[prev in list] [next in list] [prev in thread] [next in thread]
List: forgerock-openam-commit
Subject: [CommitOpenAM] [10288] trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx :
From: noreply () forgerock ! org
Date: 2014-08-28 8:47:10
Message-ID: 20140828084710.A0DA9422A4 () sources ! internal ! forgerock ! com
[Download RAW message or body]
[Attachment #2 (text/html)]
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[10288] trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx: \
CR-4330 Fixes for OPENAM-4156: Document the new DN Cache control feature; \
OPENAM-4374: Add a reference for Data Store configuration options</title> </head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: \
verdana,arial,helvetica,sans-serif; font-size: 10pt; } #msg dl a { font-weight: \
bold} #msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: \
bold; } #msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: \
6px; } #logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em \
0; } #logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg \
h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; } \
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; \
} #logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: \
-1.5em; padding-left: 1.5em; } #logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em \
1em 0 1em; background: white;} #logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid \
#fa0; border-bottom: 1px solid #fa0; background: #fff; } #logmsg table th { \
text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted \
#fa0; } #logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: \
0.2em 0.5em; } #logmsg table thead th { text-align: center; border-bottom: 1px solid \
#fa0; } #logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: \
6px; } #patch { width: 100%; }
#patch h4 {font-family: \
verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, \
#patch .copfile {border:1px solid #ccc;margin:10px 0;} #patch ins \
{background:#dfd;text-decoration:none;display:block;padding:0 10px;} #patch del \
{background:#fdd;text-decoration:none;display:block;padding:0 10px;} #patch .lines, \
.info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a \
href="http://sources.forgerock.org/changelog/openam/?cs=10288">10288</a></dd> \
<dt>Author</dt> <dd>mark</dd> <dt>Date</dt> <dd>2014-08-28 09:47:10 +0100 (Thu, 28 \
Aug 2014)</dd> </dl>
<h3>Log Message</h3>
<pre>CR-4330 Fixes for <a \
href="https://bugster.forgerock.org/jira/browse/OPENAM-4156">OPENAM-4156</a>: \
Document the new DN Cache control feature; <a \
href="https://bugster.forgerock.org/jira/browse/OPENAM-4374">OPENAM-4374</a>: Add a \
reference for Data Store configuration options</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxadminguidechap \
realmsxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/admin-guide/chap-realms.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxreleasenotesc \
hapwhatsnewxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/release-notes/chap-whats-new.xml</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatas \
toresactivedirectoryxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-active-directory.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storesadamxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-adam.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storesdbxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-db.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storesdseexml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-dsee.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storesgenericldapv3xml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-generic-ldapv3.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storesopendjxml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-opendj.xml</a></li>
<li><a href="#trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdata \
storestivolixml">trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-tivoli.xml</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxadminguidechaprealmsxml"></a>
<div class="modfile"><h4>Modified: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/admin-guide/chap-realms.xml \
(10287 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/admin-guide/chap-realms.xml 2014-08-27 \
22:50:30 UTC (rev 10287)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/admin-guide/chap-realms.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -24,12 +24,12 @@
</span><span class="cx"> !
</span><span class="cx"> -->
</span><span class="cx"> <chapter xml:id='chap-realms'
</span><del>- xmlns='http://docbook.org/ns/docbook'
- version='5.0' xml:lang='en'
- xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
- xsi:schemaLocation='http://docbook.org/ns/docbook
- http://docbook.org/xml/5.0/xsd/docbook.xsd'
- xmlns:xlink='http://www.w3.org/1999/xlink'>
</del><ins>+ xmlns='http://docbook.org/ns/docbook' version='5.0' \
xml:lang='en' + xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'
+ xmlns:xlink='http://www.w3.org/1999/xlink'
+ xmlns:xinclude='http://www.w3.org/2001/XInclude'>
</ins><span class="cx"> <title>Configuring Realms</title>
</span><span class="cx">
</span><span class="cx"> \
<indexterm><primary>Realms</primary></indexterm> </span><span \
class="lines">@@ -326,17 +326,75 @@ </span><span class="cx"> <step>
</span><span class="cx"> <para>In the second screen, provide information on \
how to connect </span><span class="cx"> to your data store, and then click Finish \
to save your work.</para> </span><del>-
- <para>See the <link \
xlink:href="admin-guide#chap-auth-services"
- xlink:role="http://docbook.org/xlink/role/olink">chapter on
- authentication</link> for hints on connecting to
- <link xlink:href="admin-guide#ad-module-conf-hints"
- xlink:role="http://docbook.org/xlink/role/olink">Active \
Directory</link>,
- <link xlink:href="admin-guide#ldap-module-conf-hints"
- xlink:role="http://docbook.org/xlink/role/olink">LDAP \
directory</link>, and
- <link xlink:href="admin-guide#jdbc-module-conf-hints"
- xlink:role="http://docbook.org/xlink/role/olink">JDBC</link> \
data
- sources.</para>
</del><ins>+
+ <itemizedlist>
+ <para>
+ See the following sections for hints depending on the type of data store.
+ </para>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-active-directory"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-adam"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-db"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-generic-ldapv3"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-opendj"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-dsee"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ <link
+ xlink:href="admin-guide#sec-data-stores-tivoli"
+ xlink:role="http://docbook.org/xlink/role/olink"
+ />
+ </para>
+ </listitem>
+ </itemizedlist>
</ins><span class="cx"> </step>
</span><span class="cx"> <step>
</span><span class="cx"> <para>Click the Subjects tab, and make sure the \
connection to your </span><span class="lines">@@ -393,4 +451,12 @@
</span><span class="cx"> <para>Save your work.</para>
</span><span class="cx"> </step>
</span><span class="cx"> </procedure>
</span><ins>+
+ <xinclude:include \
href="../shared/sec-data-stores-active-directory.xml" /> + \
<xinclude:include href="../shared/sec-data-stores-adam.xml" /> + \
<xinclude:include href="../shared/sec-data-stores-db.xml" /> + \
<xinclude:include href="../shared/sec-data-stores-generic-ldapv3.xml" \
/> + <xinclude:include href="../shared/sec-data-stores-opendj.xml" \
/> + <xinclude:include href="../shared/sec-data-stores-dsee.xml" \
/> + <xinclude:include href="../shared/sec-data-stores-tivoli.xml" \
/> </ins><span class="cx"> </chapter>
</span></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxreleasenoteschapwhatsnewxml"></a>
<div class="modfile"><h4>Modified: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/release-notes/chap-whats-new.xml \
(10287 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/release-notes/chap-whats-new.xml 2014-08-27 \
22:50:30 UTC (rev 10287)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/release-notes/chap-whats-new.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -274,6 +274,21 @@
</span><span class="cx">
</span><span class="cx"> <listitem>
</span><span class="cx"> <para>
</span><ins>+ <emphasis role="bold">Configurable DN Cache for \
LDAP Data Stores</emphasis>. + OpenAM now has the capability to enable and \
disable DN caching. + DN caching helps avoid DN lookups
+ that can happen in bursts during authentication.
+ (
+ <link
+ xlink:show="new"
+ xlink:href="https://bugster.forgerock.org/jira/browse/OPENAM-3822"
+ >OPENAM-3822</link>
+ ).
