Appendix E iPlanet Web Server User Interface

• The Servers Tab
• The Preferences Tab (Admin)


• The Global Settings Tab


• The Users & Groups Tab


• The Security Tab (Admin)


• The Cluster Management Tab

• The Manage Servers Page
• The Add Server Page


• The Remove Server Page


• The Migrate Server Page (Admin)

Select a Server. Lists all the servers.

Server Root. Displays the absolute path where the server's scripts, icons, and configuration files are stored.

Hostname. Displays the fully qualified host name of this server (for example, www.mozilla.com).

Port. Displays the port number servicing HTTP requests. The default is port 80.

Error Log. Displays the directory path to the server error log. The error log contains all the errors the server has encountered; it also contains informational messages about the server, such as when the server was started, and any incorrect user authentication.

User (Unix/Linux). Specifies the user name under which the server runs. The server user should have restricted access to your system resources. You can often use a user named nobody in this situation. On some systems, however, nobody is not a valid user name. You may not want to give the user nobody group access to all files. If you do not use nobody, create a new Unix/Linux user, such as adm, to be the server user.

DNS. Displays whether DNS lookup of the IP address of the resource making a CGI request is enabled. DNS lookups can be resource intensive; therefore, allowing DNS lookups can slow performance, especially on a server that uses extensive CGI.

Help. Displays online help.

Server Name. Specifies the fully qualified host name of this server (for example, www.mozilla.com).

Server Port. Specifies the port number servicing HTTP requests. The default is port 80.

Server Identifier. Specifies the server identification that the Administration Server will use for this server instance (for example, marketing_server).

Server User (Unix/Linux). Specifies the user name under which the server runs. The server user should have restricted access to your system resources. You can often use a user named nobody in this situation. On some systems, however, nobody is not a valid user name. You may not want to give the user nobody group access to all files. If you do not use nobody, create a new Unix/Linux user, such as adm, to be the server user.

MTA Host. Specifies the name of the mail server that this server uses to send mail.

Always Attempt to Resolve IP Addresses into Host Names. Specifies whether to match IP addresses with corresponding host names. The server has the client IP address for a given client request. Some sites may wish to log all requests with their resolved DNS name instead of the IP address. Most of the time, a server does not need the DNS name.

Attempt to Resolve IP Addresses Only for Access Control and CGI.
Specifies whether to match IP addresses with corresponding host names for access control lists (ACLs) and CGI. Sometimes, a site may want to use domain names instead of IP address in ACLs and CGI. Most of the time, a server does not need the DNS name.

Never Attempt to Resolve IP Addresses into Host Names. Specifies never to match IP addresses with corresponding host names.

Document Root. Specifies the directory path to the location of the server's web documents.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Select a Server. Specifies the server you want to remove. Removing the server will delete all the server's configuration files.

Yes, I Really Do Want to Remove This Server. Verifies that you want to delete the server.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

The migration preserves your old server instance, and creates a 4.1 server instance with the same configuration.

Server Root. Specifies the directory path of the server instance from which to import the server's scripts, icons, and configuration files.

Search.. After entering a server root, click Search. The server instances available in the server root you entered appear under Installed Servers.

Select a Server to Migrate. Lists all the server instances installed in the server root specified above. Click Migrate to migrate the selected server instance.

Help. Displays online help.

The parameters you see depend on the configuration of the server instance you are migrating. The page is divided into the following possible sections:

• General Migration Parameters
• Users and Groups


• Keys and Certificates


• Document Root


• Web Publishing


• Search Collections


• Search Pattern Files

Server Name. The name of the new iPlanet Web Server 4.1 instance. It defaults to the name of the server instance from which you are migrating.

Run Server As (Unix/Linux). The Unix/Linux user name that runs the new server instance. The default is the username from the Administration Server 4.1.

Export localdb to an LDIF file. Select this box if you want to migrate the user and group information in your local database. Selecting this box will export your database to an LDIF file. After you migrate your server, you need to import this file into the Directory Server.

Key " ". This field name shows the name of the old server instance's key in quotes. Enter the key's password to migrate the key and certificate.

Use the same document root as the old server. Select this radio button if you want to use the old document root as your 4.1 document root. Choosing this option makes the documents from the old server visible on the 4.1 server. You must choose this option if you use web publishing or Netshare, otherwise you will lose all your web publishing and Netshare settings and data.

Use the new server's document root. Select this radio button to use the new server's document directory. If you want to see the old server's documents on your new server, you must manually copy them to the new location if you use this option.

Migrate Web Publishing Metadata. Select Yes to migrate your metadata. If you select No, you will lose all your metadata. In order to migrate web publishing successfully, in addition to migrating your metadata, you must also choose to keep your old document root under the Document Root section.

