Thursday Dec 03, 2009

Experimenting defensive publication

[Read More]

Tuesday Dec 01, 2009

DPS and OutLook address lookup

Outlook LDAP address lookup requires VLV and companion Server Side Sorting controls. If these controls are blocked by DPS, you may get errors messages like "The server is not configured to pass through control 1.2.840.113556.1.4.473" or "The server is not configured to pass through control 2.16.840.1.113730.3.4.9"

To enable control pass-thru in DPS, use

dpconf set-server-prop [...] allowed-ldap-controls:vlv-request \\

Tuesday Nov 17, 2009

DSEE 7.0 has been released and is available for download

Sun Directory Server Entreprise Edition 7.0 aka DSEE 7.0 has just been released today and is available for download at

Wednesday Sep 30, 2009

JDBC URLs with Oracle database

The JDBC URL structure indicated in the DPS doc set to access ORACLE databases is wrong somehow: Referring to the DPS admin guide, the db-url is in the form jdbc:vendor:driver://dbhost:dbport.

A correct db-url for Oracle is jdbc:oracle:thin:@localhost:1521:

Using "//" instead of "@" may lead to errors similar to the one below:

Snipplet from the Oracle EX logs:
28-SEP-2009 12:12:52 \*
(CONNECT_DATA=(SID=orcl)(CID=(PROGRAM=)(HOST=__jdbc__)(USER=))) \*
(ADDRESS=(PROTOCOL=tcp)(HOST= \* establish \* orcl
\* 12505
TNS-12505: TNS:listener does not currently know of SID given in connect

Wednesday Sep 02, 2009

Using DB/2 JDBC driver with DPS

The IBM DB/2 jdbc driver db2jcc.jar has a accompanying license file called db2jcc_license_cu.jar.

Both jar files must be part of the DPS java environment. If you don't, you'll get errors similars to "cannot connect to JDBC datasource .....  license is not present". To provide both jar files (driver and license), use dpconf command as follow:

$ dpconf create-jdbc-data-source -b sample -B jdbc:db2://hostname:50000/ -J file:/path/to/db2jcc_license_cu.jar -J file:/path/to/db2jcc.jar -S db2-source

Corresponding LDIF entry in the proxy configuration file looks like that:

dn: cn=db2-source,cn=data sources,cn=config
dbUrl: jdbc:db2://hostname.domain:50000/
objectClass: top
objectClass: configEntry
objectClass: dataSource
objectClass: jdbcDataSource
jarUrl: file:/usr/ds/sberthol/db2/etc/db2jcc.jar
jarUrl: file:/usr/ds/sberthol/db2/etc/db2jcc_license_cu.jar
dbName: sample
cn: db2-source
enabled: true
dbPassword: {3DES}3r1CipqhECC5E4JOLE8geyV3G9e9+QIq
dbUser: db2inst1

Monday May 04, 2009

Directory Master Event 09 in New Jersey

Last week, I attended the Sun Directory Master Conference in SomerSet, NewJersey.

I gave a presentation about the next major revision of Sun Directory Proxy Server 7.0.
It was also a unique opportunity to meet with Sun Partners and discuss Identity and Directory deployments. 

Friday Feb 27, 2009

cn=Directory Manager access through the proxy

Many DPS users reported the following problem: Bind requests as cn=Directory Manager fails when the proxy is deployed.

DPS analyses the bind dn to route the request to the data view holding the target dn. In many configuration, there is no data view candidate configured to hold the cn=directory manager suffix.

There are 2 ways to address the problem: Either create a additional data view with view base set to "cn=directory manager" or use "implicit" routing with a data view with an empty ("") view base. The latter solution is simple and also user-friendly in the sense the proxy does not need to know about the list of suffixes exposed by the directory.  Note that a "root data view" with empty dn is created by default when a DPS instance is created, but the data source pool associated with it is left empty, so if you plan to use it, don't forget to add at least one data source to that pool.

