Location of Gateway Files

Table 2-1 shows the locations of gateway files.

Securing Gateway Configuration and Settings

The following sections describe procedure for protecting the configuration information of your gateway.

• Protecting Bind DN and Password
• Protecting Root Processes on UNIX Systems

Updating the Gateway with Changes to Directory Server Configuration

Directory Server Gateway includes a script, updatedsgw , that can be used to update all gateway instances with changes to the Directory Server configuration, including changes to Directory Server port, host, suffix, and root DN (the ability to update the suffix is not available in the server administration console). The updatedsgw script is stored in the serverRoot/bin/slapd/admin/bin directory.

Changes made to the Directory Server configuration (dse.ldif) by the Netscape Console are posted to updatedsgw, and the relevant gateway files are updated. These files will be updated only when the host and port for the gateway match the host and port of the Directory Server.

HTTP Server Recommendations for Directory Server Gateway

The Netscape Administration Server is the default HTTP server for the two gateway clients that are installed with the Directory Server. Both Directory Express and the default gateway are preconfigured to run under the Administration Server without additional setup.

There are many factors affecting gateway performance on an HTTP server, including the following:

• The number of users accessing the gateway at a given time.
  
  
• The complexity of the directory searches performed and the search results required.
  
  
• Whether the gateway is additionally to be used for authentication and login.
  
  
• The load from other processes managed by the host machine.
  
  
• The speed and performance of the computer hardware selected for the host computer.
  
  
• The speed and capacity of the network (network hardware and software).

In general, gateway performance on the Administration Server will begin to slow down when the number of users accessing the gateway throughout the enterprise reaches 6,000 people. (This is a very general recommendation that does not take into account factors listed above, especially the speed of the host machine.)

Name Translation Mapping

The HTTP server uses Name Translation mapping to translate a virtual path provided by a gateway client to a physical path used by an HTTP server. This Name Translation mapping specifies the gateway's HTML directory. The gateway's CGIs use this information to output the correct URL (HTTP redirection). The NameTrans mapping is specified in the gateway's configuration file using the gwnametrans parameter.

For more information on configuring the gwnametrans parameter, see gwnametrans.

Gateway Root Suffix

Directory Express and the default gateway are set to the root suffix specified during Directory Server installation. This suffix specifies the DN for the LDAP database and represents a root in the directory tree (for example, dc=example,dc=com). Multiple gateways can be set up on an HTTP server that provide access to directory entries that correspond to this root suffix.

When the Directory Server's suffix changes, it is necessary to run the updatedsgw script manually to propagate the change to all gateway instances.

Configuring the Gateway for Web Servers

Directory Express and the default gateway are installed with the Directory Server and configured to run under the Netscape Administration Server, which is the default HTTP server for the gateway clients. No additional configuration is necessary. However, customers in high-usage networks may wish to move their gateways (or set up new gateways) on a high-performance HTTP server.

Setting up a gateway with a web server typically requires:

1. Rename the dsgw.conf or pb.conf file to a new gateway context.
   
   For example, clients/dsgw/context/dsgw.conf might become clients/dsgw/context/example.conf.
   
   
2. Set the gwnametrans parameter in the new gateway's .conf file to point to the HTML directory.
   
   For example, the gwnametrans example.conf should point to /clients/dsgw/examplehtml.
   
   
3. To support non-anonymous searching (one individual user DN and password per directory instance) using the new gateway, set the binddnfile parameter in example.conf to point to the location of the file containing the bind DN and bind password that will be used to access information in the user directory.
   
   The binddnfile contains sensitive information; for security purposes, do not store the binddnfile/clients/dsgw directory or within any directory served up over HTTP.
   
   
4. Create an HTML directory for the new gateway.
   
   For example, to provide an HTML directory for example.conf, copy and rename an existing HTML directory (/clients/dsgw/html or /clients/dsgw/pbhtml) to /clients/dsgw/examplehtml.
   
   
5. Create a template directory containing object class templates and other configuration files.
   
   For example, to provide a template directory for example.conf, copy and rename an existing template directory (/clients/dsgw/config or /clients/dsgw/pbconfig) to /clients/dsgw/exampleconfig.
   