• The Shut Down Page
• The Network Settings Page


• The Superuser Access Control Page


• The Distributed Administration Page


• The Encryption On/Off Page (Admin)


• The Encryption Preferences Page (Admin)


• The Logging Options Page


• The View Access Log Page


• The View Error Log Page (Administration Server)


• The Limit Symbolic Links Page (Unix/Linux)

Shut Down the Administration Server. Shuts down the Administration Server.

Help. Displays online help.

Admin Server User (Unix/Linux). Specifies the user name under which the server runs. The server user should have restricted access to your system resources. You can often use a user named nobody in this situation. On some systems, however, nobody is not a valid user name. You may not want to give the user nobody group access to all files. If you do not use nobody, create a new Unix/Linux user, such as adm, to be the server user.

Admin server port. Specifies the port on which the Administration Server runs. This port number was originally specified during the installation process.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Hostnames to allow. Allows the specified host name to access the Administration Server. You can use wildcard patterns to match multiple systems in a domain. For example, *iplanet.com matches a.iplanet.com and a.corp.iplanet.com. You can list multiple hosts by separating them with commas. Using host names is flexible; if a system's IP address changes, you will not need to update the server.

IP Addresses to allow. Specifies the IP address to match any host not explicitly defined. The access control for the most complete match will be used. You can also type wildcard patterns. For example, 198.95.* matches 198.95.11.6 and 198.95.11.2. You can separate IP addresses by using commas. Using IP addresses is reliable; if a DNS lookup fails for the connected client, host name restriction cannot be used.

Authentication user name. Specifies the user name of the "superuser" server administrator. (This is the user name you entered during installation.) Only this user name can be used to log in to the Administration Server. This information is stored in the admpw file.See Changing the Superuser Settings for more information.

Authentication Password. Specifies the password of the administrator. The password can have up to 8 characters and can include any character other than control characters. If you leave the password field blank, the password remains unchanged.

Authentication Password (again). Confirms the password specified in the Authentication Password field. If what you enter is different from what you entered in the Password field, you will be prompted to try again.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Activate Distributed Administration. Enables distributed administration.

Administrator Group. Allows the specified group of administrators to bypass the Administration Server and go directly to the Server Manager for a specific server. Users in the administrator group have full access to the Administration Server, but this access can limited using access control. A user in the administrator group can make changes that affect other users, such as adding users or changing access control.

Allow End User Access. Allows end-users to see a limited set of pages. This allows users to access the Administration Server using the same URL that administrators do, with the limitation that users only see a single page containing their own user information. End-users can then change their own passwords or update any other information stored in their own entry in the user database.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

• About iPlanet Web Server Security
• Using Secure Sockets Layer (SSL)


• Additional Server Security Considerations

Encryption. Specifies whether encryption is activated for the server.

Port Number. Specifies the port number that the server runs on. Port numbers can be any number from 1 to 65535; however, the standard secure server port is 443.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Allow. Specifies which SSL versions the server allows. Choose one or both of the following:

• SSL version 2. An older version of SSL that clients may use.
• SSL version 3. A more recent and more secure version of SSL.

Require client certificates (regardless of access control). Specifies whether the server should refuse any client who does not have a client certificate from a trusted CA.

SSL 2.0 ciphers. Specifies which algorithms for the 2.0 version of SSL to use in encryption.

SSL 3.0 ciphers. Specifies which algorithms for the 3.0 version of SSL to use in encryption.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Editing. Specifies a resource to which custom logging is applied. If you choose a directory, custom logging applies only when the server receives a URL for that directory or any file in that directory.

Browse. Allows you to browse your file system.

Wildcard. Specifies a wildcard pattern. For information on using wildcard patterns, see Wildcards Used in the Resource Picker.

Log client accesses. Specifies whether to include client accesses in your log files.

Log File. Specifies the absolute path for the access log file. As a default, the log files are kept in the logs directory in the server root. If you specify a partial path, the server assumes the path is relative to the logs directory in the server root.

Record. Specifies whether the server should record domain names or IP addresses of the systems accessing the server in the access log.

Format. Specifies which type of log file format to use in the access log. You can select from the following:

• Use Common Logfile Format. Includes client's host name, authenticated user name, date and time of request, HTTP header, status code returned to the client, and content length of the document sent to the client, or
• Only log. Allows you to choose which information will be logged. You can choose from the following items:



• Client hostname. The hostname (or IP address if DNS is disabled) of the client requesting access.
• Authenticate user name. The authenticated user name listed in the access log if authentication was required.


