You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

Introduction

There is two ways to initialize the server :

  1. As a standelone server
  2. As an embeded server

 Both initialization are different, for the user perspective, but not from the developper perspective, as the first initializtion system embed the server, just adding some specific mechanism to stop the server (remember that the server can be launched as a daemon)

The server initialization is done in two steps. The first one read the confuguration, and set all the necessary structures, and the second step start the server.

Initialization

This is done by reading the server.xml file, which is a Spring based document. As we refer many classes into this file, they will be instanciated on the fly.

The following classes are created :

Object

Class

Description

environment

HashTable

Initialize the euthentication objects for Ldap, Kerberos, Naming, ChangePW, and set of binary attributes

configuration

MutableServerStartupConfiguration

Initialize the server

systemPartitionConfiguration

MutableBTreePartitionConfiguration

Configuration of the system partition

examplePartitionConfiguration

MutableBTreePartitionConfiguration

Configuration of an example partition

The following schema represent the properties set by this configuration file :

Configuration initialization

During this phase, we instanciate the MutableServerStartupConfiguration, which will initialize a lot of structures, through the call to those three methods :

  • setDefaultAuthenticatorConfigurations
  • setDefaultBootstrapSchemas
  • setDefaultInterceptorConfigurations

then we will initialize the two declared partitions, system and example

setDefaultAuthenticatorConfigurations() method

This method initialize the authentication methods. At the moment, we support only Simple authentication (ie with a password) or Anonymous authentication.

Each authenticator is stored in a MutableAuthenticatorConfiguration object, which associate a name and a dedicated class.

Should those authenticators be plugins ?

We could declare those authenticator as plugins into the server.xml file, allowing us to easily add some new authenticator. However, this will introduce some weakness in the security system. If somebody add a faked authentication class, and modify the configuration file to load this plugin, what could happen?

SASL

SASL authentication should still be implemented...

For information about authentication mechanisms, open this page : Authentication Mechanisms in ADS

setDefaultBootstrapSchemas() method

In this method, we will load all the default schemas, which are :

  • CoreSchema
  • CosineSchema
  • ApacheSchema
  • InetorgpersonSchema
  • JavaSchema
  • SystemSchema
  • CollectiveSchema

Those schema are transofmed into classes by a maven plugin, and they initiate all the needed structures to handle Ldap ObjectClass, Attributes, Comparator, MatchingRules, etc...

The description of this setup can be found in this page : Schema loading

It can be noted that at this stage, we don't load any other schema. Users defined schema are loaded after the initialization of the server has been done.

Double schema loading ?

It can be noted that all the default schema loaded in this section are also declared in the server.xml file. It is questionnable to load those default schema in this part, and it may be decided to remove this step in the default initialization...

setDefaultInterceptorConfigurations() method

Here, we will create the list of all existing interecptors. Each interceptor is an instance of the MutableInterceptorConfiguration class.

The instanciated interceptors are :

  • normalizationService
  • authenticationService
  • referralService
  • authorizationService
  • defaultAuthorizationService
  • exceptionService
  • schemaService
  • subentryService
  • operationalAttributeService
  • collectiveAttributeService
  • eventService
  • triggerService

For more informations about Interceptors, go to this page : Interceptors

Other parameters 

When this basic initialization is done, this phase is achieved by the loading of default values :

Parameter

Default value

Description

enableNetworking

TRUE

Used if we allow the server to accept network communication (if the server is embeded, it can be set to FALSE)

synchPeriodMillis

20 000 ms

Interval between each flush to the disk of modifed data. Can be set to 0 if the user wants all data to be flushed on disk as soon as they are modified, but this has a huge negative impact on performance.

ldapPort

389

Default LDAP port.

ldapsPort

686

Default LDAPS port.

ldapsCertificateFile

<basedir>/certificates/server.cert

Default certificate file storage

ldapsCertificatePassword

"changeit"

Default SSL password

enableLdaps

FALSE

LDAPS is not enabled by default

enableKerberos

FALSE

KERBEROS is not enabled by default

enableChangePassword

FALSE

ChangePW is not enabled by default

enableNtp

FALSE

NTP is not enabled by default

ldifDirectory

null

The dirctory in which ldif files will be read

System and example partitions initialization

Those two partitions are instances of the MutableBTreePartitionConfiguration class.

We may have differnt kinds of partitions,  but at the moment, only one exist, which is based on JDBM. There is a need of in memory parttion, and for RDBMS based partition. One project is to use Hibernate tas an O/R mapping tool. Work In Progress, as usual, and volunteers welcomed (smile)

The initialization will create a Jdbm partition, instanciate one MutableIndexConfiguration per indexed attribute (this class stores the indexed attribute's OID with an cache size - this size is expressed as the number of attributes to keep in the cache -),

The indexed attributes are described using their OID. This is not necessary a great choice from the administrator point of view ... We should be able to use either on of the attribute's name or its OID, and internally transform the names to OID latter in the initialization process.

 

Some attributes must be indexed, like ObjectClass, uid or DistinguishedName, so it may be a good idea to index them even if they are not declared in the configuration file. However, as the cache size is defined at the same time, and as an administrator might want to set the cache size accordingly to its memory configuration, and to its expected performance, this is not really a burdn to have them in the configuration file.

The last piece of information we have to set is the entry associated with the top level element of the partition : the context entry. As a partition is characterized by a suffix and an associated entry, this is the place to declare this entry. For instance, for the dc=example, dc=com partition, the context entry is :


&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; objectClass: top
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; objectClass: domain
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; objectClass: extensibleObject
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dc: example

 

It should be clear that this entry  must be valid. We can consider that the partition suffix is the entry's DN. In our example, this is dc=example, dc=com.

Launching the server 

  • No labels