Chapter 5. Managing directory attributes and values

Procedure

1. Open the LDAP Browser menu to reveal the list of existing suffixes.
2. Using the Tree or Table view, expand the parent entry ou=people,dc=example,dc=com under which you want to create a user.

3. Click the Options menu (⋮) and select New to open the wizard window.

   
4. Select the Create a new User option and click Next.
5. For the user entry, select Posix Account type and click Next.

6. Optional: Select additional attributes, such as userPassword, and click Next. You can view all selected attributes by expanding the drop-down list near the step name.

   

7. Set a value for each attribute:

   1. Click on the pencil button of the attribute and add a value.

      

      Note that a separate menu opens when you set the userPassword value. The value is filled with asterisks (*) to hide the plain text.

   2. Click on the check button to save changes.
   3. Optional: Set an additional attribute value by clicking the Options menu (⋮) Add Another Value.
   4. After you have set all values, click Next.
8. Verify that all entry details are correct and click Create User. Directory Server creates the entry with mandatory attributes for a POSIX user and sets the password to it. You can click Back to modify entry settings, or click Cancel to cancel the entry creation.
9. View the Result for Entry Creation and click Finish.

Verification

1. Navigate to LDAP Browser Search.
2. Select the database suffix that contains the entry, such as dc=example,cd=com.
3. Enter your search criteria in the field, such as John, and press Enter.
4. Find the entry you recently created in the list of entries.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to edit, such as cn=John Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Edit to open the wizard window.
4. Optional: In the Select ObjectClasses step, add or delete object classes for the entry. Click Next.

5. In the Select Attributes step, add telephoneNumber and mail attributes to the entry and click Next. If you do not see an attribute you want to add to the entry it means that you did not add corresponding object class in the previous step.

   Note

   In this step, you can not delete mandatory attributes of the selected object classes.

6. In the Edit Attribute Values step, set telephoneNumber to 556778987 and 556897445, mail to jsmith@example.com and change userPassword value:

   1. Click on the pencil button of the attribute and add or change a new value.
   2. Click on the check button to save changes.
   3. Optional: Set an additional value to an attribute by clicking the Options menu (⋮) Add Another Value. The telephoneNumber attribute has two values in this example. When you set all values, click Next.
7. Review your changes and click Next.
8. To edit the entry, click Modify Entry. You can click Back to make other changes to the entry, or click Cancel to cancel the entry editing.
9. View the Result for Entry Modification and click Finish.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to modify, such as cn=John Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Rename to open the wizard window.

4. In the Select The Naming Attribute And Value step:

   1. Set a new value Tom Smith for the naming attribute cn and click Next.
   2. Optional: Select another naming attribute from the drop-down menu.
   3. Optional: In case you want to delete the old entry and create a new one using the new RDN, check the Delete the old RDN.
5. In Select The Entry Location step, select the parent entry for the new location, and click Next.
6. Review changes you made to the entry and click Next.
7. If the entry details are correct, click Change Entry Name. You can click Back to make other changes to the entry or click Cancel to cancel the entry modification.
8. View Result for Entry Modification and click Finish.

Procedure

1. Open the LDAP Browser menu.
2. Using the Tree or Table view, expand the entry you want to delete, such as cn=Tom Smith,ou=people,dc=example,dc=com.
3. Click the Options menu (⋮) and select Delete to open the wizard window.
4. Click Next after you review the data about the entry you want to delete.
5. In the Deletion step, toggle the switch to the Yes, I’m sure position and click Delete. You can click Cancel to cancel the entry deletion.
6. View the Result for Entry Deletion and click Finish.

Verification

1. Navigate to LDAP Browser Search.
2. Select the suffix where the entry previously existed, such as dc=example,cd=com.
3. Enter your search criteria in the field, such as Tom, and press Enter.
4. Verify that the deleted entry is no longer present.

Procedure

1. Create the DNA configuration entry on a supplier:

   #  dsconf <instance_name> plugin dna config "Account UIDs" add --type uidNumber --filter "(objectclass=posixAccount)" --scope ou=People,dc=example,dc=com --next-value 1 --max-value 1300 --shared-config-entry "cn=Account UIDs,ou=Ranges,dc=example,dc=com" --threshold 100 --range-request-timeout 60 --magic-regen 99999
   
   Successfully created the cn=Account UIDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config

   The command creates the DNA plug-in configuration that sets a unique value to the uidNumber attribute instead of the 99999 magic value in all newly created posixAccount entries under ou=People,dc=example,dc=com. The supplier sets values up to 1300 and requests a range transfer from the second supplier when reaches the value 1200. If the second supplier is unresponsive for 60 seconds, the first supplier requests the range transfer from the third supplier.

   NOTE

   If you create the configuration entry for a server without replication or for a supplier in one-supplier environment, set only the --type, --filter, --scope, --next-value options.

   For details about the DNA plug-in configuration attributes, see Distributed Numeric Assignment Plug-in Attributes and Syntax of the DNA plug-in sections.

2. Optional: Create the configuration entry that is shared among all supplier server:

   # ldapmodify -D "cn=Directory Manager" -W -H ldap://server.example.com -x
   dn: ou=Ranges,dc=example,dc=com
   changetype: add
   objectclass: top
   objectclass: extensibleObject
   objectclass: organizationalUnit
   ou: Ranges
   -
   dn: cn=Account UIDs,ou=Ranges,dc=example,dc=com
   changetype: add
   objectclass: top
   objectclass: extensibleObject
   cn: Account UIDs

3. Enable the DNA plug-in:

   #  dsconf <instance_name> plugin dna enable
   
   Enabled plugin 'Distributed Numeric Assignment Plugin'

Procedure

1. Select the Directory Server instance.
2. Open the Plugins menu and select the DNA plug-in from the list.
3. Click Add Config button to start the configuration of the new plug-in configuration entry.