• System date. The date and time of the client request.


• Full request. The exact request the client made.


• Status. The status code the server returned to the client.


• Content length. The content length, in bytes, of the document sent to the client.


• HTTP header, "referer". The referer specifies the page from which the client accessed the current page. For example, if a user was looking at the results from a text search query, the referer would be the page from which the user accessed the text search engine. Referers allow the server to create a list of backtracked links.


• HTTP header, "user-agent". The user-agent information—which includes the type of browser the client is using, its version, and the operating system it's running on—comes from the User-agent field in the HTTP header information the client sends to the server.


• Method. The HTTP request method used (GET, PUT, POST, etc.).


• URI. The Universal Resource Identifier. The location of a resource on the server. For example, for http://www.a.com:8080/special/docs, the URI is special/docs.


• Query string of the URI. The text after the question mark in a URI. For example, for
  http://www.a.com:8080/special/docs?find_this, the query string of the URI is find_this.


• Protocol. The transport protocol and version used.

Custom format. Allows you to create a customized format for your access log. For a list of customizable format parameters, see the NSAPI Programmer's Guide for iPlanet Web Server.

Do not log client accesses from. Specifies the hostnames and the IP addresses whose accesses will not be logged.

• Hostnames. Specifies all hostnames from which your server will not log client accesses. You can use a wildcard pattern to signify which hosts to leave out of the access log. For example, use *.iplanet.com if you do not want to log accesses from the domain iplanet.com.
• IP Addresses. Specifies all IP addresses from which your server will not log client accesses. You can use a wildcard pattern to signify which IP addresses to leave out of the access log. For example, use 208.12.* if you do not want to log access from IP addresses beginning with 208.12.

OK. Displays the log entries in the lower section of this page.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

• About Log Files
• Viewing an Access Log File

Number of entries. Specifies the number of entries to retrieve (starting with the most recent).

Only show entries with. Specifies a string or a character to filter the log entries. Case is important; the case of the string or character specified in this field must match the case of the entry in the access log. For example, if you want to see only access log entries that contain POST, type "POST."

OK. Displays the log entries in the lower section of this page.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Last number accesses to access. Displays the access log entries with the parameters specified in the upper section of this page.

• About Log Files
• Viewing the Error Log File

Number of errors to view. Specifies the number of entries to retrieve (starting with the most recent).

Only show entries with. Specifies a string or a character to filter the log entries. Case is important; the case of the string or character specified in this field must match the case of the entry in the error log. For example, if you want to see only those error messages that contain warning, type "warning."

OK. Displays the log entries in the lower section of this page

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Last number errors. Displays the error log entries with the parameters specified in the upper section of this page.

• The Configure Directory Service Page
• The Restrict Access Page


• The Edit Access Control Page (Administration Server)


• The NS Cron Control Page (Unix/Linux)


• The Configure JRE/JDK Paths Page


• The Community Strings Page (Unix/Linux)


• The Manager Entries Page (Unix/Linux)


• The SNMP Master Agent Control Page (Unix/Linux)

Host Name. Specifies the name of the LDAP server. You must enter a host name even if the directory server is running on the local machine.

Port. Specifies the port on which the LDAP server runs. If you are going to use SSL with a directory server, then you should enter the port number that the directory server is using for SSL.

Use Secure Sockets Layer (SSL) for connections. Specifies whether the server should use SSL for communications with the directory server. If you click Yes, then you must also configure the Administration Server to use SSL communications.

Base DN. Specifies the distinguished name where directory lookups will occur by default, and where all the Administration Server's entries will be placed in your directory tree (for example, o=mozilla.com). A DN is the string representation for the name of an entry in a directory server.

Bind DN. Specifies the distinguished name that the Administration Server will use to initially bind (or log in) to the directory server (for example, cn=Directory Manager). Binding determines the permission level you are granted for the duration of a connection. The DN supplied in a bind request can be the DN of an alias entry.

Bind Password. Specifies the password used for authentication.

Save Changes. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

For the server. Specifies the server for which to create an access control list. After choosing a server from the drop-down list, click Create ACL.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

• Upper Frame
• Lower Frame

Action. specifies whether to deny or allow access to the users, groups, or hosts. For the Administration Server, the first two lines of the access control rules are set to deny everyone except the group admin access to any portion of the Administration Server. If allow users and groups outside of the group admin access, you must click New Line and create an access control rule.

Users/Groups. Allows you to specify user and group authentication when you click "anyone." The bottom frame allows you to configure User-Group authentication. By default, no users or groups outside of the group admin can access the Administration Server resources. For more information, see Specifying Users and Groups.