   
6. Edit the htmldir and configdir parameters in example.conf to point to the new HTML and template directories.
   
   
7. To access the new gateway instance (in this example, example.conf) navigate the browser to this URL:
   
   http://adminHost:adminPort/clients/dsgw/bin/lang?context=example

Gateway Cloning

The HTML and template directories for one gateway can serve as the HTML and template directory for many others. Maintaining the functionality of multiple gateways in a centralized /config and /html directories is useful when the only values that are likely to change are parameter settings in the .conf file, such as the host and port specified by the baseurl parameter, the root DN specified by the dirmgr parameter, and the root suffix specified by the location-suffix parameter.

Changing the Default Port Setting

The LDAP port is set during Directory Server installation. This value can be changed in the baseurl parameter. The following example shows the syntax used to specify a port number that is different than the default port number of 389. For example, the baseurl parameter in the LDAP port is changed to the following:

baseurl "ldaps://dirserver.example.com:3000/o%3Dexample.com"

Setting Up a Directory Manager for the Gateway

When Directory Server is installed, a default Directory Manager account (cn=Directory Manager) is setup with permissions to the root DN. The Directory Server installation requires a root DN. If no root DN was configured when the Directory Server was installed, then no default Directory Manager is configured for the gateway.

It is strongly recommended that you use a different directory manager account for the gateway, an account other than cn=Directory Manager. Once you setup the new directory manager account (for example, cn=gateway manager,cn=config), use ACLs to restrict access to applicable sub suffixes and the user entries under those sub suffixes. This enables the gateway directory manager to change those users' passwords but prevents the entry from having complete control of the Directory Server.

Authenticating as Directory Manager

Figure 2-1 shows the authentication login screen for the default gateway. Administrators can use it to authenticate as the Directory Manager. The Authenticate as Directory Manager button is displayed only when a Directory Manager has been configured for the gateway.

The authlifetime parameter, which defines the number of seconds that a user may remain authenticated, is described in location.

Figure 2-1    Authenticating as Directory Manager

Setting Up the Suffix for Adding Entries

The location-suffix parameter is defined in dsgw.conf and identifies the suffix under which the gateway creates new entries in the directory. The location-suffix parameter can point to any suffix in a directory.

Setting the location-suffix parameter is described in include. The Netscape Directory Server Administrator's Guide describes the Suffix parameter and provides syntax examples. Setting the root suffix is also described in the Netscape Directory Server Installation Guide.

Setting Up SSL Support

When the Directory Server is installed, the gateway is configured to communicate with the Directory Server using a non-SSL host name and port number. This information is stored in the baseurl parameter.

Configuring the gateway to use SSL when communicating with the Directory Server requires modification of the securitypath and baseurl parameters in dsgw.conf.

Enabling SSL communications on the Directory Server is described in the Netscape Directory Server Administrator's Guide. Information about managing key and certificate databases is provided in Managing Servers with Netscape Console.

Setting vCard Properties

Mappings between vCARD properties and LDAP attribute type are described in vcard-property.

Language Support for HTTP Clients

When a user accesses information in the directory from an HTTP client -- through the gateway or another HTTP-based LDAP interface -- the client provides the Directory Server with information indicating the optimal character set and collation order to use in transmitting information to the browser.

Displaying a Non-English Alphabet

To display directory content that uses a non-English alphabet, a font capable of displaying a non-English alphabet must be installed on the user's system.

The Directory Server can store any Unicode character, so users of Netscape Communicator or later versions of Netscape browsers should install a font that supports all of Unicode. Bitstream Cyberbit, which is bundled with Communicator, supports Unicode.

Users who are not using Communicator should use a font that supports Latin-1 (or Western) character sets. Most of the commonly used fonts (Courier, Times Roman, Helvetica) have a Latin-1 variant.

Configuring Netscape 7.x for Preferred Language

Customizing Communicator's LDAP Settings

Administrators can reconfigure Javascript preference settings in Communicator or later versions of Netscape browsers to allow users to interact with information stored in the user directory.

• In the Address Book and Select Address dialog boxes (accessible from the mail composition window), users can enter one string of search criteria to search an LDAP directory for matching names.
  
  
• In the Search Directory dialog, users can enter more complex query expressions to search an LDAP directory using native LDAP searches.
  
  
• Users can enter LDAP URLs (beginning with the "ldap://" prefix) in Navigator (web browser) windows to search an LDAP directory.