Friday Jan 23, 2009

Fail-over based on the directory server operational state

DPS 6.x load-balancing / fail-over can be configured to stop sending traffic to a specific directory server instance in maintenance, even when that instance is up and running. For instance, you may want to remove a directory server instance from the mesh while an import or re index is in progress.

DPS 6.x periodically checks each ds server for availability by issuing (amongst others) a search request. A directory server instance is considered unreachable when that search fails or does not return any entry. By default, the search request hits the rootDSE entry. It can be configured to hit an entry in cn=config or cn=monitor to take into account the directory server operation state.

For more info, look at dpconf properties monitoring-search-filter and monitoring-entry-dn in the ldap data source object.

Friday Dec 19, 2008

DIT changes with dn virtual transformations

Here is a summary of a common deployment scenario with Sun Directory Proxy Server:

LDAP entries are grouped by location in the DIT, e.g user entries are located under ou=north,ou=people,dc=company, dc=com or  ou=south,ou=people,dc=company, dc=com or ou=east,ou=people,dc=company, dc=com or ou=west,ou=people,dc=company, dc=com based on user physical location.

Later, for sake of simplicity, the DIT is flatten so that every user entry is stored immediatly under ou=people, dc=company, dc=com

New applications are aware of the DIT structure change but DPS is used so that legacy applications expecting the location container node can operate w/o problem.

The dn mapping needed can be achieved by using virtual data transformations as described  in

Let's assume that
- you have a data view DV1 with viewBase (suffix) set to dc=company,dc=com.
- entry location (north, east,...) is always available in each entry in attribute 'location'
- entry uid=\*,ou=(north|south|east|west),ou=people,dc=company,dc=com mapped to uid=\*,ou=people,dc=company,dc=com

You have to create a virtual data transformation on the 'dn' for data view DV1. For inbound traffic (requests), the proxy must get rid of the ou=(north|south|east|west) node. For outbound traffic (responses), the proxy gerenates a (fake) ou=(north|south|east|west)  from the content of the 'location' attribute of each entry.

Here is the dpconf command to do that:

dpconf add-virtual-transformation -h <host> -p <port> -d <proxy manager> DV1 mapping attr-value-mapping dn internal-value:uid=\\${uid},ou=people view-value:uid=\\${uid},ou=\\${location},ou=people

Note: you might have to escape some characters (e.g $) in the command below depending on the command interpreter you are using. In the example above, I used \\$ instead of plain $.
Note2: dn patterns used in virtual transformations must not contain the data view viewBase (dc=company,dc=com in this case) as it is implicit.

Wednesday Sep 10, 2008

RootDSE entry management with DPS 6.x

By default, the rootDSE entry is managed/returned by the directory proxy itself and reflect proxy LDAP capabilities. Such behaviour is mandatory whenever virtualization is in use so that underlying data layout is hidden from the client applications.

In some specific cases, it might be interesting to configure DPS to fetch the rootDSE entry from the directory server(s) itself. Here is the procedure:
1- Create a data view (rootDSE) with view base set to "" and associate a data source pool containing the directory servers holding the rootDSE entry to be returned.
2- Change the DPS routing policy to manual.
3- Make sure the rootDSE exclusion base property do not contain "". If so, remove that value.

At that point, requests to rootDSE are redirected to the rootDSE data view.

Notice: If multiple directory servers are associated with the rootDSE data view, make sure they have identical rootDSE entries otherwise the rootDSE entry returned to clients may vary over time because of the load-balancing policy. This is likely to confuse client applications. There might be also a mismatch between rootDSE content and proxy capabilities (e.g supported extended operations or supported LDAP controls), so make sure to change the proxy configuration (e.g list of forwarded controls) to reflect the rootDSE entry content.

My name is Sylvain Duloutre, I worked as a Software Architect in the Oracle Directory Integration Team, the customer-facing part of Directory Services & Identity Management Product Development, working on Technical Field Enablement and Solutions Architecture.

The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.

A mirror of this blog is available on Wordpress here.


« February 2017