Configuration settings accessible through the dsconfig command.
About This Reference
This reference describes server configuration settings that you can view and edit with the dsconfig command. The dsconfig command is the primary tool for managing the server configuration, which follows an object-oriented configuration model. Each configuration object has its own properties. Configuration objects can be related to each other by inheritance and by reference.
The server configuration model exposes a wide range of configurable features. As a consequence, the dsconfig command has many subcommands. Subcommands exist to create, list, and delete configuration objects, and to get and set properties of configuration objects. Their names reflect these five actions:
create-object
list-objects
delete-object
get-object-prop
set-object-prop
Each configuration object has a user-friendly name, such as Connection Handler
. Subcommand names use lower-case, hyphenated versions of the friendly names, as in create-connection-handler
.
Chapter 1. Subcommands
This chapter describes dsconfig subcommands.
1.1. Subcommands by Category
1.1.1. Core Server
1.1.2. Caching and Backends
1.1.3. Logging
1.1.4. Directory Proxy
1.1.5. Replication
1.1.6. Authentication and Authorization
1.1.7. Service Discovery Mechanism
1.1.8. User Management
1.1.9. Help
1.2. create-access-log-filtering-criteria
Creates Access Log Filtering Criteria.
The dsconfig create-access-log-filtering-criteria command takes the following options:
--publisher-name {name}
The name of the Access Log Publisher.
--criteria-name {name}
The name of the new Access Log Filtering Criteria.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Log Filtering Criteria.
1.3. create-account-status-notification-handler
Creates Account Status Notification Handlers.
The dsconfig create-account-status-notification-handler command takes the following options:
--handler-name {name}
The name of the new Account Status Notification Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Account Status Notification Handler which should be created. The value for TYPE can be one of: custom | error-log | smtp.
Properties used in options depend on the type of object to configure.
For details about available properties, see Account Status Notification Handler.
1.4. create-alert-handler
Creates Alert Handlers.
The dsconfig create-alert-handler command takes the following options:
--handler-name {name}
The name of the new Alert Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Alert Handler which should be created. The value for TYPE can be one of: custom | jmx | smtp.
Properties used in options depend on the type of object to configure.
For details about available properties, see Alert Handler.
1.5. create-backend
Creates Backends.
The dsconfig create-backend command takes the following options:
--backend-name {STRING}
The name of the new Backend which will also be used as the value of the "backend-id" property: Specifies a name to identify the associated backend.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Backend which should be created. The value for TYPE can be one of: backup | custom | je | ldif | memory | monitor | null | proxy | schema | task | trust-store.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend.
1.6. create-backend-index
Creates Backend Indexes.
The dsconfig create-backend-index command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {OID}
The name of the new Backend Index which will also be used as the value of the "attribute" property: Specifies the name of the attribute for which the index is to be maintained.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend Index.
1.7. create-backend-vlv-index
Creates Backend VLV Indexes.
The dsconfig create-backend-vlv-index command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {STRING}
The name of the new Backend VLV Index which will also be used as the value of the "name" property: Specifies a unique name for this VLV index.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend VLV Index.
1.8. create-certificate-mapper
Creates Certificate Mappers.
The dsconfig create-certificate-mapper command takes the following options:
--mapper-name {name}
The name of the new Certificate Mapper.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Certificate Mapper which should be created. The value for TYPE can be one of: custom | fingerprint | subject-attribute-to-user-attribute | subject-dn-to-user-attribute | subject-equals-dn.
Properties used in options depend on the type of object to configure.
For details about available properties, see Certificate Mapper.
1.9. create-connection-handler
Creates Connection Handlers.
The dsconfig create-connection-handler command takes the following options:
--handler-name {name}
The name of the new Connection Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Connection Handler which should be created. The value for TYPE can be one of: custom | http | jmx | ldap | ldif | snmp.
Properties used in options depend on the type of object to configure.
For details about available properties, see Connection Handler.
1.10. create-debug-target
Creates Debug Targets.
The dsconfig create-debug-target command takes the following options:
--publisher-name {name}
The name of the Debug Log Publisher.
--target-name {STRING}
The name of the new Debug Target which will also be used as the value of the "debug-scope" property: Specifies the fully-qualified OpenDJ Java package, class, or method affected by the settings in this target definition. Use the number character (#) to separate the class name and the method name (that is, org.opends.server.core.DirectoryServer#startUp).
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Debug Target.
1.11. create-entry-cache
Creates Entry Caches.
The dsconfig create-entry-cache command takes the following options:
--cache-name {name}
The name of the new Entry Cache.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Entry Cache which should be created. The value for TYPE can be one of: custom | fifo | soft-reference.
Properties used in options depend on the type of object to configure.
For details about available properties, see Entry Cache.
1.12. create-extended-operation-handler
Creates Extended Operation Handlers.
The dsconfig create-extended-operation-handler command takes the following options:
--handler-name {name}
The name of the new Extended Operation Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Extended Operation Handler which should be created. The value for TYPE can be one of: cancel | custom | get-connection-id | get-symmetric-key | password-modify | password-policy-state | start-tls | who-am-i.
Properties used in options depend on the type of object to configure.
For details about available properties, see Extended Operation Handler.
1.13. create-global-access-control-policy
Creates Global Access Control Policies.
The dsconfig create-global-access-control-policy command takes the following options:
--policy-name {name}
The name of the new Global Access Control Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Access Control Policy.
1.14. create-group-implementation
Creates Group Implementations.
The dsconfig create-group-implementation command takes the following options:
--implementation-name {name}
The name of the new Group Implementation.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Group Implementation which should be created. The value for TYPE can be one of: custom | dynamic | static | virtual-static.
Properties used in options depend on the type of object to configure.
For details about available properties, see Group Implementation.
1.15. create-http-authorization-mechanism
Creates HTTP Authorization Mechanisms.
The dsconfig create-http-authorization-mechanism command takes the following options:
--mechanism-name {name}
The name of the new HTTP Authorization Mechanism.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of HTTP Authorization Mechanism which should be created. The value for TYPE can be one of: http-anonymous-authorization-mechanism | http-basic-authorization-mechanism | http-oauth2-cts-authorization-mechanism | http-oauth2-file-authorization-mechanism | http-oauth2-openam-authorization-mechanism | http-oauth2-token-introspection-authorization-mechanism.
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Authorization Mechanism.
1.16. create-http-endpoint
Creates HTTP Endpoints.
The dsconfig create-http-endpoint command takes the following options:
--endpoint-name {STRING}
The name of the new HTTP Endpoint which will also be used as the value of the "base-path" property: All HTTP requests matching the base path or subordinate to it will be routed to the HTTP endpoint unless a more specific HTTP endpoint is found.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of HTTP Endpoint which should be created (Default: generic). The value for TYPE can be one of: admin-endpoint | alive-endpoint | crest-metrics-endpoint | generic | healthy-endpoint | prometheus-endpoint | rest2ldap-endpoint.
Default: generic
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Endpoint.
1.17. create-identity-mapper
Creates Identity Mappers.
The dsconfig create-identity-mapper command takes the following options:
--mapper-name {name}
The name of the new Identity Mapper.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Identity Mapper which should be created. The value for TYPE can be one of: custom | exact-match | regular-expression.
Properties used in options depend on the type of object to configure.
For details about available properties, see Identity Mapper.
1.18. create-key-manager-provider
Creates Key Manager Providers.
The dsconfig create-key-manager-provider command takes the following options:
--provider-name {name}
The name of the new Key Manager Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Key Manager Provider which should be created. The value for TYPE can be one of: custom | file-based | ldap | pkcs11.
Properties used in options depend on the type of object to configure.
For details about available properties, see Key Manager Provider.
1.19. create-log-publisher
Creates Log Publishers.
The dsconfig create-log-publisher command takes the following options:
--publisher-name {name}
The name of the new Log Publisher.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Log Publisher which should be created. The value for TYPE can be one of: csv-file-access | csv-file-http-access | custom-access | custom-debug | custom-error | custom-http-access | external-access | external-http-access | file-based-access | file-based-audit | file-based-debug | file-based-error | file-based-http-access | json-file-access | json-file-http-access.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Publisher.
1.20. create-log-retention-policy
Creates Log Retention Policies.
The dsconfig create-log-retention-policy command takes the following options:
--policy-name {name}
The name of the new Log Retention Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Log Retention Policy which should be created. The value for TYPE can be one of: custom | file-count | free-disk-space | size-limit.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Retention Policy.
1.21. create-log-rotation-policy
Creates Log Rotation Policies.
The dsconfig create-log-rotation-policy command takes the following options:
--policy-name {name}
The name of the new Log Rotation Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Log Rotation Policy which should be created. The value for TYPE can be one of: custom | fixed-time | size-limit | time-limit.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Rotation Policy.
1.22. create-password-generator
Creates Password Generators.
The dsconfig create-password-generator command takes the following options:
--generator-name {name}
The name of the new Password Generator.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Password Generator which should be created. The value for TYPE can be one of: custom | random.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Generator.
1.23. create-password-policy
Creates Authentication Policies.
The dsconfig create-password-policy command takes the following options:
--policy-name {name}
The name of the new Authentication Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Authentication Policy which should be created. The value for TYPE can be one of: ldap-pass-through | password-policy.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Policy.
1.24. create-password-storage-scheme
Creates Password Storage Schemes.
The dsconfig create-password-storage-scheme command takes the following options:
--scheme-name {name}
The name of the new Password Storage Scheme.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Password Storage Scheme which should be created. The value for TYPE can be one of: aes | base64 | bcrypt | blowfish | clear | crypt | custom | md5 | pbkdf2 | pkcs5s2 | rc4 | salted-md5 | salted-sha1 | salted-sha256 | salted-sha384 | salted-sha512 | sha1 | triple-des.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Storage Scheme.
1.25. create-password-validator
Creates Password Validators.
The dsconfig create-password-validator command takes the following options:
--validator-name {name}
The name of the new Password Validator.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Password Validator which should be created. The value for TYPE can be one of: attribute-value | character-set | custom | dictionary | length-based | repeated-characters | similarity-based | unique-characters.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Validator.
1.26. create-plugin
Creates Plugins.
The dsconfig create-plugin command takes the following options:
--plugin-name {name}
The name of the new Plugin.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Plugin which should be created. The value for TYPE can be one of: attribute-cleanup | change-number-control | custom | entry-uuid | fractional-ldif-import | graphite-monitor-reporter | last-mod | ldap-attribute-description-list | password-policy-import | profiler | referential-integrity | samba-password | seven-bit-clean | unique-attribute.
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin.
1.27. create-replication-domain
Creates Replication Domains.
The dsconfig create-replication-domain command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the new Replication Domain.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Domain.
1.28. create-replication-server
Creates Replication Servers.
The dsconfig create-replication-server command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Server.
1.29. create-sasl-mechanism-handler
Creates SASL Mechanism Handlers.
The dsconfig create-sasl-mechanism-handler command takes the following options:
--handler-name {name}
The name of the new SASL Mechanism Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of SASL Mechanism Handler which should be created. The value for TYPE can be one of: anonymous | cram-md5 | custom | digest-md5 | external | gssapi | plain.
Properties used in options depend on the type of object to configure.
For details about available properties, see SASL Mechanism Handler.
1.30. create-schema-provider
Creates Schema Providers.
The dsconfig create-schema-provider command takes the following options:
--provider-name {name}
The name of the new Schema Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Schema Provider which should be created (Default: generic). The value for TYPE can be one of: core-schema | generic | json-equality-matching-rule | json-ordering-matching-rule | json-query-equality-matching-rule.
Default: generic
Properties used in options depend on the type of object to configure.
For details about available properties, see Schema Provider.
1.31. create-service-discovery-mechanism
Creates Service Discovery Mechanisms.
The dsconfig create-service-discovery-mechanism command takes the following options:
--mechanism-name {name}
The name of the new Service Discovery Mechanism.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Service Discovery Mechanism which should be created. The value for TYPE can be one of: custom | replication | static.
Properties used in options depend on the type of object to configure.
For details about available properties, see Service Discovery Mechanism.
1.32. create-synchronization-provider
Creates Synchronization Providers.
The dsconfig create-synchronization-provider command takes the following options:
--provider-name {name}
The name of the new Synchronization Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Synchronization Provider which should be created. The value for TYPE can be one of: custom | replication.
Properties used in options depend on the type of object to configure.
For details about available properties, see Synchronization Provider.
1.33. create-trust-manager-provider
Creates Trust Manager Providers.
The dsconfig create-trust-manager-provider command takes the following options:
--provider-name {name}
The name of the new Trust Manager Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Trust Manager Provider which should be created. The value for TYPE can be one of: blind | custom | file-based | ldap | pkcs11.
Properties used in options depend on the type of object to configure.
For details about available properties, see Trust Manager Provider.
1.34. create-virtual-attribute
Creates Virtual Attributes.
The dsconfig create-virtual-attribute command takes the following options:
--name {name}
The name of the new Virtual Attribute.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
-t | --type {type}
The type of Virtual Attribute which should be created. The value for TYPE can be one of: collective-attribute-subentries | custom | entity-tag | entry-dn | entry-uuid | governing-structure-rule | has-subordinates | is-member-of | member | num-subordinates | password-expiration-time | password-policy-subentry | structural-object-class | subschema-subentry | user-defined.
Properties used in options depend on the type of object to configure.
For details about available properties, see Virtual Attribute.
1.35. delete-access-log-filtering-criteria
Deletes Access Log Filtering Criteria.
The dsconfig delete-access-log-filtering-criteria command takes the following options:
--publisher-name {name}
The name of the Access Log Publisher.
--criteria-name {name}
The name of the Access Log Filtering Criteria.
-f | --force
Ignore non-existent Access Log Filtering Criteria.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Log Filtering Criteria.
1.36. delete-account-status-notification-handler
Deletes Account Status Notification Handlers.
The dsconfig delete-account-status-notification-handler command takes the following options:
--handler-name {name}
The name of the Account Status Notification Handler.
-f | --force
Ignore non-existent Account Status Notification Handlers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Account Status Notification Handler.
1.37. delete-alert-handler
Deletes Alert Handlers.
The dsconfig delete-alert-handler command takes the following options:
--handler-name {name}
The name of the Alert Handler.
-f | --force
Ignore non-existent Alert Handlers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Alert Handler.
1.38. delete-backend
Deletes Backends.
The dsconfig delete-backend command takes the following options:
--backend-name {name}
The name of the Backend.
-f | --force
Ignore non-existent Backends.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend.
1.39. delete-backend-index
Deletes Backend Indexes.
The dsconfig delete-backend-index command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend Index.
-f | --force
Ignore non-existent Backend Indexes.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend Index.
1.40. delete-backend-vlv-index
Deletes Backend VLV Indexes.
The dsconfig delete-backend-vlv-index command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend VLV Index.
-f | --force
Ignore non-existent Backend VLV Indexes.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend VLV Index.
1.41. delete-certificate-mapper
Deletes Certificate Mappers.
The dsconfig delete-certificate-mapper command takes the following options:
--mapper-name {name}
The name of the Certificate Mapper.
-f | --force
Ignore non-existent Certificate Mappers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Certificate Mapper.
1.42. delete-connection-handler
Deletes Connection Handlers.
The dsconfig delete-connection-handler command takes the following options:
--handler-name {name}
The name of the Connection Handler.
-f | --force
Ignore non-existent Connection Handlers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Connection Handler.
1.43. delete-debug-target
Deletes Debug Targets.
The dsconfig delete-debug-target command takes the following options:
--publisher-name {name}
The name of the Debug Log Publisher.
--target-name {name}
The name of the Debug Target.
-f | --force
Ignore non-existent Debug Targets.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Debug Target.
1.44. delete-entry-cache
Deletes Entry Caches.
The dsconfig delete-entry-cache command takes the following options:
--cache-name {name}
The name of the Entry Cache.
-f | --force
Ignore non-existent Entry Caches.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Entry Cache.
1.45. delete-extended-operation-handler
Deletes Extended Operation Handlers.
The dsconfig delete-extended-operation-handler command takes the following options:
--handler-name {name}
The name of the Extended Operation Handler.
-f | --force
Ignore non-existent Extended Operation Handlers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Extended Operation Handler.
1.46. delete-global-access-control-policy
Deletes Global Access Control Policies.
The dsconfig delete-global-access-control-policy command takes the following options:
--policy-name {name}
The name of the Global Access Control Policy.
-f | --force
Ignore non-existent Global Access Control Policies.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Access Control Policy.
1.47. delete-group-implementation
Deletes Group Implementations.
The dsconfig delete-group-implementation command takes the following options:
--implementation-name {name}
The name of the Group Implementation.
-f | --force
Ignore non-existent Group Implementations.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Group Implementation.
1.48. delete-http-authorization-mechanism
Deletes HTTP Authorization Mechanisms.
The dsconfig delete-http-authorization-mechanism command takes the following options:
--mechanism-name {name}
The name of the HTTP Authorization Mechanism.
-f | --force
Ignore non-existent HTTP Authorization Mechanisms.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Authorization Mechanism.
1.49. delete-http-endpoint
Deletes HTTP Endpoints.
The dsconfig delete-http-endpoint command takes the following options:
--endpoint-name {name}
The name of the HTTP Endpoint.
-f | --force
Ignore non-existent HTTP Endpoints.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Endpoint.
1.50. delete-identity-mapper
Deletes Identity Mappers.
The dsconfig delete-identity-mapper command takes the following options:
--mapper-name {name}
The name of the Identity Mapper.
-f | --force
Ignore non-existent Identity Mappers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Identity Mapper.
1.51. delete-key-manager-provider
Deletes Key Manager Providers.
The dsconfig delete-key-manager-provider command takes the following options:
--provider-name {name}
The name of the Key Manager Provider.
-f | --force
Ignore non-existent Key Manager Providers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Key Manager Provider.
1.52. delete-log-publisher
Deletes Log Publishers.
The dsconfig delete-log-publisher command takes the following options:
--publisher-name {name}
The name of the Log Publisher.
-f | --force
Ignore non-existent Log Publishers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Publisher.
1.53. delete-log-retention-policy
Deletes Log Retention Policies.
The dsconfig delete-log-retention-policy command takes the following options:
--policy-name {name}
The name of the Log Retention Policy.
