Glossary
Glossary access control instruction (ACI) An instruction that grants or denies permissions to entries in the directory. access control list (ACL) The mechanism for controlling access to your directory. access rights In the context of access control, specify the level of access granted or denied. Access rights are related to the type of operation that can be performed on the directory. The following rights can be granted or denied: read, write, add, delete, search, compare, selfwrite, proxy and all. account inactivation Disables a user account, group of accounts, or an entire domain so that all authentication attempts are automatically rejected. All IDs Threshold A size limit which is globally applied to every index key managed by the server. When the size of an individual ID list reaches this limit, the server replaces that ID list with an All IDs token. All IDs token A mechanism which causes the server to assume that all directory entries match the index key. In effect, the All IDs token causes the server to behave as if no index was available for the search request. anonymous access When granted, allows anyone to access directory information without providing credentials, and regardless of the conditions of the bind. approximate index Allows for efficient approximate or "sounds-like" searches. attribute Holds descriptive information about an entry. Attributes have a label and a value. Each attribute also follows a standard syntax for the type of information that can be stored as the attribute value. attribute list A list of required and optional attributes for a given entry type or object class. authenticating directory server In pass-through authentication (PTA), the authenticating Directory Server is the Directory Server that contains the authentication credentials of the requesting client. The PTA-enabled host sends PTA requests it receives from clients to the host. authentication certificate Digital file that is not transferable and not forgeable and is issued by a third party. Authentication certificates are sent from server to client or client to server in order to verify and authenticate the other party. base DN Base distinguished name. A search operation is performed on the base DN, the DN of the entry and all entries below it in the directory tree. base distinguished name (bind DN) Distinguished name used to authenticate to Directory Server when performing an operation. bind distinguished name (bind rule) In the context of access control, the bind rule specifies the credentials and conditions that a particular user or client must satisfy in order to get access to directory information. branch entry An entry that represents the top of a subtree in the directory. browser Software, such as Mozilla Firefox, used to request and view World Wide Web material stored as HTML files. The browser uses the HTTP protocol to communicate with the host server. browsing index Speeds up the display of entries in the Directory Server Console. Browsing indexes can be created on any branch point in the directory tree to improve display performance. cascading replication In a cascading replication scenario, one server, often called the hub supplier, acts both as a consumer and a supplier for a particular replica. It holds a read-only replica and maintains a changelog. It receives updates from the supplier server that holds the supplier copy of the data and in turn supplies those updates to the consumer. certificate A collection of data that associates the public keys of a network user with their DN in the directory. The certificate is stored in the directory as user object attributes. Certificate Authority Company or organization that sells and issues authentication certificates. You may purchase an authentication certificate from a Certification Authority that you trust. Also known as a CA. CGI Common Gateway Interface. An interface for external programs to communicate with the HTTP server. Programs written to use CGI are called CGI programs or CGI scripts and can be written in many of the common programming languages. CGI programs handle forms or perform output parsing that is not done by the server itself. chaining A method for relaying requests to another server. Results for the request are collected, compiled, and then returned to the client. changelog:. A changelog is a record that describes the modifications that have occurred on a replica. The supplier server then replays these modifications on the replicas stored on replica servers or on other suppliers, in the case of multi-suppliers replication. character type Distinguishes alphabetic characters from numeric or other characters and the mapping of upper-case to lower-case letters. ciphertext Encrypted information that cannot be read by anyone without the proper key to decrypt the information. class definition Specifies the information needed to create an instance of a particular object and determines how the object works in relation to other objects in the directory. class of serviceclassic CoS A classic CoS identifies the template entry by both its DN and the value of one of the target entry's attributes. clientcode page An internal table used by a locale in the context of the internationalization plug-in that the operating system uses to relate keyboard keys to character font screen displays. collation order Provides language and cultural-specific information about how the characters of a given language are to be sorted. This information might include the sequence of letters in the alphabet or how to compare letters with accents to letters without accents. consumer Server containing replicated directory trees or subtrees from a supplier server. consumer server In the context of replication, a server that holds a replica that is copied from a different server is called a consumer for that replica. CoS A method for sharing attributes between entries in a way that is invisible to applications. CoS definition entry Identifies the type of CoS you are using. It is stored as an LDAP subentry below the branch it affects. CoS template entry Contains a list of the shared attribute values. daemon A background process on a Unix machine that is responsible for a particular system task. Daemon processes