4. On the DNA Configuration tab, set the fields.

   For example, you want the plug-in to set a unique value to the uidNumber attribute instead of the 99999 magic value in all newly created posixAccount entries under ou=People,dc=example,dc=com. In addition, you want the supplier to set values up to 1300 and request a range transfer from the second supplier when the unique value reaches the value 1200. In this case, set the following fields:

   • Config Name to Account UIDs
   • DNA Managed Attributes to uidNumber
   • Filter to "(objectclass=posixAccount)"
   • Subtree Scope to ou=People,dc=example,dc=com
   • Next Value to 1
   • Max Value to 1300
   • Magic Regeneration Value to 99999
   • Threshold to 100

   • Range Request Timeout to 60

     NOTE

     If you create the configuration entry for a server without replication or for a supplier in one-supplier environment, set only the DNA Managed Attributes, Filter, Subtree Scope, and Next Value fields.

5. Go to the Shared Config Settings tab and set the Shared Config Entry DN field to, for example, cn=Account UIDs,ou=Ranges,dc=example,dc=com. This shared configuration entry contains information which server to contact for the range transfer if the current server is out of unique values.
6. Click the Save Config button to save the plug-in settings.
7. Toggle the switch to the Plugin is enabled position to enable the plug-in.

Procedure

1. Create a new plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq add "Mail Uniqueness" --attr-name mail --subtree ou=sales,dc=example,dc=com ou=accounting,dc=example,dc=com

   The command creates the cn=Mail Uniqueness,cn=plugins,cn=config configuration entry.

   Note

   You can set the plug-in to verify uniqueness of multiple attributes in one configuration entry.

2. Optional: Configure uniqueness across all subtrees configured in this plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --across-all-subtrees on

   The command sets the uniqueness-across-all-subtrees plug-in configuration parameter to on. Therefore, the plug-in checks uniqueness of the mail attribute across both the ou=sales,dc=example,dc=com and ou=accounting,dc=example,dc=com subtrees. By default, the plug-in only checks uniqueness across the subtree where the entry is created or updated, which means that if you create or update an entry under ou=sales,dc=example,dc=com, the plug-in checks the mail attribute uniqueness only across this subtree.

3. Optional: Set a subtree that the plug-in must exclude from the attribute uniqueness verification.

   For example, if you want the plug-in to skip the ou=internal,ou=sales,dc=example,dc=com subtree, set the uniqueness-exclude-subtrees multi-valued parameter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --exclude-subtree "ou=internal,ou=sales,dc=example,dc=com"

   Successfully changed the cn=Mail Uniqueness,cn=plugins,cn=config

4. Optional: If you what the plug-in to verify uniqueness only in entries that contain a specific object class, set this object class as a value for the uniqueness-subtree-entries-oc parameter.

   For example, you want the mail attribute to be unique only in entries that contain the inetOrgPerson object class, enter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness" --subtree-entries-oc=inetOrgPerson

5. Enable the plug-in on the server:

   # dsconf <instance_name> plugin attr-uniq enable "Mail Uniqueness"

6. Restart the instance:

   # dsctl <instance_name> restart

Procedure

1. Create a new plug-in configuration entry:

   # dsconf <instance_name> plugin attr-uniq add "Mail Uniqueness with OC" --attr-name mail --top-entry-oc=nsContainer --subtree-entries-oc=inetOrgPerson

   The command creates the cn=Mail uniqueness with OC,cn=plugins,cn=config entry with the configured uniqueness-top-entry-oc and uniqueness-subtree-entries-oc plug-in parameters.

2. Optional: Set a subtree that the plug-in must exclude from the attribute uniqueness verification.

   For example, if you want the plug-in to skip the ou=internal,ou=sales,dc=example,dc=com subtree, set the uniqueness-exclude-subtrees multi-valued parameter:

   # dsconf <instance_name> plugin attr-uniq set "Mail Uniqueness with OC" --exclude-subtree "ou=internal,ou=sales,dc=example,dc=com"

   Successfully changed the cn=Mail Uniqueness with OC,cn=plugins,cn=config

3. Enable the plug-in on the server:

   # dsconf <instance_name> plugin attr-uniq enable "Mail Uniqueness with OC"

   Successfully enabled the cn=Mail Uniqueness with OC,cn=plugins,cn=config

4. Restart the instance:

   # dsctl <instance_name> restart

Procedure

1. Select the instance, where you want to configure the plug-in.
2. Open the Plugins menu and select the Attribute Uniqueness plug-in from the list.
3. Click Add Config button to start configuring the new configuration entry of the plug-in.
4. Enter the name of the configuration entry in the Config Name field.
5. Select which attributes must be unique in the Attribute Names field. The field sets the uniqueness-attribute-name attribute.

6. Enter the subtrees under which the plug-in checks uniqueness of attributes in the Subtrees field. The field sets the uniqueness-subtrees attribute.

   By default, the plug-in checks uniqueness across only the subtree where the entry is created or updated. To check across all listed subtrees, check the Across All Subtrees checkbox that sets the uniqueness-across-all-subtrees attribute to on.

7. Optional: Enter the subtrees which the plug-in must exclude from the attribute uniqueness verification in the Excluded Subtrees field. For example, you want to exclude ou=eu_department,ou=accounting,dc=example,dc=com. The field sets the uniqueness-exclude-subtrees multi-valued attribute.
8. Toggle the switch to the Configuration is enabled position.

9. Click Add Config button to finish creation of the the plug-in configuration entry.

   Figure 5.1. Configuration example of the Attribute Uniqueness plug-in.

   
10. Restart the instance. For more details, see Starting and stopping a Directory Server instance by using the web console.