-f | --force
Ignore non-existent Log Retention Policies.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Retention Policy.
1.54. delete-log-rotation-policy
Deletes Log Rotation Policies.
The dsconfig delete-log-rotation-policy command takes the following options:
--policy-name {name}
The name of the Log Rotation Policy.
-f | --force
Ignore non-existent Log Rotation Policies.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Rotation Policy.
1.55. delete-password-generator
Deletes Password Generators.
The dsconfig delete-password-generator command takes the following options:
--generator-name {name}
The name of the Password Generator.
-f | --force
Ignore non-existent Password Generators.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Generator.
1.56. delete-password-policy
Deletes Authentication Policies.
The dsconfig delete-password-policy command takes the following options:
--policy-name {name}
The name of the Authentication Policy.
-f | --force
Ignore non-existent Authentication Policies.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Policy.
1.57. delete-password-storage-scheme
Deletes Password Storage Schemes.
The dsconfig delete-password-storage-scheme command takes the following options:
--scheme-name {name}
The name of the Password Storage Scheme.
-f | --force
Ignore non-existent Password Storage Schemes.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Storage Scheme.
1.58. delete-password-validator
Deletes Password Validators.
The dsconfig delete-password-validator command takes the following options:
--validator-name {name}
The name of the Password Validator.
-f | --force
Ignore non-existent Password Validators.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Validator.
1.59. delete-plugin
Deletes Plugins.
The dsconfig delete-plugin command takes the following options:
--plugin-name {name}
The name of the Plugin.
-f | --force
Ignore non-existent Plugins.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin.
1.60. delete-replication-domain
Deletes Replication Domains.
The dsconfig delete-replication-domain command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the Replication Domain.
-f | --force
Ignore non-existent Replication Domains.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Domain.
1.61. delete-replication-server
Deletes Replication Servers.
The dsconfig delete-replication-server command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
-f | --force
Ignore non-existent Replication Servers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Server.
1.62. delete-sasl-mechanism-handler
Deletes SASL Mechanism Handlers.
The dsconfig delete-sasl-mechanism-handler command takes the following options:
--handler-name {name}
The name of the SASL Mechanism Handler.
-f | --force
Ignore non-existent SASL Mechanism Handlers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see SASL Mechanism Handler.
1.63. delete-schema-provider
Deletes Schema Providers.
The dsconfig delete-schema-provider command takes the following options:
--provider-name {name}
The name of the Schema Provider.
-f | --force
Ignore non-existent Schema Providers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Schema Provider.
1.64. delete-service-discovery-mechanism
Deletes Service Discovery Mechanisms.
The dsconfig delete-service-discovery-mechanism command takes the following options:
--mechanism-name {name}
The name of the Service Discovery Mechanism.
-f | --force
Ignore non-existent Service Discovery Mechanisms.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Service Discovery Mechanism.
1.65. delete-synchronization-provider
Deletes Synchronization Providers.
The dsconfig delete-synchronization-provider command takes the following options:
--provider-name {name}
The name of the Synchronization Provider.
-f | --force
Ignore non-existent Synchronization Providers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Synchronization Provider.
1.66. delete-trust-manager-provider
Deletes Trust Manager Providers.
The dsconfig delete-trust-manager-provider command takes the following options:
--provider-name {name}
The name of the Trust Manager Provider.
-f | --force
Ignore non-existent Trust Manager Providers.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Trust Manager Provider.
1.67. delete-virtual-attribute
Deletes Virtual Attributes.
The dsconfig delete-virtual-attribute command takes the following options:
--name {name}
The name of the Virtual Attribute.
-f | --force
Ignore non-existent Virtual Attributes.
Default: false
Properties used in options depend on the type of object to configure.
For details about available properties, see Virtual Attribute.
1.68. get-access-control-handler-prop
Shows Access Control Handler properties.
The dsconfig get-access-control-handler-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Control Handler.
1.69. get-access-log-filtering-criteria-prop
Shows Access Log Filtering Criteria properties.
The dsconfig get-access-log-filtering-criteria-prop command takes the following options:
--publisher-name {name}
The name of the Access Log Publisher.
--criteria-name {name}
The name of the Access Log Filtering Criteria.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Log Filtering Criteria.
1.70. get-account-status-notification-handler-prop
Shows Account Status Notification Handler properties.
The dsconfig get-account-status-notification-handler-prop command takes the following options:
--handler-name {name}
The name of the Account Status Notification Handler.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Account Status Notification Handler.
1.71. get-administration-connector-prop
Shows Administration Connector properties.
The dsconfig get-administration-connector-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Administration Connector.
1.72. get-alert-handler-prop
Shows Alert Handler properties.
The dsconfig get-alert-handler-prop command takes the following options:
--handler-name {name}
The name of the Alert Handler.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Alert Handler.
1.73. get-backend-index-prop
Shows Backend Index properties.
The dsconfig get-backend-index-prop command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend Index.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend Index.
1.74. get-backend-prop
Shows Backend properties.
The dsconfig get-backend-prop command takes the following options:
--backend-name {name}
The name of the Backend.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend.
1.75. get-backend-vlv-index-prop
Shows Backend VLV Index properties.
The dsconfig get-backend-vlv-index-prop command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend VLV Index.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend VLV Index.
1.76. get-certificate-mapper-prop
Shows Certificate Mapper properties.
The dsconfig get-certificate-mapper-prop command takes the following options:
--mapper-name {name}
The name of the Certificate Mapper.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Certificate Mapper.
1.77. get-connection-handler-prop
Shows Connection Handler properties.
The dsconfig get-connection-handler-prop command takes the following options:
--handler-name {name}
The name of the Connection Handler.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Connection Handler.
1.78. get-crypto-manager-prop
Shows Crypto Manager properties.
The dsconfig get-crypto-manager-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Crypto Manager.
1.79. get-debug-target-prop
Shows Debug Target properties.
The dsconfig get-debug-target-prop command takes the following options:
--publisher-name {name}
The name of the Debug Log Publisher.
--target-name {name}
The name of the Debug Target.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Debug Target.
1.80. get-entry-cache-prop
Shows Entry Cache properties.
The dsconfig get-entry-cache-prop command takes the following options:
--cache-name {name}
The name of the Entry Cache.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Entry Cache.
1.81. get-extended-operation-handler-prop
Shows Extended Operation Handler properties.
The dsconfig get-extended-operation-handler-prop command takes the following options:
--handler-name {name}
The name of the Extended Operation Handler.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Extended Operation Handler.
1.82. get-external-changelog-domain-prop
Shows External Changelog Domain properties.
The dsconfig get-external-changelog-domain-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the Replication Domain.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see External Changelog Domain.
1.83. get-global-access-control-policy-prop
Shows Global Access Control Policy properties.
The dsconfig get-global-access-control-policy-prop command takes the following options:
--policy-name {name}
The name of the Global Access Control Policy.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Access Control Policy.
1.84. get-global-configuration-prop
Shows Global Configuration properties.
The dsconfig get-global-configuration-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Configuration.
1.85. get-group-implementation-prop
Shows Group Implementation properties.
The dsconfig get-group-implementation-prop command takes the following options:
--implementation-name {name}
The name of the Group Implementation.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Group Implementation.
1.86. get-http-authorization-mechanism-prop
Shows HTTP Authorization Mechanism properties.
The dsconfig get-http-authorization-mechanism-prop command takes the following options:
--mechanism-name {name}
The name of the HTTP Authorization Mechanism.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Authorization Mechanism.
1.87. get-http-endpoint-prop
Shows HTTP Endpoint properties.
The dsconfig get-http-endpoint-prop command takes the following options:
--endpoint-name {name}
The name of the HTTP Endpoint.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Endpoint.
1.88. get-identity-mapper-prop
Shows Identity Mapper properties.
The dsconfig get-identity-mapper-prop command takes the following options:
--mapper-name {name}
The name of the Identity Mapper.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Identity Mapper.
1.89. get-key-manager-provider-prop
Shows Key Manager Provider properties.
The dsconfig get-key-manager-provider-prop command takes the following options:
--provider-name {name}
The name of the Key Manager Provider.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Key Manager Provider.
1.90. get-log-publisher-prop
Shows Log Publisher properties.
The dsconfig get-log-publisher-prop command takes the following options:
--publisher-name {name}
The name of the Log Publisher.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Publisher.
1.91. get-log-retention-policy-prop
Shows Log Retention Policy properties.
The dsconfig get-log-retention-policy-prop command takes the following options:
--policy-name {name}
The name of the Log Retention Policy.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Retention Policy.
1.92. get-log-rotation-policy-prop
Shows Log Rotation Policy properties.
The dsconfig get-log-rotation-policy-prop command takes the following options:
--policy-name {name}
The name of the Log Rotation Policy.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Rotation Policy.
1.93. get-password-generator-prop
Shows Password Generator properties.
The dsconfig get-password-generator-prop command takes the following options:
--generator-name {name}
The name of the Password Generator.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Generator.
1.94. get-password-policy-prop
Shows Authentication Policy properties.
The dsconfig get-password-policy-prop command takes the following options:
--policy-name {name}
The name of the Authentication Policy.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Policy.
1.95. get-password-storage-scheme-prop
Shows Password Storage Scheme properties.
The dsconfig get-password-storage-scheme-prop command takes the following options:
--scheme-name {name}
The name of the Password Storage Scheme.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Storage Scheme.
1.96. get-password-validator-prop
Shows Password Validator properties.
The dsconfig get-password-validator-prop command takes the following options:
--validator-name {name}
The name of the Password Validator.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Validator.
1.97. get-plugin-prop
Shows Plugin properties.
The dsconfig get-plugin-prop command takes the following options:
--plugin-name {name}
The name of the Plugin.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin.
1.98. get-plugin-root-prop
Shows Plugin Root properties.
The dsconfig get-plugin-root-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin Root.
1.99. get-replication-domain-prop
Shows Replication Domain properties.
The dsconfig get-replication-domain-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the Replication Domain.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Domain.
1.100. get-replication-server-prop
Shows Replication Server properties.
The dsconfig get-replication-server-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Server.
1.101. get-root-dse-backend-prop
Shows Root DSE Backend properties.
The dsconfig get-root-dse-backend-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Root DSE Backend.
1.102. get-sasl-mechanism-handler-prop
Shows SASL Mechanism Handler properties.
The dsconfig get-sasl-mechanism-handler-prop command takes the following options:
--handler-name {name}
The name of the SASL Mechanism Handler.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see SASL Mechanism Handler.
1.103. get-schema-provider-prop
Shows Schema Provider properties.
The dsconfig get-schema-provider-prop command takes the following options:
--provider-name {name}
The name of the Schema Provider.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Schema Provider.
1.104. get-service-discovery-mechanism-prop
Shows Service Discovery Mechanism properties.
The dsconfig get-service-discovery-mechanism-prop command takes the following options:
--mechanism-name {name}
The name of the Service Discovery Mechanism.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Service Discovery Mechanism.
1.105. get-synchronization-provider-prop
Shows Synchronization Provider properties.
The dsconfig get-synchronization-provider-prop command takes the following options:
--provider-name {name}
The name of the Synchronization Provider.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Synchronization Provider.
1.106. get-trust-manager-provider-prop
Shows Trust Manager Provider properties.
The dsconfig get-trust-manager-provider-prop command takes the following options:
--provider-name {name}
The name of the Trust Manager Provider.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Trust Manager Provider.
1.107. get-virtual-attribute-prop
Shows Virtual Attribute properties.
The dsconfig get-virtual-attribute-prop command takes the following options:
--name {name}
The name of the Virtual Attribute.
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Virtual Attribute.
1.108. get-work-queue-prop
Shows Work Queue properties.
The dsconfig get-work-queue-prop command takes the following options:
--property {property}
The name of a property to be displayed.
--record
Modifies the display output to show one property value per line.
Default: false
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Work Queue.
1.109. list-access-log-filtering-criteria
Lists existing Access Log Filtering Criteria.
The dsconfig list-access-log-filtering-criteria command takes the following options:
--publisher-name {name}
The name of the Access Log Publisher.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Log Filtering Criteria.
1.110. list-account-status-notification-handlers
Lists existing Account Status Notification Handlers.
The dsconfig list-account-status-notification-handlers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Account Status Notification Handler.
1.111. list-alert-handlers
Lists existing Alert Handlers.
The dsconfig list-alert-handlers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Alert Handler.
1.112. list-backend-indexes
Lists existing Backend Indexes.
The dsconfig list-backend-indexes command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend Index.
1.113. list-backend-vlv-indexes
Lists existing Backend VLV Indexes.
The dsconfig list-backend-vlv-indexes command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend VLV Index.
1.114. list-backends
Lists existing Backends.
The dsconfig list-backends command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend.
1.115. list-certificate-mappers
Lists existing Certificate Mappers.
The dsconfig list-certificate-mappers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Certificate Mapper.
1.116. list-connection-handlers
Lists existing Connection Handlers.
The dsconfig list-connection-handlers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Connection Handler.
1.117. list-debug-targets
Lists existing Debug Targets.
The dsconfig list-debug-targets command takes the following options:
--publisher-name {name}
The name of the Debug Log Publisher.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Debug Target.
1.118. list-entry-caches
Lists existing Entry Caches.
The dsconfig list-entry-caches command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Entry Cache.
1.119. list-extended-operation-handlers
Lists existing Extended Operation Handlers.
The dsconfig list-extended-operation-handlers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Extended Operation Handler.
1.120. list-global-access-control-policies
Lists existing Global Access Control Policies.
The dsconfig list-global-access-control-policies command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Access Control Policy.
1.121. list-group-implementations
Lists existing Group Implementations.
The dsconfig list-group-implementations command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Group Implementation.
1.122. list-http-authorization-mechanisms
Lists existing HTTP Authorization Mechanisms.
The dsconfig list-http-authorization-mechanisms command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Authorization Mechanism.
1.123. list-http-endpoints
Lists existing HTTP Endpoints.
The dsconfig list-http-endpoints command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Endpoint.
1.124. list-identity-mappers
Lists existing Identity Mappers.
The dsconfig list-identity-mappers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Identity Mapper.
1.125. list-key-manager-providers
Lists existing Key Manager Providers.
The dsconfig list-key-manager-providers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Key Manager Provider.
1.126. list-log-publishers
Lists existing Log Publishers.
The dsconfig list-log-publishers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Publisher.
1.127. list-log-retention-policies
Lists existing Log Retention Policies.
The dsconfig list-log-retention-policies command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Retention Policy.
1.128. list-log-rotation-policies
Lists existing Log Rotation Policies.
The dsconfig list-log-rotation-policies command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Rotation Policy.
1.129. list-password-generators
Lists existing Password Generators.
The dsconfig list-password-generators command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Generator.
1.130. list-password-policies
Lists existing Password Policies.
The dsconfig list-password-policies command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Policy.
1.131. list-password-storage-schemes
Lists existing Password Storage Schemes.
The dsconfig list-password-storage-schemes command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Storage Scheme.
1.132. list-password-validators
Lists existing Password Validators.
The dsconfig list-password-validators command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Validator.
1.133. list-plugins
Lists existing Plugins.
The dsconfig list-plugins command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin.
1.134. list-properties
Describes managed objects and their properties.
The dsconfig list-properties command takes the following options:
-c | --category {category}
The category of components whose properties should be described.
-t | --type {type}
The type of components whose properties should be described. The value for TYPE must be one of the component types associated with the CATEGORY specified using the "--category" option.
--inherited
Modifies the display output to show the inherited properties of components.
Default: false
--property {property}
The name of a property to be displayed.
1.135. list-replication-domains
Lists existing Replication Domains.
The dsconfig list-replication-domains command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Domain.
1.136. list-replication-server
Lists existing Replication Server.
The dsconfig list-replication-server command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Server.
1.137. list-sasl-mechanism-handlers
Lists existing SASL Mechanism Handlers.
The dsconfig list-sasl-mechanism-handlers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see SASL Mechanism Handler.
1.138. list-schema-providers
Lists existing Schema Providers.
The dsconfig list-schema-providers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Schema Provider.
1.139. list-service-discovery-mechanisms
Lists existing Service Discovery Mechanisms.
The dsconfig list-service-discovery-mechanisms command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Service Discovery Mechanism.
1.140. list-synchronization-providers
Lists existing Synchronization Providers.
The dsconfig list-synchronization-providers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Synchronization Provider.
1.141. list-trust-manager-providers
Lists existing Trust Manager Providers.
The dsconfig list-trust-manager-providers command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Trust Manager Provider.
1.142. list-virtual-attributes
Lists existing Virtual Attributes.
The dsconfig list-virtual-attributes command takes the following options:
--property {property}
The name of a property to be displayed.
-z | --unit-size {unit}
Display size data using the specified unit. The value for UNIT can be one of b, kb, mb, gb, or tb (bytes, kilobytes, megabytes, gigabytes, or terabytes).
-m | --unit-time {unit}
Display time data using the specified unit. The value for UNIT can be one of ms, s, m, h, d, or w (milliseconds, seconds, minutes, hours, days, or weeks).
Properties used in options depend on the type of object to configure.
For details about available properties, see Virtual Attribute.
1.143. set-access-control-handler-prop
Modifies Access Control Handler properties.
The dsconfig set-access-control-handler-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Control Handler.
1.144. set-access-log-filtering-criteria-prop
Modifies Access Log Filtering Criteria properties.
The dsconfig set-access-log-filtering-criteria-prop command takes the following options:
--publisher-name {name}
The name of the Access Log Publisher.
--criteria-name {name}
The name of the Access Log Filtering Criteria.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Access Log Filtering Criteria.
1.145. set-account-status-notification-handler-prop
Modifies Account Status Notification Handler properties.
The dsconfig set-account-status-notification-handler-prop command takes the following options:
--handler-name {name}
The name of the Account Status Notification Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Account Status Notification Handler.
1.146. set-administration-connector-prop
Modifies Administration Connector properties.
The dsconfig set-administration-connector-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Administration Connector.
1.147. set-alert-handler-prop
Modifies Alert Handler properties.
The dsconfig set-alert-handler-prop command takes the following options:
--handler-name {name}
The name of the Alert Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Alert Handler.
