Server connection properties
To access a data source outside of the appliance, define the properties of the server.
The Server Connection properties table describes the properties on the Server Connections panel for the Advanced Access Control and Federation module activation levels.
- Advanced Access Control: Configure LDAP, database, web service, or Cloud Identity server connections so that you can set up policy information points. You can configure any of the server connection types.
- Federation: Configure an LDAP server as an attribute source for attribute mapping. Federation does not configure any of the other database server connection types.
| Property | Description |
|---|---|
| Name | Specifies the name for the server connection. Ensure that the name is unique. Select this
name when you define the policy information point. Note: The server connection name must begin with
an alphabetic character. Do not use control characters, leading and trailing blanks, and the
following special characters ~ ! @ # $ % ^ & * ( ) + | ` = \ ; " ' < > ? , [ ] { } / anywhere
in the name.
|
| Description | Describes the server connection. This property is optional. |
| Type | Shows the server connection type. (Read only) |
| JNDI ID (Oracle, DB2, PostgreSQL only) | Specifies the JNDI ID that the server uses. Ensure that the ID is unique. Use only alphanumeric characters: a-b, A-B, 0-9 |
| Server name (Oracle, DB2, PostgreSQL, SMTP only) | Specifies the name or IP address for the server. |
| Port (Oracle, DB2, PostgreSQL, LDAP, SMTP only) | Specifies the port number where the connection to the server can be made. |
| URL (Web Service only) | Specifies the URL where the connection to the server can be made. |
| User name (Oracle, DB2, PostgreSQL, SMTP, and Web Service only) | Specifies the user name that has the correct permissions to access the resources. |
| Password (Oracle, DB2, PostgreSQL, SMTP, and Web Service only) | Specifies the password to access the server. |
| SSL | Specifies whether SSL is used for connecting to the server. Select True or False. The default value is True. |
| Driver type (Oracle only) | Specifies the driver type. Select Thin or OCI. The default value is Thin. |
| Service name (Oracle only) | Specifies the name of the service. |
| Database name (DB2, PostgreSQL only) | Specifies the name of the database. |
| Host name (LDAP only) | Specifies the host name or IP address of the LDAP server. |
| Bind DN (LDAP only) | Specifies the LDAP distinguished name (DN) that is used when binding, or signing on, to the
LDAP server. Note: If this value is set to
"anonymous", the
appliance uses an anonymous bind to the LDAP directory server. Typically the
bind-dn has significant privileges so that it can be used to modify LDAP registry
entries, such as creating users and resetting passwords via pdadmin or the Registry Direct Java API.
Using an anonymous connection to LDAP typically comes with very limited access, perhaps at most
search and view of entries, at the least no access at all. If anonymous access has sufficient
privileges, then it might be usable for the WebSEAL level of access on users and groups. This access
includes the permission for a user to change password if "bind-auth-and-pwdchg =
yes" is set ("ldap.bind-auth-and-pwdchg = true" for Registry Direct Java
API). |
| Bind Password (LDAP only) | Specifies the password for the LDAP bind DN. Note: If bind DN
(
bind-dn) is set to anonymous, you can use any non-empty string as
the value of bind password (bind-pwd). |
| Administration hostname (Cloud Identity only) | Specifies the administration hostname of the Cloud Identity subscription. |
| Client ID (Cloud Identity only) | Specifies the client ID of an API Client on Cloud Identity. |
| Client Secret (Cloud Identity only) | Specifies the client secret of an API Client on Cloud Identity. |
| SSL Truststore (LDAP, Web Service, and Cloud Identity only) | Specifies the truststore that verifies the credentials. |
| SSL Mutual Authentication Key (LDAP, Web Service, and Cloud Identity only) | Label of the client certificate to be presented when connecting to the LDAP. This property is
sourced from SSL Truststore. Note: This field is required only if mutual SSL authentication is
required by the server.
|
Note: For information on SSL configuration, see Configuring SSL connections.
The properties in the following table are connection manager properties. The defaults that are listed are the current known defaults. All tuning properties are optional.
| Property | Description |
|---|---|
| Aged timeout (seconds) (Oracle, DB2, PostgreSQL only) | Specifies the amount of time, in seconds, before a physical connection is discarded by pool maintenance. Specify -1 to disable this timeout. The default is -1. |
| Connection timeout (seconds) | Specifies the amount of time, in seconds, after which a connection times out. For Oracle, DB2, PostgreSQL, and SMTP, specify -1 to disable this timeout. The default is 30 seconds. For LDAP, specify only integers, 1 or greater. The default is 120 seconds. |
| Max Idle Time (seconds) (Oracle, DB2, PostgreSQL only) | Specifies the maximum amount of time, in seconds, after which an unused or idle connection is discarded during pool maintenance. Specify -1 to disable this timeout. The default is 1800 seconds. |
| Max Idle Time (seconds) (LDAP only) | Specifies the amount of time, in seconds, after which an established connection is discarded
as idle. Set this to a value lower than the connection idle timeout on the LDAP server. Note: This is
only applicable for performing Attribute Mapping from an LDAP server.
|
| Reap time (seconds) (Oracle, DB2, PostgreSQL only) | Specifies the amount of time, in seconds, between runs of the pool maintenance thread. Specify -1 to disable pool maintenance. The default is 180 seconds. |
| Max pool size (Oracle, DB2, PostgreSQL only) | Specifies the maximum number of physical connections for a pool. Specify 0 for unlimited. The default is 50. |
| Max pool size (LDAP only) | Specifies the maximum number of connections that are pooled. Note: This is only applicable
for performing Attribute Mapping from an LDAP server.
|
| Min pool size (Oracle, DB2, PostgreSQL only) | Specifies the minimum number of physical connections to maintain in a pool. The aged timeout can override the minimum. |
| Purge policy (Oracle, DB2, PostgreSQL only) | Specifies which connections to delete when a stale connection is detected in the pool. Select
from the following options:
|
| Max connections per thread (Oracle, DB2, PostgreSQL only) | Specifies the limit of open connections on each thread. |
| Cache connections per thread (Oracle, DB2, PostgreSQL only) | Specifies the number of cache connections for each thread. |