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
</ins><span class="cx"> <emphasis role="bold">Quicker UI \
Customization</emphasis>. </span><span class="cx"> While customizing the \
UI, you can set the advanced server property, </span><span class="cx"> \
<literal>org.forgerock.openam.core.resource.lookup.cache.enabled</literal>,
</span></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresac \
tivedirectoryxmlfromrev10287trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecapachempmtuningxml"></a>
<div class="copfile"><h4>Copied: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-active-directory.xml \
(from rev 10287, trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-apache-mpm-tuning.xml) \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-active-directory.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-active-directory.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,1001 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-active-directory"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring Active Directory Data Stores</title>
+
+ <para>
+ Use these hints when configuring Active Directory Data Stores.
+ </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Active Directory</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>CN=Administrator,CN=Users,<replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls and load balancers
+ to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>userPassword=unicodePwd</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>group=read,create,edit,delete</literal>,
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>user=read,create,edit,delete</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=person)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>users</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any such unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>organizationalPerson</literal>,
+ <literal>person</literal>,
+ <literal>top</literal>,
+ <literal>User</literal>,
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>assignedDashboard</literal>,
+ <literal>cn</literal>,
+ <literal>devicePrintProfiles</literal>,
+ <literal>displayName</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>dn</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>givenName</literal>,
+ <literal>iplanet-am-auth-configuration</literal>,
+ <literal>iplanet-am-session-add-session-listener-on-all-sessions</literal>,
+ <literal>iplanet-am-session-destroy-sessions</literal>,
+ <literal>iplanet-am-session-get-valid-sessions</literal>,
+ <literal>iplanet-am-session-max-caching-time</literal>,
+ <literal>iplanet-am-session-max-idle-time</literal>,
+ <literal>iplanet-am-session-max-session-time</literal>,
+ <literal>iplanet-am-session-quota-limit</literal>,
+ <literal>iplanet-am-session-service-status</literal>,
+ <literal>iplanet-am-user-account-life</literal>,
+ <literal>iplanet-am-user-admin-start-dn</literal>,
+ <literal>iplanet-am-user-alias-list</literal>,
+ <literal>iplanet-am-user-auth-config</literal>,
+ <literal>iplanet-am-user-auth-modules</literal>,
+ <literal>iplanet-am-user-failure-url</literal>,
+ <literal>iplanet-am-user-federation-info-key</literal>,
+ <literal>iplanet-am-user-federation-info</literal>,
+ <literal>iplanet-am-user-login-status</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset</literal>,
+ <literal>iplanet-am-user-password-reset-options</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer</literal>,
+ <literal>iplanet-am-user-success-url</literal>,
+ <literal>mail</literal>,
+ <literal>name</literal>,
+ <literal>objectclass</literal>,
+ <literal>objectGUID</literal>,
+ <literal>postalAddress</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>preferredLocale</literal>,
+ <literal>preferredtimezone</literal>,
+ <literal>sAMAccountName</literal>,
+ <literal>sn</literal>,
+ <literal>sun-fm-saml2-nameid-info</literal>,
+ <literal>sun-fm-saml2-nameid-infokey</literal>,
+ <literal>sunAMAuthInvalidAttemptsData</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>sunIdentityServerDiscoEntries</literal>,
+ <literal>sunIdentityServerPPAddressCard</literal>,
+ <literal>sunIdentityServerPPCommonNameAltCN</literal>,
+ <literal>sunIdentityServerPPCommonNameCN</literal>,
+ <literal>sunIdentityServerPPCommonNameFN</literal>,
+ <literal>sunIdentityServerPPCommonNameMN</literal>,
+ <literal>sunIdentityServerPPCommonNamePT</literal>,
+ <literal>sunIdentityServerPPCommonNameSN</literal>,
+ <literal>sunIdentityServerPPDemographicsAge</literal>,
+ <literal>sunIdentityServerPPDemographicsBirthDay</literal>,
+ <literal>sunIdentityServerPPDemographicsDisplayLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsTimeZone</literal>,
+ <literal>sunIdentityServerPPEmergencyContact</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityAltO</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityJobTitle</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityOrg</literal>,
+ <literal>sunIdentityServerPPEncryPTKey</literal>,
+ <literal>sunIdentityServerPPFacadegreetmesound</literal>,
+ <literal>sunIdentityServerPPFacadeGreetSound</literal>,
+ <literal>sunIdentityServerPPFacadeMugShot</literal>,
+ <literal>sunIdentityServerPPFacadeNamePronounced</literal>,
+ <literal>sunIdentityServerPPFacadeWebSite</literal>,
+ <literal>sunIdentityServerPPInformalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdValue</literal>,
+ <literal>sunIdentityServerPPLegalIdentityDOB</literal>,
+ <literal>sunIdentityServerPPLegalIdentityGender</literal>,
+ <literal>sunIdentityServerPPLegalIdentityLegalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityMaritalStatus</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdValue</literal>,
+ <literal>sunIdentityServerPPMsgContact</literal>,
+ <literal>sunIdentityServerPPSignKey</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>unicodePwd</literal>,
+ <literal>userAccountControl</literal>,
+ <literal>userpassword</literal>,
+ <literal>userPrincipalname</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>userAccountControl</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ 544
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ 546
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN
+ when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=group)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>users</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Group</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>dn</literal>,
+ <literal>member</literal>,
+ <literal>name</literal>,
+ <literal>objectCategory</literal>,
+ <literal>objectclass</literal>,
+ <literal>sAMAccountName</literal>,
+ <literal>sAMAccountType</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>member</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches
+ used to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ Specify either <literal>SCOPE_BASE</literal>
+ or <literal>SCOPE_ONE</literal>.