do not need human intervention to continue functioning. DAP Directory Access Protocol. The ISO X.500 standard protocol that provides client access to the directory. database link An implementation of chaining. The database link behaves like a database but has no persistent storage. Instead, it points to data stored remotely. default index One of a set of default indexes created per database instance. Default indexes can be modified, although care should be taken before removing them, as certain plug-ins may depend on them. directory tree The logical representation of the information stored in the directory. It mirrors the tree model used by most filesystems, with the tree's root point appearing at the top of the hierarchy. Also known as DIT. Directory Manager The privileged database administrator, comparable to the root user in UNIX. Access control does not apply to the Directory Manager. directory service A database application designed to manage descriptive, attribute-based information about people and resources within an organization. distinguished name String representation of an entry's name and location in an LDAP directory. DNS Domain Name System. The system used by machines on a network to associate standard IP addresses (such as 198.93.93.10) with host names (such as www.example.com ). Machines normally get the IP address for a host name from a DNS server, or they look it up in tables maintained on their systems. DNS alias A DNS alias is a host name that the DNS server knows points to a different host\u0097specifically a DNS CNAME record. Machines always have one real name, but they can have one or more aliases. For example, an alias such as www. yourdomain . domain might point to a real machine called realthing. yourdomain . domain where the server currently exists. entry A group of lines in the LDIF file that contains information about an object. entry distribution Method of distributing directory entries across more than one server in order to scale to support large numbers of entries. entry ID list Each index that the directory uses is composed of a table of index keys and matching entry ID lists. The entry ID list is used by the directory to build a list of candidate entries that may match the client application's search request. equality index Allows you to search efficiently for entries containing a specific attribute value. file extension The section of a filename after the period or dot (.) that typically defines the type of file (for example, .GIF and .HTML). In the filename index.html the file extension is html . file type The format of a given file. For example, graphics files are often saved in GIF format, while a text file is usually saved as ASCII text format. File types are usually identified by the file extension (for example, .GIF or .HTML). filter A constraint applied to a directory query that restricts the information returned. filtered role: Allows you to assign entries to the role depending upon the attribute contained by each entry. You do this by specifying an LDAP filter. Entries that match the filter are said to possess the role. general access When granted, indicates that all authenticated users can access directory information. GSS-API Generic Security Services. The generic access protocol that is the native way for UNIX-based systems to access and authenticate Kerberos services; also supports session encryption. host name A name for a machine in the form machine.domain.dom, which is translated into an IP address. For example, www.example.com is the machine www in the subdomain example and com domain. HTML Hypertext Markup Language. The formatting language used for documents on the World Wide Web. HTML files are plain text files with formatting codes that tell browsers such as the Mozilla Firefox how to display text, position graphics, and form items and to display links to other pages. HTTP Hypertext Transfer Protocol. The method for exchanging information between HTTP servers and clients. HTTPD An abbreviation for the HTTP daemon or service, a program that serves information using the HTTP protocol. The daemon or service is often called an httpd. HTTPS A secure version of HTTP, implemented using the Secure Sockets Layer, SSL. hub In the context of replication, a server that holds a replica that is copied from a different server, and, in turn, replicates it to a third server. IID list scan limit A size limit which is globally applied to any indexed search operation. When the size of an individual ID list reaches this limit, the server replaces that ID list with an all IDs token. index key Each index that the directory uses is composed of a table of index keys and matching entry ID lists. indirect CoS An indirect CoS identifies the template entry using the value of one of the target entry's attributes. international index Speeds up searches for information in international directories. IP address A set of numbers, separated by dots, that specifies the actual location of a machine on the Internet (for example, 198.93.93.10). ISO International Standards Organization. knowledge reference Pointers to directory information stored in different databases. LDAP Lightweight Directory Access Protocol. Directory service protocol designed to run over TCP/IP and across multiple platforms. LDAPv3 Version 3 of the LDAP protocol, upon which Directory Server bases its schema format. LDAP client Software used to request and view LDAP entries from an LDAP Directory Server. LDAP URL Provides the means of locating Directory Servers using DNS and then completing the query using LDAP. A sample LDAP URL is ldap://ldap.example.com . LDBM database A high-performance, disk-based database consisting of a set of large files that contain all of the data assigned to it. The primary data store in Directory Server. LDIF LDAP Data Interchange Format. Format used to represent Directory Server entries in text form. leaf entry An entry under which there are no other entries. A leaf entry cannot be a branch point in a directory tree. locale Identifies the collation order, character type, monetary format and time / date format used to present data for users of a specific region, culture, and custom. This includes information on how data of a