dsconfig set-global-configuration-prop
Prev | dsconfig Subcommands Reference | Next

## Name

dsconfig set-global-configuration-prop — Modifies Global Configuration properties

## Synopsis

`dsconfig set-global-configuration-prop` {options}

## Description

Modifies Global Configuration properties.

## Options

The dsconfig set-global-configuration-prop command takes the following options:

`--set {PROP:VALUE}`

  Assigns a value to a property where PROP is the name of the property and VALUE is the single value to be assigned. Specify the same property multiple times in order to assign more than one value to it.

  Global Configuration properties depend on the Global Configuration type, which depends on the null option.

`--reset {property}`

  Resets a property back to its default values where PROP is the name of the property to be reset.

  Global Configuration properties depend on the Global Configuration type, which depends on the null option.

`--add {PROP:VALUE}`

  Adds a single value to a property where PROP is the name of the property and VALUE is the single value to be added.

  Global Configuration properties depend on the Global Configuration type, which depends on the null option.

`--remove {PROP:VALUE}`

  Removes a single value from a property where PROP is the name of the property and VALUE is the single value to be removed.

  Global Configuration properties depend on the Global Configuration type, which depends on the null option.

## Global Configuration

Global Configurations of type global have the following properties:

add-missing-rdn-attributes
  Description

    Indicates whether the directory server should automatically add any attribute values contained in the entry's RDN into that entry when processing an add request.

  Default Value

    true

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

allow-attribute-name-exceptions
  Description

    Indicates whether the directory server should allow underscores in attribute names and allow attribute names to begin with numeric digits (both of which are violations of the LDAP standards).

  Default Value

    false

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

allowed-task
  Description

    Specifies the fully-qualified name of a Java class that may be invoked in the server. Any attempt to invoke a task not included in the list of allowed tasks is rejected.

  Default Value

    If no values are defined, then the server does not allow any tasks to be invoked.

  Allowed Values

    A String

  Multi-valued

    Yes

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

bind-with-dn-requires-password
  Description

    Indicates whether the directory server should reject any simple bind request that contains a DN but no password. Although such bind requests are technically allowed by the LDAPv3 specification (and should be treated as anonymous simple authentication), they may introduce security problems in applications that do not verify that the client actually provided a password.

  Default Value

    true

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

check-schema
  Description

    Indicates whether schema enforcement is active. When schema enforcement is activated, the directory server ensures that all operations result in entries are valid according to the defined server schema. It is strongly recommended that this option be left enabled to prevent the inadvertent addition of invalid data into the server.

  Default Value

    true

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

default-password-policy
  Description

    Specifies the name of the password policy that is in effect for users whose entries do not specify an alternate password policy (either via a real or virtual attribute). In addition, the default password policy will be used for providing default parameters for sub-entry based password policies when not provided or supported by the sub-entry itself. This property must reference a password policy and no other type of authentication policy.

  Default Value

    None

  Allowed Values

    The DN of any Password Policy.

  Multi-valued

    No

  Required

    Yes

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

disabled-privilege
  Description

    Specifies the name of a privilege that should not be evaluated by the server. If a privilege is disabled, then it is assumed that all clients (including unauthenticated clients) have that privilege.

  Default Value

    If no values are defined, then the server enforces all privileges.

  Allowed Values
    backend-backup

      Allows the user to request that the server process backup tasks.

    backend-restore

      Allows the user to request that the server process restore tasks.

    bypass-acl

      Allows the associated user to bypass access control checks performed by the server.

    bypass-lockdown

      Allows the associated user to bypass server lockdown mode.

    cancel-request

      Allows the user to cancel operations in progress on other client connections.

    changelog-read

      The privilege that provides the ability to perform read operations on the changelog

    config-read

      Allows the associated user to read the server configuration.

    config-write

      Allows the associated user to update the server configuration. The config-read privilege is also required.

    data-sync

      Allows the user to participate in data synchronization.

    disconnect-client

      Allows the user to terminate other client connections.

    jmx-notify

      Allows the associated user to subscribe to receive JMX notifications.

    jmx-read

      Allows the associated user to perform JMX read operations.

    jmx-write

      Allows the associated user to perform JMX write operations.

    ldif-export

      Allows the user to request that the server process LDIF export tasks.

    ldif-import

      Allows the user to request that the server process LDIF import tasks.

    modify-acl

      Allows the associated user to modify the server's access control configuration.

    password-reset

      Allows the user to reset user passwords.

    privilege-change

      Allows the user to make changes to the set of defined root privileges, as well as to grant and revoke privileges for users.

    proxied-auth

      Allows the user to use the proxied authorization control, or to perform a bind that specifies an alternate authorization identity.

    server-lockdown

      Allows the user to place and bring the server of lockdown mode.

    server-restart

      Allows the user to request that the server perform an in-core restart.

    server-shutdown

      Allows the user to request that the server shut down.

    subentry-write

      Allows the associated user to perform LDAP subentry write operations.

    unindexed-search

      Allows the user to request that the server process a search that cannot be optimized using server indexes.

    update-schema

      Allows the user to make changes to the server schema.