1.148. set-backend-index-prop
Modifies Backend Index properties.
The dsconfig set-backend-index-prop command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend Index.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend Index.
1.149. set-backend-prop
Modifies Backend properties.
The dsconfig set-backend-prop command takes the following options:
--backend-name {name}
The name of the Backend.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend.
1.150. set-backend-vlv-index-prop
Modifies Backend VLV Index properties.
The dsconfig set-backend-vlv-index-prop command takes the following options:
--backend-name {name}
The name of the Pluggable Backend.
--index-name {name}
The name of the Backend VLV Index.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Backend VLV Index.
1.151. set-certificate-mapper-prop
Modifies Certificate Mapper properties.
The dsconfig set-certificate-mapper-prop command takes the following options:
--mapper-name {name}
The name of the Certificate Mapper.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Certificate Mapper.
1.152. set-connection-handler-prop
Modifies Connection Handler properties.
The dsconfig set-connection-handler-prop command takes the following options:
--handler-name {name}
The name of the Connection Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Connection Handler.
1.153. set-crypto-manager-prop
Modifies Crypto Manager properties.
The dsconfig set-crypto-manager-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Crypto Manager.
1.154. set-debug-target-prop
Modifies Debug Target properties.
The dsconfig set-debug-target-prop command takes the following options:
--publisher-name {name}
The name of the Debug Log Publisher.
--target-name {name}
The name of the Debug Target.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Debug Target.
1.155. set-entry-cache-prop
Modifies Entry Cache properties.
The dsconfig set-entry-cache-prop command takes the following options:
--cache-name {name}
The name of the Entry Cache.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Entry Cache.
1.156. set-extended-operation-handler-prop
Modifies Extended Operation Handler properties.
The dsconfig set-extended-operation-handler-prop command takes the following options:
--handler-name {name}
The name of the Extended Operation Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Extended Operation Handler.
1.157. set-external-changelog-domain-prop
Modifies External Changelog Domain properties.
The dsconfig set-external-changelog-domain-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the Replication Domain.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see External Changelog Domain.
1.158. set-global-access-control-policy-prop
Modifies Global Access Control Policy properties.
The dsconfig set-global-access-control-policy-prop command takes the following options:
--policy-name {name}
The name of the Global Access Control Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Access Control Policy.
1.159. set-global-configuration-prop
Modifies Global Configuration properties.
The dsconfig set-global-configuration-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Global Configuration.
1.160. set-group-implementation-prop
Modifies Group Implementation properties.
The dsconfig set-group-implementation-prop command takes the following options:
--implementation-name {name}
The name of the Group Implementation.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Group Implementation.
1.161. set-http-authorization-mechanism-prop
Modifies HTTP Authorization Mechanism properties.
The dsconfig set-http-authorization-mechanism-prop command takes the following options:
--mechanism-name {name}
The name of the HTTP Authorization Mechanism.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Authorization Mechanism.
1.162. set-http-endpoint-prop
Modifies HTTP Endpoint properties.
The dsconfig set-http-endpoint-prop command takes the following options:
--endpoint-name {name}
The name of the HTTP Endpoint.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see HTTP Endpoint.
1.163. set-identity-mapper-prop
Modifies Identity Mapper properties.
The dsconfig set-identity-mapper-prop command takes the following options:
--mapper-name {name}
The name of the Identity Mapper.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Identity Mapper.
1.164. set-key-manager-provider-prop
Modifies Key Manager Provider properties.
The dsconfig set-key-manager-provider-prop command takes the following options:
--provider-name {name}
The name of the Key Manager Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Key Manager Provider.
1.165. set-log-publisher-prop
Modifies Log Publisher properties.
The dsconfig set-log-publisher-prop command takes the following options:
--publisher-name {name}
The name of the Log Publisher.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Publisher.
1.166. set-log-retention-policy-prop
Modifies Log Retention Policy properties.
The dsconfig set-log-retention-policy-prop command takes the following options:
--policy-name {name}
The name of the Log Retention Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Retention Policy.
1.167. set-log-rotation-policy-prop
Modifies Log Rotation Policy properties.
The dsconfig set-log-rotation-policy-prop command takes the following options:
--policy-name {name}
The name of the Log Rotation Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Log Rotation Policy.
1.168. set-password-generator-prop
Modifies Password Generator properties.
The dsconfig set-password-generator-prop command takes the following options:
--generator-name {name}
The name of the Password Generator.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Generator.
1.169. set-password-policy-prop
Modifies Authentication Policy properties.
The dsconfig set-password-policy-prop command takes the following options:
--policy-name {name}
The name of the Authentication Policy.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Policy.
1.170. set-password-storage-scheme-prop
Modifies Password Storage Scheme properties.
The dsconfig set-password-storage-scheme-prop command takes the following options:
--scheme-name {name}
The name of the Password Storage Scheme.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Storage Scheme.
1.171. set-password-validator-prop
Modifies Password Validator properties.
The dsconfig set-password-validator-prop command takes the following options:
--validator-name {name}
The name of the Password Validator.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Password Validator.
1.172. set-plugin-prop
Modifies Plugin properties.
The dsconfig set-plugin-prop command takes the following options:
--plugin-name {name}
The name of the Plugin.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin.
1.173. set-plugin-root-prop
Modifies Plugin Root properties.
The dsconfig set-plugin-root-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Plugin Root.
1.174. set-replication-domain-prop
Modifies Replication Domain properties.
The dsconfig set-replication-domain-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--domain-name {name}
The name of the Replication Domain.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Domain.
1.175. set-replication-server-prop
Modifies Replication Server properties.
The dsconfig set-replication-server-prop command takes the following options:
--provider-name {name}
The name of the Replication Synchronization Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Replication Server.
1.176. set-root-dse-backend-prop
Modifies Root DSE Backend properties.
The dsconfig set-root-dse-backend-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Root DSE Backend.
1.177. set-sasl-mechanism-handler-prop
Modifies SASL Mechanism Handler properties.
The dsconfig set-sasl-mechanism-handler-prop command takes the following options:
--handler-name {name}
The name of the SASL Mechanism Handler.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see SASL Mechanism Handler.
1.178. set-schema-provider-prop
Modifies Schema Provider properties.
The dsconfig set-schema-provider-prop command takes the following options:
--provider-name {name}
The name of the Schema Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Schema Provider.
1.179. set-service-discovery-mechanism-prop
Modifies Service Discovery Mechanism properties.
The dsconfig set-service-discovery-mechanism-prop command takes the following options:
--mechanism-name {name}
The name of the Service Discovery Mechanism.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Service Discovery Mechanism.
1.180. set-synchronization-provider-prop
Modifies Synchronization Provider properties.
The dsconfig set-synchronization-provider-prop command takes the following options:
--provider-name {name}
The name of the Synchronization Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Synchronization Provider.
1.181. set-trust-manager-provider-prop
Modifies Trust Manager Provider properties.
The dsconfig set-trust-manager-provider-prop command takes the following options:
--provider-name {name}
The name of the Trust Manager Provider.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Trust Manager Provider.
1.182. set-virtual-attribute-prop
Modifies Virtual Attribute properties.
The dsconfig set-virtual-attribute-prop command takes the following options:
--name {name}
The name of the Virtual Attribute.
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Virtual Attribute.
1.183. set-work-queue-prop
Modifies Work Queue properties.
The dsconfig set-work-queue-prop command takes the following options:
--set {PROP:VALUE}
Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.
--reset {property}
Resets a property back to its default values where PROP is the name of the property to be reset.
--add {PROP:VALUE}
Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.
--remove {PROP:VALUE}
Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.
Properties used in options depend on the type of object to configure.
For details about available properties, see Work Queue.
Chapter 2. Objects
This chapter describes dsconfig configuration objects.
2.1. Objects by Inheritance
This section lists inheritance relationships between configuration objects.
2.1.1. Core Server
2.1.2. Caching and Backends
2.1.3. Logging
2.1.4. Directory Proxy
2.1.5. Replication
2.1.6. Authentication and Authorization
2.1.7. Service Discovery Mechanism
2.1.8. User Management
2.2. Access Control Handler
This is an abstract object type that cannot be instantiated.
Access Control Handlers manage the application-wide access control. The OpenDJ access control handler is defined through an extensible interface, so that alternate implementations can be created. Only one access control handler may be active in the server at any given time.
Note that OpenDJ also has a privilege subsystem, which may have an impact on what clients may be allowed to do in the server. For example, any user with the bypass-acl privilege is not subject to access control checking regardless of whether the access control implementation is enabled.
2.2.1. Access Control Handlers
The following Access Control Handlers are available:
These Access Control Handlers inherit the properties described below.
2.2.2. Access Control Handler Properties
Basic Properties | ||
---|---|---|
|
2.2.3. Basic Properties
enabled
Synopsis | Indicates whether the Access Control Handler is enabled. If set to FALSE, then no access control is enforced, and any client (including unauthenticated or anonymous clients) could be allowed to perform any operation if not subject to other restrictions, such as those enforced by the privilege subsystem. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Access Control Handler implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.3. Access Log Filtering Criteria
A set of rules which together determine whether a log record should be logged or not.
2.3.2. Access Log Filtering Criteria Properties
2.3.3. Basic Properties
connection-client-address-equal-to
Synopsis | Filters log records associated with connections which match at least one of the specified client host names or address masks. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. |
Default Value | None |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
connection-client-address-not-equal-to
Synopsis | Filters log records associated with connections which do not match any of the specified client host names or address masks. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. |
Default Value | None |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
connection-port-equal-to
Synopsis | Filters log records associated with connections to any of the specified listener port numbers. |
Default Value | None |
Allowed Values | An integer. Lower limit: 1. Upper limit: 65535. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
connection-protocol-equal-to
Synopsis | Filters log records associated with connections which match any of the specified protocols. |
Description | Typical values include "ldap", "ldaps", or "jmx". |
Default Value | None |
Allowed Values | The protocol name as reported in the access log. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-record-type
Synopsis | Filters log records based on their type. |
Default Value | None |
Allowed Values | abandon: Abandon operations add: Add operations bind: Bind operations compare: Compare operations connect: Client connections delete: Delete operations disconnect: Client disconnections extended: Extended operations modify: Modify operations rename: Rename operations search: Search operations unbind: Unbind operations |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
request-target-dn-equal-to
Synopsis | Filters operation log records associated with operations which target entries matching at least one of the specified DN patterns. |
Description | Valid DN filters are strings composed of zero or more wildcards. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com). |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
request-target-dn-not-equal-to
Synopsis | Filters operation log records associated with operations which target entries matching none of the specified DN patterns. |
Description | Valid DN filters are strings composed of zero or more wildcards. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com). |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
response-etime-greater-than
Synopsis | Filters operation response log records associated with operations which took longer than the specified number of milli-seconds to complete. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
response-etime-less-than
Synopsis | Filters operation response log records associated with operations which took less than the specified number of milli-seconds to complete. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
response-result-code-equal-to
Synopsis | Filters operation response log records associated with operations which include any of the specified result codes. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
response-result-code-not-equal-to
Synopsis | Filters operation response log records associated with operations which do not include any of the specified result codes. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
search-response-is-indexed
Synopsis | Filters search operation response log records associated with searches which were either indexed or unindexed. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
search-response-nentries-greater-than
Synopsis | Filters search operation response log records associated with searches which returned more than the specified number of entries. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
search-response-nentries-less-than
Synopsis | Filters search operation response log records associated with searches which returned less than the specified number of entries. |
Description | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. |
Default Value | None |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
user-dn-equal-to
Synopsis | Filters log records associated with users matching at least one of the specified DN patterns. |
Description | Valid DN filters are strings composed of zero or more wildcards. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com). |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
user-dn-not-equal-to
Synopsis | Filters log records associated with users which do not match any of the specified DN patterns. |
Description | Valid DN filters are strings composed of zero or more wildcards. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com). |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
user-is-member-of
Synopsis | Filters log records associated with users which are members of at least one of the specified groups. |
Default Value | None |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
user-is-not-member-of
Synopsis | Filters log records associated with users which are not members of any of the specified groups. |
Default Value | None |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.4. Access Log Publisher
This is an abstract object type that cannot be instantiated.
Access Log Publishers are responsible for distributing access log messages from the access logger to a destination.
Access log messages provide information about the types of operations processed by the server.
2.4.1. Access Log Publishers
The following Access Log Publishers are available:
These Access Log Publishers inherit the properties described below.
2.4.2. Parent
The Access Log Publisher object inherits from Log Publisher.
2.4.3. Dependencies
The following objects belong to Access Log Publishers:
2.4.4. Access Log Publisher Properties
Basic Properties | Advanced Properties | |||||
---|---|---|---|---|---|---|
|
|
2.4.5. Basic Properties
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filtering-policy
Synopsis | Specifies how filtering criteria should be applied to log records. |
Default Value | no-filtering |
Allowed Values | exclusive: Records must not match any of the filtering criteria in order to be logged. inclusive: Records must match at least one of the filtering criteria in order to be logged. no-filtering: No filtering will be performed, and all records will be logged. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the Access Log Publisher implementation. |
Default Value | org.opends.server.loggers.AccessLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.4.6. Advanced Properties
Use the --advanced
option to access advanced properties.
suppress-internal-operations
Synopsis | Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-synchronization-operations
Synopsis | Indicates whether access messages that are generated by synchronization operations should be suppressed. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.5. Account Status Notification Handler
This is an abstract object type that cannot be instantiated.
Account Status Notification Handlers are invoked to provide notification to users in some form (for example, by an email message) when the status of a user's account has changed in some way. The Account Status Notification Handler can be used to notify the user and/or administrators of the change.
2.5.1. Account Status Notification Handlers
The following Account Status Notification Handlers are available:
These Account Status Notification Handlers inherit the properties described below.
2.5.2. Dependencies
The following objects depend on Account Status Notification Handlers:
2.5.3. Account Status Notification Handler Properties
Basic Properties | ||
---|---|---|
|
2.5.4. Basic Properties
enabled
Synopsis | Indicates whether the Account Status Notification Handler is enabled. Only enabled handlers are invoked whenever a related event occurs in the server. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Account Status Notification Handler implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.6. Admin Endpoint
The Admin Endpoint provides RESTful access to OpenDJ's monitoring and configuration backends.
2.6.1. Parent
The Admin Endpoint object inherits from HTTP Endpoint.
2.6.2. Admin Endpoint Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.6.3. Basic Properties
Synopsis | The HTTP authorization mechanisms supported by this HTTP Endpoint. |
Default Value | None |
Allowed Values | The name of an existing HTTP Authorization Mechanism. The referenced authorization mechanism must be enabled when the HTTP Endpoint is enabled. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-path
Synopsis | All HTTP requests matching the base path or subordinate to it will be routed to the HTTP endpoint unless a more specific HTTP endpoint is found. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
enabled
Synopsis | Indicates whether the HTTP Endpoint is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.6.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Admin Endpoint implementation. |
Default Value | org.opends.server.protocols.http.rest2ldap.AdminEndpoint |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.7. Administration Connector
The Administration Connector is used to interact with administration tools using LDAP.
It is a dedicated entry point for administration.
2.7.1. Dependencies
Administration Connectors depend on the following objects:
2.7.2. Administration Connector Properties
2.7.3. Basic Properties
allowed-client
Synopsis | A set of clients who will be allowed to establish connections to this Administration Connector. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | All clients with addresses that do not match an address on the deny list are allowed. If there is no deny list, then all clients are allowed. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
denied-client
Synopsis | A set of clients who are not allowed to establish connections to this Administration Connector. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. If both allowed and denied client masks are defined and a client connection matches one or more masks in both lists, then the connection is denied. If only a denied list is specified, then any client not matching a mask in that list is allowed. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | If an allow list is specified, then only clients with addresses on the allow list are allowed. Otherwise, all clients are allowed. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
key-manager-provider
Synopsis | Specifies the name of the key manager that is used with the Administration Connector . |
Default Value | None |
Allowed Values | The name of an existing Key Manager Provider. The referenced key manager provider must be enabled. |
Multi-valued | No |
Required | Yes |
Admin Action Required | Restart the server for changes to take effect. |
Advanced | No |
Read-Only | No |
listen-address
Synopsis | Specifies the address or set of addresses on which this Administration Connector should listen for connections from LDAP clients. |
Description | Multiple addresses may be provided as separate values for this attribute. If no values are provided, then the Administration Connector listens on all interfaces. |
Default Value | 0.0.0.0 |
Allowed Values | An IP address. |
Multi-valued | Yes |
Required | No |
Admin Action Required | Restart the server for changes to take effect. |
Advanced | No |
Read-Only | No |
listen-port
Synopsis | Specifies the port number on which the Administration Connector will listen for connections from clients. |
Description | Only a single port number may be provided. |
Default Value | None |
Allowed Values | An integer. Lower limit: 1. Upper limit: 65535. |
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
restricted-client
Synopsis | A set of clients who will be limited to the maximum number of connections specified by the "restricted-client-connection-limit" property. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | No restrictions are imposed on the number of connections a client can open. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
restricted-client-connection-limit
Synopsis | Specifies the maximum number of connections a restricted client can open at the same time to this Administration Connector. |
Description | Once Directory Server accepts the specified number of connections from a client specified in restricted-client, any additional connection will be rejected. The number of connections is maintained by IP address. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | 100 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
ssl-cert-nickname
Synopsis | Specifies the nicknames (also called the aliases) of the keys or key pairs that the Administration Connector should use when performing SSL communication. The property can be used multiple times (referencing different nicknames) when server certificates with different public key algorithms are used in parallel (for example, RSA, DSA, and ECC-based algorithms). When a nickname refers to an asymmetric (public/private) key pair, the nickname for the public key certificate and associated private key entry must match exactly. A single nickname is used to retrieve both the public key and the private key. |
Default Value | Let the server decide. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | Restart the server for changes to take effect. |
Advanced | No |
Read-Only | No |
ssl-cipher-suite
Synopsis | Specifies the names of the SSL cipher suites that are allowed for use in SSL communication. |
Default Value | Uses the default set of SSL cipher suites provided by the server's JVM. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but will only impact new SSL/TLS-based sessions created after the change. |
Advanced | No |
Read-Only | No |
ssl-protocol
Synopsis | Specifies the names of the SSL protocols that are allowed for use in SSL or StartTLS communication. |
Default Value | Uses the default set of SSL protocols provided by the server's JVM. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. |
Advanced | No |
Read-Only | No |
trust-manager-provider
Synopsis | Specifies the name of the trust manager that is used with the Administration Connector . |
Default Value | None |
Allowed Values | The name of an existing Trust Manager Provider. The referenced trust manager provider must be enabled. |
Multi-valued | No |
Required | Yes |
Admin Action Required | Restart the server for changes to take effect. |
Advanced | No |
Read-Only | No |
2.8. AES Password Storage Scheme
The AES Password Storage Scheme provides a mechanism for encoding user passwords using the AES reversible encryption mechanism.
