Configuring the Virtual Directory

Edit online

You can configure the Virtual Directory by using the command line.

Before you begin

Ensure that you meet the following requirements before you start to configure the Virtual Directory.
  • The Virtual Directory feature is available only in IBM® Verify Directory, Enterprise Edition.
  • Ensure that the IBM Verify Directory srvfdproxy package is installed on the system.
  • Create an instance of the Virtual Directory by using the idsicrt command.
  • Start the server in Configuration Only mode by using the command ibmslapd -a.
  • If you require attributes that are not a part of the standard schema of the Virtual Directory, then such attributes must be added to the custom schema.

About this task

The Virtual Directory configuration consists of clusters that have servers or endpoints. Each cluster denotes a backend suffix that is mapped to a Virtual Directory suffix.

This topic provides information about high-level activities to configure the Virtual Directory by using the command line. Examples that are provided in each of the following activities include the corresponding stanzas that must be configured.

Procedure

  • Add a cluster. Run the following command:
    idsldapadd -D cn=root -w root -h Hostname -p port_number
    A sample stanza:
    dn: cn=Cluster_New, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: Cluster_New
ibm-slapdFDProxyAttrMap: title $ title $ sensitive
ibm-slapdFDProxyAttrMap: cn $ cn $ normal
ibm-slapdFDProxyAttrMap: uid $ uid $ normal
ibm-slapdFDProxyAttrMap: ou $ ou $ normal
ibm-slapdFDProxyAttrMap: sn $ sn $ sensitive
ibm-slapdFDProxyAttrMap: description $ description $ normal
ibm-slapdFDProxyAttrMap: dn $ dn $ normal
ibm-slapdFDProxyAttrMap: userpassword $ userpassword $ critical
ibm-slapdFDProxyAttrMap: telephonenumber $ telephonenumber $ sensitive
ibm-slapdFDProxyAttrMap: uniquemember $ uniquemember $ sensitive
ibm-slapdFDProxyAttrMap: jpegphoto $ jpegphoto $ normal
ibm-slapdFDProxyAttrMap: ibm-pwdIndividualPolicyDN $ ibm-pwdIndividualPolicyDN $ normal
ibm-slapdFDProxyAttrMap: objectclass $ objectclass $ normal
ibm-slapdFDProxyAttrMap: member $ member $ normal
ibm-slapdFDProxyAttrMap: roleOccupant $ roleOccupant $ sensitive
ibm-slapdFDProxyAttrMap: ibm-memberGroup $ ibm-memberGroup $ normal
ibm-slapdFDProxyAttrMap: memberURL  $ memberURL $ normal
ibm-slapdFDProxyBackendPriority: 1
ibm-slapdFDProxyBackendServerVendor: OpenLdap
ibm-slapdFDProxyBackendSuffix: dc=example, dc=com
ibm-slapdFDProxyServerDN: cn=Server2, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
ibm-slapdFDProxySuffix: o=OL
objectClass: top
objectClass: ibm-slapdFDProxyBackendServerGroup
objectClass: ibm-slapdConfigEntry
    Note: The following values are supported for the ibm-slapdFDProxyBackendServerVendor entry:
    • ActiveDirectory
    • SecurityDirectoryServer
    • SunDirectory
    • OpenLDAP
    • CustomLDAP
  • Add endpoints or servers for a cluster that is defined in the previous step.
    To add endpoints or servers, run the following command:
    idsldapadd -D cn=root -w root -h Hostname -p port_number
    Sample stanza:
    dn: cn=Server2, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: Server2
ibm-slapdFDProxyBackendRole: Any
ibm-slapdFDProxyTimeout: 5000
ibm-slapdProxyBindMethod: Simple
ibm-slapdProxyConnectionPoolSize: 1
ibm-slapdProxyDN: cn=root
ibm-slapdProxyHealthCheckOlimit: 24
ibm-slapdProxyPW: backend_server_password
ibm-slapdProxyTargetURL: ldaps://hostname:port
ibm-slapdSslCertificate: AD_Server
ibm-slapdSSLKeyDatabase: path_directory_certificates/serverc.kdb
ibm-slapdSSLKeyDatabasePW: kdb_password
objectClass: top
objectClass: ibm-slapdFDProxyBackendServer
objectClass: ibm-slapdConfigEntry
  • Configure or add authorization users for the Virtual Directory. Run the following command: 
    idsldapadd -D cn=root -w root -h Hostname -p port_number
    Sample stanzas:
    dn: cn=FDProxyUser1, cn=Authorization, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: FDProxyUser1
ibm-slapdFDProxyAdminDN: cn=Admin1
ibm-slapdFDProxyAdminPW: admin_password
ibm-slapdFDProxyAdminRole: Administrator
objectClass: top
objectClass: ibm-slapdFDProxyAuthorization
objectClass: ibm-slapdConfigEntry

