1.4.1 Configuration of ApacheDS with Spring

Page edited by Stefan Seelmann

Configuration of ApacheDS with Spring

This section describes the overall structure of the server configuration, which uses Spring.

ApacheDS and Spring
Using Apache Directory Studio for configuration
ApacheDS configurable parameters
Resources

ApacheDS and Spring

There are several options to configure ApacheDS. For instance you can practically do everything programmatically if you embed the server in a Java component.

For this guide we assume a standard installation of ApacheDS run standalone, and the default mechanism to configure this deployment option is (in almost all cases) changing the file server.xml, which is located in the conf directory of your ApacheDS instance. The file is composed of bean definitions, because configuration in ApacheDS 1.5 is done with the help of the Spring Framework.

Despite the fact that the default server.xml shipped with the product is somewhat long, a quick look with the help of the Spring IDE displays that the structure is rather simple:

Most configuration tasks can be accomplished by modifying the properties of existing bean definitions, or (e.g. for a new partition) by adding new beans of certain types and wiring them to the configuration.

Note that the picture above does not show all properties available in the configuration. Only those are visible for which the default server.xml contains a value. There are more, and in case of absence the default value is chosen. Feel free to browse the file to get an impression about further options – several other features controlled by properties are commented out.

Using Apache Directory Studio for configuration

Apache Directory Studio supports creation and manipulations of these configurations files. Apache Directory Studio 1.5.0 supports the configuration file format of Apache DS 1.5.5.

ApacheDS configurable parameters

Apache Directory Server has many different configuration parameters. This page summarize all the possible parameters, and what are the default values for all of them.

The global structure is given here :

[apacheDS|]
- defaultDirectoryService
- ldapService

ldapService

defaultDirectoryService
- [defaultChangeLog|]
- interceptors
- [partitions|]
  - jdbmPartition
    - [indexedAttributes|]
      - jdbmIndex
- systemPartition
  - jdbmPartition
    - [indexedAttributes|]
      - jdbmIndex
- [testEntries|]

changePasswordServer

dnsServer

kdcServer

ntpServer
- tcpTransport
- udpTransport

Interceptors

We have currently 16 possible interceptors we can use in the server. It's important to understand that some of them are mandatory, and other can be activated or disabled. The interceptors order is also very important : most of them can't be moved up or down, without severely impact the server behaviour.

Here is the list of the mandatory interceptors, and the order in which they should appears in the configuration file :

Interceptor	Mandatory	Order
AciAuthorizationInterceptor	Yes	4
AuthenticationInterceptor	Yes	2
ChangeLogInterceptor	No	7
CollectiveAttributeInterceptor	Yes	13
DefaultAuthorizationInterceptor	Yes	5
EventInterceptor	Yes	14
ExceptionInterceptor	Yes	6
KeyDerivationInterceptor	No	10
NormalizationInterceptor	Yes	1
OperationalAttributeInterceptor	Yes	8
PasswordPolicyInterceptor	No	9
ReferralInterceptor	Yes	3
ReplicationInterceptor	No	16
SchemaInterceptor	Yes	11
SubentryInterceptor	Yes	12
TriggerInterceptor	No	15

The following table represents the same interceptor in the order they must appear :

Interceptor	Mandatory
NormalizationInterceptor	Yes
AuthenticationInterceptor	Yes
ReferralInterceptor	Yes
AciAuthorizationInterceptor	Yes
DefaultAuthorizationInterceptor	Yes
ExceptionInterceptor	Yes
ChangeLogInterceptor	No
OperationalAttributeInterceptor	Yes
PasswordPolicyInterceptor	No
KeyDerivationInterceptor	No
SchemaInterceptor	Yes
SubentryInterceptor	Yes
CollectiveAttributeInterceptor	Yes
EventInterceptor	Yes
TriggerInterceptor	No
ReplicationInterceptor	No

Interceptor without any parameters

Most of all the interceptors don't take any paramter. The only possible configuration is to enable or disable them, simply by adding or removing them from the list of interceptors. Here is the list of those interceptors :

AciAuthorizationInterceptor
AuthenticationInterceptor
ChangeLogInterceptor
CollectiveAttributeInterceptor
DefaultAuthorizationInterceptor
EventInterceptor
ExceptionInterceptor
KeyDerivationInterceptor
NormalizationInterceptor
OperationalAttributeInterceptor
PasswordPolicyInterceptor
ReferralInterceptor
SchemaInterceptor
SubentryInterceptor
TriggerInterceptor

Here is an example of configuration where the aciAuthorizationInterceptor is enabled :

<defaultDirectoryService ...
    ...
    <interceptors>
      ...
      <aciAuthorizationInterceptor/>
      ...

