Novell LDAP Services for eDirectory is installed through the eDirectory installation. You can modify the default configuration of LDAP Services for eDirectory using ConsoleOneTM. For more information, see Installing and Upgrading Novell eDirectory.
Two new objects are added to your directory tree when eDirectory is installed:
See Configuring the LDAP Server Object for more information.
See Configuring the LDAP Group Object for more information.
LDAP Services for eDirectory can be loaded and unloaded manually. To load LDAP Services for eDirectory, enter the following commands:
Table 100. Commands to Load LDAP Services for eDirectory
To unload LDAP Services for eDirectory, enter the following commands:
Table 101. Commands to Unload LDAP Services for eDirectory
The following are the optimal settings for eDirectory LDAP search and authentication on a server with two processors and 2 GB of RAM:
Table 102. Optimal Settings for eDirectory LDAP Search and Authentication
eDirectory uses memory for the database cache and for directory usage. These are separate allocated memory pools. The directory engine uses memory from available memory pools in the operating system as needed. The database uses a cache pool that is defined by parameters detailed below. Usually, the more database cache given to eDirectory, the better the performance. However, since eDirectory uses available system memory for its buffers, if clients are performing queries that require large data sets to be returned, the size of the database cache might need to be decreased to have enough system memory for the directory to handle building the query responses.
The database engine uses the database cache to hold the most recently accessed blocks. This cache is initially defined with a fixed size of 16 MB. The size of this cache can be changed from the command line in shipping versions of eDirectory. The following example command will set the eDirectory database cache to 80 million bytes:
set dstrace=!mb 80000000
A file named _ndsdb.ini in the SYS:\NETWARE directory on a NetWare server, or in the directory containing the eDirectory database files on the Windows, Solaris, and Linux environments (normally \novell\nds\dbfiles) can also be defined. This text file simply needs to contain a line such as the following:
cache=80000000
Don't add any white space by the equals (=) sign
The cache in eDirectory 8.6 can be initialized with a hard limit just as with earlier versions. In addition, the upper and lower limits can be set either as hard numbers or as a percentage of available memory. Dynamic allocation control parameters allow the cache size to grow or shrink depending on use. If the proper configuration parameters are set, the database cache dynamically grows or shrinks based on other system resource needs.
Editing the _ndsdb.ini file can manually control database memory usage. The format for INI file commands is given below:
cache=cacheBytes # Set a hard memory limit
Alternative formats are shown in Table 103.
Table 103. Alternative INI Commands
If a hard limit is specified and the administrator wants to define the database cache to use a percentage of the memory, the administrator can select between a percentage of total memory or a percentage of available memory. Dynamic limits always refer to a percentage of available memory. The following command examples are all valid in the _ndsdb.ini file.
The following is an example dynamic limit of 75% available memory, a minimum of 16 million bytes, and 32 million bytes for the OS:
cache=DYN,%:75,MIN:16000000, LEAVE 32000000
The following is an example hard limit of 75% total physical memory, a minimum of 18 million bytes, and a maximum of 512 million bytes:
cache=HARD, TOTAL,%:75,MIN:18000000, MAX 512000000
The following is an example old style hard limit of 8 million bytes:
cache=8000000
The database cache is divided between block cache and record cache. Block cache holds data and index blocks that mirror the storage on the disk. Record cache holds in-memory representations of directory objects and attributes. If updating or adding to the directory, use the block cache setting. If performing mostly reads, use the record cache. It is possible to cause a thrashing condition in both caches if performing numerous sequential updates without allocating cache size properly. Unless specifically changed, the cache is allocated to be 50% block cache and 50% record cache. The blockcachepercent option can be included in the _ndsdb.ini file to specify the percentage of cache allocated to caching data and index blocks. (The default is 50%.) The remaining cache is used for entries.
For example, to designate 60% block cache and 40% record cache, enter the following:
blockcachepercent=60
Do not select 100% of the cache for either block or record cache and starve the other cache type. In general, do not allocate more than 75% of your cache memory to one or the other type.
Database cache settings can also be controlled using Novell iMonitor.
Although the cache size is dynamic depending on the amount of memory available, the DSTRACE command can still be used for custom environments.
The LDAP Server object stores configuration data for an LDAP Services for eDirectory server. During installation, an LDAP Server object named LDAP Server server_name is created (where server_name is the name of the server LDAP Services for eDirectory is installed on). The LDAP Server object is created in the same container as the Server object.
Each LDAP Server object configures one LDAP Services for eDirectory server. Do not assign the same LDAP Server object to more than one LDAP Services for eDirectory server. If you assign the LDAP Server object to another server, it is no longer assigned to the previous server.
In ConsoleOne, right-click the LDAP Server object > click Properties.
Enter the configurable parameters in the property pages.
For more information on LDAP Server parameters, see the LDAP online help.
Click Apply > OK.
The LDAP Group object stores configuration data that can be applied to a single LDAP server or a group of LDAP servers. If you plan to implement the same configuration on multiple servers, configure one LDAP Group object and assign it to each of the LDAP Services for eDirectory servers from the LDAP Server General Page.
The LDAP Group configures the class and attribute mappings and security policies on the server. This greatly simplifies configuration changes, because one configuration change can be applied instantly to multiple LDAP servers.
During installation, an LDAP Group object named LDAP Group server_name is created in the same container as the Server object.
To configure the LDAP Group object, use ConsoleOne to complete the following steps:
In ConsoleOne, right-click the LDAP Group object > click Properties.
Enter the configurable parameters in the property pages.
For more information on LDAP Group parameters, see the LDAP online help.
Click Apply > OK.
You can use the LDAP configuration utility, ldapconfig, on Linux or Solaris systems to modify, view, and refresh the attributes of LDAP Server and Group objects.
Use the following syntax to view LDAP attribute values on Linux and Solaris systems:
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a <user FDN>] [-V] [-R] [-H] [-f] -v attribute,attribute2...
Use the following syntax to modify values of LDAP attributes on Linux and Solaris systems:
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a admin_FDN] -s attribute=value,...
Table 104. ldapconfig Parameters
| ldapconfig Parameter | Description |
|---|---|
-t |
Name of the eDirectory tree where the component will be installed. |
-p |
Name of the host. |
-w |
Password of the user having administration rights. |
-a |
Fully distinguished name of the user having administration rights. |
-v |
Option to view the value of the LDAP attribute. |
-s |
Option to set a value for an attribute of the installed components. |
-R |
Refreshes the LDAP server. |
-V |
Lets you view the current LDAP configuration settings. |
-H |
Lets you view the usage and help strings. |
-f |
Allows operations on a filtered replica. |
attribute |
Configurable LDAP server or group attribute name. For more information, see LDAP Server Attributes and LDAP Group Attributes. |
Table 105 provides a description of configurable LDAP Server attributes:
Table 105. LDAP Server Attributes
Table 106 provides a description of configurable LDAP Group attributes:
Table 106. LDAP Group Attributes
To view value of the attribute in the attribute list:
Enter the following command:
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a user_FDN] -v "LDAP Allow Clear Text Password","searchTimeLimit"
To configure the LDAP TCP port number:
Enter the following command:
ldapconfig [-t tree_name | -p host_name[:port]] [-w password] [-a admin_FDN] -s "LDAP TCP Port=389","searchSizeLimit=1000"