Changes between Version 1 and Version 2 of LDAPInstall

Timestamp:

06/02/13 07:17:58 (11 years ago)

Author:

uaguest_SPatel1@…

Comment:

--

LDAPInstall

@@ -66 +66 @@
 Directory Server must be restarted for changes to take effect.
 }}}
+
+
+10.  Restart directory
+
+{{{
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsadm restart /srv/servers/slapd-grouper-test
+Directory Server instance '/srv/servers/slapd-grouper-test' stopped
+Directory Server instance '/srv/servers/slapd-grouper-test' started: pid=17197
+}}}
+
+11.  Check config
+
+{{{
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsadm info /srv/servers/slapd-grouper-test/
+Instance Path:     /srv/servers/slapd-grouper-test
+Owner:             oracle(oinstall)
+Non-secure port:   1389
+Secure port:       1636
+Bit format:        64-bit
+State:             Running
+Server PID:        17197
+DSCC url:          -
+Instance version:  D-A30
+}}}
+
+12.  Set server properties.   This is based on existing UA documentation the production directory servers.
+
+{{{
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 look-through-limit:unlimited
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-check-enabled:on
+Enter "cn=Directory Manager" password:
+Enabling "pwd-check-enabled" property automatically sets the value of "pwd-accept-hashed-pwd-enabled" property to "off".
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-lockout-duration:30m
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-lockout-enabled:on
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-max-age:57w1d
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-max-failure-count:5
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-max-history-count:5
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-min-length:8
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-must-change-enabled:off
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-root-dn-bypass-enabled:on
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 pwd-user-change-enabled:off
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$
+[oracle@grinnell ~]$  /srv/dsee7/bin/dsconf set-server-prop -p 1389 search-size-limit:unlimited
+Enter "cn=Directory Manager" password:
+}}}
+
+13.  Copy production schema.  (Assume that grinnell has a copy of the production "config" directory located at /srv/tmp/config.)
+
+{{{
+mv /srv/servers/slapd-grouper-test/config/schema/99user.ldif /srv/tmp/99user.ldif.orig
+cp /srv/tmp/config/schema/99user.ldif /srv/servers/slapd-grouper-test/config/schema/
+chown oracle:oinstall /srv/servers/slapd-grouper-test/config/schema/99user.ldif
+}}}
+
+14.  Configure attribute uniqueness plugin.
+
+{{{
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf create-plugin -p 1389 -H /srv/dsee7/lib64/uid-plugin.so -F NSUniqueAttr_Init -Y preoperation "ARSCSystemID Uniqueness"
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf set-plugin-prop -p 1389 "ARSCSystemID Uniqueness" desc:"Enforce unique attribute values..." version:7.0 vendor:"Sun Microsystems, Inc." depends-on-type:database
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf enable-plugin -p 1389 "ARSCSystemID Uniqueness"
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf set-plugin-prop -p 1389 "ARSCSystemID Uniqueness" argument:"ARSCSystemID" argument:"dc=alaska,dc=edu"
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf create-plugin -p 1389 -H /srv/dsee7/lib64/uid-plugin.so -F NSUniqueAttr_Init -Y preoperation "UASystemID Uniqueness"
+Enter "cn=Directory Manager" password:
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf set-plugin-prop -p 1389 "UASystemID Uniqueness" desc:"Enforce unique attribute values..." version:7.0 vendor:"Sun Microsystems, Inc." depends-on-type:database
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf enable-plugin -p 1389 "UASystemID Uniqueness"
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsconf set-plugin-prop -p 1389 "UASystemID Uniqueness" argument:"UASystemID" argument:"dc=alaska,dc=edu"
+Enter "cn=Directory Manager" password:
+Directory Server must be restarted for changes to take effect.
+
+
+[oracle@grinnell ~]$ /srv/dsee7/bin/dsadm restart /srv/servers/slapd-grouper-test    
+Directory Server instance '/srv/servers/slapd-grouper-test' stopped
+Directory Server instance '/srv/servers/slapd-grouper-test' started: pid=27485
+}}}
+
+15.  The top of the dse.ldif file contains ACIs.  Copy the ACIs from the production dse.ldif file to the dse.ldif file on grinnell at /srv/servers/slapd-grouper-test/config/dse.ldif.
+
+{{{
+aci: (targetattr != "aci") (targetscope = "base") (version 3.0;  aci "Enable r
+ ead access to rootdse for anonymous users";  allow(read,search,compare) user
+ dn="ldap:///anyone"; )
+aci: (targetattr = "*") (version 3.0;  acl "Enable full access for Administrat
+ ors group";  allow (all)(groupdn = "ldap:///cn=Administrators,cn=config"); )
+aci: (targetattr = "userPassword") ( version 3.0; acl "allow userpassword self
+  modification";  allow (write) userdn = "ldap:///self";)
+aci: (targetattr = "*") (version 3.0; acl "Enable full access for Directory Se
+ rvices Managers"; allow (all)(userdn = "ldap:///cn=*,cn=Administrators,cn=ds
+ cc");)
+aci: (targetattr = "aci") (targetscope = "base") (version 3.0; acl "Enable roo
+ t ACI modification by Directory Services Managers"; allow (all)(userdn = "ld
+ ap:///cn=*,cn=Administrators,cn=dscc");)
+}}}