From host. Allows you to specify the computers you want to include in the rule when you click "anyplace". In the bottom frame, you can enter wildcard patterns of host names or IP addresses to allow or deny. For more information, see Specifying Host Names and IP Addresses.

Programs. Restricts access to the tabs in the Administration Server. For example, you can restrict access to all pages for configuring the administration server by selecting All Programs. If you want to restrict access to one or two sets of pages, choose the name of the tab in the scroll-down list. If you want to restrict access to one page in a tab, type the name of the page in Program Items. For example, to restrict access to the Access Control List Management page, type distacl in Program Items. For more information, see Access to Programs.

Extra. Allows you to specify a customized ACL entry. This is useful if you use the access control API to customize ACLs. For more information, see Writing Customized Expressions.

Continue. Specifies that the next line in the access control rule chain is evaluated before the server determines if the user is allowed access. When creating multiple lines in an access control entry, it's best to work from the most general restrictions to the most specific ones.

Trash can icon. Deletes the corresponding line from the access control rules.

Access control is on. Specifies whether access control is enabled.

New Line. Adds a default ACL rule to the bottom row of the table. You can use the up and down arrows in the left column to move the rule.

Response when denied. Specifies the response a user sees when denied access. You can vary the message for each access control object. By default, the user is sent a message saying that the file was not found (the HTTP error code 404 Not Found is also sent).

Submit. Saves your entries.

Revert. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

Allow. Allows the user, group, or host access.

Deny. Denies the user, group, or host access.

Update. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

Anyone (no authentication). Allows everyone access to the resource. No authentication is required.

Authenticated people only. Allows only authenticated users and groups to access the resource. Choose from the following options:

• All in the authentication database. Allows all users and groups in the LDAP directory.
• Only the following people. Allows only the users and groups specified. Click List under Group or User to list or search for groups and users in the LDAP directory.

Prompt for authentication. Allows you specify message text that appears in the authentication dialog box. You can use this text to describe what the user needs to enter. Depending on the operating system, the user will see about the first 40 characters of the prompt. Netscape Navigator and Netscape Communicator cache the username and password and associate them with the prompt text. This means that if the user accesses areas (files and directories) of the server that have the same prompt, the user will not have to retype usernames and passwords. Conversely, if you want to force users to reauthenticate for various areas, you must change the prompt for the ACL on that resource.

Update. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

Any place. Allows any machine access to the resource.

Only from. Allows only the specified host names or IP address access to the resource. You specify this restriction by using wildcard patterns that match the machines' host names or IP addresses. For example, to allow or deny all computers in a specific domain, you would enter a wildcard pattern that matches all hosts from that domain, such as *.iplanet.com.

Update. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

All programs. Allows users or groups access to all the tabs in the Administration Server.

Only the following. Allows users or groups access to either specific tabs or specific pages. You can choose multiple tabs by pressing the Control key and then clicking the tabs.

Update. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

Customize expressions. Allows you to enter custom expressions for an ACL in the text box. You can use this feature if you are familiar with the syntax and structure of ACL files. For more information on customized expressions, see Writing Customized Expressions, and ACL File Syntax.

Update. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays the online help.

Respond with the default file (redirection off). Displays the HTTP error code 404 Not Found error when the file being requested is not found.

Respond with the following file (physical path): (redirection on). Specifies a URL or the absolute path to a text or HTML file in your server's document root that you want to send to users when they are denied access. Be sure the server has read access to this file on your system—it's a good idea to have the file in a directory under the server root.

Start. Starts ns-cron, and starts all scheduled cron jobs.

Stop. Stops all cron jobs defined in ns-cron.

Restart. Restarts all cron jobs in ns-cron.

Choose either JDK or JRE. Specifies whether the server will run servlets using the JDK or JRE.

JDK Path. Specifies the directory where you installed the JDK.

JDK Runtime Libpath. Specifies the runtime library path for the JDK.

JDK Runtime Classpath. Specifies the paths to the directories and JAR files needed by the JDK. You can add new values to the existing class path, but do not delete the existing value since it includes paths that are essential for servlet operation.

JRE Path. Specifies the directory where you installed the JRE.

JRE Runtime Libpath. Specifies the runtime library path for the JRE.

Community. Specifies the name of the community you want to create.

Operation. Specifies the permissions for the new community. Choose from the following:

• Allow all operations. Allows this community string to request data or reply to messages, and set variable values.
• Allow GET operations. Allow this community string to only request messages or reply to messages, and not set variables.
• Allow ALL operations. Allows this community string to only set variable values.

