| Online Help
Sun Java System Directory Proxy Server 5 2004Q2

> Network Group Referrals View
> Directory Proxy Server network groups describe how to identify an LDAP client, and the restrictions to enforce for clients that match that group. Clients are initially identified into a group based on the network address from which they connect. They may change their group after a successful bind.

> Network groups are tested in the descending order of priority, specified by their placement in the Network Group window. In this window, groups on the bottom of the list have less priority than those towards the top. If no groups are found to match a client, the client's request will be rejected. There must be at least one group entry in the configuration specification.

> Clients are identified to belong to this network group based on their IP address and/or domain name.

> This tab specifies whether a network group will forward, follow, or discard referrals returned by the server. Note that a client that does not implement LDAPv3 will not understand forwarded referrals.

> This option applies to all referrals except for search continuation referrals.

> Discard the referral. Enable this option if a network group will discard all referrals returned by the server.

> Forward the referral. By default, this option is enabled, which will forward referrals returned by the server.

> Follow the referral and return result to client. Enable this option if a network group will forward referrals returned by the server and return results to the client.

> Bind policy. This option controls the bind policy when an operation is referred and the referral is being followed.

> Note that Directory Proxy Server cannot replay binds for clients bound using a SASL mechanism. Thus the referral operation will be rejected if "Required" is specified and the client used a SASL mechanism to bind.

> Always. Select this option if a network group should bind anonymous if a client had used bind anonymous.

> Any. Select this option if a network group should use simple bind if the client had used password-based bind, else bind as anonymous. This is the default.

> Required. Select this option if a network group should reject the referred operation if the client is not password-based bound.

> Maximum referrals per operation. Enter an integer value greater or equal to zero. This will limit the maximum number of references that will be followed for a single operation. The default is 15. A value of zero indicates that no limit will be applied.

> Referral SSL Policy. In order to enable the Referral SSL Policy Panel, "SSL is available" option must be enabled on the encryption view.

> If client has an SSL session established. Enable this option if a network group will only initiate SSL if the client already has SSL session established with Directory Proxy Server. This is the default.

> For all referrals. Enable "For all referrals" if, upon a referral, a group will initiate an SSL session before the operation is forwarded.

> Copyright 2004 Sun Microsystems, Inc. All rights reserved.