Known limitations in the Virtual Directory

Edit online

The topic provides information about known limitations in the Virtual Directory.

Unsupported controls

The Virtual Directory does not support controls that are related to the display of the result set, which is returned from the backend server. For example, the following controls are not supported:
Table 1. Unsupported controls
Control Name Object Identifier (OID)
Sorted search results control 1.2.840.113556.1.4.473
Persistent search control 2.16.840.1.113730.3.4.3
Paged search results control 1.2.840.113556.1.4.319
AES bind control 1.3.18.0.2.10.28
Group authorization control 1.3.18.0.2.10.21
Proxy authorization control 2.16.840.1.113730.3.4.18
Return deleted objects control. 1.3.18.0.2.10.33
Virtual list view control 2.16.840.1.113730.3.4.9
Note:
  • If a critical control is sent to the Virtual Directory that is not supported by the backend server, then an error message is displayed.
  • The Virtual Directory does not support replication-related controls.

Unsupported attributes

The Virtual Directory does not support the following attributes. For more information about attributes, see LDAP_SEARCH.
  • +ibmaci
  • +ibmentry && ++ibmentry
  • +ibmpwdpolicy
  • +ibmrepl & ++ibmrepl
  • ibm-allgroups
  • ibm-allmembers

Password policy applicability

If the connection from the Virtual Directory to the backend server is established as a root or admin user, the password policies that are at the backend server are not applied.

Backend server user unable to perform NULL search in the Virtual Directory

Even after a successful bind operation by a backend server user, a NULL search operation cannot be performed in the Virtual Directory. According to the Virtual Directory authorization, a backend server user has limited access, which is restricted to its own entry and only to the normal attributes that are mapped in the Virtual Directory. Therefore, a backend server user is unauthorized to perform a NULL search operation in the Virtual Directory.

Attribute name that contains underscore (_) is not supported

Do not use attribute names that contain an underscore (_) in it because when such attribute names appear in the RDN, it can fail RDN validation.

However, attribute values have no such limitation.

Web Administration Tool not supported

The Virtual Directory does not support the Web Administration Tool. You cannot perform any of the Virtual Directory features by using Web Administration Tool.

idsxinst not supported

The Virtual Directory cannot be configured by using the idsxinst command. The idsicrt command-line utility must be used to configure the Virtual Directory.

Limitation about ROOT DSE search with ibm-supportedcapabilities and ibm-enabledcapabilities

A ROOT DSE search with ibm-supportedcapabilities and ibm-enabledcapabilities might display a few capabilities that are not supported by the Virtual Directory, or capabilities that are not related to the Virtual Directory.

Limitation about anonymous bind for LDAP operations

Anonymous bind for LDAP operations that are performed on the Virtual Directory are not supported.

Limitation about administrative users

Administrative users such as a local administrator or configuration administrator are not supported. Use the Virtual Directory administrative users. For more information, see Authorization.