issues With the New Password Policy; userpassword; Migration of Replication Agreements; must; Migration of Referrals; master
Issues Related to Migrating Replicated Servers Depending on your replication topology, and on your migration strategy, certain issues mightarise when you migrate replicated servers. These issues are described in the following sections. Issues With the New Password Policy If you are migrating a multi...
Page 53 - Manual Reset of Replication Credentials; Problems Related to Tombstone Purging
2. Demote the master server to a hub, as described in “Promoting or Demoting Replicas” in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide . 3. Migrate the hub server, either using dsmig or the manual migration progress. 4. Promote the hub server to a master, as described...
Page 54 - Migrating the Consumers; For each consumer in the replicated topology:
Advantages of an all-master topology include the following: ■ Availability. Write traffic is never disrupted if one of the servers goes down. ■ Simplicity. In an all-master topology, there is no need to set up referrals to route reads and writes to different servers. There may be reasons that an all...
Page 56 - The next step involves migrating the version 5 consumer.
The next step involves migrating the version 5 consumer. The next step involves enabling the replication agreements to the new consumer, initializing theconsumer if necessary, and rerouting client applications to the new consumer. 5.x Master A 5.x Master B 5.x Hub A 5.x Hub B 5.x Consumer A 5.x Cons...
Page 57 - Migrating the Hubs; For each hub in the replicated topology:
Migrating the Hubs For each hub in the replicated topology: 1. Disable replication agreements from the masters to the hub you want to migrate. 2. Disable replication agreements from the hub you want to migrate to the consumers. 3. Stop the hub. 4. Migrate the hub according to the instructions under ...
Page 59 - The next step involves migrating the version 5 hub.
The next step involves migrating the version 5 hub. The next step involves enabling the replication agreements to the new hub and initializing thehub if necessary. 5.x Master A 5.x Master B 5.x Hub A 5.x Hub B 6.0 Consumer A 6.0 Hub A 6.0 Consumer B FIGURE 4–7 Migrating the version 5 Hub Migration S...
Page 60 - Migrating the Masters; For each master in the replicated topology:
Check that the replication on the consumers is in sync with the rest of the topology beforemigrating another hub. A server that has just been migrated does not have a change log, and cantherefore not update consumer servers that are out of sync. Allow the topology to stabilize andall servers to sync...
Page 61 - If you have migrated the data, check that replication is in sync.
8. Enable the replication agreements from the master to the hubs and other masters in the topology. 9. If you have migrated the data, check that replication is in sync. 10. If you have not migrated the data, reinitialize the master from another master in the topology. 11. If you rerouted client appl...
Page 62 - The next step involves migrating the version 5 master.
The next step involves migrating the version 5 master. 5.x Master A 5.x Master B 6.0 Consumer A 6.0 Consumer B 6.0 Hub A 6.0 Hub B FIGURE 4–10 Isolating the Master From the Topology 5.x Master A 5.x Master B 6.0 Consumer A 6.0 Consumer B 6.0 Hub A 6.0 Master A 6.0 Hub B FIGURE 4–11 Migrating the ver...
Page 63 - Migrating a Replicated Topology to a New Topology; The following figure shows the existing version 5 topology.
The next step involves enabling the replication agreements to and from the new master andinitializing the master if necessary. Check that the replication on all hubs and consumers is in sync with the rest of the topologybefore migrating another master. A server that has just been migrated does not h...
Page 64 - Migrating All the Servers; “Migrating a Replicated
Migrating All the Servers The first step is to migrate all the servers individually, as described in “Migrating a Replicated Topology to an Identical Topology” on page 54 . The resulting topology is illustrated in the following figure. 5.x Master A 5.x Master B 5.x Hub A 5.x Hub B 5.x Consumer A 5.x...
Page 65 - Promoting the Hubs
Promoting the Hubs The next step involves promoting the hubs to masters, and creating a fully-meshed topologybetween the masters. To promote the hubs, follow the instructions in “Promoting or DemotingReplicas” in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide . The foll...