AuthenticationInterceptor :

Set<Authenticator> : The list of supported Authenticators. Currently, we have Anonymous, Simple and Strong authenticators. We can just list the associated beans in the server.xml file. Here is a sample of such a configuration :

<defaultDirectoryService ...
    ...
    <interceptors>
      ...
      <authenticationInterceptor>
        <s:property name="authenticators">
          <s:set>
            <!-- Define a new Simple authenticator with a cache of 50 elements -->
            <s:bean id="simpleAuthenticator"
                    class="org.apache.directory.server.core.authn.SimpleAuthenticator">
              <s:constructor-arg value="50"/>
            </s:bean>

            <!-- Define a Strong authenticator -->
            <s:bean id="strongAuthenticator"
                    class="org.apache.directory.server.core.authn.StrongAuthenticator"/>
          </s:set>
        </s:property>
      </authenticationInterceptor>
      ...

The possible values are : AnonymousAuthenticator, SimpleAuthenticator and StrongAuthenticator, out of which the SimpleAuthenticator has a possible parameter, the cache size (an integer value)

ReplicationInterceptor

This interceptor manage the replication. It has many parameters, most of them being defined in a specific clas : ReplicationConfiguration. Let's describe those parameters.

Each instance has a name, which allows multiple instances of the server to be present on the same machine, but with possible replication between them.

First, let see an example :

<defaultDirectoryService ...
    ...
    <replicationInterceptor>
      <configuration>
        <replicationConfiguration logMaxAge="5"
                                  replicaId="instance_a"
                                  replicationInterval="2"
                                  responseTimeout="10"
                                  serverPort="10390">
          <s:property name="peerReplicas">
            <s:set>
              <s:value>instance_b@localhost:1234</s:value>
              <s:value>instance_c@localhost:1234</s:value>
            </s:set>
          </s:property>
        </replicationConfiguration>
      </configuration>
    </replicationInterceptor>
    ...

Here, we have set 2 replicas (instance B and C), the current instance is listening on port 10390, and we have modified the default values for logMaxAge, replicationInterval and responseTimeout.

The ReplicationConfiguration bean contains those parameters :

Name	Type	Default value	Description
logMaxAge	int	7	Maximum days of change logs stored
replicaId	String	none	ID of the replica
replicationInterval	int	5	Replication data exchange interval (seconds) between two replicas
responseTimeout	int	60	response timeout value (seconds) for each sent message during the communication between replicas.
serverPort	int	7846	TCP/IP port number that the interceptor listens to
peerReplicas	Set<String>	none	The remote peer replica list

The peerReplicas parameter is a composite one.

This is the list of remote replicas. Each replica is defined by a name, a host address and a port. The syntax must be :
<replicaid>@<host>:<port>, like ServerAAA@10.1.2.7:1234.

Partition

The ADS server can support more than one kind of Partition, but the default is to use JDBM. Here is the associated configuration for this underlying partition.

JdbmPartition

The main class managing the backend where entries are stored and indexed.

Six kind of parameters can be configured. Here is a table presenting each of them. Only one is a composite parameter, the JdbmIndex list, which is the list of indexes we can set for this partition

Parameter	Default	Mandatory	Description
id	N/A	yes	The Partition identification.
suffix	N/A	yes	The DN for this partition.
cacheSize	10000	no	The number of cached objects
optimizerEnabled	true	no	Tells if the optimizer is on. Unless having some serious reasons to switch it off, don't !
syncOnWrite	true	no	Flush data on disk for every written entry.
indexedAttributes	None	no	Gives the list of indexed attributes. (see below)

Here is an example of a partition configuration

...
  <jdbmPartition id="example"
                 suffix="dc=example,dc=com"
                 cacheSize="100"
                 optimizerEnabled="true"
                 syncOnWrite="true">
    <indexedAttributes>
      ...
    </indexedAttributes>
  </jdbmPartition>
  ...

We have created the example partition, described by the "dc=example,dc=com" DN, with a cache of 100 objects.

JdbmIndex

Each JdbmIndex represent an index set on a specific attributeType. Using index is vital in LDAP if one want to get some performance boost. As a LDAP server is mainly used for reads, index all the AttributeType you will use to retrieve entries from the base.