+ Do not specify <literal>SCOPE_SUB</literal>,
+ as it can have a severe impact on Active Directory performance.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresadamxml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-adam.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-adam.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-adam.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,1013 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-adam"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring Active Directory Application Mode (ADAM) Data \
Stores</title> +
+ <para>
+ Use these hints when configuring Active Directory Application Mode (ADAM) Data \
Stores. + </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Active Directory Application Mode (ADAM)</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>CN=Administrator,CN=Users,<replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls
+ and load balancers to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>userPassword=unicodePwd</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>group=read,create,edit,delete</literal>,
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>user=read,create,edit,delete</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=person)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>devicePrintProfilesContainer</literal>,
+ <literal>forgerock-am-dashboard-service</literal>,
+ <literal>iplanet-am-auth-configuration-service</literal>,
+ <literal>iplanet-am-managed-person</literal>,
+ <literal>iplanet-am-user-service</literal>,
+ <literal>iPlanetPreferences</literal>,
+ <literal>organizationalPerson</literal>,
+ <literal>person</literal>,
+ <literal>sunAMAuthAccountLockout</literal>,
+ <literal>sunFederationManagerDataStore</literal>,
+ <literal>sunFMSAML2NameIdentifier</literal>,
+ <literal>sunIdentityServerLibertyPPService</literal>,
+ <literal>top</literal>,
+ <literal>User</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>assignedDashboard</literal>,
+ <literal>cn</literal>,
+ <literal>devicePrintProfiles</literal>,
+ <literal>displayName</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>dn</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>givenName</literal>,
+ <literal>iplanet-am-auth-configuration</literal>,
+ <literal>iplanet-am-session-add-session-listener-on-all-sessions</literal>,
+ <literal>iplanet-am-session-destroy-sessions</literal>,
+ <literal>iplanet-am-session-get-valid-sessions</literal>,
+ <literal>iplanet-am-session-max-caching-time</literal>,
+ <literal>iplanet-am-session-max-idle-time</literal>,
+ <literal>iplanet-am-session-max-session-time</literal>,
+ <literal>iplanet-am-session-quota-limit</literal>,
+ <literal>iplanet-am-session-service-status</literal>,
+ <literal>iplanet-am-user-account-life</literal>,
+ <literal>iplanet-am-user-admin-start-dn</literal>,
+ <literal>iplanet-am-user-alias-list</literal>,
+ <literal>iplanet-am-user-auth-config</literal>,
+ <literal>iplanet-am-user-auth-modules</literal>,
+ <literal>iplanet-am-user-failure-url</literal>,
+ <literal>iplanet-am-user-federation-info-key</literal>,
+ <literal>iplanet-am-user-federation-info</literal>,
+ <literal>iplanet-am-user-login-status</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset</literal>,
+ <literal>iplanet-am-user-password-reset-options</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer</literal>,
+ <literal>iplanet-am-user-success-url</literal>,
+ <literal>mail</literal>,
+ <literal>name</literal>,
+ <literal>objectclass</literal>,
+ <literal>objectGUID</literal>,
+ <literal>postalAddress</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>preferredLocale</literal>,
+ <literal>preferredtimezone</literal>,
+ <literal>sAMAccountName</literal>,
+ <literal>sn</literal>,
+ <literal>sun-fm-saml2-nameid-info</literal>,
+ <literal>sun-fm-saml2-nameid-infokey</literal>,
+ <literal>sunAMAuthInvalidAttemptsData</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>sunIdentityServerDiscoEntries</literal>,
+ <literal>sunIdentityServerPPAddressCard</literal>,
+ <literal>sunIdentityServerPPCommonNameAltCN</literal>,
+ <literal>sunIdentityServerPPCommonNameCN</literal>,
+ <literal>sunIdentityServerPPCommonNameFN</literal>,
+ <literal>sunIdentityServerPPCommonNameMN</literal>,
+ <literal>sunIdentityServerPPCommonNamePT</literal>,
+ <literal>sunIdentityServerPPCommonNameSN</literal>,
+ <literal>sunIdentityServerPPDemographicsAge</literal>,
+ <literal>sunIdentityServerPPDemographicsBirthDay</literal>,
+ <literal>sunIdentityServerPPDemographicsDisplayLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsTimeZone</literal>,
+ <literal>sunIdentityServerPPEmergencyContact</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityAltO</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityJobTitle</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityOrg</literal>,
+ <literal>sunIdentityServerPPEncryPTKey</literal>,
+ <literal>sunIdentityServerPPFacadegreetmesound</literal>,
+ <literal>sunIdentityServerPPFacadeGreetSound</literal>,
+ <literal>sunIdentityServerPPFacadeMugShot</literal>,
+ <literal>sunIdentityServerPPFacadeNamePronounced</literal>,
+ <literal>sunIdentityServerPPFacadeWebSite</literal>,
+ <literal>sunIdentityServerPPInformalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdValue</literal>,
+ <literal>sunIdentityServerPPLegalIdentityDOB</literal>,
+ <literal>sunIdentityServerPPLegalIdentityGender</literal>,
+ <literal>sunIdentityServerPPLegalIdentityLegalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityMaritalStatus</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdValue</literal>,
+ <literal>sunIdentityServerPPMsgContact</literal>,
+ <literal>sunIdentityServerPPSignKey</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>unicodePwd</literal>,
+ <literal>userAccountControl</literal>,
+ <literal>userpassword</literal>,
+ <literal>userPrincipalname</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>msDS-UserAccountDisabled</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ FALSE
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ TRUE
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=group)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Group</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>dn</literal>,
+ <literal>member</literal>,
+ <literal>name</literal>,
+ <literal>objectCategory</literal>,
+ <literal>objectclass</literal>,
+ <literal>sAMAccountName</literal>,
+ <literal>sAMAccountType</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>member</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches used
+ to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ Specify either <literal>SCOPE_BASE</literal>
+ or <literal>SCOPE_ONE</literal>.
+ Do not specify <literal>SCOPE_SUB</literal>,
+ as it can have a severe impact on Active Directory performance.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresdbxml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-db.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-db.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-db.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,538 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-db"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'
+ xmlns:xlink='http://www.w3.org/1999/xlink'>
+ <title>Hints for Configuring Database Repository (Early Access) Data \
Stores</title> +
+ <para>
+ Use these hints when configuring Database Repository (Early Access) Data Stores.
+ </para>
+
+ <important>
+ <para>
+ This feature is in Early Access,
+ meaning it is not generally supported for use in production environments.
+ If you expect to use a relational database as an identity repository
+ other than for development or testing purposes,
+ first confirm supportability of your configuration with an expert.
+ You can contact ForgeRock at
+ <link xlink:href="mailto:info@forgerock.com">info@forgerock.com</link>.
+ </para>
+ </important>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Database Repository (Early Access)</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add the appropriate schema to the database on saving the configuration.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database Data Access Object Plugin Class Name</term>
+ <listitem>
+ <para>
+ OpenAM data access implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-dao-class-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>com.sun.identity.idm.plugins.database.JdbcSimpleUserDao</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Connection Type</term>
+ <listitem>
+ <para>
+ Whether to connect directly to the database,
+ or to connect through JNDI provided by the container where OpenAM runs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-dao-JDBCConnectionType</literal>
+ </para>
+
+ <para>
+ Default:
+ Connection is retrieved via programmatic connection
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database DataSource Name</term>
+ <listitem>
+ <para>
+ Data source name from the container configuration when connecting over JNDI
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-DataSourceJndiName</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>java:comp/env/jdbc/openssousersdb</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>JDBC Driver Class Name</term>
+ <listitem>
+ <para>
+ Driver class used when connecting directly
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-JDBCDriver</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>com.mysql.jdbc.Driver</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>JDBC Driver URL</term>
+ <listitem>
+ <para>
+ URL used when connecting directly
