User manual REDHAT DIRECTORY SERVER 2.0 GATEWAY

[. . . ] A mapping function is applied to yield a target DN in the host Directory Server's directory information tree. The gateway attempts to verify the presented credentials by binding as the mapped DN against the host Directory Server. If the gateway binds successfully, the session is marked as "authenticated. " For authenticated sessions, LDAP proxy authorization controls are sent with every operation to the Directory Server. This ensures that operations are done in the security context of the presented credentials (as mapped). 2. 3. 4. [. . . ] During installation, the files relevant to the DSML gateway are placed in serverRoot/clients/dsmlgw. The configuration information is stored in dsmlgw. cfg. You can modify desired settings in the file and customize the application to suit your organization. The gateway connects to the default port (389) of Directory Server. The gateway can also point to a different server and port; you can configure this at installation or when moving or creating instances of the gateway. This is addressed in "Configuring the DSML Gateway. " DSML gateway can be configured to point to the Directory Server or the Admin Server, to run from a different port, and to allow read-write access. The default settings allow read-only access to the directory with the server set as the Directory Server. See "Configuring the DSML Gateway" for detailed information on configuration parameters. It is recommended that you not change the default settings. Activating the Gateway The DSML gateway is installed with Directory Server. 2. Stop the server with the . /stop-admin command. Run the activation script to enable the gateway: . /slapd-serverID/dsml-activate. extension -i where extension is either . bat, for Windows systems, or . pl, for all others. Running this script changes the jvm12. conf, obj. conf, and server. xml files in the /admin-serv/config directory. 3. Restart the Admin Server with the . /start-admin command. 4 Red Hat Directory Server DSML Gateway · February 2005 Activating the Gateway NOTE Any changes made to files in the /admin-serv/config directory will be lost if the gateway is deactivated and restarted. Gateway Utilities The DSML gateway comes with three command-line utilities, listed in Table DSML-1. Table DSML-1 Gateway Command-Line Utilities -i -p -u Initializes the gateway. Restores edited files and disables the gateway the next time the server is restarted. When activating the gateway, you can use the -p utility to specify a port number other than the default (389 for the Directory Server, 8080 for the Admin Server). This parameter can also be edited manually; see "Changing the Port. " The -u utility will restore edited files when the server is restarted. Any changes made to the configuration files are normally lost when the gateway is deactivated and restarted; using this utility will save those changes and restore them when the host server is stopped and started: . /slapd-serverID/dsml-activate. {pl|bat} -u You must run the -u utility after -i. If you were to run the commands dsml-activate. {pl|bat} -i -p 3033 dsml-activate. {pl|bat} -i -p 3222 back-to-back, the Admin Server and the gateway will not start, with an error message, such as: -u required at . /dsml-activate. pl line 30 Any changes in configuration or restarts must occur in a -i -u -i order, as follows, to ensure that both the server and the gateway will start: dsml-activate. {pl|bat} -i -p 3033 dsml-activate. {pl|bat} -u dsml-activate. {pl|bat} -i -p 3222 Red Hat Directory Server DSML Gateway 5 Configuring the DSML Gateway Configuring the DSML Gateway The gateway is already configured at installation. With the default settings, the gateway is running using the Admin Server as the host. The default URL is host:port/axis/sercvices/dsmlgw, where the host and port are the Admin Server's hostname and DSML gateway port as determined by dsml-activate. The configuration settings are stored in a Java properties text file in the following location: serverRoot/clients/dsmlgw/dsmlgw. cfg Table DSML-2 lists the DSML gateway default configuration settings: Table DSML-2Configuration Settings Parameter Description Default Setting ServerHost ServerPort BindDN BindPW MinimumConnectionPool MaximumConnectionPool MinimumLoginPool MaximumLoginPool UseAuth Host name for its peer Directory Server. Port number for its peer Directory Server. [. . . ] Changing the bind DN will allow read-write access for the directory if you reset the bind DN to a DN that has read-write permissions. NOTE Everyone can read from the DSML gateway in its default configuration. To restrict access further, set the UseAuth value to true. If the UseAuth attribute value is set to true, the gateway requires standard HTTP headers, consisting of the user's full distinguished name and password. Any operations done over the gateway will be done with proxy authorization and will require a distinguished name with proxy rights. [. . . ]