  Multi-valued

    Yes

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

etime-resolution
  Description

    Specifies the resolution to use for operation elapsed processing time (etime) measurements.

  Default Value

    milliseconds

  Allowed Values
    milliseconds

      Use millisecond resolution.

    nanoseconds

      Use nanosecond resolution.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

idle-time-limit
  Description

    Specifies the maximum length of time that a client connection may remain established since its last completed operation. A value of "0 seconds" indicates that no idle time limit is enforced.

  Default Value

    0 seconds

  Allowed Values

    Some property values take a time duration. Durations are expressed as numbers followed by units. For example `1 s` means one second, and `2 w` means two weeks. Some durations have minimum granularity or maximum units, so you cannot necessary specify every duration in milliseconds or weeks for example. Some durations allow you to use a special value to mean unlimited. Units are specified as follows.

    - `ms`: milliseconds

    - `s`: seconds

    - `m`: minutes

    - `h`: hours

    - `d`: days

    - `w`: weeks

    Lower limit is 0 milliseconds.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

invalid-attribute-syntax-behavior
  Description

    Specifies how the directory server should handle operations whenever an attribute value violates the associated attribute syntax.

  Default Value

    reject

  Allowed Values
    accept

      The directory server silently accepts attribute values that are invalid according to their associated syntax. Matching operations targeting those values may not behave as expected.

    reject

      The directory server rejects attribute values that are invalid according to their associated syntax.

    warn

      The directory server accepts attribute values that are invalid according to their associated syntax, but also logs a warning message to the error log. Matching operations targeting those values may not behave as expected.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

lookthrough-limit
  Description

    Specifies the maximum number of entries that the directory server should "look through" in the course of processing a search request. This includes any entry that the server must examine in the course of processing the request, regardless of whether it actually matches the search criteria. A value of 0 indicates that no lookthrough limit is enforced. Note that this is the default server-wide limit, but it may be overridden on a per-user basis using the ds-rlim-lookthrough-limit operational attribute.

  Default Value

    5000

  Allowed Values

    An integer value. Lower value is 0.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

max-allowed-client-connections
  Description

    Specifies the maximum number of client connections that may be established at any given time A value of 0 indicates that unlimited client connection is allowed.

  Default Value

    0

  Allowed Values

    An integer value. Lower value is 0.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

max-internal-buffer-size
  Description

    The threshold capacity beyond which internal cached buffers used for encoding and decoding entries and protocol messages will be trimmed after use. Individual buffers may grow very large when encoding and decoding large entries and protocol messages and should be reduced in size when they are no longer needed. This setting specifies the threshold at which a buffer is determined to have grown too big and should be trimmed down after use.

  Default Value

    32 KB

  Allowed Values

    Lower value is 512.Upper value is 1000000000.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

max-psearches
  Description

    Defines the maximum number of concurrent persistent searches that can be performed on directory server The persistent search mechanism provides an active channel through which entries that change, and information about the changes that occur, can be communicated. Because each persistent search operation consumes resources, limiting the number of simultaneous persistent searches keeps the performance impact minimal. A value of -1 indicates that there is no limit on the persistent searches.

  Default Value

    -1

  Allowed Values

    An integer value. Lower value is 0. A value of "-1" or "unlimited" for no limit.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

notify-abandoned-operations
  Description

    Indicates whether the directory server should send a response to any operation that is interrupted via an abandon request. The LDAP specification states that abandoned operations should not receive any response, but this may cause problems with client applications that always expect to receive a response to each request.

  Default Value

    false

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

proxied-authorization-identity-mapper
  Description

    Specifies the name of the identity mapper to map authorization ID values (using the "u:" form) provided in the proxied authorization control to the corresponding user entry.

  Default Value

    None

  Allowed Values

    The DN of any Identity Mapper. The referenced identity mapper must be enabled.

