Online Help | |
Sun Java (TM) System Directory Proxy Server | |
Network Group Network View
Directory Proxy Server network groups describe how to identify an LDAP client, and the restrictions to enforce for clients that match that group. Clients are initially identified into a group based on the network address from which they connect. They may change their group after a successful bind.
Network groups are tested in the descending order of priority, specified by their placement in the Network Group window. In this window, groups on the bottom of the list have less priority than those towards the top. If no groups are found to match a client, the client's request will be rejected. There must be at least one group entry in the configuration specification.
Clients are identified to belong to this network group based on their IP address and/or domain name.
Group name. Enter the group name that specifies the name of the group. This value must be unique within the set of groups. This value must be present as it forms the RDN of entries of this class.
Enable. By default, this option is selected for you. Deselect it to disable a group in a configuration. For a group to be part of Directory Proxy Server configuration, this option must be selected.
Specify connection timeout. Select this box if you wish to enter a period of client inactivity after which Directory Proxy Server may close the connection to the client. The value is a number of seconds, typically 600 or more. The default, if no value is present, is to not timeout connections. If TCP keepalives are not enabled, this attribute must be present to keep Directory Proxy Server from being clogged by lost client connections.
Perform reverse DNS lookup of connecting clients. By default, " Reverse DNS lookup" is enabled. If Reverse DNS lookup is disabled, then Directory Proxy Server will not perform a reverse DNS lookup to find the domain name of the connecting client. Disabling Reverse DNS lookup can sometimes significantly improve Directory Proxy Server performance. If you have used a domain name or a domain name suffix as a value in the "Client Network Binding Criteria," you must not disable Reverse DNS lookup, otherwise Directory Proxy Server will not function properly.
Enable TCP no delay. By default, " TCP no delay" is enabled. If "TCP no delay" is disabled, then Directory Proxy Server will disable the Nagle Algorithm for connections between itself and clients that fall into this group. "TCP no delay" should only be disabled if the network bandwidth between Directory Proxy Server and clients is small; however, it may create substantial performance degradation.
Client network binding criteria. Use this section to specify which clients are able to bind in this network group. Enable "No IP binding" if clients are only to switch when they bind to a network group. Enable "Bind from ANY network host" if all hosts for a group are allowed to bind. And enable "Bind with the following criteria:" to specify the domain names or IP addresses of the hosts that match a network group.
No IP binding. By default, "No IP binding" is enabled. Disable "No IP binding" if a network group is only used for clients to switch to when they bind.
Bind from ANY network host. All hosts are allowed to bind with this network group.
Bind with the following criteria. Enable "Bind with the following criteria" if a network group will specify the domain name or IP address of the host that will bind to it.
Add... Displays a dialog to add a network criteria. There are four options: "Domain Name," "IP address," "IP address and bits," "IP address and quad."
Edit... Displays a dialog to edit a network criteria.
Remove... Displays a dialog to remove a network criteria.
Domain name dialog. Specify the domain name of a client that can bind to a network group, e.g., foo.sun.com. Note: Directory Proxy Server does not assume any domain suffix by default; hence, complete domain names must be provided. A domain name suffix with a leading period, e.g., .sun.com will cause all hosts with domain names that end in that suffix to match.
IP address. Specify a single IP address in dotted decimal form, e.g., 198.214.11.1.
IP address and bits. Specify an IP network mask, in the form of <network number>/<mask bits>, e.g., 198.241.11.0/24. The first half is the network number and the second half indicates the number of bits of the network number necessary for matching.
IP address and quad. Specify an IP network mask, in the form of a pair of dotted decimal quads, e.g., 198.241.11.0/255.255.255.128. The first half is a network number, the second half indicates the bits of the network number necessary for matching. For example, 198.214.11.0/255.255.255.128 will match a host with IP address 198.214.11.63 but not one with IP address 198.214.11.191.
Note: use of domain names or domain name suffixes requires "Perform reverse DNS lookup of connecting client" to be enabled.
Copyright 2005 Sun Microsystems, Inc. All rights reserved.