9 Managing System Configuration Attributes

9.1.1 What are Configuration Attributes?

Most Oracle Internet Directory configuration information is stored in the directory itself. The information is stored as attributes of specific configuration entries. You must have superuser privileges to set system configuration attributes.

Some configuration attributes are specific to an individual instance of the Oracle Internet Directory server. Instance-specific attributes are located in the instance-specific configuration entry, a specific subentry of the Oracle Internet Directory instance entry. Figure 8-1, "DIT Showing Two Instance-Specific Configuration Entries" show s the location of these entries in the DIT.

Some configuration attributes are shared by all Oracle Internet Directory server instances in a WebLogic Server domain that are connected to the same database. Shared attributes reside in the DSA Configuration entry. Replication-specific attributes reside in the Replica Subentry, Replication Configuration, and Replication Agreement Entry.

Some attributes reside in the DSE Root. Most of those are non-configurable.

You can manage all the configuration attributes from the command-line. In addition, many of the configuration attributes have specific, task-oriented management interfaces in Oracle Enterprise Manager Fusion Middleware Control or Oracle Directory Services Manager. You can also use the Data Browser feature of Oracle Directory Services Manager to manage the entries directly.

9.1.2 Attributes of the Instance-Specific Configuration Entry

During installation, Oracle Identity Management 11g Installer creates an instance-specific configuration entry for the first Oracle Internet Directory instance. It copies default values from a read-only entry under cn=configset0. (You can specify different values for the SSL port and non-SSL during the install.)

The DN of an instance-specific configuration entry has the form:

cn=componentname,cn=osdldapd,cn=subconfigsubentry

For example, if the component name for a server instance is oid1,then the DIT of the instance-specific configuration entry would be:

cn=oid1,cn=osdldapd,cn=subconfigsubentry

Table 9-1 lists the attributes of the instance-specific configuration entry. In the Update Mechanism column, EM refers to Oracle Enterprise Manager Fusion Middleware Control and LDAP refers to the LDAP command-line tools. See "Managing System Configuration Attributes by Using Oracle Enterprise Manager Fusion Middleware Control" and "Managing System Configuration Attributes by Using LDAP Tools".

Authentication.SUCCESSESONLY,
Authorization(Permission -eq 'CSFPerfmission") 

cn=orcladmin.

9.1.3 Attributes of the DSA Configuration Entry

The DSA configuration entry has the DN:

cn=dsaconfig,cn=configsets,cn=oracle internet directory

Table 9-2 shows shared attributes in the DSA configuration entry. In the Update Mechanism column, EM refers to Oracle Enterprise Manager Fusion Middleware Control and LDAP refers to the LDAP command-line tools. See "Managing System Configuration Attributes by Using Oracle Enterprise Manager Fusion Middleware Control" and "Managing System Configuration Attributes by Using LDAP Tools".

9.1.4 Attributes of the DSE

The DSA-specific entry (DSE) is the root of the DIT. This is where Oracle Internet Directory publishes information about itself, such as naming contexts, supported controls, and matching rules. Most attributes of the DSE should not be modified directly. Some attributes that you might need to modify are listed in Table 9-3.

9.2.1 Configuring Server Properties

You can configure most of the attributes in the instance-specific configuration entry by using the Oracle Internet Directory Server Properties pages of Fusion Middleware Control., as follows:

1. Select Administration, then Server Properties from the Oracle Internet Directory menu.

2. Select General, Performance, SASL, Statistics, or Logging, depending on which parameters you want to configure.

3. After changing the configuration, choose Apply.

The correspondence between server properties and configuration attributes on the General tab of the Server Properties page is shown in Table 9-4.

General

After changing orclnonsslport or orclsslport, restart the server and run opmnctl updatecomponentregistration, as described in "Updating the Component Registration of an Oracle Instance by Using opmnctl".

Performance

The correspondence between server properties and configuration attributes on the Performance tab of the Server Properties page is shown in Table 33-7, "Configuration Attributes on Server Properties Page, Performance Tab"

SASL

The correspondence between server properties and configuration attributes on the SASL tab of the Server Properties page is shown in Table 31-1, "Configuration Attributes on Server Properties, SASL Tab".

Statistics

The correspondence between server properties and configuration attributes on the Statistics tab of the Server Properties page is shown in Table 23-2, "Configuration Attributes on Server Properties Page, Statistics Tab".