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-JDBCUrl</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>jdbc:mysql://127.0.0.1:3306/test</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Connect This User to Database</term>
+ <listitem>
+ <para>
+ Username used when connecting directly
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-JDBCDbuser</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>root</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Password for Connecting to Database</term>
+ <listitem>
+ <para>
+ Password used when connecting directly
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-JDBCDbpassword</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer profiles.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database Repository Plugin Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>com.sun.identity.idm.plugins.database.DatabaseRepo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to database column names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>iplanet-am-user-account-life=iplanet_am_user_account_life</literal>,
+ <literal>iplanet-am-user-alias-list=iplanet_am_user_alias_list</literal>,
+ <literal>iplanet-am-user-auth-config=iplanet_am_user_auth_config</literal>,
+ <literal>iplanet-am-user-failure-url=iplanet_am_user_failure_url</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset=iplanet_am_user_password_reset_force_reset</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer=iplanet_am_user_password_reset_question_answer</literal>,
+ <literal>iplanet-am-user-password-resetoptions=iplanet_am_user_password_resetoptions</literal>,
+ <literal>iplanet-am-user-success-url=iplanet_am_user_success_url</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>group=read,create,edit,delete</literal>,
+ <literal>user=read,create,edit,delete,service</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database User Table Name</term>
+ <listitem>
+ <para>
+ Table to store user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-UserTableName</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>opensso_users</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>List of User Attributes Names in Database</term>
+ <listitem>
+ <para>
+ Columns for user profile attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-UserAttrs</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ChangePassword</literal>,
+ <literal>cn</literal>,
+ <literal>employeenumber</literal>,
+ <literal>givenname</literal>,
+ <literal>inetuserstatus</literal>,
+ <literal>iplanet_am_user_account_life</literal>,
+ <literal>iplanet_am_user_alias_list</literal>,
+ <literal>iplanet_am_user_auth_config</literal>,
+ <literal>iplanet_am_user_failure_url</literal>,
+ <literal>iplanet_am_user_password_reset_force_reset</literal>,
+ <literal>iplanet_am_user_password_reset_question_answer</literal>,
+ <literal>iplanet_am_user_password_resetoptions</literal>,
+ <literal>iplanet_am_user_success_url</literal>,
+ <literal>mail</literal>,
+ <literal>manager</literal>,
+ <literal>postaladdress</literal>,
+ <literal>preferredlocale</literal>,
+ <literal>sn</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>telephonenumber</literal>,
+ <literal>uid</literal>,
+ <literal>userpassword</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Password Attribute Name</term>
+ <listitem>
+ <para>
+ Column for user passwords
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-UserPasswordAttr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>userpassword</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User ID Attribute Name</term>
+ <listitem>
+ <para>
+ Column for user IDs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-UserIDAttr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Column to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-UserStatusAttr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetuserstatus</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-activeValue</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Active</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-inactiveValue</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Inactive</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Users Search Attribute in Database</term>
+ <listitem>
+ <para>
+ Key for looking up user profiles by name
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Database Membership table name</term>
+ <listitem>
+ <para>
+ Table to store group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-MembershipTableName</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groups</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Membership ID Attribute Name</term>
+ <listitem>
+ <para>
+ Column for group IDs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-MembershipIDAttr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>group_name</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Membership Search Attribute in Database</term>
+ <listitem>
+ <para>
+ Key for looking up group profiles by name
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-opensso-database-membership-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresdseexml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-dsee.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-dsee.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-dsee.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,1261 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-dsee"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring Sun DS with OpenAM schema Data \
Stores</title> +
+ <para>
+ Use these hints when configuring Data Stores
+ for Oracle DSEE or Sun DSEE using OpenAM schema.
+ </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Oracle DSEE</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn=dsameuser,ou=DSAME \
Users,<replaceable>base-dn</replaceable></literal> + \
</para> + </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls
+ and load balancers to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>filteredrole=read,create,edit,delete</literal>,
+ <literal>group=read,create,edit,delete</literal>,
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>role=read,create,edit,delete</literal>,
+ <literal>user=read,create,edit,delete,service</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=inetorgperson)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>people</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>devicePrintProfilesContainer</literal>,
+ <literal>forgerock-am-dashboard-service</literal>,
+ <literal>inetadmin</literal>,
+ <literal>inetorgperson</literal>,
+ <literal>inetuser</literal>,
+ <literal>iplanet-am-auth-configuration-service</literal>,
+ <literal>iplanet-am-managed-person</literal>,
+ <literal>iplanet-am-user-service</literal>,
+ <literal>iPlanetPreferences</literal>,
+ <literal>organizationalperson</literal>,
+ <literal>person</literal>,
+ <literal>sunAMAuthAccountLockout</literal>,
+ <literal>sunFederationManagerDataStore</literal>,
+ <literal>sunFMSAML2NameIdentifier</literal>,
+ <literal>sunIdentityServerLibertyPPService</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>sunIdentityServerPPDemographicsBirthDay</literal>,
+ <literal>uid</literal>,
+ <literal>sunIdentityServerPPLegalIdentityLegalName</literal>,
+ <literal>manager</literal>,
+ <literal>assignedDashboard</literal>,
+ <literal>sunIdentityServerPPCommonNameSN</literal>,
+ <literal>userPassword</literal>,
+ <literal>iplanet-am-session-get-valid-sessions</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityJobTitle</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer</literal>,
+ <literal>sunIdentityServerPPLegalIdentityDOB</literal>,
+ <literal>sunIdentityServerPPEmergencyContact</literal>,
+ <literal>sunIdentityServerPPCommonNameCN</literal>,
+ <literal>iplanet-am-user-success-url</literal>,
+ <literal>iplanet-am-user-admin-start-dn</literal>,
+ <literal>iplanet-am-user-federation-info</literal>,
+ <literal>userCertificate</literal>,
+ <literal>sunIdentityServerPPFacadeGreetSound</literal>,
+ <literal>sunAMAuthInvalidAttemptsData</literal>,
+ <literal>sunIdentityServerPPFacadeNamePronounced</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>sunIdentityServerPPDemographicsTimeZone</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>iplanet-am-session-max-caching-time</literal>,
+ <literal>sn</literal>,
+ <literal>iplanet-am-session-quota-limit</literal>,
+ <literal>iplanet-am-session-max-session-time</literal>,
+ <literal>adminRole</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityAltO</literal>,
+ <literal>objectClass</literal>,
+ <literal>sun-fm-saml2-nameid-info</literal>,
+ <literal>sunIdentityServerPPLegalIdentityMaritalStatus</literal>,
+ <literal>iplanet-am-user-login-status</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdType</literal>,
+ <literal>devicePrintProfiles</literal>,
+ <literal>iplanet-am-session-max-idle-time</literal>,
+ <literal>sunIdentityServerPPFacadegreetmesound</literal>,
+ <literal>cn</literal>,
+ <literal>iplanet-am-user-password-reset-options</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>iplanet-am-user-federation-info-key</literal>,
+ <literal>sunIdentityServerPPMsgContact</literal>,
+ <literal>sunIdentityServerPPLegalIdentityGender</literal>,
+ <literal>iplanet-am-user-alias-list</literal>,
+ <literal>sunIdentityServerPPCommonNameFN</literal>,
+ <literal>caCertificate</literal>,
+ <literal>inetUserStatus</literal>,
+ <literal>sunIdentityServerPPCommonNameMN</literal>,
+ <literal>sunIdentityServerPPEncryPTKey</literal>,
+ <literal>givenName</literal>,
+ <literal>memberOf</literal>,