  Multi-valued

    No

  Required

    Yes

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

reject-unauthenticated-requests
  Description

    Indicates whether the directory server should reject any request (other than bind or StartTLS requests) received from a client that has not yet been authenticated, whose last authentication attempt was unsuccessful, or whose last authentication attempt used anonymous authentication.

  Default Value

    false

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

return-bind-error-messages
  Description

    Indicates whether responses for failed bind operations should include a message string providing the reason for the authentication failure. Note that these messages may include information that could potentially be used by an attacker. If this option is disabled, then these messages appears only in the server's access log.

  Default Value

    false

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

save-config-on-successful-startup
  Description

    Indicates whether the directory server should save a copy of its configuration whenever the startup process completes successfully. This ensures that the server provides a "last known good" configuration, which can be used as a reference (or copied into the active config) if the server fails to start with the current "active" configuration.

  Default Value

    true

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

server-error-result-code
  Description

    Specifies the numeric value of the result code when request processing fails due to an internal server error.

  Default Value

    80

  Allowed Values

    An integer value. Lower value is 0.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

single-structural-objectclass-behavior
  Description

    Specifies how the directory server should handle operations an entry does not contain a structural object class or contains multiple structural classes.

  Default Value

    reject

  Allowed Values
    accept

      The directory server silently accepts entries that do not contain exactly one structural object class. Certain schema features that depend on the entry's structural class may not behave as expected.

    reject

      The directory server rejects entries that do not contain exactly one structural object class.

    warn

      The directory server accepts entries that do not contain exactly one structural object class, but also logs a warning message to the error log. Certain schema features that depend on the entry's structural class may not behave as expected.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

size-limit
  Description

    Specifies the maximum number of entries that can be returned to the client during a single search operation. A value of 0 indicates that no size limit is enforced. Note that this is the default server-wide limit, but it may be overridden on a per-user basis using the ds-rlim-size-limit operational attribute.

  Default Value

    1000

  Allowed Values

    An integer value. Lower value is 0.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

smtp-server
  Description

    Specifies the address (and optional port number) for a mail server that can be used to send email messages via SMTP. It may be an IP address or resolvable hostname, optionally followed by a colon and a port number.

  Default Value

    If no values are defined, then the server cannot send email via SMTP.

  Allowed Values

    A hostname, optionally followed by a ":" followed by a port number.

  Multi-valued

    Yes

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

subordinate-base-dn
  Description

    Specifies the set of base DNs used for singleLevel, wholeSubtree, and subordinateSubtree searches based at the root DSE.

  Default Value

    The set of all user-defined suffixes is used.

  Allowed Values

    A valid DN.

  Multi-valued

    Yes

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

time-limit
  Description

    Specifies the maximum length of time that should be spent processing a single search operation. A value of 0 seconds indicates that no time limit is enforced. Note that this is the default server-wide time limit, but it may be overridden on a per-user basis using the ds-rlim-time-limit operational attribute.

  Default Value

    60 seconds

  Allowed Values

    Some property values take a time duration. Durations are expressed as numbers followed by units. For example `1 s` means one second, and `2 w` means two weeks. Some durations have minimum granularity or maximum units, so you cannot necessary specify every duration in milliseconds or weeks for example. Some durations allow you to use a special value to mean unlimited. Units are specified as follows.

    - `ms`: milliseconds

    - `s`: seconds

    - `m`: minutes

    - `h`: hours

    - `d`: days

    - `w`: weeks

    Lower limit is 0 seconds.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

trust-transaction-ids
  Description

    Indicates whether the directory server should trust the transaction ids that may be received from requests, either through a LDAP control or through a HTTP header.

  Default Value

    false

  Allowed Values

    true

    false

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    Yes (Use --advanced in interactive mode.)

  Read-only

    No

writability-mode
  Description

    Specifies the kinds of write operations the directory server can process.

  Default Value

    enabled

  Allowed Values
    disabled

      The directory server rejects all write operations that are requested of it, regardless of their origin.

    enabled

      The directory server attempts to process all write operations that are requested of it, regardless of their origin.

    internal-only

      The directory server attempts to process write operations requested as internal operations or through synchronization, but rejects any such operations requested from external clients.

  Multi-valued

    No

  Required

    No

  Admin Action Required

    None

  Advanced Property

    No

  Read-only

    No

Prev | Up | Next
dsconfig set-external-changelog-domain-prop | Home | dsconfig set-group-implementation-prop