This scheme contains only an implementation for the user password syntax, with a storage scheme name of "AES".
2.8.1. Parent
The AES Password Storage Scheme object inherits from Password Storage Scheme.
2.8.2. AES Password Storage Scheme Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.8.3. Basic Properties
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.8.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the AES Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.AESPasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.9. Alert Handler
This is an abstract object type that cannot be instantiated.
Alert Handlers are used to notify administrators of significant problems or notable events that occur in the OpenDJ directory server.
2.9.1. Alert Handlers
The following Alert Handlers are available:
These Alert Handlers inherit the properties described below.
2.9.2. Alert Handler Properties
Basic Properties | ||||
---|---|---|---|---|
|
2.9.3. Basic Properties
disabled-alert-type
Synopsis | Specifies the names of the alert types that are disabled for this alert handler. |
Description | If there are any values for this attribute, then no alerts with any of the specified types are allowed. If there are no values for this attribute, then only alerts with a type included in the set of enabled alert types are allowed, or if there are no values for the enabled alert types option, then all alert types are allowed. |
Default Value | If there is a set of enabled alert types, then only alerts with one of those types are allowed. Otherwise, all alerts are allowed. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Alert Handler is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled-alert-type
Synopsis | Specifies the names of the alert types that are enabled for this alert handler. |
Description | If there are any values for this attribute, then only alerts with one of the specified types are allowed (unless they are also included in the disabled alert types). If there are no values for this attribute, then any alert with a type not included in the list of disabled alert types is allowed. |
Default Value | All alerts with types not included in the set of disabled alert types are allowed. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Alert Handler implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.10. Alive HTTP endpoint
The Alive HTTP endpoint provides a way to check whether the server is facing serious problems that need administrative actions to recover.
This endpoint responds 200 without content when the server is alive or 503 with a JSON containing an array of serious errors in the field "alive-errors".
2.10.1. Parent
The Alive HTTP endpoint object inherits from HTTP Endpoint.
2.10.2. Alive HTTP endpoint Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.10.3. Basic Properties
Synopsis | The HTTP authorization mechanisms supported by this HTTP Endpoint. |
Default Value | None |
Allowed Values | The name of an existing HTTP Authorization Mechanism. The referenced authorization mechanism must be enabled when the HTTP Endpoint is enabled. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-path
Synopsis | All HTTP requests matching the base path or subordinate to it will be routed to the HTTP endpoint unless a more specific HTTP endpoint is found. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
enabled
Synopsis | Indicates whether the HTTP Endpoint is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.10.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Alive HTTP endpoint implementation. |
Default Value | org.opends.server.protocols.http.AliveEndpoint |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.11. Anonymous SASL Mechanism Handler
The ANONYMOUS SASL mechanism provides the ability for clients to perform an anonymous bind using a SASL mechanism.
The only real benefit that this provides over a normal anonymous bind (that is, using simple authentication with no password) is that the ANONYMOUS SASL mechanism also allows the client to include a trace string in the request. This trace string can help identify the application that performed the bind (although since there is no authentication, there is no assurance that some other client did not spoof that trace string).
2.11.1. Parent
The Anonymous SASL Mechanism Handler object inherits from SASL Mechanism Handler.
2.11.2. Anonymous SASL Mechanism Handler Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.11.3. Basic Properties
enabled
Synopsis | Indicates whether the SASL mechanism handler is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.11.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the SASL mechanism handler implementation. |
Default Value | org.opends.server.extensions.AnonymousSASLMechanismHandler |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.12. Attribute Cleanup Plugin
A pre-parse plugin which can be used to remove and rename attributes in ADD and MODIFY requests before being processed.
This plugin should be used in order maintain interoperability with client applications which attempt to update attributes in a way which is incompatible with LDAPv3 or OpenDJ. For example, this plugin may be used in order to remove changes to operational attributes such as modifiersName, creatorsName, modifyTimestamp, and createTimestamp (Sun DSEE chaining does this).
2.12.1. Parent
The Attribute Cleanup Plugin object inherits from Plugin.
2.12.2. Attribute Cleanup Plugin Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.12.3. Basic Properties
enabled
Synopsis | Indicates whether the plug-in is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the plug-in implementation. |
Default Value | org.opends.server.plugins.AttributeCleanupPlugin |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
remove-inbound-attributes
Synopsis | A list of attributes which should be removed from incoming add or modify requests. |
Default Value | No attributes will be removed |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
rename-inbound-attributes
Synopsis | A list of attributes which should be renamed in incoming add or modify requests. |
Default Value | No attributes will be renamed |
Allowed Values | An attribute name mapping. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.12.4. Advanced Properties
Use the --advanced
option to access advanced properties.
invoke-for-internal-operations
Synopsis | Indicates whether the plug-in should be invoked for internal operations. |
Description | Any plug-in that can be invoked for internal operations must ensure that it does not create any new internal operatons that can cause the same plug-in to be re-invoked. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
plugin-type
Synopsis | Specifies the set of plug-in types for the plug-in, which specifies the times at which the plug-in is invoked. |
Default Value | preparseadd preparsemodify |
Allowed Values | intermediateresponse: Invoked before sending an intermediate repsonse message to the client. ldifexport: Invoked for each operation to be written during an LDIF export. ldifimport: Invoked for each entry read during an LDIF import. ldifimportbegin: Invoked at the beginning of an LDIF import session. ldifimportend: Invoked at the end of an LDIF import session. postconnect: Invoked whenever a new connection is established to the server. postdisconnect: Invoked whenever an existing connection is terminated (by either the client or the server). postoperationabandon: Invoked after completing the abandon processing. postoperationadd: Invoked after completing the core add processing but before sending the response to the client. postoperationbind: Invoked after completing the core bind processing but before sending the response to the client. postoperationcompare: Invoked after completing the core compare processing but before sending the response to the client. postoperationdelete: Invoked after completing the core delete processing but before sending the response to the client. postoperationextended: Invoked after completing the core extended processing but before sending the response to the client. postoperationmodify: Invoked after completing the core modify processing but before sending the response to the client. postoperationmodifydn: Invoked after completing the core modify DN processing but before sending the response to the client. postoperationsearch: Invoked after completing the core search processing but before sending the response to the client. postoperationunbind: Invoked after completing the unbind processing. postresponseadd: Invoked after sending the add response to the client. postresponsebind: Invoked after sending the bind response to the client. postresponsecompare: Invoked after sending the compare response to the client. postresponsedelete: Invoked after sending the delete response to the client. postresponseextended: Invoked after sending the extended response to the client. postresponsemodify: Invoked after sending the modify response to the client. postresponsemodifydn: Invoked after sending the modify DN response to the client. postresponsesearch: Invoked after sending the search result done message to the client. postsynchronizationadd: Invoked after completing post-synchronization processing for an add operation. postsynchronizationdelete: Invoked after completing post-synchronization processing for a delete operation. postsynchronizationmodify: Invoked after completing post-synchronization processing for a modify operation. postsynchronizationmodifydn: Invoked after completing post-synchronization processing for a modify DN operation. preoperationadd: Invoked prior to performing the core add processing. preoperationbind: Invoked prior to performing the core bind processing. preoperationcompare: Invoked prior to performing the core compare processing. preoperationdelete: Invoked prior to performing the core delete processing. preoperationextended: Invoked prior to performing the core extended processing. preoperationmodify: Invoked prior to performing the core modify processing. preoperationmodifydn: Invoked prior to performing the core modify DN processing. preoperationsearch: Invoked prior to performing the core search processing. preparseabandon: Invoked prior to parsing an abandon request. preparseadd: Invoked prior to parsing an add request. preparsebind: Invoked prior to parsing a bind request. preparsecompare: Invoked prior to parsing a compare request. preparsedelete: Invoked prior to parsing a delete request. preparseextended: Invoked prior to parsing an extended request. preparsemodify: Invoked prior to parsing a modify request. preparsemodifydn: Invoked prior to parsing a modify DN request. preparsesearch: Invoked prior to parsing a search request. preparseunbind: Invoked prior to parsing an unbind request. searchresultentry: Invoked before sending a search result entry to the client. searchresultreference: Invoked before sending a search result reference to the client. shutdown: Invoked during a graceful directory server shutdown. startup: Invoked during the directory server startup process. subordinatedelete: Invoked in the course of deleting a subordinate entry of a delete operation. subordinatemodifydn: Invoked in the course of moving or renaming an entry subordinate to the target of a modify DN operation. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.13. Attribute Value Password Validator
The Attribute Value Password Validator attempts to determine whether a proposed password is acceptable for use by determining whether that password is contained in any attribute within the user's entry.
It can be configured to look in all attributes or in a specified subset of attributes.
2.13.1. Parent
The Attribute Value Password Validator object inherits from Password Validator.
2.13.2. Attribute Value Password Validator Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.13.3. Basic Properties
check-substrings
Synopsis | Indicates whether this password validator is to match portions of the password string against attribute values. |
Description | If "false" then only match the entire password against attribute values otherwise ("true") check whether the password contains attribute values. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the password validator is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
match-attribute
Synopsis | Specifies the name(s) of the attribute(s) whose values should be checked to determine whether they match the provided password. If no values are provided, then the server checks if the proposed password matches the value of any attribute in the user's entry. |
Default Value | All attributes in the user entry will be checked. |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
min-substring-length
Synopsis | Indicates the minimal length of the substring within the password in case substring checking is enabled. |
Description | If "check-substrings" option is set to true, then this parameter defines the length of the smallest word which should be used for substring matching. Use with caution because values below 3 might disqualify valid passwords. |
Default Value | 5 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
test-reversed-password
Synopsis | Indicates whether this password validator should test the reversed value of the provided password as well as the order in which it was given. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.13.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the password validator implementation. |
Default Value | org.opends.server.extensions.AttributeValuePasswordValidator |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.14. Authentication Policy
This is an abstract object type that cannot be instantiated.
Authentication Policies define the policies which should be used for authenticating users and managing the password and other account related state.
2.14.1. Authentication Policies
The following Authentication Policies are available:
These Authentication Policies inherit the properties described below.
2.14.3. Authentication Policy Properties
Basic Properties | |
---|---|
|
2.14.4. Basic Properties
java-class
Synopsis | Specifies the fully-qualified name of the Java class which provides the Authentication Policy implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.15. Backend
This is an abstract object type that cannot be instantiated.
Backends are responsible for providing access to the underlying data presented by the server.
The data may be stored locally in an embedded database, remotely in an external system, or generated on the fly (for example, calculated from other information that is available).
2.15.1. Backends
The following Backends are available:
These Backends inherit the properties described below.
2.15.2. Backend Properties
Basic Properties | |||
---|---|---|---|
|
2.15.3. Basic Properties
backend-id
Synopsis | Specifies a name to identify the associated backend. |
Description | The name must be unique among all backends in the server. The backend ID may not be altered after the backend is created in the server. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
enabled
Synopsis | Indicates whether the backend is enabled in the server. |
Description | If a backend is not enabled, then its contents are not accessible when processing operations. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the backend implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.16. Backend Index
Backend Indexes are used to store information that makes it possible to locate entries very quickly when processing search operations.
Indexing is performed on a per-attribute level and different types of indexing may be performed for different kinds of attributes, based on how they are expected to be accessed during search operations.
2.16.2. Backend Index Properties
Basic Properties | Advanced Properties | ||||||||
---|---|---|---|---|---|---|---|---|---|
|
|
2.16.3. Basic Properties
attribute
Synopsis | Specifies the name of the attribute for which the index is to be maintained. |
Default Value | None |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
confidentiality-enabled
Synopsis | Specifies whether contents of the index should be confidential. |
Description | Setting the flag to true will hash keys for equality type indexes using SHA-1 and encrypt the list of entries matching a substring key for substring indexes. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None If the index for the attribute must be protected for security purposes and values for that attribute already exist in the database, the index must be rebuilt before it will be accurate. The property cannot be set on a backend for which confidentiality is not enabled. |
Advanced | No |
Read-Only | No |
index-extensible-matching-rule
Synopsis | The extensible matching rule in an extensible index. |
Description | An extensible matching rule must be specified using either LOCALE or OID of the matching rule. |
Default Value | No extensible matching rules will be indexed. |
Allowed Values | A Locale or an OID. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None The index must be rebuilt before it will reflect the new value. |
Advanced | No |
Read-Only | No |
index-type
Synopsis | Specifies the type(s) of indexing that should be performed for the associated attribute. |
Description | For equality, presence, and substring index types, the associated attribute type must have a corresponding matching rule. |
Default Value | None |
Allowed Values | approximate: This index type is used to improve the efficiency of searches using approximate matching search filters. equality: This index type is used to improve the efficiency of searches using equality search filters. extensible: This index type is used to improve the efficiency of searches using extensible matching search filters. ordering: This index type is used to improve the efficiency of searches using "greater than or equal to" or "less then or equal to" search filters. presence: This index type is used to improve the efficiency of searches using the presence search filters. substring: This index type is used to improve the efficiency of searches using substring search filters. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None If any new index types are added for an attribute, and values for that attribute already exist in the database, the index must be rebuilt before it will be accurate. |
Advanced | No |
Read-Only | No |
ttl-age
Synopsis | The age when timestamps are considered to have expired. |
Default Value | 0s |
Allowed Values | Uses Duration Syntax. Lower limit: 0 milliseconds. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
ttl-enabled
Synopsis | Enable TTL for this generalized time index. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.16.4. Advanced Properties
Use the --advanced
option to access advanced properties.
index-entry-limit
Synopsis | Specifies the maximum number of entries that are allowed to match a given index key before that particular index key is no longer maintained. |
Description | This is analogous to the ALL IDs threshold in the Sun Java System Directory Server. If this is specified, its value overrides the JE backend-wide configuration. For no limit, use 0 for the value. Changing the index entry limit significantly can result in serious performance degradation. Please read the documentation before changing this setting. |
Default Value | 4000 |
Allowed Values | An integer. Lower limit: 0. Upper limit: 2147483647. |
Multi-valued | No |
Required | No |
Admin Action Required | None If any index keys have already reached this limit, indexes must be rebuilt before they will be allowed to use the new limit. |
Advanced | Yes |
Read-Only | No |
substring-length
Synopsis | The length of substrings in a substring index. |
Default Value | 6 |
Allowed Values | An integer. Lower limit: 3. |
Multi-valued | No |
Required | No |
Admin Action Required | None The index must be rebuilt before it will reflect the new value. |
Advanced | Yes |
Read-Only | No |
2.17. Backend VLV Index
Backend VLV Indexes are used to store information about a specific search request that makes it possible to efficiently process them using the VLV control.
A VLV index effectively notifies the server that a virtual list view, with specific query and sort parameters, will be performed. This index also allows the server to collect and maintain the information required to make using the virtual list view faster.
2.17.2. Backend VLV Index Properties
Basic Properties | |||||
---|---|---|---|---|---|
|
2.17.3. Basic Properties
base-dn
Synopsis | Specifies the base DN used in the search query that is being indexed. |
Default Value | None |
Allowed Values | A valid DN. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None The index must be rebuilt after modifying this property. |
Advanced | No |
Read-Only | No |
filter
Synopsis | Specifies the LDAP filter used in the query that is being indexed. |
Default Value | None |
Allowed Values | A valid LDAP search filter. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None The index must be rebuilt after modifying this property. |
Advanced | No |
Read-Only | No |
name
Synopsis | Specifies a unique name for this VLV index. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None The VLV index name cannot be altered after the index is created. |
Advanced | No |
Read-Only | Yes |
scope
Synopsis | Specifies the LDAP scope of the query that is being indexed. |
Default Value | None |
Allowed Values | base-object: Search the base object only. single-level: Search the immediate children of the base object but do not include any of their descendants or the base object itself. subordinate-subtree: Search the entire subtree below the base object but do not include the base object itself. whole-subtree: Search the base object and the entire subtree below the base object. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None The index must be rebuilt after modifying this property. |
Advanced | No |
Read-Only | No |
sort-order
Synopsis | Specifies the names of the attributes that are used to sort the entries for the query being indexed. |
Description | Multiple attributes can be used to determine the sort order by listing the attribute names from highest to lowest precedence. Optionally, + or - can be prefixed to the attribute name to sort the attribute in ascending order or descending order respectively. |
Default Value | None |
Allowed Values | Valid attribute types defined in the schema, separated by a space and optionally prefixed by + or -. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None The index must be rebuilt after modifying this property. |
Advanced | No |
Read-Only | No |
2.18. Backup Backend
The Backup Backend provides read-only access to the set of backups that are available for OpenDJ.
It is provided as a convenience feature that makes it easier to determine what backups are available to be restored if necessary.
2.18.1. Parent
The Backup Backend object inherits from Local Backend.
2.18.2. Backup Backend Properties
Basic Properties | Advanced Properties | |||||
---|---|---|---|---|---|---|
|
|
2.18.3. Basic Properties
backend-id
Synopsis | Specifies a name to identify the associated backend. |
Description | The name must be unique among all backends in the server. The backend ID may not be altered after the backend is created in the server. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
backup-directory
Synopsis | Specifies the path to a backup directory containing one or more backups for a particular backend. |
Description | This is a multivalued property. Each value may specify a different backup directory if desired (one for each backend for which backups are taken). Values may be either absolute paths or paths that are relative to the base of the OpenDJ directory server installation. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the backend is enabled in the server. |
Description | If a backend is not enabled, then its contents are not accessible when processing operations. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.18.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the backend implementation. |
Default Value | org.opends.server.backends.BackupBackend |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
writability-mode
Synopsis | Specifies the behavior that the backend should use when processing write operations. |
Default Value | disabled |
Allowed Values | disabled: Causes all write attempts to fail. enabled: Allows write operations to be performed in that backend (if the requested operation is valid, the user has permission to perform the operation, the backend supports that type of write operation, and the global writability-mode property is also enabled). internal-only: Causes external write attempts to fail but allows writes by replication and internal operations. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.19. Base64 Password Storage Scheme
The Base64 Password Storage Scheme provides a mechanism for encoding user passwords using the BASE64 encoding mechanism.
