Server connection properties

To access a data source outside of the appliance, define the properties of the server.

The Server Connection properties table describes the properties on the LDAP Server Connections panel for the Advanced Access Control and Federation module activation levels.

Property Description
Name Name for the server connection. Ensure the name is unique. Select this name when defining the policy information point. The server connection name must begin with an alphabetic character. Do not use control characters, leading and trailing blanks, and the following special characters ~ ! @ # $ % ^ & * ( ) + | ` = \ ; " ' < > ? , [ ] { } / anywhere in the name.
Description Describes the server connection. Optional.
Type Shows the server connection type. (Read only)
JNDI ID (Oracle, DB2, PostgreSQL only) JNDI ID the server uses. Ensure the ID is unique. Use only alphanumeric characters: a-b, A-B, 0-9
Server name (Oracle, DB2, PostgreSQL, SMTP only) Name or IP address for the server.
Port (Oracle, DB2, PostgreSQL, LDAP, SMTP only) Port number where the connection to the server can be made.
URL (Web Service only) URL where the connection to the server can be made.
User name (Oracle, DB2, PostgreSQL, SMTP, and Web Service only) User name that has the correct permissions to access the resources.
Password (Oracle, DB2, PostgreSQL, SMTP, and Web Service only) Password to access the server.
SSL Whether SSL is used for connecting to the server. Select True or False. Default is True.
Driver type (Oracle only) Driver type. Select Thin or OCI. Default is Thin.
Service name (Oracle only) Name of the service.
Database name (DB2, PostgreSQL only) Name of the database.
Host name (LDAP only) Host name or IP address of the LDAP server.
Bind DN (LDAP only) LDAP distinguished name (DN) used when binding, or signing on, to the LDAP server. If this value is set to "anonymous", the appliance uses an anonymous bind to the LDAP directory server. Typically the bind-dn has significant privileges so that it can be used to modify LDAP registry entries, such as creating users and resetting passwords via pdadmin or the Registry Direct Java API. Using an anonymous connection to LDAP typically comes with very limited access, perhaps at most search and view of entries, at the least no access at all. If anonymous access has sufficient privileges, then it might be usable for the WebSEAL level of access on users and groups. This access includes the permission for a user to change password if "bind-auth-and-pwdchg = yes" is set ("ldap.bind-auth-and-pwdchg = true" for Registry Direct Java API).
Bind Password (LDAP only) Password for the LDAP bind DN. If bind DN (bind-dn) is set to anonymous, we can use any non-empty string as the value of bind password (bind-pwd).
Administration hostname (Cloud Identity only) Administration hostname of the Cloud Identity subscription.
Client ID (Cloud Identity only) Client ID of an API Client on Cloud Identity.
Client Secret (Cloud Identity only) Client secret of an API Client on Cloud Identity.
SSL Truststore (LDAP, Web Service, and Cloud Identity only) Truststore that verifies the credentials.
SSL Mutual Authentication Key (LDAP, Web Service, and Cloud Identity only) Label of the client certificate to be presented when connecting to the LDAP. This property is sourced from SSL Truststore. This field is required only if mutual SSL authentication is required by the server.

For information on SSL configuration, see Configure SSL connections.

The properties in the following table are connection manager properties. The defaults that are listed are the current known defaults. All tuning properties are optional.

Property Description
Aged timeout (seconds) (Oracle, DB2, PostgreSQL only) Time, in seconds, before a physical connection is discarded by pool maintenance. Specify -1 to disable this timeout. The default is -1.
Connection timeout (seconds) Time, in seconds, after which a connection times out.

For Oracle, DB2, PostgreSQL, and SMTP, specify -1 to disable this timeout. The default is 30 seconds.

For LDAP, specify only integers, 1 or greater. The default is 120 seconds.

Max Idle Time (seconds) (Oracle, DB2, PostgreSQL only) Maximum amount of time, in seconds, after which an unused or idle connection is discarded during pool maintenance. Specify -1 to disable this timeout. The default is 1800 seconds.
Max Idle Time (seconds) (LDAP only) Time, in seconds, after which an established connection is discarded as idle. Set this to a value lower than the connection idle timeout on the LDAP server. This is only applicable for performing Attribute Mapping from an LDAP server.
Reap time (seconds) (Oracle, DB2, PostgreSQL only) Time, in seconds, between runs of the pool maintenance thread. Specify -1 to disable pool maintenance. The default is 180 seconds.
Max pool size (Oracle, DB2, PostgreSQL only) Maximum number of physical connections for a pool. Specify 0 for unlimited. The default is 50.
Max pool size (LDAP only) Maximum number of connections that are pooled. This is only applicable for performing Attribute Mapping from an LDAP server.
Min pool size (Oracle, DB2, PostgreSQL only) Minimum number of physical connections to maintain in a pool. The aged timeout can override the minimum.
Purge policy (Oracle, DB2, PostgreSQL only) Which connections to delete when a stale connection is detected in the pool. Select from the following options:

    Entire pool

    When a stale connection is detected, all connections in the pool are marked stale, and when no longer in use, are closed. This is the default option.

    Failing connection only

    When a stale connection is detected, only the connection that was found to be bad is closed.

    Validate all connections

    When a stale connection is detected, connections are tested and the ones found to be bad are closed.

Max connections per thread (Oracle, DB2, PostgreSQL only) Limit of open connections on each thread.
Cache connections per thread (Oracle, DB2, PostgreSQL only) Number of cache connections for each thread.

Parent topic: Policy information points

Parent topic: Manage server connections