Package org.forgerock.opendj.server.config.server

Interface ProxyBackendCfg

  • All Superinterfaces:
    BackendCfg, Configuration
    public interface ProxyBackendCfg
extends BackendCfg
    A server-side interface for querying Proxy Backend settings.

    A Proxy Backend forwards LDAP requests to other servers.

    • Method Detail

      • addProxyChangeListener

        void addProxyChangeListener​(ConfigurationChangeListener<ProxyBackendCfg> listener)
        Register to be notified when this Proxy Backend is changed.
        Parameters:
        listener - The Proxy Backend configuration change listener.

      • removeProxyChangeListener

        void removeProxyChangeListener​(ConfigurationChangeListener<ProxyBackendCfg> listener)
        Deregister an existing Proxy Backend configuration change listener.
        Parameters:
        listener - The Proxy Backend configuration change listener.

      • getBaseDn

        SortedSet<Dn> getBaseDn()
        Gets the "base-dn" property.

        Specifies the base DN(s) for the data that the backend handles.

        A single backend may be responsible for one or more base DNs. Note that no two backends may have the same base DN although one backend may have a base DN that is below a base DN provided by another backend (similar to the use of sub-suffixes in the Sun Java System Directory Server). If any of the base DNs is subordinate to a base DN for another backend, then all base DNs for that backend must be subordinate to that same base DN. When the "route-all" property is set to "true" then the "base-dn" property is ignored.

        Returns:
        Returns an unmodifiable set containing the values of the "base-dn" property.

      • getBindConnectionPoolIdleTimeout

        long getBindConnectionPoolIdleTimeout()
        Gets the "bind-connection-pool-idle-timeout" property.

        The time out period after which unused non-core bind connections will be closed and removed from the bind connection pool.

        Default value: 10s

        Returns:
        Returns the value of the "bind-connection-pool-idle-timeout" property.

      • getBindConnectionPoolMaxSize

        int getBindConnectionPoolMaxSize()
        Gets the "bind-connection-pool-max-size" property.

        Maximum size of the connection pool that will be used for sending bind requests

        Only one bind request at a time can be pending on a connection and bind requests may take a significant amount of time to process depending on the remote server's password policies. Therefore, the maximum pool size should be reasonably high in order to be able to process bind requests concurrently.

        Default value: 1024

        Returns:
        Returns the value of the "bind-connection-pool-max-size" property.

      • getBindConnectionPoolMinSize

        int getBindConnectionPoolMinSize()
        Gets the "bind-connection-pool-min-size" property.

        Minimum size of the connection pool that will be used for sending bind requests

        Default value: 4

        Returns:
        Returns the value of the "bind-connection-pool-min-size" property.

      • getConnectionTimeout

        long getConnectionTimeout()
        Gets the "connection-timeout" property.

        Specifies the timeout used when connecting to servers, performing SSL negotiation, and for individual search and bind requests.

        If the timeout expires then the current operation will be aborted and retried against another LDAP server if one is available.

        Default value: 3s

        Returns:
        Returns the value of the "connection-timeout" property.

      • getDiscoveryInterval

        long getDiscoveryInterval()
        Gets the "discovery-interval" property.

        Interval between two server configuration discovery executions.

        Specifies how frequently to read the configuration of the servers in order to discover any configuration change.

        Default value: 60s

        Returns:
        Returns the value of the "discovery-interval" property.

      • getHashFunction

        ProxyBackendCfgDefn.HashFunction getHashFunction()
        Gets the "hash-function" property.

        Specifies the hash function which will be used for data distribution.

        This setting only applies to data distribution. Once this server is deployed, this setting must not be modified. Doing so could result in data loss. The hash function is used by the router to map incoming requests to a target server based on the request's target DN. The role of the hash function is to ensure that the flow of incoming requests is evenly distributed on the set of servers.

        Default value: murmur3

        Returns:
        Returns the value of the "hash-function" property.

      • getHeartbeatInterval

        long getHeartbeatInterval()
        Gets the "heartbeat-interval" property.

        Specifies the heartbeat interval that the Proxy Backend will use when communicating with the remote servers.