This scheme contains only an implementation for the user password syntax, with a storage scheme name of "BASE64". The Base64 Password Storage Scheme merely obscures the password so that the clear-text password is not available to casual observers. However, it offers no real protection and should only be used if there are client applications that specifically require this capability.
2.19.1. Parent
The Base64 Password Storage Scheme object inherits from Password Storage Scheme.
2.19.2. Base64 Password Storage Scheme Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.19.3. Basic Properties
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.19.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Base64 Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.Base64PasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.20. Bcrypt Password Storage Scheme
The Bcrypt Password Storage Scheme provides a mechanism for encoding user passwords using the bcrypt message digest algorithm.
This scheme contains an implementation for the user password syntax, with a storage scheme name of "BCRYPT".
2.20.1. Parent
The Bcrypt Password Storage Scheme object inherits from Password Storage Scheme.
2.20.2. Bcrypt Password Storage Scheme Properties
Basic Properties | Advanced Properties | |||
---|---|---|---|---|
|
|
2.20.3. Basic Properties
bcrypt-cost
Synopsis | The cost parameter specifies a key expansion iteration count as a power of two. A default value of 12 (2^12 iterations) is considered in 2016 as a reasonable balance between responsiveness and security for regular users. |
Default Value | 12 |
Allowed Values | An integer. Lower limit: 4. Upper limit: 30. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.20.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Bcrypt Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.BcryptPasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.21. Blind Trust Manager Provider
The blind trust manager provider always trusts any certificate that is presented to it, regardless of its issuer, subject, and validity dates.
Use the blind trust manager provider only for testing purposes, because it allows clients to use forged certificates and authenticate as virtually any user in the server.
2.21.1. Parent
The Blind Trust Manager Provider object inherits from Trust Manager Provider.
2.21.2. Blind Trust Manager Provider Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.21.3. Basic Properties
enabled
Synopsis | Indicate whether the Trust Manager Provider is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.21.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | The fully-qualified name of the Java class that provides the Blind Trust Manager Provider implementation. |
Default Value | org.opends.server.extensions.BlindTrustManagerProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.22. Blowfish Password Storage Scheme
The Blowfish Password Storage Scheme provides a mechanism for encoding user passwords using the Blowfish reversible encryption mechanism.
This scheme contains only an implementation for the user password syntax, with a storage scheme name of "BLOWFISH".
2.22.1. Parent
The Blowfish Password Storage Scheme object inherits from Password Storage Scheme.
2.22.2. Blowfish Password Storage Scheme Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.22.3. Basic Properties
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.22.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Blowfish Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.BlowfishPasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.23. Cancel Extended Operation Handler
The Cancel Extended Operation Handler provides support for the LDAP cancel extended operation as defined in RFC 3909.
It allows clients to cancel operations initiated from earlier requests. The property ensures that both the cancel request and the operation being canceled receives response messages.
2.23.1. Parent
The Cancel Extended Operation Handler object inherits from Extended Operation Handler.
2.23.2. Cancel Extended Operation Handler Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.23.3. Basic Properties
enabled
Synopsis | Indicates whether the Extended Operation Handler is enabled (that is, whether the types of extended operations are allowed in the server). |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.23.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Cancel Extended Operation Handler implementation. |
Default Value | org.opends.server.extensions.CancelExtendedOperation |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.24. Certificate Mapper
This is an abstract object type that cannot be instantiated.
Certificate Mappers are responsible for establishing a mapping between a client certificate and the entry for the user that corresponds to that certificate.
2.24.1. Certificate Mappers
The following Certificate Mappers are available:
These Certificate Mappers inherit the properties described below.
2.24.2. Dependencies
The following objects depend on Certificate Mappers:
2.24.3. Certificate Mapper Properties
Basic Properties | |||
---|---|---|---|
|
2.24.4. Basic Properties
enabled
Synopsis | Indicates whether the Certificate Mapper is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
issuer-attribute
Synopsis | Specifies the name or OID of the attribute whose value should exactly match the certificate issuer DN. |
Description | Certificate issuer verification should be enabled whenever multiple CAs are trusted in order to prevent impersonation. In particular, it is possible for different CAs to issue certificates having the same subject DN. |
Default Value | The certificate issuer DN will not be verified. |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Certificate Mapper implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.25. Change Number Control Plugin
The Change Number Control Plugin returns the change number generated by the replication subsystem.
The Change Number Control Plugin returns the change number generated by the Multi-Master Replication subsystem when : - the Multi-Master Replication is configured and enabled - the request is a write operation (add, delete, modify, moddn) - the control is part of a request. If all of the above are true, the response contains a control response with a string representing the change number. The implementation for the chnage number control plug-in is contained in the org.opends.server.plugins.ChangeNumberControlPlugin class. It must be configured with the postOperationAdd, postOperationDelete, postOperationModify and postOperationModifyDN plug-in types, but it does not have any other custom configuration.
2.25.1. Parent
The Change Number Control Plugin object inherits from Plugin.
2.25.2. Change Number Control Plugin Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.25.3. Basic Properties
enabled
Synopsis | Indicates whether the plug-in is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.25.4. Advanced Properties
Use the --advanced
option to access advanced properties.
invoke-for-internal-operations
Synopsis | Indicates whether the plug-in should be invoked for internal operations. |
Description | Any plug-in that can be invoked for internal operations must ensure that it does not create any new internal operatons that can cause the same plug-in to be re-invoked. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the plug-in implementation. |
Default Value | org.opends.server.plugins.ChangeNumberControlPlugin |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
plugin-type
Synopsis | Specifies the set of plug-in types for the plug-in, which specifies the times at which the plug-in is invoked. |
Default Value | postOperationAdd postOperationDelete postOperationModify postOperationModifyDN |
Allowed Values | intermediateresponse: Invoked before sending an intermediate repsonse message to the client. ldifexport: Invoked for each operation to be written during an LDIF export. ldifimport: Invoked for each entry read during an LDIF import. ldifimportbegin: Invoked at the beginning of an LDIF import session. ldifimportend: Invoked at the end of an LDIF import session. postconnect: Invoked whenever a new connection is established to the server. postdisconnect: Invoked whenever an existing connection is terminated (by either the client or the server). postoperationabandon: Invoked after completing the abandon processing. postoperationadd: Invoked after completing the core add processing but before sending the response to the client. postoperationbind: Invoked after completing the core bind processing but before sending the response to the client. postoperationcompare: Invoked after completing the core compare processing but before sending the response to the client. postoperationdelete: Invoked after completing the core delete processing but before sending the response to the client. postoperationextended: Invoked after completing the core extended processing but before sending the response to the client. postoperationmodify: Invoked after completing the core modify processing but before sending the response to the client. postoperationmodifydn: Invoked after completing the core modify DN processing but before sending the response to the client. postoperationsearch: Invoked after completing the core search processing but before sending the response to the client. postoperationunbind: Invoked after completing the unbind processing. postresponseadd: Invoked after sending the add response to the client. postresponsebind: Invoked after sending the bind response to the client. postresponsecompare: Invoked after sending the compare response to the client. postresponsedelete: Invoked after sending the delete response to the client. postresponseextended: Invoked after sending the extended response to the client. postresponsemodify: Invoked after sending the modify response to the client. postresponsemodifydn: Invoked after sending the modify DN response to the client. postresponsesearch: Invoked after sending the search result done message to the client. postsynchronizationadd: Invoked after completing post-synchronization processing for an add operation. postsynchronizationdelete: Invoked after completing post-synchronization processing for a delete operation. postsynchronizationmodify: Invoked after completing post-synchronization processing for a modify operation. postsynchronizationmodifydn: Invoked after completing post-synchronization processing for a modify DN operation. preoperationadd: Invoked prior to performing the core add processing. preoperationbind: Invoked prior to performing the core bind processing. preoperationcompare: Invoked prior to performing the core compare processing. preoperationdelete: Invoked prior to performing the core delete processing. preoperationextended: Invoked prior to performing the core extended processing. preoperationmodify: Invoked prior to performing the core modify processing. preoperationmodifydn: Invoked prior to performing the core modify DN processing. preoperationsearch: Invoked prior to performing the core search processing. preparseabandon: Invoked prior to parsing an abandon request. preparseadd: Invoked prior to parsing an add request. preparsebind: Invoked prior to parsing a bind request. preparsecompare: Invoked prior to parsing a compare request. preparsedelete: Invoked prior to parsing a delete request. preparseextended: Invoked prior to parsing an extended request. preparsemodify: Invoked prior to parsing a modify request. preparsemodifydn: Invoked prior to parsing a modify DN request. preparsesearch: Invoked prior to parsing a search request. preparseunbind: Invoked prior to parsing an unbind request. searchresultentry: Invoked before sending a search result entry to the client. searchresultreference: Invoked before sending a search result reference to the client. shutdown: Invoked during a graceful directory server shutdown. startup: Invoked during the directory server startup process. subordinatedelete: Invoked in the course of deleting a subordinate entry of a delete operation. subordinatemodifydn: Invoked in the course of moving or renaming an entry subordinate to the target of a modify DN operation. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.26. Character Set Password Validator
The Character Set Password Validator determines whether a proposed password is acceptable by checking whether it contains a sufficient number of characters from one or more user-defined character sets and ranges.
For example, the validator can ensure that passwords must have at least one lowercase letter, one uppercase letter, one digit, and one symbol.
2.26.1. Parent
The Character Set Password Validator object inherits from Password Validator.
2.26.2. Character Set Password Validator Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.26.3. Basic Properties
allow-unclassified-characters
Synopsis | Indicates whether this password validator allows passwords to contain characters outside of any of the user-defined character sets and ranges. |
Description | If this is "false", then only those characters in the user-defined character sets and ranges may be used in passwords. Any password containing a character not included in any character set or range will be rejected. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
character-set
Synopsis | Specifies a character set containing characters that a password may contain and a value indicating the minimum number of characters required from that set. |
Description | Each value must be an integer (indicating the minimum required characters from the set which may be zero, indicating that the character set is optional) followed by a colon and the characters to include in that set (for example, "3:abcdefghijklmnopqrstuvwxyz" indicates that a user password must contain at least three characters from the set of lowercase ASCII letters). Multiple character sets can be defined in separate values, although no character can appear in more than one character set. |
Default Value | If no sets are specified, the validator only uses the defined character ranges. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
character-set-ranges
Synopsis | Specifies a character range containing characters that a password may contain and a value indicating the minimum number of characters required from that range. |
Description | Each value must be an integer (indicating the minimum required characters from the range which may be zero, indicating that the character range is optional) followed by a colon and one or more range specifications. A range specification is 3 characters: the first character allowed, a minus, and the last character allowed. For example, "3:A-Za-z0-9". The ranges in each value should not overlap, and the characters in each range specification should be ordered. |
Default Value | If no ranges are specified, the validator only uses the defined character sets. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the password validator is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
min-character-sets
Synopsis | Specifies the minimum number of character sets and ranges that a password must contain. |
Description | This property should only be used in conjunction with optional character sets and ranges (those requiring zero characters). Its value must include any mandatory character sets and ranges (those requiring greater than zero characters). This is useful in situations where a password must contain characters from mandatory character sets and ranges, and characters from at least N optional character sets and ranges. For example, it is quite common to require that a password contains at least one non-alphanumeric character as well as characters from two alphanumeric character sets (lower-case, upper-case, digits). In this case, this property should be set to 3. |
Default Value | The password must contain characters from each of the mandatory character sets and ranges and, if there are optional character sets and ranges, at least one character from one of the optional character sets and ranges. |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.26.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the password validator implementation. |
Default Value | org.opends.server.extensions.CharacterSetPasswordValidator |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.27. Clear Password Storage Scheme
The Clear Password Storage Scheme provides a mechanism for storing user passwords in clear text, without any form of obfuscation.
This scheme contains only an implementation for the user password syntax, with a storage scheme name of "CLEAR". The Clear Password Storage Scheme should only be used if there are client applications that specifically require this capability.
2.27.1. Parent
The Clear Password Storage Scheme object inherits from Password Storage Scheme.
2.27.2. Clear Password Storage Scheme Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.27.3. Basic Properties
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.27.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Clear Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.ClearPasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.28. Collective Attribute Subentries Virtual Attribute
The Collective Attribute Subentries Virtual Attribute generates a virtual attribute that specifies all collective attribute subentries that affect the entry.
2.28.1. Parent
The Collective Attribute Subentries Virtual Attribute object inherits from Virtual Attribute.
2.28.2. Collective Attribute Subentries Virtual Attribute Properties
Basic Properties | Advanced Properties | ||||||||
---|---|---|---|---|---|---|---|---|---|
|
|
2.28.3. Basic Properties
attribute-type
Synopsis | Specifies the attribute type for the attribute whose values are to be dynamically assigned by the virtual attribute. |
Default Value | collectiveAttributeSubentries |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-dn
Synopsis | Specifies the base DNs for the branches containing entries that are eligible to use this virtual attribute. |
Description | If no values are given, then the server generates virtual attributes anywhere in the server. |
Default Value | The location of the entry in the server is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Virtual Attribute is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filter
Synopsis | Specifies the search filters to be applied against entries to determine if the virtual attribute is to be generated for those entries. |
Description | If no values are given, then any entry is eligible to have the value generated. If one or more filters are specified, then only entries that match at least one of those filters are allowed to have the virtual attribute. |
Default Value | (objectClass=*) |
Allowed Values | Any valid search filter string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
group-dn
Synopsis | Specifies the DNs of the groups whose members can be eligible to use this virtual attribute. |
Description | If no values are given, then group membership is not taken into account when generating the virtual attribute. If one or more group DNs are specified, then only members of those groups are allowed to have the virtual attribute. |
Default Value | Group membership is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
scope
Synopsis | Specifies the LDAP scope associated with base DNs for entries that are eligible to use this virtual attribute. |
Default Value | whole-subtree |
Allowed Values | base-object: Search the base object only. single-level: Search the immediate children of the base object but do not include any of their descendants or the base object itself. subordinate-subtree: Search the entire subtree below the base object but do not include the base object itself. whole-subtree: Search the base object and the entire subtree below the base object. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.28.4. Advanced Properties
Use the --advanced
option to access advanced properties.
conflict-behavior
Synopsis | Specifies the behavior that the server is to exhibit for entries that already contain one or more real values for the associated attribute. |
Default Value | virtual-overrides-real |
Allowed Values | merge-real-and-virtual: Indicates that the virtual attribute provider is to preserve any real values contained in the entry and merge them with the set of generated virtual values so that both the real and virtual values are used. real-overrides-virtual: Indicates that any real values contained in the entry are preserved and used, and virtual values are not generated. virtual-overrides-real: Indicates that the virtual attribute provider suppresses any real values contained in the entry and generates virtual values and uses them. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the virtual attribute provider class that generates the attribute values. |
Default Value | org.opends.server.extensions.CollectiveAttributeSubentriesVirtualAttributeProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.29. Common Audit Access Log Publisher
This is an abstract object type that cannot be instantiated.
Common Audit Access Log Publishers publish access events to commons audit.
2.29.1. Common Audit Access Log Publishers
The following Common Audit Access Log Publishers are available:
These Common Audit Access Log Publishers inherit the properties described below.
2.29.2. Parent
The Common Audit Access Log Publisher object inherits from Access Log Publisher.
2.29.3. Common Audit Access Log Publisher Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.29.4. Basic Properties
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filtering-policy
Synopsis | Specifies how filtering criteria should be applied to log records. |
Default Value | no-filtering |
Allowed Values | exclusive: Records must not match any of the filtering criteria in order to be logged. inclusive: Records must match at least one of the filtering criteria in order to be logged. no-filtering: No filtering will be performed, and all records will be logged. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the Access Log Publisher implementation. |
Default Value | org.opends.server.loggers.AccessLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-control-oids
Synopsis | Specifies whether control OIDs will be included in operation log records. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.29.5. Advanced Properties
Use the --advanced
option to access advanced properties.
suppress-internal-operations
Synopsis | Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-synchronization-operations
Synopsis | Indicates whether access messages that are generated by synchronization operations should be suppressed. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.30. Connection Handler
This is an abstract object type that cannot be instantiated.
Connection Handlers are responsible for handling all interaction with the clients, including accepting the connections, reading requests, and sending responses.
2.30.1. Connection Handlers
The following Connection Handlers are available:
These Connection Handlers inherit the properties described below.
2.30.2. Connection Handler Properties
2.30.3. Basic Properties
allowed-client
Synopsis | A set of clients who will be allowed to establish connections to this Connection Handler. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | All clients with addresses that do not match an address on the deny list are allowed. If there is no deny list, then all clients are allowed. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
denied-client
Synopsis | A set of clients who are not allowed to establish connections to this Connection Handler. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. If both allowed and denied client masks are defined and a client connection matches one or more masks in both lists, then the connection is denied. If only a denied list is specified, then any client not matching a mask in that list is allowed. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | If an allow list is specified, then only clients with addresses on the allow list are allowed. Otherwise, all clients are allowed. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Connection Handler is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Connection Handler implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
restricted-client
Synopsis | A set of clients who will be limited to the maximum number of connections specified by the "restricted-client-connection-limit" property. |
Description | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | No restrictions are imposed on the number of connections a client can open. |
Allowed Values | An IP address mask. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
restricted-client-connection-limit
Synopsis | Specifies the maximum number of connections a restricted client can open at the same time to this Connection Handler. |
Description | Once Directory Server accepts the specified number of connections from a client specified in restricted-client, any additional connection will be rejected. The number of connections is maintained by IP address. Specifying a value for this property in a connection handler will override any value set in the global configuration. |
Default Value | 100 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and do not interfere with established connections. |
Advanced | No |
Read-Only | No |
2.31. Core Schema
Core Schema define the core schema elements to load.