given language is interpreted, stored, or collated. The locale also indicates which code page should be used to represent a given language. managed object A standard value which the SNMP agent can access and send to the NMS. Each managed object is identified with an official name and a numeric identifier expressed in dot-notation. managed role Allows creation of an explicit enumerated list of members. mapping tree A data structure that associates the names of suffixes (subtrees) with databases. matching rule Provides guidelines for how the server compares strings during a search operation. In an international search, the matching rule tells the server what collation order and operator to use. MD5 A message digest algorithm by RSA Data Security, Inc., which can be used to produce a short digest of data that is unique with high probability and is mathematically extremely hard to produce; a piece of data that will produce the same message digest. MD5 signature A message digest produced by the MD5 algorithm. MIB Management Information Base. All data, or any portion thereof, associated with the SNMP network. We can think of the MIB as a database which contains the definitions of all SNMP managed objects. The MIB has a tree-like hierarchy, where the top level contains the most general information about the network and lower levels deal with specific, separate network areas. MIB namespace Management Information Base namespace. The means for directory data to be named and referenced. Also called the directory tree. monetary format Specifies the monetary symbol used by specific region, whether the symbol goes before or after its value, and how monetary units are represented. multi-supplier replication An advanced replication scenario in which two servers each hold a copy of the same read-write replica. Each server maintains a changelog for the replica. Modifications made on one server are automatically replicated to the other server. In case of conflict, a time stamp is used to determine which server holds the most recent version. multiplexor The server containing the database link that communicates with the remote server. n + 1 directory problem The problem of managing multiple instances of the same information in different directories, resulting in increased hardware and personnel costs. name collisions Multiple entries with the same distinguished name. nested role Allows the creation of roles that contain other roles. network management application Network Management Station component that graphically displays information about SNMP managed devices, such as which device is up or down and which and how many error messages were received. NIS Network Information Service. A system of programs and data files that Unix machines use to collect, collate, and share specific information about machines, users, filesystems, and network parameters throughout a network of computers. NMS Powerful workstation with one or more network management applications installed. ns-slapd Red Hat's LDAP Directory Server daemon or service that is responsible for all actions of the Directory Server. object class Defines an entry type in the directory by defining which attributes are contained in the entry. object identifier A string, usually of decimal numbers, that uniquely identifies a schema element, such as an object class or an attribute, in an object-oriented system. Object identifiers are assigned by ANSI, IETF or similar organizations. operational attribute Contains information used internally by the directory to keep track of modifications and subtree properties. Operational attributes are not returned in response to a search unless explicitly requested. parent access When granted, indicates that users have access to entries below their own in the directory tree if the bind DN is the parent of the targeted entry. pass-through subtree In pass-through authentication, the PTA directory server will pass through bind requests to the authenticating Directory Server from all clients whose DN is contained in this subtree. password file A file on Unix machines that stores Unix user login names, passwords, and user ID numbers. It is also known as /etc/passwd because of where it is kept. password policy A set of rules that governs how passwords are used in a given directory. permission In the context of access control, permission states whether access to the directory information is granted or denied and the level of access that is granted or denied. PDU Encoded messages which form the basis of data exchanges between SNMP devices. pointer CoS A pointer CoS identifies the template entry using the template DN only. presence index Allows searches for entries that contain a specific indexed attribute. protocol A set of rules that describes how devices on a network exchange information. protocol data unitproxy authentication A special form of authentication where the user requesting access to the directory does not bind with its own DN but with a proxy DN. proxy DN Used with proxied authorization. The proxy DN is the DN of an entry that has access permissions to the target on which the client-application is attempting to perform an operation. PTA Mechanism by which one Directory Server consults another to check bind credentials. PTA directory server In pass-through authentication (PTA), the PTA Directory Server is the server that sends (passes through) bind requests it receives to the authenticating Directory Server. PTA LDAP URL In pass-through authentication, the URL that defines the authenticating Directory Server, pass-through subtree(s), and optional parameters. RAM Random access memory. The physical semiconductor-based memory in a computer. Information stored in RAM is lost when the computer is shut down. rc.local A file on Unix machines that describes programs that are run when the machine starts. It is also called /etc/rc.local because of its location. RDN The name of the actual entry itself, before the entry's ancestors have been appended to the string to form the full distinguished name. referential integrity Mechanism that ensures that relationships between related entries are maintained within the directory. read-only replica A replica that refers all update operations to