Red Hat DIRECTORY SERVER 8.1 - RELEASE NOTES Release Note page 2

Red Hat Directory Server 8.1 Release Notes
1.1. Enhanced Server to Server Connections with Added SASL/
Digest-MD5 (Kerberos), SASL/GSSAPI (Kerberos), and Start TLS
Support
Red Hat Directory Server performs a number of different connections between servers, such as
replication, chaining, synchronization, and pass-through authentication. To secure these connections,
Red Hat Directory Server previously supported SSL and TLS authentication. Directory Server 8.1
expands the secure connection options to include SASL/Digest-MD5 (Kerberos), SASL/GSSAPI
(Kerberos), and Start TLS for these server to server operations.
Connections between Directory Server instances can be secured using SASL and Start TLS. This
includes replication and chaining (database links).
Pass-through authentication now allows optional arguments to enable Start TLS. (SASL connections
are not supported for pass-through authentication.)
Windows synchronization now supports Start TLS (a secure TLS connection over a standard LDAP
port) for Active Directory-Directory Server connections. (SASL connections are not supported for
Windows.)
The configuration attributes and Console has been updated to include these enhancements:
• For replication and synchronization, the nsds5ReplicaBindMethod and
nsds5ReplicaTransportInfo attributes
• For chaining, the nsUseStartTLS, nsBindMechanism and nsActiveChainingComponents
attributes
1.2. Server Task Management to LDAP with cn=tasks Entries
Directory Server 8.1 has long had the ability to launch server maintenance tasks over LDAP. Directory
tasks like import, export, backup, restore, and indexing, as well as new tasks for reloading schema
and updating people's group membership attributes. However, this feature has not previously been
documented. In Directory Server, documentation has been added for the five original database tasks
(import, export, index, backup, and restore). Additionally, two new tasks have been created for the new
dynamic schema reload and memberOf tasks.
Each task has its own entry under the cn=tasks,cn=config configuration entry in the server's DSE.
A new task entry can be added, with task-specific attributes, to initiate the task. As soon as the task is
completed, the task entry is removed. For example, this launches a task to create a new index:
/usr/lib/mozldap/ldapmodify -a -D "cn=directory manager" -w secret -p 389 -
h server.example.com
dn: cn=example presence index, cn=index, cn=tasks, cn=config
objectclass: nsDirectoryServerTask
cn: example presence index
nsIndexAttribute: "cn:pres"
All seven tasks and their allowed attributes are covered in the cn=tasks,cn=config section of
the core configuration chapter in the Red Hat Directory Server Configuration, Command, and File
Reference.
2