Core schema provider configuration.
2.31.1. Parent
The Core Schema object inherits from Schema Provider.
2.31.2. Core Schema Properties
Basic Properties | Advanced Properties | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
2.31.3. Basic Properties
disabled-matching-rule
Synopsis | The set of disabled matching rules. |
Description | Matching rules must be specified using the syntax: OID, or use the default value 'NONE' to specify no value. |
Default Value | NONE |
Allowed Values | The OID of the disabled matching rule. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
disabled-syntax
Synopsis | The set of disabled syntaxes. |
Description | Syntaxes must be specified using the syntax: OID, or use the default value 'NONE' to specify no value. |
Default Value | NONE |
Allowed Values | The OID of the disabled syntax, or NONE |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Schema Provider is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.31.4. Advanced Properties
Use the --advanced
option to access advanced properties.
allow-attribute-types-with-no-sup-or-syntax
Synopsis | Indicates whether the schema should allow attribute type definitions that do not declare a superior attribute type or syntax |
Description | When set to true, invalid attribute type definitions will use the default syntax. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
allow-zero-length-values-directory-string
Synopsis | Indicates whether zero-length (that is, an empty string) values are allowed for directory string. |
Description | This is technically not allowed by the revised LDAPv3 specification, but some environments may require it for backward compatibility with servers that do allow it. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Core Schema implementation. |
Default Value | org.opends.server.schema.CoreSchemaProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
json-validation-policy
Synopsis | Specifies the policy that will be used when validating JSON syntax values. |
Default Value | strict |
Allowed Values | disabled: JSON syntax values will not be validated and, as a result any sequence of bytes will be acceptable. lenient: JSON syntax values must comply with RFC 7159 except: 1) comments are allowed, 2) single quotes may be used instead of double quotes, and 3) unquoted control characters are allowed in strings. strict: JSON syntax values must strictly conform to RFC 7159. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
strict-format-certificates
Synopsis | Indicates whether X.509 Certificate values are required to strictly comply with the standard definition for this syntax. |
Description | When set to false, certificates will not be validated and, as a result any sequence of bytes will be acceptable. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
strict-format-country-string
Synopsis | Indicates whether country code values are required to strictly comply with the standard definition for this syntax. |
Description | When set to false, country codes will not be validated and, as a result any string containing 2 characters will be acceptable. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
strict-format-jpeg-photos
Synopsis | Indicates whether to require JPEG values to strictly comply with the standard definition for this syntax. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
strict-format-telephone-numbers
Synopsis | Indicates whether to require telephone number values to strictly comply with the standard definition for this syntax. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
strip-syntax-min-upper-bound-attribute-type-description
Synopsis | Indicates whether the suggested minimum upper bound appended to an attribute's syntax OID in it's schema definition Attribute Type Description is stripped off. |
Description | When retrieving the server's schema, some APIs (JNDI) fail in their syntax lookup methods, because they do not parse this value correctly. This configuration option allows the server to be configured to provide schema definitions these APIs can parse correctly. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.32. CRAM-MD5 SASL Mechanism Handler
The CRAM-MD5 SASL mechanism provides the ability for clients to perform password-based authentication in a manner that does not expose their password in the clear.
Rather than including the password in the bind request, the CRAM-MD5 mechanism uses a two-step process in which the client needs only to prove that it knows the password. The server sends randomly-generated data to the client that is to be used in the process, which makes it resistant to replay attacks. The one-way message digest algorithm ensures that the original clear-text password is not exposed. Note that the algorithm used by the CRAM-MD5 mechanism requires that both the client and the server have access to the clear-text password (or potentially a value that is derived from the clear-text password). In order to authenticate to the server using CRAM-MD5, the password for a user's account must be encoded using a reversible password storage scheme that allows the server to have access to the clear-text value.
2.32.1. Parent
The CRAM-MD5 SASL Mechanism Handler object inherits from SASL Mechanism Handler.
2.32.2. Dependencies
CRAM-MD5 SASL Mechanism Handlers depend on the following objects:
2.32.3. CRAM-MD5 SASL Mechanism Handler Properties
Basic Properties | Advanced Properties | |||
---|---|---|---|---|
|
|
2.32.4. Basic Properties
enabled
Synopsis | Indicates whether the SASL mechanism handler is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
identity-mapper
Synopsis | Specifies the name of the identity mapper used with this SASL mechanism handler to match the authentication ID included in the SASL bind request to the corresponding user in the directory. |
Default Value | None |
Allowed Values | The name of an existing Identity Mapper. The referenced identity mapper must be enabled when the CRAM-MD5 SASL Mechanism Handler is enabled. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.32.5. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the SASL mechanism handler implementation. |
Default Value | org.opends.server.extensions.CRAMMD5SASLMechanismHandler |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.33. Common REST Metrics HTTP Endpoint
The Common REST Metrics HTTP Endpoint provides access to OpenDJ's monitoring information via the Common REST protocol.
2.33.1. Parent
The Common REST Metrics HTTP Endpoint object inherits from HTTP Endpoint.
2.33.2. Common REST Metrics HTTP Endpoint Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.33.3. Basic Properties
Synopsis | The HTTP authorization mechanisms supported by this HTTP Endpoint. |
Default Value | None |
Allowed Values | The name of an existing HTTP Authorization Mechanism. The referenced authorization mechanism must be enabled when the HTTP Endpoint is enabled. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-path
Synopsis | All HTTP requests matching the base path or subordinate to it will be routed to the HTTP endpoint unless a more specific HTTP endpoint is found. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
enabled
Synopsis | Indicates whether the HTTP Endpoint is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
excluded-metric-pattern
Synopsis | Zero or more regular expressions identifying metrics that should not be published to the Graphite server. The metric name prefix must not be included in the filter. Exclusion patterns take precedence over inclusion patterns. |
Default Value | None |
Allowed Values | Any valid regular expression pattern which is supported by the java.util.regex.Pattern class (see https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html for documentation about this class for Java SE 8). |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
included-metric-pattern
Synopsis | Zero or more regular expressions identifying metrics that should be published to the Graphite server. The metric name prefix must not be included in the filter. Exclusion patterns take precedence over inclusion patterns. |
Default Value | None |
Allowed Values | Any valid regular expression pattern which is supported by the java.util.regex.Pattern class (see https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html for documentation about this class for Java SE 8). |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.33.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Common REST Metrics HTTP Endpoint implementation. |
Default Value | org.opends.server.protocols.http.CrestMetricsEndpoint |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.34. Crypt Password Storage Scheme
The Crypt Password Storage Scheme provides a mechanism for encoding user passwords like Unix crypt does. Like on most Unix systems, the password may be encrypted using different algorithms, either Unix crypt, md5, sha256 or sha512.
This scheme contains only an implementation for the user password syntax, with a storage scheme name of "CRYPT". Like on most Unixes, the "CRYPT" storage scheme has different algorithms, the default being Unix crypt. Warning: even though Unix crypt is a one-way digest, it is very weak by today's standards. Only the first 8 characters in a password are used, and it only uses the bottom 7 bits of each character. It only supports a 12-bit salt (meaning that there are only 4096 possible ways to encode a given password), so it is vulnerable to dictionary attacks. You should therefore use this algorithm only in cases where an external application expects to retrieve the password and verify it outside of the directory, instead of by performing an LDAP bind.
2.34.1. Parent
The Crypt Password Storage Scheme object inherits from Password Storage Scheme.
2.34.2. Crypt Password Storage Scheme Properties
Basic Properties | Advanced Properties | |||
---|---|---|---|---|
|
|
2.34.3. Basic Properties
crypt-password-storage-encryption-algorithm
Synopsis | Specifies the algorithm to use to encrypt new passwords. |
Description | Select the crypt algorithm to use to encrypt new passwords. The value can either be "unix", which means the password is encrypted with the weak Unix crypt algorithm, or "md5" which means the password is encrypted with the BSD MD5 algorithm and has a $1$ prefix, or "sha256" which means the password is encrypted with the SHA256 algorithm and has a $5$ prefix, or "sha512" which means the password is encrypted with the SHA512 algorithm and has a $6$ prefix. |
Default Value | unix |
Allowed Values | md5: New passwords are encrypted with the BSD MD5 algorithm. sha256: New passwords are encrypted with the Unix crypt SHA256 algorithm. sha512: New passwords are encrypted with the Unix crypt SHA512 algorithm. unix: New passwords are encrypted with the Unix crypt algorithm. Passwords are truncated at 8 characters and the top bit of each character is ignored. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Password Storage Scheme is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.34.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Crypt Password Storage Scheme implementation. |
Default Value | org.opends.server.extensions.CryptPasswordStorageScheme |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.35. Crypto Manager
The Crypto Manager provides a common interface for performing compression, decompression, hashing, encryption and other kinds of cryptographic operations.
2.35.1. Crypto Manager Properties
2.35.2. Basic Properties
key-wrapping-transformation
Synopsis | The preferred key wrapping transformation for the directory server. This value must be the same for all server instances in a replication topology. |
Default Value | RSA/ECB/OAEPWITHSHA-1ANDMGF1PADDING |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property will take effect immediately but will only affect cryptographic operations performed after the change. |
Advanced | No |
Read-Only | No |
ssl-cert-nickname
Synopsis | Specifies the nicknames (also called the aliases) of the keys or key pairs that the Crypto Manager should use when performing SSL communication. The property can be used multiple times (referencing different nicknames) when server certificates with different public key algorithms are used in parallel (for example, RSA, DSA, and ECC-based algorithms). When a nickname refers to an asymmetric (public/private) key pair, the nickname for the public key certificate and associated private key entry must match exactly. A single nickname is used to retrieve both the public key and the private key. |
Description | This is only applicable when the Crypto Manager is configured to use SSL. |
Default Value | Let the server decide. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
ssl-cipher-suite
Synopsis | Specifies the names of the SSL cipher suites that are allowed for use in SSL or TLS communication. |
Default Value | Uses the default set of SSL cipher suites provided by the server's JVM. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. |
Advanced | No |
Read-Only | No |
ssl-encryption
Synopsis | Specifies whether SSL/TLS is used to provide encrypted communication between two OpenDJ server components. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. |
Advanced | No |
Read-Only | No |
ssl-protocol
Synopsis | Specifies the names of the SSL protocols that are allowed for use in SSL or TLS communication. |
Default Value | Uses the default set of SSL protocols provided by the server's JVM. |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only impact new SSL/TLS-based sessions created after the change. |
Advanced | No |
Read-Only | No |
2.35.3. Advanced Properties
Use the --advanced
option to access advanced properties.
cipher-key-length
Synopsis | Specifies the key length in bits for the preferred cipher. |
Default Value | 128 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only affect cryptographic operations performed after the change. |
Advanced | Yes |
Read-Only | No |
cipher-transformation
Synopsis | Specifies the cipher for the directory server using the syntax algorithm/mode/padding. |
Description | The full transformation is required: specifying only an algorithm and allowing the cipher provider to supply the default mode and padding is not supported, because there is no guarantee these default values are the same among different implementations. Some cipher algorithms, including RC4 and ARCFOUR, do not have a mode or padding, and hence must be specified using NONE for the mode field and NoPadding for the padding field. For example, RC4/NONE/NoPadding. |
Default Value | AES/CBC/PKCS5Padding |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only affect cryptographic operations performed after the change. |
Advanced | Yes |
Read-Only | No |
digest-algorithm
Synopsis | Specifies the preferred message digest algorithm for the directory server. |
Default Value | SHA-1 |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately and only affect cryptographic operations performed after the change. |
Advanced | Yes |
Read-Only | No |
mac-algorithm
Synopsis | Specifies the preferred MAC algorithm for the directory server. |
Default Value | HmacSHA1 |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only affect cryptographic operations performed after the change. |
Advanced | Yes |
Read-Only | No |
mac-key-length
Synopsis | Specifies the key length in bits for the preferred MAC algorithm. |
Default Value | 128 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property take effect immediately but only affect cryptographic operations performed after the change. |
Advanced | Yes |
Read-Only | No |
2.36. CSV File Access Log Publisher
CSV File Access Log Publishers publish access messages to CSV files.
2.36.1. Parent
The CSV File Access Log Publisher object inherits from Common Audit Access Log Publisher.
2.36.2. Dependencies
CSV File Access Log Publishers depend on the following objects:
2.36.3. CSV File Access Log Publisher Properties
Basic Properties | Advanced Properties | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
2.36.4. Basic Properties
csv-delimiter-char
Synopsis | The delimiter character to use when writing in CSV format. |
Default Value | , |
Allowed Values | The delimiter character to use when writing in CSV format. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filtering-policy
Synopsis | Specifies how filtering criteria should be applied to log records. |
Default Value | no-filtering |
Allowed Values | exclusive: Records must not match any of the filtering criteria in order to be logged. inclusive: Records must match at least one of the filtering criteria in order to be logged. no-filtering: No filtering will be performed, and all records will be logged. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
key-store-file
Synopsis | Specifies the path to the file that contains the private key information. This may be an absolute path, or a path that is relative to the OpenDJ instance root. |
Description | Changes to this property will take effect the next time that the key store is accessed. |
Default Value | None |
Allowed Values | A path to an existing file that is readable by the server. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
key-store-pin
Synopsis | Specifies the clear-text PIN needed to access the CSV File Access Log Publisher . |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property will take effect the next time that the CSV File Access Log Publisher is accessed. |
Advanced | No |
Read-Only | No |
log-control-oids
Synopsis | Specifies whether control OIDs will be included in operation log records. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-directory
Synopsis | The directory to use for the log files generated by the CSV File Access Log Publisher. The path to the directory is relative to the server root. |
Default Value | logs |
Allowed Values | A path to an existing directory that is readable and writable by the server. |
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
log-field-blacklist
Synopsis | List of fields that the server omits from access log messages. |
Description | Valid values for this property are JSON paths for fields present in the log file. |
Default Value | No message elements are blacklisted by default |
Allowed Values | A JSON path to an existing object of the access event definition. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-file-name-prefix
Synopsis | File name prefix (without extension) for CSV and JSON file based access log publishers. |
Default Value | ldap-access |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
retention-policy
Synopsis | The retention policy to use for the CSV File Access Log Publisher . |
Description | When multiple policies are used, log files are cleaned when any of the policy's conditions are met. |
Default Value | No retention policy is used and log files are never cleaned. |
Allowed Values | The name of an existing Log Retention Policy. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
rotation-policy
Synopsis | The rotation policy to use for the CSV File Access Log Publisher . |
Description | When multiple policies are used, rotation will occur if any policy's conditions are met. |
Default Value | No rotation policy is used and log rotation will not occur. |
Allowed Values | The name of an existing Log Rotation Policy. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
tamper-evident
Synopsis | Specifies whether the log should be signed in order to detect tampering. |
Description | Every log record will be signed, making it possible to verify that the log has not been tampered with. This feature has a significative impact on performance of the server. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.36.5. Advanced Properties
Use the --advanced
option to access advanced properties.
asynchronous
Synopsis | Indicates whether the CSV File Access Log Publisher will publish records asynchronously. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
auto-flush
Synopsis | Specifies whether to flush the writer after every log record. |
Description | If the asynchronous writes option is used, the writer is flushed after all the log records in the queue are written. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
csv-eol-symbols
Synopsis | The string that marks the end of a line. |
Default Value | Use the platform specific end of line character sequence. |
Allowed Values | The string that marks the end of a line. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
csv-quote-char
Synopsis | The character to append and prepend to a CSV field when writing in CSV format. |
Default Value | " |
Allowed Values | The quote character to use when writting in CSV format. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the CSV File Access Log Publisher implementation. |
Default Value | org.opends.server.loggers.CsvFileAccessLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
signature-time-interval
Synopsis | Specifies the interval at which to sign the log file when the tamper-evident option is enabled. |
Default Value | 3s |
Allowed Values | Uses Duration Syntax. Lower limit: 1 milliseconds. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-internal-operations
Synopsis | Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-synchronization-operations
Synopsis | Indicates whether access messages that are generated by synchronization operations should be suppressed. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.37. CSV File HTTP Access Log Publisher
CSV File HTTP Access Log Publishers publish HTTP access messages to CSV files.
2.37.1. Parent
The CSV File HTTP Access Log Publisher object inherits from HTTP Access Log Publisher.
2.37.2. Dependencies
CSV File HTTP Access Log Publishers depend on the following objects:
2.37.3. CSV File HTTP Access Log Publisher Properties
2.37.4. Basic Properties
csv-delimiter-char
Synopsis | The delimiter character to use when writing in CSV format. |
Default Value | , |
Allowed Values | The delimiter character to use when writing in CSV format. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
key-store-file
Synopsis | Specifies the path to the file that contains the private key information. This may be an absolute path, or a path that is relative to the OpenDJ instance root. |
Description | Changes to this property will take effect the next time that the key store is accessed. |
Default Value | None |
Allowed Values | A path to an existing file that is readable by the server. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
key-store-pin
Synopsis | Specifies the clear-text PIN needed to access the CSV File HTTP Access Log Publisher . |
Default Value | None |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | None Changes to this property will take effect the next time that the CSV File HTTP Access Log Publisher is accessed. |
Advanced | No |
Read-Only | No |
log-directory
Synopsis | The directory to use for the log files generated by the CSV File HTTP Access Log Publisher. The path to the directory is relative to the server root. |
Default Value | logs |
Allowed Values | A path to an existing directory that is readable and writable by the server. |
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
log-field-blacklist
Synopsis | List of fields that the server omits from access log messages. |
Description | Valid values for this property are JSON paths for fields present in the log file. |
Default Value | /http/request/headers |
Allowed Values | A JSON path to an existing object of the access event definition. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-file-name-prefix
Synopsis | File name prefix (without extension) for CSV and JSON file based access log publishers. |
Default Value | http-access |
Allowed Values | A string. |
Multi-valued | No |
Required | No |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
retention-policy
Synopsis | The retention policy to use for the CSV File HTTP Access Log Publisher . |
Description | When multiple policies are used, log files are cleaned when any of the policy's conditions are met. |
Default Value | No retention policy is used and log files are never cleaned. |
Allowed Values | The name of an existing Log Retention Policy. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
rotation-policy
Synopsis | The rotation policy to use for the CSV File HTTP Access Log Publisher . |
Description | When multiple policies are used, rotation will occur if any policy's conditions are met. |
Default Value | No rotation policy is used and log rotation will not occur. |
Allowed Values | The name of an existing Log Rotation Policy. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
tamper-evident
Synopsis | Specifies whether the log should be signed in order to detect tampering. |
Description | Every log record will be signed, making it possible to verify that the log has not been tampered with. This feature has a significative impact on performance of the server. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.37.5. Advanced Properties
Use the --advanced
option to access advanced properties.
asynchronous
Synopsis | Indicates whether the CSV File HTTP Access Log Publisher will publish records asynchronously. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
auto-flush
Synopsis | Specifies whether to flush the writer after every log record. |
Description | If the asynchronous writes option is used, the writer is flushed after all the log records in the queue are written. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
csv-eol-symbols
Synopsis | The string that marks the end of a line. |
Default Value | Use the platform specific end of line character sequence. |
Allowed Values | The string that marks the end of a line. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
csv-quote-char
Synopsis | The character to append and prepend to a CSV field when writing in CSV format. |
Default Value | " |
Allowed Values | The quote character to use when writing in CSV format. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the CSV File HTTP Access Log Publisher implementation. |
Default Value | org.opends.server.loggers.CommonAuditHTTPAccessLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
signature-time-interval
Synopsis | Specifies the interval at which to sign the log file when secure option is enabled. |
Default Value | 3s |
Allowed Values | Uses Duration Syntax. Lower limit: 1 milliseconds. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.38. Debug Log Publisher
This is an abstract object type that cannot be instantiated.
