Glossary
Glossary
Use this section to locate definitions of some of the IBM® Directory product terms
- access control list (ACL)
- In computer security, a list associated with an object that identifies all the subjects that can access the object and their access rights.
- access control groups
- Groups to be used for access control. Each group contains a multivalued attribute consisting of member DNs. Access control groups have an object class of 'AccessGroup'.
- access permissions
- There are two sets of access permissions:
- Permissions that apply to an entire object
- Permissions that apply to attribute access classes or individual attributes.
- aclEntry
- A multivalue attribute that contains information pertaining to the access allowed to the entry and its attributes. An aclEntry lists the following types of information: who has rights to the entry (scope of the protection), what attributes or classes of attributes the user has access to (attribute access classes), and what rights the user or group has (permission).
- aclPropagate
- The attribute that controls ACL propagation. If the value is set to true, ACLs are propagated down the hierarchy tree. If the value is set to false, the ACL becomes an override, pertaining only to this particular object.
- aclSource
- A read only operational attribute that is associated with each object. This attribute contains the distinguished name (DN) of the entry in which the access control list (ACL) is defined.
- alias
- A pointer to another directory object. Aliases can be used within LDAP to reference entries anywhere within the directory tree.
- attribute access class
- Class that consists of attributes that require similar permission for access. Attributes are assigned to an access class within the schema files. The user-modifiable access classes are normal, sensitive, critical, and restricted. An additional class of system is not user-modifiable.
- bulkload
- A command line utility that is used for bulk-loading large amounts of data in LDIF format.
- cascading replication
- A replication topology in which there are multiple tiers of servers. A peer/master server replicates to a small set of read-only servers which in turn replicate to other servers. Such a topology off-loads replication work from the master servers.
- consumer server
- A server which receives changes through replication from a supplier server.
- directory schema
- The valid attribute types, object classes, matching rules and syntaxes that can appear in a directory. The attribute types and object classes define the syntax of the attribute values, which attributes must be present, and which attributes may be present for specific object classes.
- directory server instance
- A directory server instance is comprised of all of the nonexecutable files that are required for a directory server and its corresponding administration daemon to run on a machine. These files include the ibmslapd.conf file, the schema files, the stash files, and the log files of the directory server instance. Each server instance and its corresponding administration daemon listens on a unique port with the same IP address.
- distinguished name (DN)
- The name that uniquely identifies an entry in a directory. A distinguished name is made up of attribute=value pairs, separated by commas.
- dynamic group
- A group that is defined using a search expression. A directory entry that matches the search expression is automatically a member of the group.
- entryOwner
- An attribute whose value can refer to a user or a group. Each entry has an associated entryOwner attribute. However, the entryOwner subject has all authority to the entry.
- Forwarding server
- A read-only server that replicates all changes sent to it. This contrasts to a peer/master server in that it is read only and it can have no peers.
- Gateway server
- A server that forwards all replication traffic from the local replication site where it resides to other Gateway servers in the replicating network. Also receives replication traffic from other Gateway servers within the replication network, which it forwards to all servers on its local replication site.
Gateway servers must be masters (writable).
- group
- A logical organization of users based on some common criteria. Groups can be used in specifying a common set of directory access permissions.
- gsk7ikm
- A utility that creates public-private key pairs and certificate requests, receives certificate requests into a key database, and manages keys in a key database.
- indexing rules
- Index rules attached to attributes make it possible to retrieve information faster. The IBM Tivoli® Directory Server provides the following indexing rules:
See Indexing rules.
- Equality
- Approximate
- Substring
- Reverse
- ldapadd
- The LDAP modify-entry and LDAP add-entry tool ldapmodify is a shell-accessible interface to the ldap_modify and ldap_add library calls. ldapadd is implemented as a renamed version of ldapmodify. When invoked as ldapadd the -a (add new entry) flag is turned on automatically.
- ldapdelete
- The LDAP delete-entry tool ldapdelete is a shell-accessible interface to the ldap_delete library call. ldapdelete opens a connection to an LDAP server and binds and deletes one or more entries. If one or more dn arguments are provided, entries with those Distinguished Names (DN) are deleted. Each DN should be a string-represented DN.
- ldapmodify
- The LDAP modify-entry and LDAP add-entry tools ldapmodify is a shell-accessible interface to the ldap_modify and ldap_add library calls. ldapadd is implemented as a renamed version of ldapmodify. When invoked as ldapadd the -a (add new entry) flag is turned on automatically.
- ldapmodrdn
- LDAP modify-entry RDN tool ldapmodrdn is a shell-accessible interface to the ldap_modrdn library call. ldapmodrdn opens a connection to an LDAP server and binds and modifies the RDN of entries. The entry information is read from standard input, from a file, through the use of the - f option, or from the command-line pair DN and RDN.
- ldapsearch
- The LDAP search tool ldapsearch is a shell-accessible interface to the ldap_search library call. ldapsearch opens a connection to an LDAP server and binds and performs a search using the filter . The filter should conform to the string representation for LDAP filters.
- LDAP Data Interchange Format (LDIF)
- A format used by the LDAP import-export tools as well as ldapmodify, ldapadd, and ldapsearch command-line utilities to represent LDAP entries or changes to entries in a standard portable text form. See RFC 2849.