        The Proxy Backend sends a heartbeat request to the servers every heartbeat interval. The heartbeat serves 3 purposes: keepalive, heartbeat and recovery. The hearbeat requests are small requests sent to prevent the connection from appearing idle and being forcefully closed (keepalive). The heartbeat responses inform the Proxy Backend the server is available (heartbeat). If a heartbeat answer is not received within the interval, the Proxy Backend closes the unresponsive connection and connects to another server. After an unresponsive connection is closed, the server is contacted each heartbeat interval to determine whether it is available again (recovery).

        Default value: 10s

        Returns:
        Returns the value of the "heartbeat-interval" property.

      • getHeartbeatSearchRequestBaseDn

        Dn getHeartbeatSearchRequestBaseDn()
        Gets the "heartbeat-search-request-base-dn" property.

        Specifies the name of the entry that will be targeted by heartbeat requests.

        By default heartbeat requests will attempt to read the remote server's root DSE, which is sufficient to determine whether the remote server is available, but it will not detect whether a particular backend is available. Set the heartbeat request base DN to the base entry of the backend containing application data in order to detect whether a remote server is available and handling requests against the backend.

        Default value:

        Returns:
        Returns the value of the "heartbeat-search-request-base-dn" property.

      • getJavaClass

        String getJavaClass()
        Gets the "java-class" property.

        Specifies the fully-qualified name of the Java class that provides the backend implementation.

        Default value: org.opends.server.backends.ProxyBackend

        Specified by:
        getJavaClass in interface BackendCfg
        Returns:
        Returns the value of the "java-class" property.

      • getKeyManagerProvider

        String getKeyManagerProvider()
        Gets the "key-manager-provider" property.

        Specifies the name of the key manager that should be used with this Proxy Backend.

        Default value is undefined

        Returns:
        Returns the value of the "key-manager-provider" property.

      • getKeyManagerProviderDn

        Dn getKeyManagerProviderDn()
        Gets the "key-manager-provider" property as a DN.

        Specifies the name of the key manager that should be used with this Proxy Backend.

        Returns:
        Returns the DN value of the "key-manager-provider" property.

      • getLoadBalancingAlgorithm

        ProxyBackendCfgDefn.LoadBalancingAlgorithm getLoadBalancingAlgorithm()
        Gets the "load-balancing-algorithm" property.

        How to load balance between servers within a shard

        Default value: affinity

        Returns:
        Returns the value of the "load-balancing-algorithm" property.

      • getPartitionBaseDn

        SortedSet<Dn> getPartitionBaseDn()
        Gets the "partition-base-dn" property.

        Specifies the base DN(s) which will be used for "affinity" load-balancing algorithm and data distribution

        This settings only applies for "affinity" load-balancing and data distribution. When applied to "affinity" load-balancing within a single shard, this setting provides consistency for add/delete operations targeting entries within the same sub-tree. Entries immediately subordinate to the partition base DNs will be considered to be the root of a sub-tree whose entries belong to the same shard. For example, a partition base DN of "ou=people,dc=example,dc=com" would mean that "uid=bjensen,ou=people,dc=example,dc=com" and "deviceid=12345,uid=bjensen,ou=people,dc=example,dc=com" both belong to the same shard, and all operations targeting them would be routed to the same remote server. When applied to data distribution across multiple shards, this setting consistently routes operations targeting an entry below the partition DN to the same shard. Requests targeting the partition DN or above are routed to any shard. Search requests are routed to all shards unless their scope is under the partition DN. For example, if the partition base DN is set to "ou=people,dc=example,dc=com", a search with base DN "uid=bjensen,ou=people,dc=example,dc=com" or "deviceid=12345,uid=bjensen,ou=people,dc=example,dc=com" is always routed to the same shard. A search with base DN "ou=people,dc=example,dc=com" is routed to all shards.

        Returns:
        Returns an unmodifiable set containing the values of the "partition-base-dn" property.

      • getProxyUserDn

        Dn getProxyUserDn()
        Gets the "proxy-user-dn" property.

        The bind DN that is used to forward LDAP requests to remote servers.

        The proxy connects to the remote server using this bind DN and uses the proxied authorization control to forward requests on behalf of the proxy users. This bind DN must exist on all the remote servers.

        Default value is undefined

        Returns:
        Returns the value of the "proxy-user-dn" property.

      • getProxyUserPassword

        String getProxyUserPassword()
        Gets the "proxy-user-password" property.

        Clear-text password associated with the proxy bind DN.

        The proxy password must be the same on all the remote servers.

        Default value is undefined

        Returns:
        Returns the value of the "proxy-user-password" property.

      • getRequestConnectionPoolSize

        int getRequestConnectionPoolSize()
        Gets the "request-connection-pool-size" property.

        The size of the connection pool which will be used for sending all requests other than bind requests.

        Unlike bind requests, other types of request may be processed concurrently on the same connection, so this connection pool should be configured with a smaller number of connections, such as 10.

        Default value: 10

        Returns:
        Returns the value of the "request-connection-pool-size" property.

      • isRouteAll

        boolean isRouteAll()
        Gets the "route-all" property.

        Route requests to all discovered public naming contexts.

        When the "route-all" property is set to "true" then the "base-dn" property is ignored.

        Returns:
        Returns the value of the "route-all" property.

      • getShard

        SortedSet<String> getShard()
        Gets the "shard" property.

        Specifies one or more shards which will be used for distributing data and requests.

        When multiple shards are configured, this setting consistently routes write requests for the same target entry below the partition DN to the same shard. Requests targeting an entry under the partition DN are always routed to a single shard. Requests targeting the partition DN or above are routed to any shard. Search requests are routed to all shards unless their scope is under the partition DN. For example, a search with base DN "uid=bjensen,ou=people,dc=example,dc=com" or "deviceid=12345,uid=bjensen,ou=people,dc=example,dc=com" is always routed to the same shard. A search with base DN "ou=people,dc=example,dc=com" is routed to all shards.

        Default value is undefined

        Returns:
        Returns an unmodifiable set containing the values of the "shard" property.

      • getShardDns

        SortedSet<Dn> getShardDns()
        Gets the "shard" property as a set of DNs.

        Specifies one or more shards which will be used for distributing data and requests.

        When multiple shards are configured, this setting consistently routes write requests for the same target entry below the partition DN to the same shard. Requests targeting an entry under the partition DN are always routed to a single shard. Requests targeting the partition DN or above are routed to any shard. Search requests are routed to all shards unless their scope is under the partition DN. For example, a search with base DN "uid=bjensen,ou=people,dc=example,dc=com" or "deviceid=12345,uid=bjensen,ou=people,dc=example,dc=com" is always routed to the same shard. A search with base DN "ou=people,dc=example,dc=com" is routed to all shards.

        Returns:
        Returns the DN values of the "shard" property.

      • getSslCertNickname

        SortedSet<String> getSslCertNickname()
        Gets the "ssl-cert-nickname" property.

        Specifies the nicknames (also called the aliases) of the keys or key pairs that the Proxy Backend should use when performing SSL communication.

        The property can be used multiple times (referencing different nicknames) when server certificates with different public key algorithms are used in parallel (for example, RSA, DSA, and ECC-based algorithms). When a nickname refers to an asymmetric (public/private) key pair, the nickname for the public key certificate and associated private key entry must match exactly. A single nickname is used to retrieve both the public key and the private key. This is only applicable when the Proxy Backend is configured to use SSL.

        Returns:
        Returns an unmodifiable set containing the values of the "ssl-cert-nickname" property.

      • isUseSaslExternal

        boolean isUseSaslExternal()
        Gets the "use-sasl-external" property.

        Indicates whether the Proxy Backend should use certificate based authentication when communicating with backend servers.

        If enabled, the Proxy Backend will use mutual TLS when connecting to backend servers. Once the TLS handshake has completed, a SASL/External LDAP bind request will be sent in order to associate the TLS client certificate with an LDAP account on the remote backend server. A key manager provider containing the client certificate must be configured in order to use this feature.

        Default value: false

        Returns:
        Returns the value of the "use-sasl-external" property.