Here are the parameters you can configure on an index

Parameter	Default	Mandatory	Description
attributeId	NA	yes	The attributeType to index (see below, [1])
cacheSize	100	no	The number of objects stored into the cache
numDupLimit	512	no	WARNING : this is a technical parameter, do not change it without good reasons. This parameter tells the server to switch from a linear storage of duplicated elements to a B-tree backed storage (see below, [2])
wkDirPath	NA	no	WARNING : this is a technical parameter, do not change it without good reasons. Sets the working directory path to something other than the default. Sometimes more performance is gained by locating indices on separate disk spindles.

[1] Many indexes must be set on technical attributes. Right now, only OID are used for those technical attributeTypes. In a close future, we will remove them from the indexed attribute list, unless one wants to set another cache size for them
[2] In some case, an attribute value can point to many entries. For instance, the 'person' ObjectClass will point to potentially millions of entries if we manage millions of users. In this case, we don't store all the references to entries into a big hashmap, but instead we are using a secondary B-Tree to speed-up the search and modification. Usually, 512 elements stored into a page is a good guess.

Here is an example of indexed attribute configuration for a partition

...
  <jdbmPartition id="example"
                 suffix="dc=example,dc=com"
                 cacheSize="100"
                 optimizerEnabled="true"
                 syncOnWrite="true">
    <indexedAttributes>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.1" cacheSize="100"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.2" cacheSize="100"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.3" cacheSize="100"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.4" cacheSize="100"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.5" cacheSize="10"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.6" cacheSize="10"/>
      <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.7" cacheSize="10"/>
      <jdbmIndex attributeId="ou" cacheSize="100"/>
      <jdbmIndex attributeId="uid" cacheSize="100"/>
      <jdbmIndex attributeId="objectClass" cacheSize="100"/>
    </indexedAttributes>
  </jdbmPartition>
  ...

We have define two indexes for the ou and uid attributeType, on top of the technical attributeTypes (all the OIDs), and the ObjectClass, obviously. The cache size is small (from 10 objects to 100 objects).

Protocols

All the supported protocols (except DHCP) are derived from the AbstractProtocolService, and all of those protocols but NTP inherit from the DirectoryBackedService.

It means that we have some common configuration shared by all the protocols. Here is the table of the AbstractProtocolService class shared parameters :

Parameter	Default	Mandatory	Description
Enabled	N/A	no	Tells if the service is enabled or not
IpAddress	localhost	yes	The server IP address we are listening on
IpBackLog	50	no	The back log for the UDP and TCP acceptors
IpPort	N/A	no	The port number the server is listening to, on UDP and TCP
NbThreads	3	no	The number of threads dedicated to processing the incoming requests

In some case, we want a protocol to be accepting connection only on UDP or only on TCP, or on both but with a different port. In these cases, we are using the following parameters, in place of the three parameters IpBackLog, IpPort, NbThreads :

TCP specific configuration :

Parameter	Default	Mandatory	Description
TcpBackLog	50	no	The back log for the TCP acceptor
TcpPort	N/A	no	The TCP port number the server is listening to
NbTcpThreads	3	no	The number of threads dedicated to processing the incoming requests on TCP

UDP specific configuration :

Parameter	Default	Mandatory	Description
UdpBackLog	50	no	The back log for the UDP acceptor
UdpPort	NA	no	The UDP port number the server is listening to
NbUdpThreads	3	no	The number of threads dedicated to processing the incoming requests on UDP

And here are the DirectoryBackedService shared parameters :

Parameter	Default	Mandatory	Description
catalogBased	N/A	no	Set to true if this service uses a catalog for searching different regions of the DIT for its data (used for kerberos, mainly).
searchBaseDn	N/A	no	The base DN we will search on when looking for an entry during an authentication (mainly used for kerberos)

Those two parameters are not frequently used. Just ignore them unless you are installing a kKerberos server. They might be moved to another place later.

Each protocol have its own configuration. The following paragraphs will describe those configurations.

ChangePasswordServer

Some documentation is available here

This service is not fully documented atm. A complete review must be done before considering this service usable.

The ChangePassword server has the following parameters :

Parameter	Default	Mandatory	Description
allowableClockSkew	5 minutes	no	The allowable clock skew.
emptyAddressesAllowed	true	no	Whether tickets issued with empty Host Addresses are allowed.
encryptionTypes	des-cbc-md5	no	A list of possible encryption types. See [1] for the possible values
policyCategoryCount	3	no	The policy for number of character categories required (A - Z), (a - z), (0 - 9), non-alphanumeric (!, $, #, %, ... ).
policyPasswordLength	6	no	The policy for minimum password length.
policyTokenSize	3	no	The policy for minimum token size. Passwords must not contain tokens smaller than 'policyTokenSize' that occur in the user's principal name
primaryRealm	EXAMPLE.COM	no	The primary realm.
servicePrincipal	kadmin/changepw@EXAMPLE.COM	no	The service principal name.