Debug Log Publishers are responsible for distributing debug log messages from the debug logger to a destination.
Debug log messages provide information that can be used for debugging or troubleshooting problems in the server, or for providing more detailed information about the processing that the server performs.
2.38.1. Debug Log Publishers
The following Debug Log Publishers are available:
These Debug Log Publishers inherit the properties described below.
2.38.2. Parent
The Debug Log Publisher object inherits from Log Publisher.
2.38.4. Debug Log Publisher Properties
2.38.5. Basic Properties
default-debug-exceptions-only
Synopsis | Indicates whether only logs with exception should be logged. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
default-include-throwable-cause
Synopsis | Indicates whether to include the cause of exceptions in exception thrown and caught messages logged by default. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
default-omit-method-entry-arguments
Synopsis | Indicates whether to include method arguments in debug messages logged by default. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
default-omit-method-return-value
Synopsis | Indicates whether to include the return value in debug messages logged by default. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
default-throwable-stack-frames
Synopsis | Indicates the number of stack frames to include in the stack trace for method entry and exception thrown messages. |
Default Value | 2147483647 |
Allowed Values | An integer. Lower limit: 0. Upper limit: 2147483647. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the Debug Log Publisher implementation. |
Default Value | org.opends.server.loggers.DebugLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.39. Debug Target
Debug Targets define the types of messages logged by the debug logPublisher.
Debug targets allow for fine-grain control of which messages are logged based on the package, class, or method that generated the message. Each debug target configuration entry resides below the entry with RDN of "cn=Debug Target" immediately below the parent ds-cfg-debug-log-publisher entry.
2.39.2. Debug Target Properties
2.39.3. Basic Properties
debug-exceptions-only
Synopsis | Indicates whether only logs with exception should be logged. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
debug-scope
Synopsis | Specifies the fully-qualified OpenDJ Java package, class, or method affected by the settings in this target definition. Use the number character (#) to separate the class name and the method name (that is, org.opends.server.core.DirectoryServer#startUp). |
Default Value | None |
Allowed Values | The fully-qualified OpenDJ Java package, class, or method name. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | Yes |
enabled
Synopsis | Indicates whether the Debug Target is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
include-throwable-cause
Synopsis | Specifies the property to indicate whether to include the cause of exceptions in exception thrown and caught messages. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
omit-method-entry-arguments
Synopsis | Specifies the property to indicate whether to include method arguments in debug messages. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
omit-method-return-value
Synopsis | Specifies the property to indicate whether to include the return value in debug messages. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
throwable-stack-frames
Synopsis | Specifies the property to indicate the number of stack frames to include in the stack trace for method entry and exception thrown messages. |
Default Value | 0 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.40. Dictionary Password Validator
The Dictionary Password Validator determines whether a proposed password is acceptable based on whether the given password value appears in a provided dictionary file.
A large dictionary file is provided with the server, but the administrator can supply an alternate dictionary. In this case, then the dictionary must be a plain-text file with one word per line.
2.40.1. Parent
The Dictionary Password Validator object inherits from Password Validator.
2.40.2. Dictionary Password Validator Properties
Basic Properties | Advanced Properties | |||||||
---|---|---|---|---|---|---|---|---|
|
|
2.40.3. Basic Properties
case-sensitive-validation
Synopsis | Indicates whether this password validator is to treat password characters in a case-sensitive manner. |
Description | If it is set to true, then the validator rejects a password only if it appears in the dictionary with exactly the same capitalization as provided by the user. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
check-substrings
Synopsis | Indicates whether this password validator is to match portions of the password string against dictionary words. |
Description | If "false" then only match the entire password against words otherwise ("true") check whether the password contains words. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
dictionary-file
Synopsis | Specifies the path to the file containing a list of words that cannot be used as passwords. |
Description | It should be formatted with one word per line. The value can be an absolute path or a path that is relative to the OpenDJ instance root. |
Default Value | For Unix and Linux systems: config/wordlist.txt. For Windows systems: config\wordlist.txt |
Allowed Values | The path to any text file contained on the system that is readable by the server. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the password validator is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
min-substring-length
Synopsis | Indicates the minimal length of the substring within the password in case substring checking is enabled. |
Description | If "check-substrings" option is set to true, then this parameter defines the length of the smallest word which should be used for substring matching. Use with caution because values below 3 might disqualify valid passwords. |
Default Value | 5 |
Allowed Values | An integer. Lower limit: 0. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
test-reversed-password
Synopsis | Indicates whether this password validator is to test the reversed value of the provided password as well as the order in which it was given. |
Description | For example, if the user provides a new password of "password" and this configuration attribute is set to true, then the value "drowssap" is also tested against attribute values in the user's entry. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.40.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the password validator implementation. |
Default Value | org.opends.server.extensions.DictionaryPasswordValidator |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.41. DIGEST-MD5 SASL Mechanism Handler
The DIGEST-MD5 SASL mechanism is used to perform all processing related to SASL DIGEST-MD5 authentication.
The DIGEST-MD5 SASL mechanism is very similar to the CRAM-MD5 mechanism in that it allows for password-based authentication without exposing the password in the clear (although it does require that both the client and the server have access to the clear-text password). Like the CRAM-MD5 mechanism, it uses data that is randomly generated by the server to make it resistant to replay attacks, but it also includes randomly-generated data from the client, which makes it also resistant to problems resulting from weak server-side random number generation.
2.41.1. Parent
The DIGEST-MD5 SASL Mechanism Handler object inherits from SASL Mechanism Handler.
2.41.2. Dependencies
DIGEST-MD5 SASL Mechanism Handlers depend on the following objects:
2.41.3. DIGEST-MD5 SASL Mechanism Handler Properties
Basic Properties | Advanced Properties | ||||||
---|---|---|---|---|---|---|---|
|
|
2.41.4. Basic Properties
enabled
Synopsis | Indicates whether the SASL mechanism handler is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
identity-mapper
Synopsis | Specifies the name of the identity mapper that is to be used with this SASL mechanism handler to match the authentication or authorization ID included in the SASL bind request to the corresponding user in the directory. |
Default Value | None |
Allowed Values | The name of an existing Identity Mapper. The referenced identity mapper must be enabled when the DIGEST-MD5 SASL Mechanism Handler is enabled. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
quality-of-protection
Synopsis | The name of a property that specifies the quality of protection the server will support. |
Default Value | none |
Allowed Values | confidentiality: Quality of protection equals authentication with integrity and confidentiality protection. integrity: Quality of protection equals authentication with integrity protection. none: QOP equals authentication only. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
realm
Synopsis | Specifies the realms that is to be used by the server for DIGEST-MD5 authentication. |
Description | If this value is not provided, then the server defaults to use the fully qualified hostname of the machine. |
Default Value | If this value is not provided, then the server defaults to use the fully qualified hostname of the machine. |
Allowed Values | Any realm string that does not contain a comma. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
server-fqdn
Synopsis | Specifies the DNS-resolvable fully-qualified domain name for the server that is used when validating the digest-uri parameter during the authentication process. |
Description | If this configuration attribute is present, then the server expects that clients use a digest-uri equal to "ldap/" followed by the value of this attribute. For example, if the attribute has a value of "directory.example.com", then the server expects clients to use a digest-uri of "ldap/directory.example.com". If no value is provided, then the server does not attempt to validate the digest-uri provided by the client and accepts any value. |
Default Value | The server attempts to determine the fully-qualified domain name dynamically. |
Allowed Values | The fully-qualified address that is expected for clients to use when connecting to the server and authenticating via DIGEST-MD5. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.41.5. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the SASL mechanism handler implementation. |
Default Value | org.opends.server.extensions.DigestMD5SASLMechanismHandler |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.42. DSEE Compatible Access Control Handler
The DSEE Compatible Access Control Handler provides an implementation that uses syntax compatible with the Sun Java System Directory Server Enterprise Edition access control handlers.
2.42.1. Parent
The DSEE Compatible Access Control Handler object inherits from Access Control Handler.
2.42.2. DSEE Compatible Access Control Handler Properties
Basic Properties | Advanced Properties | |||
---|---|---|---|---|
|
|
2.42.3. Basic Properties
enabled
Synopsis | Indicates whether the Access Control Handler is enabled. If set to FALSE, then no access control is enforced, and any client (including unauthenticated or anonymous clients) could be allowed to perform any operation if not subject to other restrictions, such as those enforced by the privilege subsystem. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
global-aci
Synopsis | Defines global access control rules. |
Description | Global access control rules apply to all entries anywhere in the data managed by the OpenDJ directory server. The global access control rules may be overridden by more specific access control rules placed in the data. |
Default Value | No global access control rules are defined, which means that no access is allowed for any data in the server unless specifically granted by access control rules in the data. |
Allowed Values | An access control instruction (ACI). |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.42.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the DSEE Compatible Access Control Handler implementation. |
Default Value | org.opends.server.authorization.dseecompat.AciHandler |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.43. Dynamic Group Implementation
The Dynamic Group Implementation provides a grouping mechanism in which the group membership is determined based on criteria defined in one or more LDAP URLs.
2.43.1. Parent
The Dynamic Group Implementation object inherits from Group Implementation.
2.43.2. Dynamic Group Implementation Properties
Basic Properties | Advanced Properties | ||
---|---|---|---|
|
|
2.43.3. Basic Properties
enabled
Synopsis | Indicates whether the Group Implementation is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.43.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Dynamic Group Implementation implementation. |
Default Value | org.opends.server.extensions.DynamicGroup |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.44. Entity Tag Virtual Attribute
The Entity Tag Virtual Attribute ensures that all entries contain an "entity tag" or "Etag" as defined in section 3.11 of RFC 2616.
The entity tag may be used by clients, in conjunction with the assertion control, for optimistic concurrency control, as a way to help prevent simultaneous updates of an entry from conflicting with each other.
2.44.1. Parent
The Entity Tag Virtual Attribute object inherits from Virtual Attribute.
2.44.2. Entity Tag Virtual Attribute Properties
Basic Properties | Advanced Properties | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
|
2.44.3. Basic Properties
attribute-type
Synopsis | Specifies the attribute type for the attribute whose values are to be dynamically assigned by the virtual attribute. |
Default Value | etag |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-dn
Synopsis | Specifies the base DNs for the branches containing entries that are eligible to use this virtual attribute. |
Description | If no values are given, then the server generates virtual attributes anywhere in the server. |
Default Value | The location of the entry in the server is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
checksum-algorithm
Synopsis | The algorithm which should be used for calculating the entity tag checksum value. |
Default Value | adler-32 |
Allowed Values | adler-32: The Adler-32 checksum algorithm which is almost as reliable as a CRC-32 but can be computed much faster. crc-32: The CRC-32 checksum algorithm. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Virtual Attribute is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
excluded-attribute
Synopsis | The list of attributes which should be ignored when calculating the entity tag checksum value. |
Description | Certain attributes like "ds-sync-hist" may vary between replicas due to different purging schedules and should not be included in the checksum. |
Default Value | ds-sync-hist |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filter
Synopsis | Specifies the search filters to be applied against entries to determine if the virtual attribute is to be generated for those entries. |
Description | If no values are given, then any entry is eligible to have the value generated. If one or more filters are specified, then only entries that match at least one of those filters are allowed to have the virtual attribute. |
Default Value | (objectClass=*) |
Allowed Values | Any valid search filter string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
group-dn
Synopsis | Specifies the DNs of the groups whose members can be eligible to use this virtual attribute. |
Description | If no values are given, then group membership is not taken into account when generating the virtual attribute. If one or more group DNs are specified, then only members of those groups are allowed to have the virtual attribute. |
Default Value | Group membership is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
scope
Synopsis | Specifies the LDAP scope associated with base DNs for entries that are eligible to use this virtual attribute. |
Default Value | whole-subtree |
Allowed Values | base-object: Search the base object only. single-level: Search the immediate children of the base object but do not include any of their descendants or the base object itself. subordinate-subtree: Search the entire subtree below the base object but do not include the base object itself. whole-subtree: Search the base object and the entire subtree below the base object. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.44.4. Advanced Properties
Use the --advanced
option to access advanced properties.
conflict-behavior
Synopsis | Specifies the behavior that the server is to exhibit for entries that already contain one or more real values for the associated attribute. |
Default Value | real-overrides-virtual |
Allowed Values | merge-real-and-virtual: Indicates that the virtual attribute provider is to preserve any real values contained in the entry and merge them with the set of generated virtual values so that both the real and virtual values are used. real-overrides-virtual: Indicates that any real values contained in the entry are preserved and used, and virtual values are not generated. virtual-overrides-real: Indicates that the virtual attribute provider suppresses any real values contained in the entry and generates virtual values and uses them. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the virtual attribute provider class that generates the attribute values. |
Default Value | org.opends.server.extensions.EntityTagVirtualAttributeProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.45. Entry Cache
This is an abstract object type that cannot be instantiated.
Entry Caches are responsible for caching entries which are likely to be accessed by client applications in order to improve OpenDJ directory server performance.
2.45.1. Entry Caches
The following Entry Caches are available:
These Entry Caches inherit the properties described below.
2.45.2. Entry Cache Properties
Basic Properties | |||
---|---|---|---|
|
2.45.3. Basic Properties
cache-level
Synopsis | Specifies the cache level in the cache order if more than one instance of the cache is configured. |
Default Value | None |
Allowed Values | An integer. Lower limit: 1. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Entry Cache is enabled. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Entry Cache implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.46. entryDN Virtual Attribute
The entryDN Virtual Attribute generates the entryDN operational attribute in directory entries, which contains a normalized form of the entry's DN.
This attribute is defined in the draft-zeilenga-ldap-entrydn Internet Draft and contains the DN of the entry in which it is contained. This component provides the ability to use search filters containing the entry's DN.
2.46.1. Parent
The entryDN Virtual Attribute object inherits from Virtual Attribute.
2.46.2. entryDN Virtual Attribute Properties
Basic Properties | Advanced Properties | ||||||||
---|---|---|---|---|---|---|---|---|---|
|
|
2.46.3. Basic Properties
attribute-type
Synopsis | Specifies the attribute type for the attribute whose values are to be dynamically assigned by the virtual attribute. |
Default Value | entryDN |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-dn
Synopsis | Specifies the base DNs for the branches containing entries that are eligible to use this virtual attribute. |
Description | If no values are given, then the server generates virtual attributes anywhere in the server. |
Default Value | The location of the entry in the server is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Virtual Attribute is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filter
Synopsis | Specifies the search filters to be applied against entries to determine if the virtual attribute is to be generated for those entries. |
Description | If no values are given, then any entry is eligible to have the value generated. If one or more filters are specified, then only entries that match at least one of those filters are allowed to have the virtual attribute. |
Default Value | (objectClass=*) |
Allowed Values | Any valid search filter string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
group-dn
Synopsis | Specifies the DNs of the groups whose members can be eligible to use this virtual attribute. |
Description | If no values are given, then group membership is not taken into account when generating the virtual attribute. If one or more group DNs are specified, then only members of those groups are allowed to have the virtual attribute. |
Default Value | Group membership is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
scope
Synopsis | Specifies the LDAP scope associated with base DNs for entries that are eligible to use this virtual attribute. |
Default Value | whole-subtree |
Allowed Values | base-object: Search the base object only. single-level: Search the immediate children of the base object but do not include any of their descendants or the base object itself. subordinate-subtree: Search the entire subtree below the base object but do not include the base object itself. whole-subtree: Search the base object and the entire subtree below the base object. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.46.4. Advanced Properties
Use the --advanced
option to access advanced properties.
conflict-behavior
Synopsis | Specifies the behavior that the server is to exhibit for entries that already contain one or more real values for the associated attribute. |
Default Value | virtual-overrides-real |
Allowed Values | merge-real-and-virtual: Indicates that the virtual attribute provider is to preserve any real values contained in the entry and merge them with the set of generated virtual values so that both the real and virtual values are used. real-overrides-virtual: Indicates that any real values contained in the entry are preserved and used, and virtual values are not generated. virtual-overrides-real: Indicates that the virtual attribute provider suppresses any real values contained in the entry and generates virtual values and uses them. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the virtual attribute provider class that generates the attribute values. |
Default Value | org.opends.server.extensions.EntryDNVirtualAttributeProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.47. entryUUID Plugin
The entryUUID Plugin generates values for the entryUUID operational attribute whenever an entry is added via protocol or imported from LDIF.