Page 66 - Promoting the Consumers; Sun Java System Directory Server Enterprise Edition 6.0
Promoting the Consumers The next step involves promoting the consumers to hubs, and then to masters, and creating afully-meshed topology between the masters. To promote the consumers, follow the instructionsin “Promoting or Demoting Replicas” in Sun Java System Directory Server Enterprise Edition 6....
Page 67 - Migrating Over Multiple Data Centers; “Migrating a Replicated Topology to an Identical
Migrating Over Multiple Data Centers Migrating servers over multiple data centers involves migrating each server in each data centerindividually. Before you start migrating replicated servers, determine whether your deploymentmight not be better served by changing the architecture of the topology. I...
Page 69 - Architectural Changes in Directory Server 6.0; all; Changes in the Administration Framework; Upgrade each server individually; Directory; ServerRoot
Architectural Changes in Directory Server 6.0 This chapter describes the architectural changes in Directory Server 6.0 that affect migrationfrom a previous version. For information on all changes and bug fixes in Directory Server 6.0, see “What’s New at a Glance” in Sun Java System Directory Server ...
Page 70 - configuration directory; Changes in the ACI Scope; Changes in Suffix-Level ACIs
Removal of the o=netscapeRoot Suffix In previous versions of Directory Server, centralized administration information was kept in o=netscapeRoot . In the new administration model, the concept of a configuration directory server no longer exists. The o=netscapeRoot suffix is no longer required, and t...
Page 71 - dsadm
aci: (targetattr = "userPassword") ( version 3.0; acl "allow userpassword self modification"; allow (write) userdn = "ldap:///self";) In Directory Server 6.0, the default userPassword ACI at root DSE level provides equivalent access control to the default 5.2 ACI at suffix le...
Page 73 - Deprecated Commands
TABLE 5–1 Directory Server 5 and 6 commands (Continued) Version 5 Command Version 6.0 Command Description stop-slapd dsadm stop Stop a Directory Server instance suffix2instance dsconf get-suffix-prop See the backend name for a suffix vlvindex dsadm reindex Create virtual list view indexes TABLE 5–2 ...
Page 74 - New Password Policy; “Password Policy for LDAP Directories” Internet-Draft
Changes to the Console The downloaded, Java Swing-based console has been replaced by Directory Service ControlCenter (DSCC). DSCC is a graphical interface that enables you to manage an entire directoryservice by using a web browser. The DSCC requires no migration. Migrated Directory Serverinstances ...
Page 75 - Password Policy Compatibility; old
■ The password is too young ■ The password already exists in history The LDAP_CONTROL_PWP control indicates warning and error conditions. The control value is a BER octet string, with the format {tii} , which has the following meaning: ■ t is a tag defining which warning is set, if any. The value of...
Page 76 - dsconf
$ dsconf get-server-prop pwd-compat-mode The pwd-compat-mode property can have one of the following values: DS5-compatible-mode If you install a Directory Server instance as part of a replicatedtopology that includes a version 5 server, the compatibility stateshould be set to DS5-compatible-mode . I...
Page 78 - Sun Java System Directory Server
Plug-Ins Deprecated in Directory Server 6.0 The following plug-ins have been deprecated in Directory Server 6.0: cn=aci,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn=cn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn=encrypted attributes,cn=userRoot,cn=ldbm database,cn=...
Page 79 - Administration Utilities Previously Under; startconsole; Binaries Previously Under; Libraries and Plug-Ins Previously Under; Online Help Previously Under
Administration Utilities Previously Under ServerRoot In Directory Server 6.0 the Administration Server is no longer used to manage server instances. The following system administration utilities previously located under ServerRoot have therefore been deprecated: ■ restart-admin ■ start-admin ■ start...
Page 80 - Plug-Ins Previously Under; Utilities Previously Under
Plug-Ins Previously Under ServerRoot /plugins The following tables describes the new location of sample server plug-ins, and header files forplug-in development. TABLE 5–4 Support for Plug-Ins Directory Server 5.2 Plug-In Directory Directory Server 6.0 Plug-In Directory Remarks ServerRoot /plugins/s...
