Chapter 10. Configuring the chaining policy

• The ACI plug-in component

  The ACI plug-in component implements access control. You cannot chain operations used to retrieve and update ACI attributes because it not safe to mix the local and the remote attributes. However, you can chain requests used to retrieve user entries by setting the following chaining components attribute:

  nsActiveChainingComponents: cn=ACI Plugin,cn=plugins,cn=config

  Permissions: Read, search, and compare.

• The resource limit component

  The resource limits component sets server limits depending on the user bind DN. If you chain the resource limitation component, you can apply resource limits on the remote users. To chain resource limit component operations, add the following chaining component attribute:

  nsActiveChainingComponents: cn=resource limits,cn=components,cn=config

  Permissions: Read, search, and compare.

• The certificate-based authentication component

  You can use the certificate-based authentication component during the external bind method.This component retrieves user certificates from the database on the remote server. When you allow this component to chain, it enables certificate-based authentication to work with the database link. To chain this component’s operations, add the following chaining component attribute:

  nsActiveChainingComponents: cn=certificate-based authentication,cn=components,cn=config

  Permissions: Read, search, and compare.

• The password policy component

  The password policy component adds SASL binds to the remote server. Authenticating with a user name and password is essential for some forms of SASL authentication. When you enable the password policy, it allows the server to verify and implement the specific authentication method requested and to apply the appropriate password policies. To chain this component’s operations, add the chaining component attribute:

  nsActiveChainingComponents: cn=password policy,cn=components,cn=config

  Permissions: Read, search, and compare.

• The SASL component

  The SASL component allows SASL to bind to the remote server. To chain this component’s operations, add the chaining component attribute:

  nsActiveChainingComponents: cn=password policy,cn=components,cn=config

  Permissions: Read, search, and compare.

• The referential integrity postoperation component

  The referential integrity postoperation component propagates updates made to attributes containing DNs to the entries that contain pointers to the attributes. For example, you can automatically remove an entry from a group when group is deleted. By using the referential integrity postoperation plug-in together with the chaining simplifies the management of static group when the group members are remote to the static group definition.

  nsActiveChainingComponents: cn=referential integrity postoperation,cn=plugins,cn=config

  Permissions: Read, search, and compare.

• The attribute Uniqueness component

  The attribute Uniqueness component validates that all the values for a specified attribute are unique. When you chain the plug-in, it confirms that attribute values are unique even when attributes are changed through a database link. To chain this component’s operations, add the chaining component attribute:

  nsActiveChainingComponents: cn=attribute uniqueness,cn=plugins,cn=config

  Permissions: Read, search, and compare.

• The roles component

  The roles component chains the roles and roles assignments for the entries in a database. When you chain this component, it maintains the roles even on chained databases. To chain this component’s operations, addthe chaining component attribute:

  nsActiveChainingComponents: cn=roles,cn=components,cn=config

  Permissions: Read, search, and compare.

Verification

• Display the components allowed to chain:

  # dsconf -D "cn=Directory Manager" ldap://server.example.com chaining config-set \ --add-comp="cn=referential integrity postoperation,cn=components,cn=config"

Prerequisites

• You have opened the Directory Server user interface in the web console and selected the instance.

Verification

• Selected component should be chained .