Current communities. Lists all communities currently defined for the server. To modify a community, click Edit in the community row. To delete a community, click Remove in the community row.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Manager station. Specifies the name of the system that is running your network management software.

Trap port. Specifies the port number on which your network management system listens for traps (the well-known port is 162).

With community. Specifies the community string you want to use in the trap.

Current manager entries. Lists all manager stations defined for the server. To modify a manager entry, click Edit in the manager entry row. To delete a manager entry, click Remove in the manager entry row.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

• Installing the SNMP Master Agent
• Enabling and Starting the SNMP Master Agent

Start. Starts the SNMP master agent.

Stop. Stops the SNMP master agent.

Restart. Restarts the SNMP master agent.

• The New User Page

• The Edit Users Page
• The Manage Users Page
• The New Group Page



• The Edit Groups Page
• The Edit Members Page


• The Group Cert Members Page


• The Manage Groups Page
• The New Organizational Unit Page


• The Manage Organizational Units Page



• The Edit Organizational Unit Page
• The Manage Preferred Language List Page

Given name. Specifies the users's given name or first name.

Surname. Specifies the user's surname or last name.

Full name. Specifies the user's given name and surname. If you entered a given name and a surname, this field is automatically filled in.

User ID. Specifies a unique user name for the user. The user ID is generated as the first initial of the user's first name followed by the user's last name. You can replace this user ID with an ID of your own choosing. If you entered a given name and a surname, this field is automatically filled in.

Password. Specifies the password for the user.

Password (again). Confirms the password entered in the Password field. If what you enter in this field is different from what you entered in the Password field, you will be prompted to try again.

E-Mail address. Specifies the email address of the user.

Add new user to. Specifies the organizational unit where you want the new user to be placed. The default location is your directory's root point.

Create user. Adds the user to the LDAP database.

Create and edit user. Adds the user, and then proceeds to The Edit Users Page for the user you have just added.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

For more information, see Managing Users.

• General
• Password


• License

Given name (First Name). Specifies the users's given name or first name.

Surname (Last Name). Specifies the user's surname or last name.

Full names. Specifies the user's given name and surname.

Title. Specifies the job title of the user.

User ID. Specifies a unique user name for the user. The user ID generated by the gateway is the first initial of the user's first name followed by the user's last name. You can replace this user ID with an ID of your own choosing.

E-Mail address. Specifies the email address of the user.

Phone number. Specifies the phone number of the user.

Save changes. Saves changes to the LDAP database.

Rename user. Renames the user entry (including the entry's distinguished name) in the LDAP database.

Delete user. Deletes the user from the LDAP database.

Help. Displays online help.

Password. Specifies the new password. This password is used for user entries by the various Netscape/iPlanet servers for user authentication

Password (again). Confirms the password entered in the Password field. If what you enter in this field is different from what you entered in the Password field, you will be prompted to try again.

Set password. Changes the password immediately.

Disable password. Disables the user's password by setting it to an invalid value.

Help. Displays online help.

Find user. Specifies a descriptive value for the entry that you want to edit. You can enter any of the following in the search field:

• A name. Specifies a full name or a partial name. All entries that equally match the search string will be returned. If no such entries are found, all entries that contain the search string will be found. If no such entries are found, any entries that sound like the search string are found.
• A user ID. If you enter only a partial user ID, any entries that contain the string will be returned.
• A telephone number. If you enter only a partial number, any entries that have telephone numbers ending in the search number will be returned.
• An email address. Any search string containing an at (@) symbol is assumed to be an email address. If an exact match cannot be found, then a search is performed to find all email addresses that begin with the search string.
• An asterisk (*). Displays all the entries currently in your directory. You can achieve the same effect by simply leaving the field blank.
• Any LDAP search filter. Treats any string that contains an equal sign (=) as a search filter (for example, ou=Network).

Find all users whose. Allows you to build a custom search filter. Use this field to narrow down the search results returned by Find User field. You can specify the following search criteria:

• The left pull-down list allows you to specify the attribute on which the search will be based. You can choose from the following options:

• full name. Searches each entry's full name for a match.
• last name. Searches each entry's last name, or surname for a match.


• user id. Searches each entry's user id for a match.


• phone number. Searches each entry's phone number for a match.


• email address. Searches each entry's email address for a match.


• In the center pull-down list, select the type of search you want to perform. You can choose from the following options:

• contains. Causes a sub-string search to be performed. Entries with attribute values containing the specified search string are returned. For example, if you know a user's name probably contains the word "Steve", use this option with the search string "Steve" to find the user's entry.
• is. Causes an exact match to be found. This option specifies an equality search. Use this option when you know the exact value of a user's attribute. For example, if you know the exact spelling of the user's name, use this option.


