The is used to interact with clients using LDAP. In particular, it provides full support for LDAPv3 and limited support for LDAPv2. 1.3.6.1.4.1.26027.1.2.14 ds-cfg-ldap-connection-handler ds-cfg-connection-handler org.opends.server.protocols.ldap.LDAPConnectionHandler Specifies the address or set of addresses on which this should listen for connections from LDAP clients. Multiple addresses may be provided as separate values for this attribute. If no values are provided, then the will listen on all interfaces. 0.0.0.0 1.3.6.1.4.1.26027.1.1.56 ds-cfg-listen-address Indicates whether connections from LDAPv2 clients will be allowed. If LDAPv2 clients will be allowed, then only a minimal degree of special support will be provided for them to ensure that LDAPv3-specific protocol elements (e.g., Configuration Guide 25 controls, extended response messages, intermediate response messages, referrals, etc.) are not sent to an LDAPv2 client. true 1.3.6.1.4.1.26027.1.1.7 ds-cfg-allow-ldapv2 Indicates whether the should keep statistics. If enabled, the will maintain statistics about the number and types of operations requested over LDAP and the amount of data sent and received. true 1.3.6.1.4.1.26027.1.1.47 ds-cfg-keep-stats Indicates whether the should use TCP keep-alive. If enabled, the SO_KEEPALIVE socket option to indicate that TCP keepalive messages should periodically be sent to the client to verify that the associated connection is still valid. This may also help prevent cases in which intermediate network hardware could silently drop an otherwise idle client connection, provided that the keepalive interval configured in the underlying operating system is smaller than the timeout enforced by the network hardware. true 1.3.6.1.4.1.26027.1.1.138 ds-cfg-use-tcp-keepalive Indicates whether the should use TCP no-delay. If enabled, the TCP_NODELAY socket option will be used to ensure that response messages to the client are sent immediately rather than potentially waiting to determine whether additional response messages can be sent in the same packet. In most cases, using the TCP_NODELAY socket option will provide better performance and lower response times, but disabling it may help for some cases in which the server will send a large number of entries to a client in response to a search request. true 1.3.6.1.4.1.26027.1.1.139 ds-cfg-use-tcp-nodelay Indicates whether the should reuse socket descriptors. If enabled, the SO_REUSEADDR socket option will be used on the server listen socket to potentially allow the reuse of socket descriptors for clients in a TIME_WAIT state. This may help the server avoid temporarily running out of socket descriptors in cases in which a very large number of short-lived connections have been established from the same client system. true 1.3.6.1.4.1.26027.1.1.9 ds-cfg-allow-tcp-reuse-address Indicates whether the should send a notice of disconnection extended response message to the client if a new connection is rejected for some reason. The extended response message may provide an explanation indicating the reason that the connection was rejected. true 1.3.6.1.4.1.26027.1.1.114 ds-cfg-send-rejection-notice Specifies the size of the largest LDAP request message that will be allowed by this . This property is analogous to the maxBERSize configuration attribute of the Sun Java System Directory Server. This can help prevent denial-of-service attacks by clients that indicate they will send extremely large requests to the server causing it to attempt to allocate large amounts of memory. 5mib 1.3.6.1.4.1.26027.1.1.67 ds-cfg-max-request-size Specifies the number of request handlers that will be used to read requests from clients. The uses one thread to accept new connections from clients, but uses one or more additional threads to read requests from existing client connections. This can help ensure that new requests are read efficiently and that the connection handler itself does not become a bottleneck when the server is under heavy load from many clients at the same time. 1 1.3.6.1.4.1.26027.1.1.72 ds-cfg-num-request-handlers Indicates whether clients will be allowed to use StartTLS. If enabled, the will allow clients to use the StartTLS extended operation to initiate secure communication over an otherwise insecure channel. Note that this will only be allowed if the is not configured to use SSL, and if the server is configured with a valid key manager provider and a valid trust manager provider. true 1.3.6.1.4.1.26027.1.1.8 ds-cfg-allow-start-tls Specifies the policy that the should use regarding client SSL certificates. This is only applicable if clients are allowed to use SSL. optional Clients will not be required to provide their own certificates when performing SSL negotiation. Clients will be requested to provide their own certificates when performing SSL negotiation, but will still accept the connection even if the client does not provide a certificate. Clients will be required to provide their own certificates when performing SSL negotiation, and will be refused access if the do not provide a certificate. 1.3.6.1.4.1.26027.1.1.119 ds-cfg-ssl-client-auth-policy Specifies the maximum number of pending connection attempts that will be allowed to queue up in the accept backlog before the server starts rejecting new connection attempts. This is primarily an issue for cases in which a large number of connections are established to the server in a very short period of time (e.g., a benchmark utility that creates a large number of client threads that each have their own connection to the server) and the connection handler is unable to keep up with the rate at which the new connections are established. 128 connections 1.3.6.1.4.1.26027.1.1.153 ds-cfg-accept-backlog No LDAP OID is assigned for this yet! Specifies the names of the SSL protocols that will be allowed for use in SSL or StartTLS communication. Changes to this configuration attribute will take immediately but will only impact new SSL/TLS-based sessions created after the change. Uses the default set of SSL protocols provided by the server's JVM. 1.3.6.1.4.1.26027.1.1.9999 ds-cfg-ssl-protocols No LDAP OID is assigned for this yet! Specifies the names of the SSL cipher suites that will be allowed for use in SSL or StartTLS communication. Changes to this configuration attribute will take immediately but will only impact new SSL/TLS-based sessions created after the change. Uses the default set of SSL cipher suites provided by the server's JVM. 1.3.6.1.4.1.26027.1.1.9999 ds-cfg-ssl-protocols