read-write replicas. A server can hold any number of read-only replicas. read-write replica A replica that contains a writable copy of directory information and can be updated. A server can hold any number of read-write replicas. replica A database that participates in replication. replication Act of copying directory trees or subtrees from supplier servers to replica servers. replication agreement Set of configuration parameters that are stored on the supplier server and identify the databases to replicate, the replica servers to which the data is pushed, the times during which replication can occur, the DN and credentials used by the supplier to bind to the consumer, and how the connection is secured. RFC Request for Comments. Procedures or standards documents submitted to the Internet community. People can send comments on the technologies before they become accepted standards. role An entry grouping mechanism. Each role has members , which are the entries that possess the role. role-based attributes Attributes that appear on an entry because it possesses a particular role within an associated CoS template. root The most privileged user available on Unix machines. The root user has complete access privileges to all files on the machine. root suffix The parent of one or more sub suffixes. A directory tree can contain more than one root suffix. SASL An authentication framework for clients as they attempt to bind to a directory. schema Definitions describing what types of information can be stored as entries in the directory. When information that does not match the schema is stored in the directory, clients attempting to access the directory may be unable to display the proper results. schema checking Ensures that entries added or modified in the directory conform to the defined schema. Schema checking is on by default, and users will receive an error if they try to save an entry that does not conform to the schema. Secure Sockets Layerself access When granted, indicates that users have access to their own entries if the bind DN matches the targeted entry. server daemon The server daemon is a process that, once running, listens for and accepts requests from clients. server service A process on Windows that, once running, listens for and accepts requests from clients. It is the SMB server on Windows NT. Server Selector Interface that allows you select and configure servers using a browser. service A background process on a Windows machine that is responsible for a particular system task. Service processes do not need human intervention to continue functioning. SIE Server Instance Entry. The ID assigned to an instance of Directory Server during installation. single-supplier replication The most basic replication scenario in which multiple servers, up to four, each hold a copy of the same read-write replicas to replica servers. In a single-supplier replication scenario, the supplier server maintains a changelog. SIRslapd LDAP Directory Server daemon or service that is responsible for most functions of a directory except replication. SNMP Used to monitor and manage application processes running on the servers by exchanging data about network activity. SNMP master agent Software that exchanges information between the various subagents and the NMS. SNMP subagent Software that gathers information about the managed device and passes the information to the master agent. Also called a subagent. SSL A software library establishing a secure connection between two parties (client and server) used to implement HTTPS, the secure version of HTTP. Also called Secure Sockets Layer. standard index index maintained by default. sub suffix A branch underneath a root suffix. substring index Allows for efficient searching against substrings within entries. Substring indexes are limited to a minimum of two characters for each entry. suffix The name of the entry at the top of the directory tree, below which data is stored. Multiple suffixes are possible within the same directory. Each database only has one suffix. superuser The most privileged user available on Unix machines. The superuser has complete access privileges to all files on the machine. Also called root. supplier Server containing the writable copy of directory trees or subtrees that are replicated to replica servers. supplier server In the context of replication, a server that holds a replica that is copied to a different server is called a supplier for that replica. supplier-initiated replication Replication configuration where supplier servers replicate directory data to any replica servers. symmetric encryption Encryption that uses the same key for both encrypting and decrypting. DES is an example of a symmetric encryption algorithm. system index Cannot be deleted or modified as it is essential to Directory Server operations. target In the context of access control, the target identifies the directory information to which a particular ACI applies. target entry The entries within the scope of a CoS. TCP/IP Transmission Control Protocol/Internet Protocol. The main network protocol for the Internet and for enterprise (company) networks. time/date format Indicates the customary formatting for times and dates in a specific region. TLS The new standard for secure socket layers; a public key based protocol. Also Transport Layer Security. topology The way a directory tree is divided among physical servers and how these servers link with one another. uid A unique number associated with each user on a Unix system. URL Uniform Resource Locater. The addressing system used by the server and the client to request documents. It is often called a location. The format of a URL is protocol :// machine : port / document . The port number is necessary only on selected servers, and it is often assigned by the server, freeing the user of having to place it in the URL. virtual list view index Speeds up the display of entries in the Directory Server Console. Virtual list view indexes can be created on any branch point in the directory tree to improve display performance. X.500 standard The set of ISO/ITU-T documents outlining the recommended information model, object classes and attributes used by directory server implementation.