[1] Encryption types values

des-cbc-crc
des-cbc-md4
des-cbc-md5
des3-cbc-md5
des3-cbc-sha1
dsaWithSHA1-CmsOID
md5WithRSAEncryption-CmsOID
sha1WithRSAEncryption-CmsOID
rc2CBC-EnvOID
rsaEncryption-EnvOID
rsaES-OAEP-ENV-OID
des-ede3-cbc-Env-OID
des3-cbc-sha1-kd
aes128-cts-hmac-sha1-96
aes256-cts-hmac-sha1-96
rc4-hmac
rc4-hmac-exp
subkey-keymaterial
rc4-md4
rc4-hmac-old
rc4-hmac-old-exp

DnsServer

KdcServer

LdapService

We have two sets of parameters : some are simple, some are composite. We will expose the full list first, then a description for every composite parameter the composite parameters are bold).

Parameter	Default	Mandatory	Description
allowAnonymousAccess	true	no	A flag to allow or forbid anonymous connections
certificatePassword	N/A	no	If the certificate is stored in an external KeyStore, this is the certificate password
confidentialityRequired	false	no	Sets the mode for this LdapService to accept requests with or without a TLS secured connection via either StartTLS extended operations or using LDAPS.
directoryService	N/A	yes	The reference to the underlying Directory service (see below)
enableLdaps	true	no	Enable LDAPS
extendedOperationHandlers	N/A	no	A list of extended operations supported by the server. It makes the server extensible, as you can add a new extended operation (see below).
keystoreFile	N/A	no	Define the external KeyStore to use, if one don't want to use ADS to store the certificates
maxSizeLimit	No limit (0)	no	Sets the maximum size limit in number of entries to return for search
maxTimeLimit	No limit (0)	no	Sets the maximum time limit in milliseconds to conduct a search

SASL configuration

Those parameters are defined when using SASL Authentication.

Parameter	Default	Mandatory	Description
saslHost	N/A	no	Sets the FQDN of this SASL host, validated during SASL negotiation.
saslMechanismHandlers	PLAIN, CRAM_MD5, DIGEST_MD5, GSSAPI, NTLM, GSS_SPNEGO	no	A map representing the supported authentication mechanisms.
saslPrincipal	N/A	no	Sets the Kerberos principal name for this LDAP service, used by GSSAPI.
saslQop	N/A	no	Sets the desired quality-of-protection, used by DIGEST-MD5 and GSSAPI.
saslRealms	N/A	no	Sets the realms serviced by this SASL host, used by DIGEST-MD5 and GSSAPI.

SaslMechanismHandlers configuration

This is a list of parameters describing the supported SASL mechanisms. Currently, the following mechanisms are supported :

SIMPLE
PLAIN
CRAM_MD5
DIGEST_MD5
GSSAPI
NTLM

The configuration file will be something like :

<ldapService>
    ...
    <!-- The list of supported authentication mechanisms. -->
    <saslMechanismHandlers>
      <simpleMechanismHandler mech-name="SIMPLE"/>
      <cramMd5MechanismHandler mech-name="CRAM-MD5" />
      <digestMd5MechanismHandler mech-name="DIGEST-MD5" />
      <gssapiMechanismHandler mech-name="GSSAPI" />
      <ntlmMechanismHandler mech-name="NTLM" ntlmProviderFqcn="com.foo.Bar"/>

    </saslMechanismHandlers>
  ...

The specific parameters for each of those handlers is described here.

SaslQoP configuration

This parameter is used when the GSSAPI and DIGEST-MD5 authentication handlers are used (see RFC 2831). It contains the possible Quality of Protections :

auth
auth-int
auth-conf

Here is an example of configuration in the server.xml file :

<ldapService>
    ...
    <!-- The desired quality-of-protection, used by DIGEST-MD5 and GSSAPI.  -->
    <saslQop>
      <s:value>auth</s:value>
      <s:value>auth-int</s:value>
      <s:value>auth-conf</s:value>
    </saslQop>
    ...

SaslRealms configuration

This parameter lists the realms serviced by this SASL host, used by DIGEST-MD5 and GSSAPI. It contains a list of host name.