Logging

The correspondence between server properties and configuration attributes on the Logging tab of the Server Properties page is shown in Table 22-2, "Configuration Attributes on Server Properties Page, Logging Tab".

9.2.2 Configuring Shared Properties

You can configure some of the shared system configuration attributes in the DSA configuration entry by using the Oracle Internet Directory Shared Properties page of Fusion Middleware Control. Select Administration, then Shared Properties, then select General, Change Superuser Password, or Replication from the Oracle Internet Directory menu. After changing the configuration, choose Apply. The correspondence is as follows:

General

A server restart is recommended after changing orclskiprefinsql or orclskewedattribute.

Change Superuser Password

See "Changing the Superuser Password by Using Fusion Middleware Control".

Replication

Replication-related attributes are described in Chapter 39, "Managing Replication Configuration Attributes." See "Configuring Attributes on the Shared Properties, Replication Tab"

9.2.3 Configuring Other Parameters

You can configure SSL parameters by using the Oracle Internet Directory SSL Configuration Page. See "Configuring SSL by Using Fusion Middleware Control". You must restart the server for SSL configuration changes to take effect.

You can configure Audit attributes by using the Oracle Internet Directory Audit Policy Settings page. See "Managing Auditing by Using Fusion Middleware Control".

9.4.1 Setting System Configuration Attributes by Using ldapmodify

You can modify most attributes in Table 9-1, Table 9-2, and Table 9-3 by using the command-line:

ldapmodify -D cn=orcladmin -q -p portNum -h hostname -f ldifFile 

The contents of the LDIF file depends on the DN and the operation being performed.

The LDIF file for changing the value of the orclgeneratechangelog attribute in the instance-specific entry to 1 would be:

dn: cn=componentname,cn=osdldapd,cn=subconfigsubentry
changetype: modify
modify: orclgeneratechangelog
orclgeneratechangelog: 1

The LDIF file for adding the orclinmemfiltprocess attribute to the DSA configuration entry would be:

dn: cn=dsaconfig, cn=configsets, cn=oracle internet directory
changetype: modify
add: orclinmemfiltprocess
orclinmemfiltprocess: (objectclass=inetorgperson)(orclisenabled=TRUE)

For more examples, see "Modifying Performance-Related System Configuration Attributes by Using ldapmodify".

The "Oracle Identity Management LDAP Attribute Reference" in Oracle Fusion Middleware User Reference for Oracle Identity Management describes the modifiable system configuration attributes.

9.4.2 Listing Configuration Attributes with ldapsearch

You can use ldapsearch to list most attributes.

Instance-Specific Configuration Entry

If the component name for a server instance is oid1,then you can list the attributes in the instance-specific configuration entry with a command line such as:

ldapsearch -p 3060 -h myhost.example.com -D cn=orcladmin -q \
   -b "cn=oid1,cn=osdldapd,cn=subconfigsubentry" -s base "objectclass=*"

DSA Configuration Entry

You can list the attributes with the command line:

ldapsearch -p 3060 -h myhost.example.com -D cn=orcladmin -q \
   -b "cn=dsaconfig,cn=configsets,cn=oracle internet directory" \
   -s base "objectclass=*"

DSE

You can list the attributes with the command line:

ldapsearch -p 3060 -h myhost.example.com  -D cn=orcladmin -q \
    -b "" -s base "objectclass=*" 

9.5.1 Navigating to the Instance-Specific Configuration Entry

On the Data Browser tab, in the navigation tree, expand subconfigsubentry, then osdldapd. Then select the name of the Oracle Internet Directory component you want to manage.

9.5.2 Navigating to the DSA Configuration Entry

In ODSM, you cannot navigate to the DSA configuration entry directly in the data tree, but you can get to it by using an advanced search., as follows

1. On the Data Browser tab, click Advanced.

2. Set Root of the Search to cn=dsaconfig,cn=configsets,cn=oracle internet directory.

3. Select a Search Depth value of Base.

4. Under Search Criteria select the attribute objectclass and the criterion Present.

5. Select Show LDAP Filter. Confirm that the LDAP Query is (objectClass=*).

6. Click Search.

   The dsaconfig entry appears under Search Results.

9.5.3 Navigating to the DSE Root

On the Data Browser tab, click Root in the navigation tree to select the DSE.