The entryUUID plug-in ensures that all entries added to the server, whether through an LDAP add operation or via an LDIF import, are assigned an entryUUID operational attribute if they do not already have one. The entryUUID attribute contains a universally unique identifier that can be used to identify an entry in a manner that does not change (even in the event of a modify DN operation). This plug-in generates a random UUID for entries created by an add operation, but the UUID is constructed from the DN of the entry during an LDIF import (which means that the same LDIF file can be imported on different systems but still get the same value for the entryUUID attribute). This behavior is based on the specification contained in RFC 4530. The implementation for the entry UUID plug-in is contained in the org.opends.server.plugins.EntryUUIDPlugin class. It must be configured with the preOperationAdd and ldifImport plug-in types, but it does not have any other custom configuration. This plug-in must be enabled in any directory that is intended to be used in a synchronization environment.
2.47.1. Parent
The entryUUID Plugin object inherits from Plugin.
2.47.2. entryUUID Plugin Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.47.3. Basic Properties
enabled
Synopsis | Indicates whether the plug-in is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.47.4. Advanced Properties
Use the --advanced
option to access advanced properties.
invoke-for-internal-operations
Synopsis | Indicates whether the plug-in should be invoked for internal operations. |
Description | Any plug-in that can be invoked for internal operations must ensure that it does not create any new internal operatons that can cause the same plug-in to be re-invoked. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the plug-in implementation. |
Default Value | org.opends.server.plugins.EntryUUIDPlugin |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
plugin-type
Synopsis | Specifies the set of plug-in types for the plug-in, which specifies the times at which the plug-in is invoked. |
Default Value | ldifimport preoperationadd |
Allowed Values | intermediateresponse: Invoked before sending an intermediate repsonse message to the client. ldifexport: Invoked for each operation to be written during an LDIF export. ldifimport: Invoked for each entry read during an LDIF import. ldifimportbegin: Invoked at the beginning of an LDIF import session. ldifimportend: Invoked at the end of an LDIF import session. postconnect: Invoked whenever a new connection is established to the server. postdisconnect: Invoked whenever an existing connection is terminated (by either the client or the server). postoperationabandon: Invoked after completing the abandon processing. postoperationadd: Invoked after completing the core add processing but before sending the response to the client. postoperationbind: Invoked after completing the core bind processing but before sending the response to the client. postoperationcompare: Invoked after completing the core compare processing but before sending the response to the client. postoperationdelete: Invoked after completing the core delete processing but before sending the response to the client. postoperationextended: Invoked after completing the core extended processing but before sending the response to the client. postoperationmodify: Invoked after completing the core modify processing but before sending the response to the client. postoperationmodifydn: Invoked after completing the core modify DN processing but before sending the response to the client. postoperationsearch: Invoked after completing the core search processing but before sending the response to the client. postoperationunbind: Invoked after completing the unbind processing. postresponseadd: Invoked after sending the add response to the client. postresponsebind: Invoked after sending the bind response to the client. postresponsecompare: Invoked after sending the compare response to the client. postresponsedelete: Invoked after sending the delete response to the client. postresponseextended: Invoked after sending the extended response to the client. postresponsemodify: Invoked after sending the modify response to the client. postresponsemodifydn: Invoked after sending the modify DN response to the client. postresponsesearch: Invoked after sending the search result done message to the client. postsynchronizationadd: Invoked after completing post-synchronization processing for an add operation. postsynchronizationdelete: Invoked after completing post-synchronization processing for a delete operation. postsynchronizationmodify: Invoked after completing post-synchronization processing for a modify operation. postsynchronizationmodifydn: Invoked after completing post-synchronization processing for a modify DN operation. preoperationadd: Invoked prior to performing the core add processing. preoperationbind: Invoked prior to performing the core bind processing. preoperationcompare: Invoked prior to performing the core compare processing. preoperationdelete: Invoked prior to performing the core delete processing. preoperationextended: Invoked prior to performing the core extended processing. preoperationmodify: Invoked prior to performing the core modify processing. preoperationmodifydn: Invoked prior to performing the core modify DN processing. preoperationsearch: Invoked prior to performing the core search processing. preparseabandon: Invoked prior to parsing an abandon request. preparseadd: Invoked prior to parsing an add request. preparsebind: Invoked prior to parsing a bind request. preparsecompare: Invoked prior to parsing a compare request. preparsedelete: Invoked prior to parsing a delete request. preparseextended: Invoked prior to parsing an extended request. preparsemodify: Invoked prior to parsing a modify request. preparsemodifydn: Invoked prior to parsing a modify DN request. preparsesearch: Invoked prior to parsing a search request. preparseunbind: Invoked prior to parsing an unbind request. searchresultentry: Invoked before sending a search result entry to the client. searchresultreference: Invoked before sending a search result reference to the client. shutdown: Invoked during a graceful directory server shutdown. startup: Invoked during the directory server startup process. subordinatedelete: Invoked in the course of deleting a subordinate entry of a delete operation. subordinatemodifydn: Invoked in the course of moving or renaming an entry subordinate to the target of a modify DN operation. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.48. entryUUID Virtual Attribute
The entryUUID Virtual Attribute ensures that all entries contained in private backends have values for the entryUUID operational attribute.
The entryUUID values are generated based on a normalized representation of the entry's DN, which does not cause a consistency problem because OpenDJ does not allow modify DN operations to be performed in private backends.
2.48.1. Parent
The entryUUID Virtual Attribute object inherits from Virtual Attribute.
2.48.2. entryUUID Virtual Attribute Properties
Basic Properties | Advanced Properties | ||||||||
---|---|---|---|---|---|---|---|---|---|
|
|
2.48.3. Basic Properties
attribute-type
Synopsis | Specifies the attribute type for the attribute whose values are to be dynamically assigned by the virtual attribute. |
Default Value | entryUUID |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
base-dn
Synopsis | Specifies the base DNs for the branches containing entries that are eligible to use this virtual attribute. |
Description | If no values are given, then the server generates virtual attributes anywhere in the server. |
Default Value | The location of the entry in the server is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Virtual Attribute is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filter
Synopsis | Specifies the search filters to be applied against entries to determine if the virtual attribute is to be generated for those entries. |
Description | If no values are given, then any entry is eligible to have the value generated. If one or more filters are specified, then only entries that match at least one of those filters are allowed to have the virtual attribute. |
Default Value | (objectClass=*) |
Allowed Values | Any valid search filter string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
group-dn
Synopsis | Specifies the DNs of the groups whose members can be eligible to use this virtual attribute. |
Description | If no values are given, then group membership is not taken into account when generating the virtual attribute. If one or more group DNs are specified, then only members of those groups are allowed to have the virtual attribute. |
Default Value | Group membership is not taken into account when determining whether an entry is eligible to use this virtual attribute. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
scope
Synopsis | Specifies the LDAP scope associated with base DNs for entries that are eligible to use this virtual attribute. |
Default Value | whole-subtree |
Allowed Values | base-object: Search the base object only. single-level: Search the immediate children of the base object but do not include any of their descendants or the base object itself. subordinate-subtree: Search the entire subtree below the base object but do not include the base object itself. whole-subtree: Search the base object and the entire subtree below the base object. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.48.4. Advanced Properties
Use the --advanced
option to access advanced properties.
conflict-behavior
Synopsis | Specifies the behavior that the server is to exhibit for entries that already contain one or more real values for the associated attribute. |
Default Value | real-overrides-virtual |
Allowed Values | merge-real-and-virtual: Indicates that the virtual attribute provider is to preserve any real values contained in the entry and merge them with the set of generated virtual values so that both the real and virtual values are used. real-overrides-virtual: Indicates that any real values contained in the entry are preserved and used, and virtual values are not generated. virtual-overrides-real: Indicates that the virtual attribute provider suppresses any real values contained in the entry and generates virtual values and uses them. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the virtual attribute provider class that generates the attribute values. |
Default Value | org.opends.server.extensions.EntryUUIDVirtualAttributeProvider |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.49. Error Log Account Status Notification Handler
The Error Log Account Status Notification Handler is a notification handler that writes information to the server error log whenever an appropriate account status event occurs.
2.49.1. Parent
The Error Log Account Status Notification Handler object inherits from Account Status Notification Handler.
2.49.2. Error Log Account Status Notification Handler Properties
Basic Properties | Advanced Properties | |||
---|---|---|---|---|
|
|
2.49.3. Basic Properties
account-status-notification-type
Synopsis | Indicates which types of event can trigger an account status notification. |
Default Value | None |
Allowed Values | account-disabled: Generate a notification whenever a user account has been disabled by an administrator. account-enabled: Generate a notification whenever a user account has been enabled by an administrator. account-expired: Generate a notification whenever a user authentication has failed because the account has expired. account-idle-locked: Generate a notification whenever a user account has been locked because it was idle for too long. account-permanently-locked: Generate a notification whenever a user account has been permanently locked after too many failed attempts. account-reset-locked: Generate a notification whenever a user account has been locked, because the password had been reset by an administrator but not changed by the user within the required interval. account-temporarily-locked: Generate a notification whenever a user account has been temporarily locked after too many failed attempts. account-unlocked: Generate a notification whenever a user account has been unlocked by an administrator. password-changed: Generate a notification whenever a user changes his/her own password. password-expired: Generate a notification whenever a user authentication has failed because the password has expired. password-expiring: Generate a notification whenever a password expiration warning is encountered for a user password for the first time. password-reset: Generate a notification whenever a user's password is reset by an administrator. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Account Status Notification Handler is enabled. Only enabled handlers are invoked whenever a related event occurs in the server. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.49.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Error Log Account Status Notification Handler implementation. |
Default Value | org.opends.server.extensions.ErrorLogAccountStatusNotificationHandler |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.50. Error Log Publisher
This is an abstract object type that cannot be instantiated.
Error Log Publishers are responsible for distributing error log messages from the error logger to a destination.
Error log messages provide information about any warnings, errors, or significant events that are encountered during server processing.
2.50.1. Error Log Publishers
The following Error Log Publishers are available:
These Error Log Publishers inherit the properties described below.
2.50.2. Parent
The Error Log Publisher object inherits from Log Publisher.
2.50.3. Error Log Publisher Properties
Basic Properties | ||||
---|---|---|---|---|
|
2.50.4. Basic Properties
default-severity
Synopsis | Specifies the default severity levels for the logger. |
Default Value | error warning |
Allowed Values | all: Messages of all severity levels are logged. debug: The error log severity that is used for messages that provide debugging information triggered during processing. error: The error log severity that is used for messages that provide information about errors which may force the server to shut down or operate in a significantly degraded state. info: The error log severity that is used for messages that provide information about significant events within the server that are not warnings or errors. none: No messages of any severity are logged by default. This value is intended to be used in conjunction with the override-severity property to define an error logger that will publish no error message beside the errors of a given category. notice: The error log severity that is used for the most important informational messages (i.e., information that should almost always be logged but is not associated with a warning or error condition). warning: The error log severity that is used for messages that provide information about warnings triggered during processing. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | The fully-qualified name of the Java class that provides the Error Log Publisher implementation. |
Default Value | org.opends.server.loggers.ErrorLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
override-severity
Synopsis | Specifies the override severity levels for the logger based on the category of the messages. |
Description | Each override severity level should include the category and the severity levels to log for that category, for example, core=error,info,warning. Valid categories are: core, extensions, protocol, config, log, util, schema, plugin, jeb, backend, tools, task, access-control, admin, sync, version, setup, admin-tool, dsconfig, user-defined. Valid severities are: all, error, info, warning, notice, debug. |
Default Value | All messages with the default severity levels are logged. |
Allowed Values | A string in the form category=severity1,severity2... |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.51. Exact Match Identity Mapper
The Exact Match Identity Mapper maps an identifier string to user entries by searching for the entry containing a specified attribute whose value is the provided identifier. For example, the username provided by the client for DIGEST-MD5 authentication must match the value of the uid attribute
2.51.1. Parent
The Exact Match Identity Mapper object inherits from Identity Mapper.
2.51.2. Exact Match Identity Mapper Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.51.3. Basic Properties
enabled
Synopsis | Indicates whether the Identity Mapper is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
match-attribute
Synopsis | Specifies the attribute whose value should exactly match the ID string provided to this identity mapper. |
Description | At least one value must be provided. All values must refer to the name or OID of an attribute type defined in the directory server schema. If multiple attributes or OIDs are provided, at least one of those attributes must contain the provided ID string value in exactly one entry. The internal search performed includes a logical OR across all of these values. |
Default Value | uid |
Allowed Values | The name of an attribute type defined in the LDAP schema. |
Multi-valued | Yes |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
match-base-dn
Synopsis | Specifies the set of base DNs below which to search for users. |
Description | The base DNs will be used when performing searches to map the provided ID string to a user entry. If multiple values are given, searches are performed below all specified base DNs. |
Default Value | The server searches below all public naming contexts local to the server. |
Allowed Values | A valid DN. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.51.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Exact Match Identity Mapper implementation. |
Default Value | org.opends.server.extensions.ExactMatchIdentityMapper |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | Yes |
Read-Only | No |
2.52. Extended Operation Handler
This is an abstract object type that cannot be instantiated.
Extended Operation Handlers processes the different types of extended operations in the server.
2.52.1. Extended Operation Handlers
The following Extended Operation Handlers are available:
These Extended Operation Handlers inherit the properties described below.
2.52.2. Extended Operation Handler Properties
Basic Properties | ||
---|---|---|
|
2.52.3. Basic Properties
enabled
Synopsis | Indicates whether the Extended Operation Handler is enabled (that is, whether the types of extended operations are allowed in the server). |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
java-class
Synopsis | Specifies the fully-qualified name of the Java class that provides the Extended Operation Handler implementation. |
Default Value | None |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
2.53. External Access Log Publisher
External Access Log Publishers publish access messages to an external handler.
2.53.1. Parent
The External Access Log Publisher object inherits from Common Audit Access Log Publisher.
2.53.2. External Access Log Publisher Properties
Basic Properties | Advanced Properties | ||||||||
---|---|---|---|---|---|---|---|---|---|
|
|
2.53.3. Basic Properties
config-file
Synopsis | The JSON configuration file that defines the External Access Log Publisher. The content of the JSON configuration file depends on the type of external audit event handler. The path to the file is relative to the server root. |
Default Value | None |
Allowed Values | A path to an existing file that is readable by the server. |
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
filtering-policy
Synopsis | Specifies how filtering criteria should be applied to log records. |
Default Value | no-filtering |
Allowed Values | exclusive: Records must not match any of the filtering criteria in order to be logged. inclusive: Records must match at least one of the filtering criteria in order to be logged. no-filtering: No filtering will be performed, and all records will be logged. |
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-control-oids
Synopsis | Specifies whether control OIDs will be included in operation log records. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-field-blacklist
Synopsis | List of fields that the server omits from access log messages. |
Description | Valid values for this property are JSON paths for fields present in the log file. |
Default Value | No message elements are blacklisted by default |
Allowed Values | A JSON path to an existing object of the access event definition. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.53.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | The fully-qualified name of the Java class that provides the External Access Log Publisher implementation. |
Default Value | org.opends.server.loggers.ExternalAccessLogPublisher |
Allowed Values | A Java class that extends or implements:
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-internal-operations
Synopsis | Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users. |
Default Value | true |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
suppress-synchronization-operations
Synopsis | Indicates whether access messages that are generated by synchronization operations should be suppressed. |
Default Value | false |
Allowed Values |
|
Multi-valued | No |
Required | No |
Admin Action Required | None |
Advanced | Yes |
Read-Only | No |
2.54. External Changelog Domain
The External Changelog Domain provides configuration of the external changelog for the replication domain.
2.54.2. External Changelog Domain Properties
Basic Properties | |||
---|---|---|---|
|
2.54.3. Basic Properties
ecl-include
Synopsis | Specifies a list of attributes which should be published with every change log entry, regardless of whether the attribute itself has changed. |
Description | The list of attributes may include wild cards such as "*" and "+" as well as object class references prefixed with an ampersand, for example "@person". The included attributes will be published using the "includedAttributes" operational attribute as a single LDIF value rather like the "changes" attribute. For modify and modifyDN operations the included attributes will be taken from the entry before any changes were applied. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
ecl-include-for-deletes
Synopsis | Specifies a list of attributes which should be published with every delete operation change log entry, in addition to those specified by the "ecl-include" property. |
Description | This property provides a means for applications to archive entries after they have been deleted. See the description of the "ecl-include" property for further information about how the included attributes are published. |
Default Value | None |
Allowed Values | A string. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the External Changelog Domain is enabled. To enable computing the change numbers, set the Replication Server's "changelog-enabled" property to "enabled". |
Description | Changes to this property will return incoherent results across the topology and as such is not supported. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.55. External HTTP Access Log Publisher
External HTTP Access Log Publishers publish HTTP access messages to an external handler.
2.55.1. Parent
The External HTTP Access Log Publisher object inherits from HTTP Access Log Publisher.
2.55.2. External HTTP Access Log Publisher Properties
Basic Properties | Advanced Properties | ||||
---|---|---|---|---|---|
|
|
2.55.3. Basic Properties
config-file
Synopsis | The JSON configuration file that defines the External HTTP Access Log Publisher. The content of the JSON configuration file depends on the type of external audit event handler. The path to the file is relative to the server root. |
Default Value | None |
Allowed Values | A path to an existing file that is readable by the server. |
Multi-valued | No |
Required | Yes |
Admin Action Required | The object must be disabled and re-enabled for changes to take effect. |
Advanced | No |
Read-Only | No |
enabled
Synopsis | Indicates whether the Log Publisher is enabled for use. |
Default Value | None |
Allowed Values |
|
Multi-valued | No |
Required | Yes |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
log-field-blacklist
Synopsis | List of fields that the server omits from access log messages. |
Description | Valid values for this property are JSON paths for fields present in the log file. |
Default Value | /http/request/headers |
Allowed Values | A JSON path to an existing object of the access event definition. |
Multi-valued | Yes |
Required | No |
Admin Action Required | None |
Advanced | No |
Read-Only | No |
2.55.4. Advanced Properties
Use the --advanced
option to access advanced properties.
java-class
Synopsis | The fully-qualified name of the Java class that provides the External HTTP Access Log Publisher implementation. |
Default Value | org.opends.serv |