+ <literal>iplanet-am-static-group-dn</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdValue</literal>,
+ <literal>preferredLocale</literal>,
+ <literal>iplanet-am-session-service-status</literal>,
+ <literal>sun-fm-saml2-nameid-infokey</literal>,
+ <literal>sunIdentityServerPPDemographicsAge</literal>,
+ <literal>sunIdentityServerDiscoEntries</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdType</literal>,
+ <literal>iplanet-am-user-auth-config</literal>,
+ <literal>iplanet-am-user-failure-url</literal>,
+ <literal>sunIdentityServerPPAddressCard</literal>,
+ <literal>sunIdentityServerPPCommonNamePT</literal>,
+ <literal>dn</literal>,
+ <literal>iplanet-am-session-add-session-listener-on-all-sessions</literal>,
+ <literal>mail</literal>,
+ <literal>authorityRevocationList</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset</literal>,
+ <literal>inetUserHttpURL</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdValue</literal>,
+ <literal>sunIdentityServerPPCommonNameAltCN</literal>,
+ <literal>preferredtimezone</literal>,
+ <literal>sunIdentityServerPPInformalName</literal>,
+ <literal>sunIdentityServerPPSignKey</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityOrg</literal>,
+ <literal>iplanet-am-session-destroy-sessions</literal>,
+ <literal>sunIdentityServerPPFacadeMugShot</literal>,
+ <literal>sunIdentityServerPPFacadeWebSite</literal>,
+ <literal>sunIdentityServerPPDemographicsDisplayLanguage</literal>,
+ <literal>postalAddress</literal>,
+ <literal>iplanet-am-auth-configuration</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>iplanet-am-user-auth-modules</literal>,
+ <literal>iplanet-am-user-account-life</literal>,
+ <literal>sunIdentityServerPPDemographicsLanguage</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetuserstatus</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Active</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Inactive</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=groupOfUniqueNames)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groups</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groupofuniquenames</literal>,
+ <literal>iplanet-am-managed-group</literal>,
+ <literal>iplanet-am-managed-static-group</literal>,
+ <literal>groupofurls</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>iplanet-am-group-subscribable</literal>,
+ <literal>dn</literal>,
+ <literal>objectclass</literal>,
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Group Member URL</term>
+ <listitem>
+ <para>
+ Attribute in the dynamic group's LDAP entry
+ whose values are LDAP URLs specifying members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberurl</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>memberUrl</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Roles Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a role by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-roles-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Roles Search Filter</term>
+ <listitem>
+ <para>
+ When searching for roles, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-roles-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(&amp;(objectclass=ldapsubentry)(objectclass=nsmanagedroledefinition))</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Roles Object Class</term>
+ <listitem>
+ <para>
+ Role profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-role-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ldapsubentry</literal>,
+ <literal>nsmanagedroledefinition</literal>,
+ <literal>nsroledefinition</literal>,
+ <literal>nssimpleroledefinition</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Filter Roles Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a filtered role by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-filterroles-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Filter Roles Search Filter</term>
+ <listitem>
+ <para>
+ When searching for filtered roles, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-filterroles-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(&amp;(objectclass=ldapsubentry)(objectclass=nsfilteredroledefinition))</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Filter Roles Object Class</term>
+ <listitem>
+ <para>
+ Filtered role profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-filterrole-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ldapsubentry</literal>,
+ <literal>nscomplexroledefinition</literal>,
+ <literal>nsfilteredroledefinition</literal>,
+ <literal>nsroledefinition</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Filter Roles Attributes</term>
+ <listitem>
+ <para>
+ Filtered role profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-filterrole-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>nsRoleFilter</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Filtered Role Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the filtered roles to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-nsrole</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>nsrole</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Role Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the roles to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-nsroledn</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>nsRoleDN</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Filtered Role Filter</term>
+ <listitem>
+ <para>
+ LDAP attribute whose values are the filters for filtered roles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-nsrolefilter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>nsRoleFilter</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches used
+ to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Filter</term>
+ <listitem>
+ <para>
+ LDAP filter to apply when performing persistent searches
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=*)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ true
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresgenericldapv3xml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-generic-ldapv3.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-generic-ldapv3.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-generic-ldapv3.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,978 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-generic-ldapv3"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring Generic LDAPv3 Data Stores</title>
+
+ <para>
+ Use these hints when configuring Generic LDAPv3 compliant Data Stores.
+ </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Generic LDAPv3</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls
+ and load balancers to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>user=read,create,edit,delete</literal>,
+ <literal>group=read,create,edit,delete</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=inetorgperson)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetorgperson</literal>,
+ <literal>inetUser</literal>,
+ <literal>organizationalPerson</literal>,
+ <literal>person</literal>,
+ <literal>top</literal>,
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>,
+ <literal>caCertificate</literal>,
+ <literal>authorityRevocationList</literal>,
+ <literal>inetUserStatus</literal>,
+ <literal>mail</literal>,
+ <literal>sn</literal>,
+ <literal>manager</literal>,
+ <literal>userPassword</literal>,
+ <literal>adminRole</literal>,
+ <literal>objectClass</literal>,
+ <literal>givenName</literal>,
+ <literal>memberOf</literal>,
+ <literal>cn</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>userCertificate</literal>,
+ <literal>postalAddress</literal>,
+ <literal>dn</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>distinguishedName</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>, <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetuserstatus</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Active</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Inactive</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=groupOfUniqueNames)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groups</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groupofuniquenames</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>,
+ <literal>cn</literal>,
+ <literal>description</literal>,
+ <literal>dn</literal>,
+ <literal>objectclass</literal>,
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Group Member URL</term>
+ <listitem>
+ <para>
+ Attribute in the dynamic group's LDAP entry
+ whose value is a URL specifying the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberurl</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>memberUrl</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Default Group Member's User DN</term>
+ <listitem>
+ <para>
+ DN of member added to all newly created groups
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-dftgroupmember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches used
+ to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Filter</term>
+ <listitem>
+ <para>
+ LDAP filter to apply when performing persistent searches
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=*)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastoresopendjxml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-opendj.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-opendj.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-opendj.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,1031 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-opendj"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring OpenDJ Data Stores</title>
+
+ <para>
+ Use these hints when configuring OpenDJ Data Stores.