Here is an example in the server.xml file :

<ldapService>
    ...
    <!-- The realms serviced by this SASL host, used by DIGEST-MD5 and GSSAPI. -->
    <saslRealms>
      <s:value>example.com</s:value>
      <s:value>apache.org</s:value>
    </saslRealms>
    ...

DirectoryService configuration

This is the directory service managing all the stored information for many protocols, including LDAP, KDC, DNS and ChangePassword.

It has many parameters which can be tunned. Here is the list of all the available parameters :

Parameter	Default	Mandatory	Description
accessControlEnabled	false	no	Sets whether to enable basic access control checks or not
allowAnonymousAccess	true	no	Sets whether to allow anonymous access to entries other than the RootDSE
changeLog	N/A	no	Sets the ChangeLog service for this DirectoryService used for tracking changes
denormalizeOpAttrsEnabled	false	no	Sets whether the operational attributes are denormalized when returned
exitVmOnShutdown	true	no	A flag used to shutdown the VM when stopping the server. Useful when the server is standalone. If the server is embedded, we don't want to shutdown the VM
interceptors	N/A	yes	Manage the list of available interceptors. See Interceptors
journal	N/A	no	Manage the Journaling system. See Journal
maxPDUSize	Integer.MAX	no	The maximum size for an incoming PDU
partitions	N/A	yes	The set of all declared partitions
passwordHidden	false	no	A flag to tell if the userPassword attribute's value must be hidden (NYI)
replicaId	0	false	The directory instance replication ID (must be an integer in [0,999]
systemPartition	N/A	yes	The System partition
testEntries	N/A	no	A list of LDIF entries to inject at startup
workingDirectory	"server-work"	no	The server working directory

Journal

Manage the Journaling system. It can be enabled or disabled, and is associated with a Store. Here is an example of configuration :

<journal enabled="true">
  <journalStore fileName="journal.log" workingDirectory="/var/log">
</journal>

ExtendedOperationHandlers configuration

This parameter is used to list the supported extended operations. This is a highly technical parameter, and you are not likely to change it, except if you want to remove some of the extended operations for some reasons.

The syntax is simple : it's a list of all the supported classes implementing extended operations. Here is an example in the server.xml file :

<ldapService>
    ...
    <!-- the collection of extended operation handlers to install -->
    <extendedOperationHandlers>
      <startTlsHandler/>
      <gracefulShutdownHandler/>
      <launchDiagnosticUiHandler/>
      <!-- The Stored Procedure Extended Operation is not stable yet and it may cause security risks.-->
      <!--storedProcedureExtendedOperationHandler/-->
    </extendedOperationHandlers>
  ...

As you can see, the last extended operation is commented, it won't be available into this instance of the LDAP server.

Currently, the available extended operations are :

GracefulShutdownHandler : Handle the server shutdown
LaunchDiagnosticUiHandler : Launch a graphical tool to look at the backend content
StartTlsHandler : Handle the StartTLS operation (establishes a secured connection between the server and a client)
StoredProcedureExtendedOperationHandler : Manage StoredProcedured, executing them when received.

NtpServer

There is no specific parameter for the NtpServer. The AbstractProtocolService parameters have to be used in order to configure this server. Here is an example of configuration :

<NtpServer ipPort="60123" nbThreads="8"/>

We have a running NtpServer on localhost, waiting for incomming connection on port 60213, for TCP and UDP transports. 8 processing threads for each of the transport connectors will be used to process the incoming requests.

1.4.1 Configuration of ApacheDS with Spring

Page edited by Stefan Seelmann

Configuration of ApacheDS with Spring

ApacheDS and Spring

Using Apache Directory Studio for configuration

ApacheDS configurable parameters

Interceptors

Interceptor without any parameters

AuthenticationInterceptor :

ReplicationInterceptor

Partition

JdbmPartition

JdbmIndex

Protocols

ChangePasswordServer

DnsServer

KdcServer

LdapService

SASL configuration

SaslMechanismHandlers configuration

SaslQoP configuration

SaslRealms configuration

DirectoryService configuration

Journal

ExtendedOperationHandlers configuration

NtpServer

StandardThreadPool ???

LDAP Handlers

SASL Mechanism handlers

CramMd5MechanismHandler

DigestMd5MechanismHandler

GssapiMechanismHandler

NtlmMechanismHandler

PlainMechanismHandler

SimpleMechanismHandler

ADS

ReplicationConfiguration

ApacheDSJdbmPartition

Resources