Page 81 - Certificate and Key Files
TABLE 5–5 Tools Previously Under ServerRoot /shared/bin (Continued) 5.2 File 6.0 File Purpose ServerRoot /shared/bin/ldapcompare /usr/sfw/bin/ldapcompare Compare attribute value In Directory Server 6.0 you mustinstall the SUN-LDAPCSDK-TOOLS package to get this utility ServerRoot /shared/bin/ldapdele...
Page 82 - Silent Installation and Uninstallation Templates; Server Instance Scripts Previously Under; The command-line administration scripts previously under; Server Instance Subdirectories
Silent Installation and Uninstallation Templates In Directory Server 5.2, the ServerRoot /setup5 directory contained sample templates for silent installation and uninstallation. Silent installation and uninstallation are no longer needed forDirectory Server 6.0 and these files have therefore been de...
Page 83 - The chapter covers the following topics:; Mapping the Global Configuration; dpadm backup
Migrating Directory Proxy Server There is no automatic migration path to move from a previous version to Directory ProxyServer 6.0. Directory Proxy Server 6.0 provides much more functionality than previousversions. While a one to one mapping of configuration information is therefore not possible inm...
Page 84 - name
The global Directory Proxy Server 5 configuration is specified by two object classes: ■ ids-proxy-sch-LDAPProxy. Contains the name of the Directory Proxy Server server and the DN of the global configuration object. ■ ids-proxy-sch-GlobalConfiguration. Contains various global configuration attributes...
Page 85 - Mapping the Global Security Configuration; dpadm
TABLE 6–1 Mapping of Version 5 Global Configuration Attributes to 6.0 Properties (Continued) Directory Proxy Server 5 Attribute Directory Proxy Server 6.0 Property ids-proxy-con-max-conns This attribute can be mapped to the max-client-connections property of a connection handler resource limit. To c...
Page 86 - Managing Certificates; Directory Proxy Server 5, certificates were managed by using the; Access Control on the Proxy Configuration
TABLE 6–2 Mapping of Security Configuration Directory Proxy Server 5 Attribute Directory Proxy Server 6.0 Property ids-proxy-con-ssl-key ssl-key-pin ids-proxy-con-ssl-cert ssl-certificate-directory ssl-server-cert-alias ids-proxy-con-send-cert-as-client This attribute enables the proxy server to sen...
Page 88 - dpconf; Mapping the Group Object
Mapping the Groups Configuration Directory Proxy Server 5 uses groups to define how client connections are identified and whatrestrictions are placed on the client connections. In Directory Proxy Server 6.0, thisfunctionality is achieved using connection handlers, data views and listeners. Connectio...
Page 89 - Mapping the Network Group Object; object class. These attributes can be mapped to properties of
Mapping the Network Group Object Directory Proxy Server 5 groups are configured by setting the attributes of the ids-proxy-sch-NetworkGroup object class. These attributes can be mapped to properties of Directory Proxy Server 6.0 connection handlers, data sources and listeners. For a list of all thep...
Page 90 - Mapping Bind Forwarding; Proxy Server 5.2, these configuration attributes are stored under
TABLE 6–5 Mapping Between Version 5 Network Group Attributes and 6.0 Properties (Continued) Directory Proxy Server 5 Network Group Attribute Directory Proxy Server 6.0 Property ids-proxy-con-tcp-no-delay Set this as a property for a specific listener port by usingthe following command: $ dpconf set-...
Page 91 - Mapping Operation Forwarding
TABLE 6–6 Mapping of Directory Proxy Server 5 Bind Forwarding Attributes to Directory Proxy Server 6 Connection Handler Property Settings (Continued) Directory Proxy Server 5 Attribute Directory Proxy Server 6 Property ids-proxy-con-permit-auth-sasl allowed-auth-methods:sasl Mapping Operation Forwar...