+ </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>OpenDJ</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls
+ and load balancers to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>user=read,create,edit,delete</literal>,
+ <literal>group=read,create,edit,delete</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=inetorgperson)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>people</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>devicePrintProfilesContainer</literal>,
+ <literal>forgerock-am-dashboard-service</literal>,
+ <literal>inetorgperson</literal>,
+ <literal>inetuser</literal>,
+ <literal>iplanet-am-auth-configuration-service</literal>,
+ <literal>iplanet-am-managed-person</literal>,
+ <literal>iplanet-am-user-service</literal>,
+ <literal>iPlanetPreferences</literal>,
+ <literal>organizationalperson</literal>,
+ <literal>person</literal>,
+ <literal>sunAMAuthAccountLockout</literal>,
+ <literal>sunFederationManagerDataStore</literal>,
+ <literal>sunFMSAML2NameIdentifier</literal>,
+ <literal>sunIdentityServerLibertyPPService</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>sunIdentityServerPPDemographicsBirthDay</literal>,
+ <literal>uid</literal>,
+ <literal>sunIdentityServerPPLegalIdentityLegalName</literal>,
+ <literal>manager</literal>,
+ <literal>assignedDashboard</literal>,
+ <literal>sunIdentityServerPPCommonNameSN</literal>,
+ <literal>userPassword</literal>,
+ <literal>iplanet-am-session-get-valid-sessions</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityJobTitle</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer</literal>,
+ <literal>sunIdentityServerPPLegalIdentityDOB</literal>,
+ <literal>sunIdentityServerPPEmergencyContact</literal>,
+ <literal>sunIdentityServerPPCommonNameCN</literal>,
+ <literal>iplanet-am-user-success-url</literal>,
+ <literal>iplanet-am-user-admin-start-dn</literal>,
+ <literal>iplanet-am-user-federation-info</literal>,
+ <literal>userCertificate</literal>,
+ <literal>sunIdentityServerPPFacadeGreetSound</literal>,
+ <literal>sunAMAuthInvalidAttemptsData</literal>,
+ <literal>sunIdentityServerPPFacadeNamePronounced</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>sunIdentityServerPPDemographicsTimeZone</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>iplanet-am-session-max-caching-time</literal>,
+ <literal>sn</literal>,
+ <literal>iplanet-am-session-quota-limit</literal>,
+ <literal>iplanet-am-session-max-session-time</literal>,
+ <literal>adminRole</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityAltO</literal>,
+ <literal>objectClass</literal>,
+ <literal>sun-fm-saml2-nameid-info</literal>,
+ <literal>sunIdentityServerPPLegalIdentityMaritalStatus</literal>,
+ <literal>iplanet-am-user-login-status</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdType</literal>,
+ <literal>devicePrintProfiles</literal>,
+ <literal>iplanet-am-session-max-idle-time</literal>,
+ <literal>sunIdentityServerPPFacadegreetmesound</literal>,
+ <literal>cn</literal>,
+ <literal>iplanet-am-user-password-reset-options</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>iplanet-am-user-federation-info-key</literal>,
+ <literal>sunIdentityServerPPMsgContact</literal>,
+ <literal>sunIdentityServerPPLegalIdentityGender</literal>,
+ <literal>iplanet-am-user-alias-list</literal>,
+ <literal>sunIdentityServerPPCommonNameFN</literal>,
+ <literal>caCertificate</literal>,
+ <literal>inetUserStatus</literal>,
+ <literal>sunIdentityServerPPCommonNameMN</literal>,
+ <literal>sunIdentityServerPPEncryPTKey</literal>,
+ <literal>givenName</literal>,
+ <literal>memberOf</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdValue</literal>,
+ <literal>preferredLocale</literal>,
+ <literal>iplanet-am-session-service-status</literal>,
+ <literal>sun-fm-saml2-nameid-infokey</literal>,
+ <literal>sunIdentityServerPPDemographicsAge</literal>,
+ <literal>sunIdentityServerDiscoEntries</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdType</literal>,
+ <literal>iplanet-am-user-auth-config</literal>,
+ <literal>iplanet-am-user-failure-url</literal>,
+ <literal>sunIdentityServerPPAddressCard</literal>,
+ <literal>sunIdentityServerPPCommonNamePT</literal>,
+ <literal>dn</literal>,
+ <literal>iplanet-am-session-add-session-listener-on-all-sessions</literal>,
+ <literal>mail</literal>,
+ <literal>authorityRevocationList</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset</literal>,
+ <literal>inetUserHttpURL</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdValue</literal>,
+ <literal>sunIdentityServerPPCommonNameAltCN</literal>,
+ <literal>preferredtimezone</literal>,
+ <literal>sunIdentityServerPPInformalName</literal>,
+ <literal>sunIdentityServerPPSignKey</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityOrg</literal>,
+ <literal>iplanet-am-session-destroy-sessions</literal>,
+ <literal>sunIdentityServerPPFacadeMugShot</literal>,
+ <literal>sunIdentityServerPPFacadeWebSite</literal>,
+ <literal>sunIdentityServerPPDemographicsDisplayLanguage</literal>,
+ <literal>postalAddress</literal>,
+ <literal>iplanet-am-auth-configuration</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>iplanet-am-user-account-life</literal>,
+ <literal>iplanet-am-user-auth-modules</literal>,
+ <literal>sunIdentityServerPPDemographicsLanguage</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>, <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetuserstatus</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Active</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Inactive</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=groupOfUniqueNames)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groups</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groupofuniquenames</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>dn</literal>,
+ <literal>objectclass</literal>,
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>uniqueMember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches used
+ to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Filter</term>
+ <listitem>
+ <para>
+ LDAP filter to apply when performing persistent searches
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=*)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ The OpenDJ data store uses this setting only for persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ true
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre></div>
<a id="trunkopenamopenamdocumentationopenamdocsourcesrcmaindocbkxsharedsecdatastorestivolixml"></a>
<div class="addfile"><h4>Added: \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-tivoli.xml \
(0 => 10288)</h4> <pre class="diff"><span>
<span class="info">--- \
trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-tivoli.xml \
(rev 0)
+++ trunk/openam/openam-documentation/openam-doc-source/src/main/docbkx/shared/sec-data-stores-tivoli.xml 2014-08-28 \
08:47:10 UTC (rev 10288) </span><span class="lines">@@ -0,0 +1,1032 @@
</span><ins>+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ ! CCPL HEADER START
+ !
+ ! This work is licensed under the Creative Commons
+ ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
+ ! To view a copy of this license, visit
+ ! http://creativecommons.org/licenses/by-nc-nd/3.0/
+ ! or send a letter to Creative Commons, 444 Castro Street,
+ ! Suite 900, Mountain View, California, 94041, USA.
+ !
+ ! You can also obtain a copy of the license at
+ ! trunk/opendj3/legal-notices/CC-BY-NC-ND.txt.
+ ! See the License for the specific language governing permissions
+ ! and limitations under the License.
+ !
+ ! If applicable, add the following below this CCPL HEADER, with the fields
+ ! enclosed by brackets "[]" replaced with your own identifying \
information: + ! Portions Copyright [yyyy] [name of copyright owner]
+ !
+ ! CCPL HEADER END
+ !
+ ! Copyright 2011-2014 ForgeRock AS
+ !
+-->
+<section xml:id="sec-data-stores-tivoli"
+ xmlns='http://docbook.org/ns/docbook' version='5.0' xml:lang='en'
+ xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
+ xsi:schemaLocation='http://docbook.org/ns/docbook
+ http://docbook.org/xml/5.0/xsd/docbook.xsd'>
+ <title>Hints for Configuring Tivoli Directory Server Data \
Stores</title> +
+ <para>
+ Use these hints when configuring Tivoli Directory Server Data Stores.
+ </para>
+
+ <indexterm>
+ <primary>Data stores</primary>
+ <secondary>Tivoli Directory Server</secondary>
+ </indexterm>
+
+ <para>
+ <command>ssoadm</command> service name:
+ <literal>sunIdentityRepositoryService</literal>
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term>Name</term>
+ <listitem>
+ <para>
+ Name for the data store configuration
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Load schema when finished</term>
+ <listitem>
+ <para>
+ Add appropriate LDAP schema to the directory server
+ when saving the configuration.
+ The LDAP Bind DN user must have access to perform this operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>idRepoLoadSchema</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Server</term>
+ <listitem>
+ <para>
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ to contact the directory server, with optional
+ <literal>|<replaceable>server_ID</replaceable>|<replaceable>site_ID</replaceable></literal>
+ for deployments with multiple servers and sites
+ </para>
+
+ <orderedlist>
+ <para>
+ OpenAM uses the optional settings to determine
+ which directory server to contact first.
+ OpenAM tries to contact directory servers
+ in the following priority order, with highest priority first.
+ </para>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>server_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the list
+ whose <replaceable>site_ID</replaceable>
+ matches the current OpenAM server
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ The first directory server in the remaining list
+ </para>
+ </listitem>
+ </orderedlist>
+
+ <para>
+ If the directory server is not available,
+ OpenAM proceeds to the next directory server in the list.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ldap-server</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>host</replaceable>:<replaceable>port</replaceable></literal>
+ of the initial directory server configured for this OpenAM server
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind DN</term>
+ <listitem>
+ <para>
+ Bind DN for connecting to the directory server.