- ldif2db
- This program is used to load entries specified in text LDAP Directory Interchange Format (LDIF) into a directory stored in a relational database. The database must already exist. ldif2db can be used to add entries to an empty directory database or to a database that already contains entries.
- matching rule
- A rule that describes how to perform a comparison.
- multiple values
- Multiple values are used to assign more than one value to an attribute. The attribute can have multiple values, for example, to accommodate a maiden and married last name. To add multiple values to an attribute, click Multiple values, then add one value per line. If an attribute contains multiple values, the field displays as a drop-down list.
- nested group
- A child group entry whose distinguished name (DN) is referenced by an attribute contained within a parent group entry. The ibm-membergroup attribute has been defined to explicitly distinguish nested groups from ordinary members.
- nested subtree
- A subtree within another subtree of the directory.
- object class definition
- Statement that specifies which attributes must be present in an object of that class, as well as attributes that might be present. Every entry contains an objectClass attribute that identifies what type of information the entry contains.
- object class types
- Object classes can be structural, for example, person; abstract, for example top; or auxiliary, for example ePerson.
- ownerPropagate
- The attribute that controls directory object ownership propagation. If the value is set to true, directory object ownership is propagated down the hierarchy tree. If that attribute is set to false, the entry owner specified is an override, pertaining only to this particular entry.
- ownerSource
- A read only operational attribute that contains the distinguished name (DN) of the entry in which the owner values are defined. Each entry has an associated ownerSource attribute. This attribute is maintained by the server but can be retrieved for administrative purposes.
- Peer server
- The term used for a master server when there are multiple masters for a given subtree. A peer server does not replicate changes sent to it from another peer server; it only replicates changes that are originally made on it.
- proxy server
- A server that receives requests intended for another server and that acts on the client's behalf (as the client's proxy) to obtain the requested service. A proxy server is often used when the client and the server are incompatible for direct connection. For example, the client is unable to meet the security authentication requirements of the server but should be permitted some services.
- quiesce
- To put the server into a state in which it does not accept client updates, except for those done by the administrator and accompanied by replication management control.
- referral
- A way for servers to refer clients to additional directory servers. Referrals can distribute namespace information among multiple servers, provide knowledge of where data resides within a set of interrelated servers, and route client requests to the appropriate server. The general format for a referral is: ldap[s]://hostname:port. Typically the format for a referral to a nonsecure server is: ldap://hostname:389 and to a secure SSL server is: ldaps://hostname:636.
- relative distinguished name (RDN)
- The first component of the distinguished name (DN). For example, if the entry's DN is cn=John Doe,ou=Test,o=sample, the RDN is cn=John Doe.
- replica
- A server that contains a copy of the directory or a copy of part of the directory of another server. Replicas back up servers in order to enhance performance or response times and to ensure data integrity.
- replicated subtree
- A portion of the directory information tree (DIT) that is replicated from one server to another. Under this design, a given subtree can be replicated to some servers and not to others. A subtree can be writable on a given server, while other subtrees might be read-only.
- Replicating network
- A network that contains connected replication sites.
- replication agreement
- Information contained in the directory that defines the connection or replication path between two servers. One server is called the supplier (the one that sends the changes) and the other is the consumer (the one that receives the changes). The agreement contains all the information needed for making a connection from the supplier to the consumer and scheduling replication.
- replication context
- The replication context identifies the root of a replicated subtree. The configuration information related to replication is maintained in a set of entries created below a replication context.
- replication site
- A Gateway server and any master, peer or replica servers configured to replicate together.
- role
- A job function that identifies the tasks that a user can perform and the resources to which a user has access. A user can be assigned one or more roles.
orDefines what access levels a given user has and the specific resources they can modify at those levels. The user may be limited in how they can access information if they do not have the proper role. Multiple roles are permissible.- Secure Sockets Layer (SSL)
- A security protocol that provides communication privacy. SSL enables client and server applications to communicate in a way that is designed to prevent eavesdropping, tampering, and message forgery. SSL was developed by Netscape Communications Corp. and RSA Data Security, Inc.
- sorted search
- Search that allows a client to receive search results sorted based on a list of criteria, where each criteria represents a sort key. This moves the responsibility of sorting from the client application to the server, where it might be done more efficiently.
- subtree
- A section of a directory hierarchy, which is also called a directory tree. The subtree typically starts at a particular directory and includes all subdirectories and objects below that directory in the directory hierarchy; that is, any subdirectories or objects connected to the directory or to any lower level of its subdirectories.
- suffix
- A distinguished name (DN) that identifies the top entry in a locally held directory hierarchy. Because of the relative naming scheme used in Lightweight Directory Access Protocol (LDAP), this suffix applies to every other entry within that directory hierarchy. A directory server can have multiple suffixes, each identifying a locally held directory hierarchy. A suffix is also known as a naming context.
- supplier server
- A server that sends changes to a consumer server.
- syntax
- Syntax refers to the required format for the values of an attribute. Supported syntaxes are:
IBM Attribute Type Description Matching Rule Description Name Form Description Attribute Type Description Object Class Description DIT Structure Rule Description DIT Content Rule Description LDAP Syntax Description OID Matching Rule Use Description Boolean - TRUE/FALSE Binary - octet string INTEGER - integral number Generalized Time IA5 String - case-sensitive string Directory String - case-insensitive string UTC time Telephone Number DN - distinguished name
[ Top of Page | Previous Page | Next Page | Contents | Index ]