Page 92 - dpadm help-properties
Mapping Subtree Hiding Directory Proxy Server 5 uses the ids-proxy-con-forbidden-subtree attribute to specify a subtree of entries to be excluded in any client request. Directory Proxy Server 6.0 provides thisfunctionality with the allowed-subtrees and prohibited-subtrees properties of a request fil...
Page 93 - Mapping Compare Request Controls; Mapping Attributes Modifying Search Requests
TABLE 6–8 Mapping Directory Proxy Server 5 Search Request Control Attributes to Directory Proxy Server 6.0 Properties Directory Proxy Server 5 Attribute Directory Proxy Server 6.0 Property ids-proxy-con-filter-inequality allow-inequality-search-operations property of the request filtering policy ids...
Page 94 - Mapping Attributes Restricting Search Responses; Search Data Hiding Rules” in
Enterprise Edition 6.0 Administration Guide . For information on configuring a resource limits policy, see “Creating and Configuring a Resource Limits Policy” in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide . In Iplanet Directory Access Router 5.0 (IDAR) these configu...
Page 95 - Mapping the Referral Configuration Attributes
The following table maps the Directory Proxy Server 5 search response restriction attributes tothe corresponding Directory Proxy Server 6.0 properties. TABLE 6–11 Mapping of Directory Proxy Server 5 Search Response Restriction Attributes to Directory Proxy Server 6.0 Properties Directory Proxy Serve...
Page 96 - Mapping the Server Load Configuration
TABLE 6–12 Mapping of Directory Proxy Server 5 Referral Configuration Attributes to Directory Proxy Server 6 resource limits Properties Directory Proxy Server 5 Attribute Directory Proxy Server 6 Property ids-proxy-con-reference referral-policy ids-proxy-con-referral-ssl-policy referral-policy ids-p...
Page 97 - Attribute Renaming Property
Mapping the Properties Configuration The Directory Proxy Server 5 property objects enable you to specify specialized restrictions thatLDAP clients must follow. Most of the functionality of property objects is available in DirectoryProxy Server 6, although it is supplied by various elements of the ne...
Page 98 - LDAP Server Property; In Directory Proxy Server 5, the
TABLE 6–14 Mapping of Directory Proxy Server 5 Server Load Configuration Attributes to Directory Proxy Server 6 Resource Limits Properties Directory Proxy Server 5 Attribute Directory Proxy Server 6 Property ids-proxy-con-dn-exact target-dns ids-proxy-con-dn-regexp target-dn-regular-expressions ids-...
Page 99 - Load Balancing Property
TABLE 6–15 Mapping of ids-proxy-sch-LDAPServer Attributes to Data Source Properties Directory Proxy Server 5 Attribute Directory Proxy Server 6.0 Property ids-proxy-con-host ldap-address ids-proxy-con-port ldap-port ids-proxy-con-sport ldaps-port ids-proxy-con-supported-version No equivalent Directo...
Page 100 - Monitoring Backend Servers
load balancing only, that is, each LDAP server is allotted a certain percentage of the total load.The ids-proxy-sch-LoadBalanceProperty object class has one attribute, ids-proxy-con-Server , whose value has the following syntax: server-name [# percentage ] In Iplanet Directory Access Router 5.0 (IDA...
Page 101 - Search Size Limit Property; Log Property
Server 6.0 has a number of properties that can be configured to monitor its backend servers. Formore information, see “Retrieving Monitored Data About Data Sources” in Sun Java System Directory Server Enterprise Edition 6.0 Administration Guide . Search Size Limit Property Directory Proxy Server 5 u...
Page 103 - Two types of event objects are supported:
TABLE 6–17 Version 5 and Version 6 Log Functionality (Continued) Directory Proxy Server 5 Attribute Purpose Directory Proxy Server 6.0 Equivalent ids-proxy-con-audit-syslog Syslog facility code for auditlog No equivalent ids-proxy-con-audit-file Path to audit log file log-file-name of the access-log...