+ Some OpenAM capabilities require write access to directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authid</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Bind Password</term>
+ <listitem>
+ <para>
+ Bind password for connecting to the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-authpw</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Organization DN</term>
+ <listitem>
+ <para>
+ The base DN under which to find user and group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-organization_name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP SSL/TLS Enabled</term>
+ <listitem>
+ <para>
+ Whether to use LDAPS or StartTLS to connect to the directory server.
+ If you enable SSL/TLS, OpenAM must be able to trust server certificates,
+ either because the server certificates were signed by a CA
+ whose certificate is already included in the trust store
+ used by the container where OpenAM runs,
+ or because you imported the certificates into the trust store.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-ssl-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Pool Maximum Size</term>
+ <listitem>
+ <para>
+ Maximum number of connections to the directory server.
+ Make sure the directory service can cope
+ with the maximum number of client connections across all servers.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-connection_pool_max_size</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Interval</term>
+ <listitem>
+ <para>
+ How often to send a heartbeat request to the directory server
+ to ensure that the connection does not remain idle.
+ Some network administrators configure firewalls
+ and load balancers to drop connections that are idle for too long.
+ You can turn this off by setting the value to 0 or to a negative number.
+ To set the units for the interval use LDAP Connection Heartbeat Time Unit.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-interval</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Connection Heartbeat Time Unit</term>
+ <listitem>
+ <para>
+ Time unit for the LDAP Connection Heartbeat Interval setting
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>openam-idrepo-ldapv3-heartbeat-timeunit</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>second</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Maximum Results Returned from Search</term>
+ <listitem>
+ <para>
+ A cap for the number of search results to request.
+ For example when using the Subjects tab to view profiles,
+ even if you set
+ Configuration > Console > Administration > Maximum Results Returned \
from Search + to a larger number, OpenAM does not exceed this setting.
+ Rather than raise this number,
+ consider narrowing your search to match fewer directory entries.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-max-result</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Search Timeout</term>
+ <listitem>
+ <para>
+ Maximum time to wait for search results in seconds.
+ Does not apply to persistent searches.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-time-limit</literal>
+ </para>
+
+ <para>
+ Default:
+ 10
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-search-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Repository Plug-in Class Name</term>
+ <listitem>
+ <para>
+ OpenAM identity repository implementation
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoClass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>org.forgerock.openam.idrepo.ldap.DJLDAPv3Repo</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name Mapping</term>
+ <listitem>
+ <para>
+ Map of OpenAM profile attribute names to directory server attribute names
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoAttributeMapping</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAPv3 Plug-in Supported Types and Operations</term>
+ <listitem>
+ <para>
+ Map of OpenAM operations that can be performed in the specified OpenAM contexts
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sunIdRepoSupportedOperations</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>group=read,create,edit,delete</literal>,
+ <literal>realm=read,create,edit,delete,service</literal>,
+ <literal>user=read,create,edit,delete,service</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a user by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Users Search Filter</term>
+ <listitem>
+ <para>
+ When searching for users, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-users-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=inetorgperson)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP People Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains user profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-people-container-value</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Object Class</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP object classes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>devicePrintProfilesContainer</literal>,
+ <literal>forgerock-am-dashboard-service</literal>,
+ <literal>inetorgperson</literal>,
+ <literal>inetuser</literal>,
+ <literal>iplanet-am-auth-configuration-service</literal>,
+ <literal>iplanet-am-managed-person</literal>,
+ <literal>iplanet-am-user-service</literal>,
+ <literal>iPlanetPreferences</literal>,
+ <literal>organizationalperson</literal>,
+ <literal>person</literal>,
+ <literal>sunAMAuthAccountLockout</literal>,
+ <literal>sunFederationManagerDataStore</literal>,
+ <literal>sunFMSAML2NameIdentifier</literal>,
+ <literal>sunIdentityServerLibertyPPService</literal>,
+ <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP User Attributes</term>
+ <listitem>
+ <para>
+ User profiles have these LDAP attributes
+ </para>
+
+ <para>
+ OpenAM handles only those attributes listed in this setting.
+ OpenAM discards any unlisted attributes from requests
+ and the request proceeds without the attribute.
+ </para>
+
+ <para>
+ For example, with default settings
+ if you request that OpenAM execute a search that asks for
+ the <literal>mailAlternateAddress</literal> attribute,
+ OpenAM does the search, but does not request
+ <literal>mailAlternateAddress</literal>.
+ In the same way, OpenAM does perform an update operation
+ with a request to set the value of an unlisted attribute
+ like <literal>mailAlternateAddress</literal>,
+ but it drops the unlisted attribute from the update request.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-user-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>adminRole</literal>,
+ <literal>assignedDashboard</literal>,
+ <literal>authorityRevocationList</literal>,
+ <literal>caCertificate</literal>,
+ <literal>cn</literal>,
+ <literal>devicePrintProfiles</literal>,
+ <literal>distinguishedName</literal>,
+ <literal>dn</literal>,
+ <literal>employeeNumber</literal>,
+ <literal>givenName</literal>,
+ <literal>inetUserHttpURL</literal>,
+ <literal>inetUserStatus</literal>,
+ <literal>iplanet-am-auth-configuration</literal>,
+ <literal>iplanet-am-session-add-session-listener-on-all-sessions</literal>,
+ <literal>iplanet-am-session-destroy-sessions</literal>,
+ <literal>iplanet-am-session-get-valid-sessions</literal>,
+ <literal>iplanet-am-session-max-caching-time</literal>,
+ <literal>iplanet-am-session-max-idle-time</literal>,
+ <literal>iplanet-am-session-max-session-time</literal>,
+ <literal>iplanet-am-session-quota-limit</literal>,
+ <literal>iplanet-am-session-service-status</literal>,
+ <literal>iplanet-am-user-account-life</literal>,
+ <literal>iplanet-am-user-admin-start-dn</literal>,
+ <literal>iplanet-am-user-alias-list</literal>,
+ <literal>iplanet-am-user-auth-config</literal>,
+ <literal>iplanet-am-user-auth-modules</literal>,
+ <literal>iplanet-am-user-failure-url</literal>,
+ <literal>iplanet-am-user-federation-info-key</literal>,
+ <literal>iplanet-am-user-federation-info</literal>,
+ <literal>iplanet-am-user-login-status</literal>,
+ <literal>iplanet-am-user-password-reset-force-reset</literal>,
+ <literal>iplanet-am-user-password-reset-options</literal>,
+ <literal>iplanet-am-user-password-reset-question-answer</literal>,
+ <literal>iplanet-am-user-success-url</literal>,
+ <literal>mail</literal>,
+ <literal>manager</literal>,
+ <literal>memberOf</literal>,
+ <literal>objectClass</literal>,
+ <literal>postalAddress</literal>,
+ <literal>preferredlanguage</literal>,
+ <literal>preferredLocale</literal>,
+ <literal>preferredtimezone</literal>,
+ <literal>sn</literal>,
+ <literal>sun-fm-saml2-nameid-info</literal>,
+ <literal>sun-fm-saml2-nameid-infokey</literal>,
+ <literal>sunAMAuthInvalidAttemptsData</literal>,
+ <literal>sunIdentityMSISDNNumber</literal>,
+ <literal>sunIdentityServerDiscoEntries</literal>,
+ <literal>sunIdentityServerPPAddressCard</literal>,
+ <literal>sunIdentityServerPPCommonNameAltCN</literal>,
+ <literal>sunIdentityServerPPCommonNameCN</literal>,
+ <literal>sunIdentityServerPPCommonNameFN</literal>,