dn: cn=FDProxyUser2, cn=Authorization, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: FDProxyUser2
ibm-slapdFDProxyAdminDN: cn=admin2
ibm-slapdFDProxyAdminPW: admin_password
ibm-slapdFDProxyAdminRole: Reader
objectClass: top
objectClass: ibm-slapdFDProxyAuthorization
objectClass: ibm-slapdConfigEntry

dn: cn=FDProxyUser3, cn=Authorization, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: FDProxyUser3
ibm-slapdFDProxyAdminDN: cn=admin3
ibm-slapdFDProxyAdminPW: admin_password
ibm-slapdFDProxyAdminRole: Writer
objectClass: top
objectClass: ibm-slapdFDProxyAuthorization
objectClass: ibm-slapdConfigEntry
  • Modify the Virtual Directory parent stanza to include the Virtual Directory specific suffixes. Run the following command: 
    idsldapmodify -D cn=root -w root -h Hostname -p port_number
    Sample stanza:
    dn: cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
changetype: modify
add: ibm-slapdSuffix
ibm-slapdSuffix: dc=example, dc=com
  • Enable the unique attribute authentication.
    Run the following command:
    idsldapmodify -D cn=root -w root -h Hostname -p port_number
    Sample stanza:
    dn: cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
changetype: modify
replace: ibm-slapdFDProxyEnableUniqueAttrAuth
ibm-slapdFDProxyEnableUniqueAttrAuth: true
    After unique attribute authentication is enabled, a user must add the attribute ibm-slapdFDProxyBackendUniqueAttr in each cluster stanza and set the value for the attribute ibm-slapdFDProxyBackendPriority in each cluster stanza.
    • Add the attribute ibm-slapdFDProxyBackendUniqueAttr in each cluster stanza.
      Run the following command:
      idsldapmodify -D cn=root -w root -h Hostname -p port_number
      Sample stanza:
      dn: cn=Cluster_LDAP1, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration 
changetype: modify
add: ibm-slapdFDProxyBackendUniqueAttr
ibm-slapdFDProxyBackendUniqueAttr: any_unique_attribute_such_as_email
    • Ensure that ibm-slapdFDProxyBackendPriority is set in each cluster stanza.
      Run the following command to search whether the ibm-slapdFDProxyBackendPriority exists in each cluster stanza or not.
      idsldapsearch -D cn=root -w root -h Hostname -s base -b 
" cn=Cluster_LDAP1, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration" 
objectclass=* ibm-slapdFDProxyBackendPriorityidsldapmodify
      If the ibm-slapdFDProxyBackendPriority is set, then the search operation might return similar output.
      idsldapsearch -D cn=root -w root -h Hostname -s base -b 
"cn=Cluster_LDAP1, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration" 
objectclass=* ibm-slapdFDProxyBackendPriorityidsldapmodify
cn=Cluster_LDAP1, cn=FDProxyDB, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
ibm-slapdFDProxyBackendPriority=1

What to do next

Restart the Directory Server by using the following commands.
ibmslapd -k
ibmslapd -n -t