Page 104 - object class. This action enables you to configure
TABLE 6–18 Mapping Between Version 5 Event Attributes and Version 6 Connection Handler Properties (Continued) Directory Proxy Server 5 Attribute Directory Proxy Server 6.0 Property ids-proxy-con-ssl-required is-ssl-mandatory ids-proxy-con-bind-anonymous allowed-auth-methods:anonymous ids-proxy-con-b...
Page 106 - Before You Migrate Identity Synchronization for Windows; For Active Directory.; “Checking the Logs” on page 144
Migration Overview Migration from Identity Synchronization for Windows version 1.1 to version 6.0 isaccomplished in the following major phases: 1. Preparing your Identity Synchronization for Windows 1.1 installation for migration. 2. Uninstalling Identity Synchronization for Windows 1.1. 3. Installi...
Page 107 - Exporting Version 1.1 Configuration; idsync importcnf
However, if you use the forcepwchg utility, you can identify affected users and force them to change passwords again. For more information, see “Forcing Password Changes on Windows NT” on page 116 . ■ All other attribute changes made during the migration process (at any directory source) willbe sync...
Page 108 - Using the export11cnf Utility; Guide; Inserting Clear-Text Passwords
Tip – Although it is possible to re-enter the 1.1 configuration manually by using the Identity Synchronization for Windows console, it is recommended that you use the export11cnf utility. If you do not use export11cnf , the state of the connectors is not preserved. Exporting the version 1.1 configur...
Page 109 - In the following sample exported configuration file,
<Credentials userName="cn=iswservice,cn=users,dc=example,dc=com" cleartextPassword="" /> <!-- INSERT PASSWORD BETWEEN THE DOUBLE QUOTES IN THE ABOVE FIELD --> You must enter a password manually, between double quotes, for every cleartextPassword field in the exported conf...
Page 114 - Checking for Undelivered Messages; Using the checktopics Utility; checktopics; checktopics
EXAMPLE 7–1 Sample Export Configuration File (Continued) name="uid" syntax="1.3.6.1.4.1.1466.115.121.1.15"/> <AttributeDescription parent.attr="CreationAttribute" name="sn" syntax="1.3.6.1.4.1.1466.115.121.1.15"/> <AttributeDescription parent.attr=...
Page 115 - cd; To Clear Messages
topic names used in Message Queue. In addition, when you run checktopics , it queries Message Queue to check how many outstanding messages remain on each activesynchronization topic and then displays this information for you. To execute the checktopics command line utility: Open a Terminal window an...
Page 116 - Forcing Password Changes on Windows NT
Forcing Password Changes on Windows NT On Windows NT, password changes are not monitored and new password values are notcaptured during the migration process. Consequently, you cannot determine new passwordvalues after the migration process. Instead of requiring all users to change passwords when yo...
Page 117 - Preparing for Migration
Preparing for Migration Use the following procedure to prepare for migration to version 6.0. Unpack Identity Synchronization for Windows 6.0 Bits Stop Synchronization Stop Identity Synchronization for Windows Services Start Identity Synchronization for Windows Services Uninstall Identity Synchroniza...
Page 118 - On Windows; Export your version 1.1 configuration settings to an XML file.; Add passwords to the exported XML file.; cleartextPassword
▼ Preparing to migrate from version 1.1, and 1.1 SP1, to version 6.0 Open a terminal window or command prompt. ■ On Solaris type the following command. uncompress -c filename | tar xf - ■ On Windows type the following command or use any archive program for Windows, such as WinZip. %JAVA_HOME%\\bin\\...
Page 119 - “Using the checktopics; On Windows NT only
Verify that your system is in a stable state. From the migration directory, execute checktopics as described in “Using the checktopics Utility” on page 114 . The following example shows the execution of the checktopics command. java -jar checktopics.jar -D “cn=directory manager” -w - \ -s “dc=exampl...
Page 120 - Alternatively, use any archive program for Windows, such as WinZip.; Uninstalling Identity Synchronization for Windows; SUNWjss; To Uninstall Identity Synchronization for Windows Version 1.1; a. Remove the following entries from the Directory Server:
Alternatively, use any archive program for Windows, such as WinZip. Start the Identity Synchronization for Windows services. For more information, see “Startingand Stopping Services” in Sun Java System Directory Server Enterprise Edition 6.0 Installation Guide . Uninstalling Identity Synchronization...
Page 121 - and then use the Identity; On; Solaris or SPARC; The location of the file is as follows:; On Solaris; “Manually Uninstalling 1.1 Core and Instances from; After uninstalling Core, restart your machine.; for Windows components. Instructions are provided in
Change directory ( cd ) to < ServerRoot \>\\isw-< hostname \> and then use the Identity Synchronization for Windows 1.1 (or 1.1 SP1) uninstallation program to uninstall the version1.1, and 1.1 SP1, Connectors and Core components. Note – You must uninstall Connectors before uninstalling C...
Page 122 - Installing or Upgrading the Dependent Products; Java 2 SDK; Sun Java System Message; “Using; Installing Identity Synchronization for Windows 6.0; Execute; against Directory Server to update the schema.
Installing or Upgrading the Dependent Products Use the following steps to upgrade the Java Run Environment, install Message Queue, andupgrade Directory Server. 1. Upgrade the Java 2 Runtime Environment (or Java 2 SDK) on each host (except on Windows NT) where Identity Synchronization for Windows com...
Page 123 - importcnf; b. Restore the NT Change Detector Service counters.
cd serverRoot \isw- hostname \bin idsync prepds arguments \ For more information about idsync prepds , see Appendix A, “Using the Identity Synchronization for Windows Command Line Utilities,” in Sun Java System Directory Server Enterprise Edition 6.0 Installation Guide . Import your version 1.1, and...
Page 124 - “Preparing for Migration” on page 117; type the following command.
iv. Double-click on each of the following entries to restore their values (which you saved prior to uninstalling version 1.1). ■ HighestChangeNumber ■ LastProcessedSecLogRecordNumber ■ LastProcessedSecLogTimeStamp ■ QueueSize c. Start the NT Change Detector service by typing the following command. n...
Page 125 - “Manually Uninstalling a 1.1 Instance from Windows NT” on page 135; Windows; where
What to Do if the 1.1 Uninstallation Fails If the version 6.0 installation program finds remnants of the version 1.1 system, the 6.0installation will fail. Verify that all of the 1.1 components are completely removed from thesystem prior to installing version 6.0. If the uninstallation program does ...
Page 126 - To Manually Uninstall Core From a Solaris Machine:; into a terminal window.; a. Type the following command to stop the Message Queue broker.; imq; Manually uninstall the packages and directories.
▼ To Manually Uninstall Core From a Solaris Machine: Stop all Identity Synchronization for Windows Java processes by typing /etc/init.d/isw stop into a terminal window. If the preceding command does not stop all of the Java processes, type the following commands. /usr/ucb/ps -gauxwww | grep java kil...
Page 127 - pkgrm; for each of the packages listed in; Run the; Remove the Directory Server Plugin.
/etc/imq /var/imq /usr/bin/imq* To remove the Identity Synchronization for Windows 1.1 Solaris packages, run pkgrm package-name for each of the packages listed in “Manually Uninstalling 1.1 Core and Instances from Solaris” on page 125 . The following example shows the use of pkgrm to uninstall packa...
Page 128 - Some of the following components may not be included in your file.
e. From the Directory Server Console, locate and remove the following entry from the Configuration Directory: cn=pswsync,cn=plugins,cn=config f. Stop Directory Server. g. Remove the Plugin binary by typing the following command. rm -f serverRoot /lib/psw-plugin.so h. Restart Directory Server. Back-u...
Page 129 - The following is an example; a. From the installation location, type the following command.; b. To remove the bootstrap files, type the following command.; command against the configuration directory where Identity; password; ldapsearch
■ <compid\>SUNWidscn . . . </compid\> ■ <compid\>SUNWidsoc . . . </compid\> ■ <compid\>ADConnector . . . </compid\> The following is an example <compid\> tag. Remove <compid\> , </compid\> , and all the text and tags in-between. <compid\>Id...
Page 131 - To uninstall Core from a Windows 2000 machine:; Although you can view Java processes (such as
Note – In this section, Identity Synchronization for Windows locations are described in the following manner: serverRoot \isw- hostname \ where serverRoot represents the parent directory of the Identity Synchronization for Windows installation location. For example, if you installed Identity Synchro...
Page 132 - regedit; Back up your current registry file before proceeding to
■ From a Command Prompt, type the following command. net stop "iMQ Broker" ■ If the preceding methods do not work, use the following steps to stop Message Queuemanually. a. Open the Services window, right-click on iMQ Broker and select Properties. b. From the General tab in the Properties wi...
Page 133 - “Manually Uninstalling
b. Select Registry → Export Registry File from the menu bar. c. When the Export Registry File dialog box is displayed, specify a name for the file and select a location to save the backup registry. In the Registry Editor, select Edit → Delete from the menu bar. Remove the following Identity Synchron...
Page 134 - Clean up the configuration directory as follows:; command against the configuration
■ <compid\>DSConnector . . . </compid\> ■ <compid\>Directory Server Plugin . . . </compid\> ■ <compid\>DSSubcomponents . . . </compid\> ■ <compid\>ObjectCache . . . </compid\> ■ <compid\>ObjectCacheDLLs . . . </compid\> ■ <compid\>ADC...
Page 135 - Manually Uninstalling a 1.1 Instance from Windows NT
"cn=Sun ONE Identity Synchronization for Windows,cn=server group, cn=myhost.mydomain.com,ou=mydomain.com,o=NetscapeRoot" b. Use the Directory Server Console to remove the Identity Synchronization for Windows Console subtree that you found and all subtrees under it. Clean up the Identity Sync...
Page 136 - net stop “Sun ONE Identity Synchronization for Windows; net stop “Sun ONE NT Change Detector Service”
Note – In this section, Identity Synchronization for Windows locations are described as follows: < serverRoot \>\\isw-< hostname \> where < serverRoot \> represents the parent directory of the Identity Synchronization for Windows installation location. For example, if you installed...
Page 137 - to open the Registry Editor window.; Do not; Export Registry File from the menu bar.; Synchronization for Windows
■ If the preceding methods do not work, use the following steps to stop the Change DetectorService manually: a. Open the Services window, right-click on Change Detector Service and select Properties. b. From the General tab in the Properties window, select Manual from the Startup type drop-down list...
Page 138 - Some of these components might not be included in your file.
Use regedt32 ( do not use regedit ) to modify (do not delete) the following registry key: a. Select the registry key entry in the left pane: HKEY_LOCAL_MACHINE\\SYSTEM\\\\CurrentControlSet\\\\CONTROL\\\\LSA The registry value type must be REG_MULTI_SZ . b. In the right pane, right-click on the Notif...
Page 139 - “Manually Uninstalling a 1.1; Remove the Password Filter DLL.
The following is a example <compid\> tag. Remove <compid\> , </compid\> , and all the text and tags in-between. <compid\>Identity Synchronization for Windows <compversion\>1.1 <uniquename\>Identity Synchronization for Windows</uniquename\> <compinstance\&...
Page 140 - Multi-Master Replication Deployment
The sample deployment scenarios include: ■ “Multi-Master Replication Deployment” on page 140 ■ “Multi-Host Deployment with Windows NT” on page 141 Multi-Master Replication Deployment In a multi-master replication (MMR) deployment, two Directory Server instances are installedon different hosts. It is...
Page 141 - Multi-Host Deployment with Windows NT; Three hosts are used in this deployment scenario:; Pass
Multi-Host Deployment with Windows NT Three hosts are used in this deployment scenario: ■ A Windows NT system ■ A host for Directory Server with the synchronized users and the Directory Server Connector Unpack I dentity Synchronization for Windows 6.0 Bits Stop Synchronization Start I dentity Synchr...