+ <literal>sunIdentityServerPPCommonNameMN</literal>,
+ <literal>sunIdentityServerPPCommonNamePT</literal>,
+ <literal>sunIdentityServerPPCommonNameSN</literal>,
+ <literal>sunIdentityServerPPDemographicsAge</literal>,
+ <literal>sunIdentityServerPPDemographicsBirthDay</literal>,
+ <literal>sunIdentityServerPPDemographicsDisplayLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsLanguage</literal>,
+ <literal>sunIdentityServerPPDemographicsTimeZone</literal>,
+ <literal>sunIdentityServerPPEmergencyContact</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityAltO</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityJobTitle</literal>,
+ <literal>sunIdentityServerPPEmploymentIdentityOrg</literal>,
+ <literal>sunIdentityServerPPEncryPTKey</literal>,
+ <literal>sunIdentityServerPPFacadegreetmesound</literal>,
+ <literal>sunIdentityServerPPFacadeGreetSound</literal>,
+ <literal>sunIdentityServerPPFacadeMugShot</literal>,
+ <literal>sunIdentityServerPPFacadeNamePronounced</literal>,
+ <literal>sunIdentityServerPPFacadeWebSite</literal>,
+ <literal>sunIdentityServerPPInformalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityAltIdValue</literal>,
+ <literal>sunIdentityServerPPLegalIdentityDOB</literal>,
+ <literal>sunIdentityServerPPLegalIdentityGender</literal>,
+ <literal>sunIdentityServerPPLegalIdentityLegalName</literal>,
+ <literal>sunIdentityServerPPLegalIdentityMaritalStatus</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdType</literal>,
+ <literal>sunIdentityServerPPLegalIdentityVATIdValue</literal>,
+ <literal>sunIdentityServerPPMsgContact</literal>,
+ <literal>sunIdentityServerPPSignKey</literal>,
+ <literal>telephoneNumber</literal>,
+ <literal>uid</literal>,
+ <literal>userCertificate</literal>,
+ <literal>userPassword</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Create User Attribute Mapping</term>
+ <listitem>
+ <para>
+ When creating a user profile,
+ apply this map of OpenAM profile attribute names
+ to directory server attribute names.
+ </para>
+
+ <para>
+ Attributes not mapped to another attribute
+ (for example, <literal>cn</literal>)
+ and attributes mapped to themselves
+ (for example, <literal>cn=cn</literal>)
+ take the value of the username
+ unless the attribute values are provided when creating the profile.
+ The object classes for user profile LDAP entries
+ generally require Common Name (cn) and Surname (sn) attributes,
+ so this prevents an LDAP constraint violation
+ when performing the add operation.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-createuser-attr-mapping</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>, <literal>sn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of User Status</term>
+ <listitem>
+ <para>
+ Attribute to check/set user status
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-isactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>inetuserstatus</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Active Value</term>
+ <listitem>
+ <para>
+ Active users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-active</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Active</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>User Status Inactive Value</term>
+ <listitem>
+ <para>
+ Inactive users have the user status attribute set to this value.
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-inactive</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>Inactive</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Authentication Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute for building the bind DN when given a username and password
+ to authenticate a user against the directory server
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-auth-naming-attr</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Attribute</term>
+ <listitem>
+ <para>
+ When searching for a group by name, match values against this attribute
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-attribute</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Search Filter</term>
+ <listitem>
+ <para>
+ When searching for groups, apply this LDAP search filter as well
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-groups-search-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=groupOfNames)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Naming Attribute</term>
+ <listitem>
+ <para>
+ RDN attribute of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-name</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Container Value</term>
+ <listitem>
+ <para>
+ RDN attribute value of the LDAP base DN which contains group profiles
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-container-value</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Object Class</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP object classes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-objectclass</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>groupofnames</literal>, <literal>top</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>LDAP Groups Attributes</term>
+ <listitem>
+ <para>
+ Group profiles have these LDAP attributes
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-group-attributes</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>cn</literal>,
+ <literal>description</literal>,
+ <literal>dn</literal>,
+ <literal>member</literal>,
+ <literal>objectclass</literal>,
+ <literal>ou</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name for Group Membership</term>
+ <listitem>
+ <para>
+ LDAP attribute in the member's LDAP entry
+ whose values are the groups to which a member belongs
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-memberof</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Attribute Name of Unique Member</term>
+ <listitem>
+ <para>
+ Attribute in the group's LDAP entry
+ whose values are the members of the group
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-uniquemember</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>member</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Default Group Member's User DN</term>
+ <listitem>
+ <para>
+ DN of member added to all newly created groups
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-dftgroupmember</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Base DN</term>
+ <listitem>
+ <para>
+ Base DN for LDAP persistent searches used
+ to receive notification of changes in directory server data
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearchbase</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal><replaceable>base-dn</replaceable></literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Filter</term>
+ <listitem>
+ <para>
+ LDAP filter to apply when performing persistent searches
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-filter</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>(objectclass=*)</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Persistent Search Scope</term>
+ <listitem>
+ <para>
+ LDAP searches can apply to a single entry (SCOPE_BASE),
+ entries directly below the search DN (SCOPE_ONE),
+ or all entries below the search DN (SEARCH_SUB)
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-config-psearch-scope</literal>
+ </para>
+
+ <para>
+ Default:
+ <literal>SCOPE_SUB</literal>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>The Delay Time Between Retries</term>
+ <listitem>
+ <para>
+ How long to wait after receiving an error result
+ that indicates OpenAM should try the LDAP operation again
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>com.iplanet.am.ldap.connection.delay.between.retries</literal>
+ </para>
+
+ <para>
+ Default:
+ 1000 milliseconds
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Enabled</term>
+ <listitem>
+ <para>
+ Whether to enable the DN cache, which is used to cache DN lookups
+ that can happen in bursts during authentication.
+ As the cache can become stale when a user is moved or renamed,
+ enable DN caching when the directory service allows move/rename operations (Mod \
DN), + and when OpenAM uses persistent searches to obtain notification of such \
updates. + </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-enabled</literal>
+ </para>
+
+ <para>
+ Default:
+ true
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>DN Cache Size</term>
+ <listitem>
+ <para>
+ Maximum number of DNs cached when caching is enabled
+ </para>
+
+ <para>
+ <command>ssoadm</command> attribute:
+ <literal>sun-idrepo-ldapv3-dncache-size</literal>
+ </para>
+
+ <para>
+ Default:
+ 1500 items
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+</section>
</ins></span></pre>
</div>
</div>
<div id="footer">Copyright (c) by ForgeRock. All rights reserved.</div>
</body>
</html>
_______________________________________________
CommitOpenAM mailing list
CommitOpenAM@forgerock.org
https://lists.forgerock.org/mailman/listinfo/commitopenam
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic