Contents Dochome
Sun Java(TM) System Directory Server Online Help

> # Chaining Tab of Data Configuration

> Use the Chaining tab to define the default settings for all new chained suffixes. Modifications to this tab do not affect the current settings of existing chained suffixes.

> ## Chaining of LDAP Controls

> These lists define the LDAP controls, identified by their OID, that are allowed to chain. For further details about the LDAP controls that may be chained, see "Creating and Maintaining Chained Suffixes" in Chapter 3 of the Sun Java System Directory Server Administration Guide.

> LDAP controls to chain. Requests received with one of the controls in this list will be forwarded to the chained suffix with the same control. If a request for this suffix includes a control that is not in this list, the request will be forwarded without the control.

> If there are controls you do not wish to forward to new chained suffixes, select one or more controls from this list and click Delete.

> By default, the following controls will be chained:

> OID of the Control | Name of the Control
> --- | ---
> 2.16.840.1.113730.3.4.2 | Managed DSA for smart referrals
> 1.2.840.113556.1.4.473 | Server side sorting
> 2.16.840.1.113730.3.4.9 | Virtual list view (VLV)
> 1.3.6.1.4.1.1466.29539.12 | Chaining loop detection

> Available LDAP controls. This list contains the controls that will not be forwarded by default but that may be moved to the other list. Controls that do not appear in either list cannot be forwarded to a chained suffix.

> If you wish to forward a control to new chained suffixes, select one or more controls from this list and click Add.

> In addition to the default controls being chained, the following are also available:

> OID of the Control | Name of the Control
> --- | ---
> 1.3.6.1.4.1.42.2.27.9.5.2 | Get effective rights request
> 2.16.840.1.113730.3.4.3 | Persistent search
> 2.16.840.1.113730.3.4.4 | Password expired notification
> 2.16.840.1.113730.3.4.5 | Password expiring notification
> 2.16.840.1.113730.3.4.12 | Proxied authorization (old specification) *
> 2.16.840.1.113730.3.4.13 | Replication update information
> 2.16.840.1.113730.3.4.14 | Search on specific database
> 2.16.840.1.113730.3.4.15 | Authentication response
> 2.16.840.1.113730.3.4.16 | Authentication request
> 2.16.840.1.113730.3.4.17 | Real attribute only request
> 2.16.840.1.113730.3.4.18 | Proxied authorization (new specification) *
> 2.16.840.1.113730.3.4.19 | Virtual attributes only request

> (*) Applications may use either control for proxied authorization. You should have the same chaining policy for both of these OIDs.

> ## Chaining of Server Components

> These lists define the server components that are allowed to access the chained suffix. A component is a server plug-in that accesses the directory contents to perform internal operations. You may need to give these components access to chained suffixes so the components can perform their function completely.

> Components allowed to chain. The components in this list will be allowed to perform internal operation on the chained suffix. By default, all internal operations are not chained.

> If there are components that you wish to remove from this list, select one or more of them and click Delete.

> Available components. This list contains controls that will not be able to send requests to chained suffixes but that may be moved to the other list. Components that do not show up in either list are never allowed to access a chained suffix.

> By default, the list contains the following components:

> DN of the Component | Effect of Chaining this Component
> --- | ---
> cn=resource limits, cn=components, cn=config | Resource limits can be applied to remote users if the resource limit plug-in is allowed to chain.
> cn=certificate-based authentication, cn=components, cn=config | Allows certificate-based authentication to work with a chained suffix.
> cn=ACL plugin, cn=plugins, cn=config | Allows ACI attributes of chained suffixes to be evaluated. Usually, mixing local and remote ACIs is not safe, so this should only be allowed on a suffix containing user entries.
> cn=old plugin, cn=plugins, cn=config | All Directory Server version 4.x plug-ins share the same chaining policy, so selecting this component enables them all to access chained suffixes.
> cn=referential integrity postoperation, cn=plugins, cn=config | Allows referential integrity across all chained suffixes where this plug-in is enabled.
> cn=uid uniqueness, cn=plugins,cn=config | Maintains attribute uniqueness across all chained suffixes where this plug-in is enabled.

> ## See Also

> "Creating and Maintaining Chained Suffixes" in Chapter 3 of the Sun Java System Directory Server Administration Guide.

> Contents Dochome

> Copyright 2004 Sun Microsystems, Inc. All rights reserved.