• isn't. Returns all the entries whose attribute value does not exactly match the search string. That is, if you want to find all the users in the directory whose name is not "Babs Jensen," use this option. Be aware, however, that use of this option can cause an extremely large number of entries to be returned to you.


• sounds like. Causes an approximate, or phonetic, search to be performed. Use this option if you know an attribute's value, but you are unsure of the spelling. For example, if you are not sure if a user's name is spelled "Sarret", "Sarette", or "Sarett", use this option.


• starts with. Causes a sub-string search to be performed. Returns all the entries whose attribute value starts with the specified search string. For example, if you know a user's name starts with "Mike", but you do not know the rest of the name, use this option.


• ends with. Causes a sub-string search to be performed. Returns all the entries whose attribute value ends with the specified search string. For example, if you know a user's name ends with "Anderson", but you do not know the rest of the name, use this option.


• In the right text field, enter your search string. To display all the user's entries contained in the directory specified in the Look within field, enter either an asterisk (*) or leave this field blank.

Look within. Specifies the organizational unit under which you want to search for entries. The default is the directory's root point (or topmost entry).

Format. Specifies whether the search results are formatted for display on screen or for printing to a printer.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Type of group. Specifies whether the group is static or dynamic. Dynamic groups are generated dynamically based upon LDAP attributes and filters. Dynamic groups can slow your group lookups.

Group name. Specifies the group name.

Description. Specifies a description of the group.

Add new group to. Specifies the directory to which you are adding the group. The default location is your directory's root point.

Create group. Adds the group to the LDAP database.

Create and edit group. Adds the group, and then proceeds to The Edit Groups Page for the group you have just added.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Group name. Specifies the group you want to edit.

Description. Specifies a description of the group.

Group members. Lists the members of the group. Click Edit to add, modify, or delete members in the group.

Group cert members. Specifies the members of the group certificate. Click Add to add members to the group certificate.

Owner. Specifies the owner of the group. Click Edit to add, modify, or delete the group owner.

See also. References other directory entries that may be relevant to the current group. See Also allows users to easily find entries for people and other groups that are related to the current group. Click Edit to add, modify, or delete See Also references.

Save changes. Saves the changes to the LDAP directory.

Rename group. Renames the group in the LDAP directory.

Delete group. Deletes the group from the LDAP directory.

Help. Displays online help.

Find. Specifies whether you are searching for users or groups.

Matching. Specifies the string or character to search for in the user or the group name.

Find and add. Finds the user or group in the LDAP database and adds them to the group.

Find and remove. Finds the user or group in the LDAP database and deletes the user or group from the group.

Remove from list. Click the checkbox next to the name of the member user or group you want to remove from the list of members.

Save changes. Saves the changes to the LDAP directory.

Cancel. Erases your changes and returns to previous page.

Help. Displays online help.

Common name. Specifies the fully qualified hostname used in DNS lookups (for example, www.iplanet.com). This is the hostname in the URL that a browser uses to connect to your site. It's important that these two names are the same, otherwise a client is notified that the certificate name does not match the site name, which will make people doubt the authenticity of your certificate. However, some CAs might require different information, so it's important to contact them.

Email address. Specifies the business email address used for correspondence between the business and the CA.

Organization. Specifies the official, legal name of the company, educational institution, partnership, and so on. Most CAs require that you verify this information with legal documents (such as a copy of a business license).

Organization unit(s). Describes an organization within your company. This can also be used to specify a less formal company name (without the Inc., Corp., and so on).

Locality. Specifies the city, principality, or country for the organization.

State or province. Specifies the state or province in which the organization is located. Most CAs require the full name, not abbreviations.

Country. Specifies the country in which the organization is located. Most CAs require the two-letter country code (for example, US for United States of America).

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Find group. Specifies the name of the group that you want to find. You can enter any of the following in the search field:

• A name. A full name or a partial name. All entries that equally match the search string are returned. If no such entries are found, all entries that contain the search string will be found. If no such entries are found, any entries that sounds like the search string are found.
• An asterisk (*). The groups currently residing in your directory. You can achieve the same effect by simply leaving the field blank.
• Any LDAP search filter. Any string that contains an equal sign (=) is considered to be a search filter.

Find all groups whose. Allows you to build a custom search filter. Use this field to narrow down the search results that are otherwise returned by Find Groups. You can specify the following search criteria:

• The left pull-down list allows you to specify the attribute on which the search is based. You can choose from the following options:

• name. Searches each entry's full name for a match.
• description. Searches each group entry's description for a match.


• In the middle pull-down list, select the type of search you want to perform. You can choose from the following options:

• contains. Causes a sub-string search to be performed. Entries with attribute values containing the specified search string are returned. For example, if you know a group's name probably contains the word "Administrator", use this option with the search string "Administrator" to find the group entry.
• is. Causes an exact match to be found. Use this option when you know the exact value of a group's attribute. For example, if you know the exact spelling of the group's name, use this option.


• isn't. Returns all the entries whose attribute value does not exactly match the search string. If you want to find all the groups in the directory whose name does not contain "administrator", use this option. Be aware, however, that use of this option can cause an extremely large number of entries to be returned to you.


• sounds like. Causes an approximate, or phonetic, search to be performed. Use this option if you know an attribute's value, but you are unsure of the spelling. For example, if you are not sure if a group's name is spelled "Sarret's list", "Sarette's list", or "Sarett's list", use this option.


• starts with. Causes a sub-string search to be performed. Returns all the entries whose attribute value starts with the specified search string. For example, if you know a group's name starts with "Product", but you do not know the rest of the name, use this option.


• ends with. Causes a sub-string search to be performed. Returns all the entries whose attribute value ends with the specified search string. For example, if you know a group's name ends with "development", but you do not know the rest of the name, use this option.


• In the right text field, enter your search string. To display all the group entries contained in the Look Within directory, enter either an asterisk (*) or simply leave this field blank.

Look within. Specifies the organizational unit under which you want to search for entries. The default is the directory's root point, or top-most entry.

Format. Specifies whether the output is formatted for display on screen or for printing to a printer.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Unit name. Specifies the name of the organizational unit.

Description. Specifies a description of the organizational unit.

Add organizational unit to. Specifies the parent organizational unit under which this new organizational unit will reside.

Create organizational unit. Adds the organizational unit to the LDAP database.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Find organizational unit. Specifies the name of the organizational unit that you want to find. You can enter any of the following in the search field:

• A name. A full name or a partial name. All entries that equally match the search string are returned. If no such entries are found, all entries that contain the search string will be found. If no such entries are found, any entries that sounds like the search string are found.
• An asterisk (*). All the groups currently residing in your directory. You can achieve the same effect by simply leaving the field blank.
• Any LDAP search filter. Any string that contains an equal sign (=) is considered to be a search filter.

Find all units whose. Allows you to build a custom search filter. Use this field to narrow down the search results that are otherwise returned by Find Organizational Unit. You can specify the following search criteria:

• The left pull-down list allows you to specify the attribute on which the search is based. You can choose from the following options:

• full name. Searches each entry's full name for a match.
• description. Searches each organizational unit entry's description for a match.


• In the middle pull-down list, select the type of search you want to perform. You can choose from the following options:

• contains. Causes a sub-string search to be performed. Entries with attribute values containing the specified search string are returned. For example, if you know an organizational unit's name probably contains the word "Administrator", use this option with the search string "Administrator" to find the organizational unit entry.
• is. Causes an exact match to be found. Use this option when you know the exact value of an organizational unit's attribute. For example, if you know the exact spelling of the organizational unit's name, use this option.


• isn't. Returns all the entries whose attribute value does not exactly match the search string. That is, if you want to find all the organizational units in the directory whose name does not contain "administrator", use this option. Be aware, however, that use of this option can cause an extremely large number of entries to be returned to you.


• sounds like. Causes an approximate, or phonetic, search to be performed. Use this option if you know an attribute's value, but you are unsure of the spelling. For example, if you are not sure if a organizational unit's name is spelled "Sarret's list", "Sarette's list", or "Sarett's list", use this option.


• starts with. Causes a sub-string search to be performed. Returns all the entries whose attribute value starts with the specified search string. For example, if you know an organizational unit's name starts with "Product", but you do not know the rest of the name, use this option.


• ends with. Causes a sub-string search to be performed. Returns all the entries whose attribute value ends with the specified search string. For example, if you know an organizational unit's name ends with "development", but you do not know the rest of the name, use this option.


• In the right text field, enter your search string. To display all the organizational unit entries contained in the Look Within directory, enter either an asterisk (*) or simply leave this field blank.

Look within. Specifies the organizational unit under which you want to search for entries. The default is the directory's root point, or top-most entry.

Format. Specifies whether the search results are formatted for display on screen or for printing to a printer.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Unit name. Specifies the name of the organizational unit.

Description. Specifies a description of the unit.

Phone. Specifies the phone number of the organizational unit.

Fax. Specifies a fax number of the organizational unit.

Mailing address. Specifies the mailing address of the organizational unit.

Save changes. Saves the changes made on this page.

Rename. Renames the organizational unit in the LDAP database.

Delete. Deletes the organizational unit from the LDAP database.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Display language selection list. Specifies whether the languages selected in the language selection list will be displayed upon saving your changes on this page.

Languages in the selection list. Displays all the available languages. Click "Add to list" to add the language to your language selection list. Click "Default value" to designate one language as the default language.

Save changes. Saves your entries. You must restart the server in order for your changes to take effect.

Help. Displays online help.

• The Create a Trust Database Page
• The Request a Server Certificate Page (Admin)


• The Install a Server Certificate Page (Admin)


• The Change the Key Pair File Password Page (Admin)


• The Manage Server Certificates Page (Administration Server)


• The Install a Certificate Revocation List


• The Manage Certificate Revocation Lists


• The Install a New PKCS#11 Module Page


• The Migrate a 3.x Cert Page

Cryptographic Module. Specifies whether the certificate database is internal.

Database Password. Specifies the certificate database password.

Password (again). Confirms the password specified in the Database Password field. If what you enter is different from what you entered in the Database Password field, you will be prompted to try again.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

New Certificate. Specifies that the certificate being requested is new.

Certificate Renewal. Specifies that the certificate being requested is a renewal of an existing certificate.

List of Available Certificate Authorities. Lists the certificate authorities from which you can get server certificates.

Submit to Certificate Authority Via. Specifies the manner in which to submit the certificate request. If you wish to contact the certificate authority via email, select CA Email Address and enter the email address in the field.

Select the Mode to Use with the Certificate. Specifies one of the following:

• Cryptographic Module. Specifies the module to be used with the certificate.
• Key Pair File Password. Specifies the certificate database password.

Requestor Name. Specifies the name under which the certificate will be issued.

Telephone Number. Specifies the telephone number of the requestor.

Common Name. Specifies the fully qualified hostname used in DNS lookups (for example, www.iplanet.com). This is the hostname in the URL that a browser uses to connect to your site. It is important that these two names are the same. Otherwise, a client is notified that the certificate name does not match the site name, which often makes uses doubt the authenticity of your certificate.

Email Address. Specifies the business email address used for correspondence between you and the CA.

Organization. Specifies the official, legal name of your company, educational institution, organization, and so on. Most CAs require that you verify this information with legal documents (such as a copy of a business license).

Organizational Unit. Specifies a description of an organizational unit within your company. This field is optional.

Locality. Specifies a description of the city, principality, or country for the organization. This field is optional.

State or Province. Specifies the state or province in which the business is located.

Country. Specifies the two-character abbreviation of your country name (in ISO format). The country code for the United States is US.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Certificate For. Specifies where the certificate will be used. Select from the following options:

• This Server. Specifies that the server will use the key-pair file password you specify to decrypt the certificate when you install it.
• Server Certificate Chain. Allows the SSL connection to continue at the client's discretion when the client does not recognize the certificate's CA. Certificate chaining is the process of presenting your CA's certificate in addition to your own. If the client trusts the CA who issued the certificate to your CA, the transaction will continue. In this way, a chain of trust is created: the client trusts the second CA, who trusts the first CA, who trusts you. Therefore, the client trusts you.
• Trusted Certificate Authority (CA). Accepts the certificate of a CA as a trusted CA for client authentication.

Database Password. Specifies the password for the certificate database.

Certificate Name. Specifies the common name of the certificate. Enter the certificate name only if it differs from the fully qualified hostname of your server used in DNS lookups (for example, www.iplanet.com).

Message is in This File. Specifies the file that contains the CA certificate.

Message Text (with headers). Contains the content of the CA certificate. If you copy and paste the text, be sure to include the headers "Begin Certificate" and "End Certificate."

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Old Password. Specifies the current key pair password.

New Password. Specifies the new key pair password.

Password (again). Confirms the password specified in the New Password field. If what you enter is different from what you entered in the New Password field, you will be prompted to try again.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Certificate Name. Specifies the name of the certificate authority.

Type. Specifies the type of certificate.

Expires (Time in UTC). Displays the date and time that the certificate expires. Once a certificate has expired, you must renew it to use it again.

Help. Displays online help.

File Contains. Specifies either a Certificate Revocation List (CRL) or a Compromised Key List (CKL).

The CRL/CKL is in this file:. Specifies the CRL/CKL location.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Server CRLs. Displays the server CRLs for more information and options.

Refresh. Updates the current list of CRLs.

Help. Displays online help.

Path to Jar File. Specifies the path from which to import PKCS#11 modules in the form of .jar files.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

3.6 Server Root. Specifies the server root of Netscape Enterprise Server 3.6.

Alias. Specifies the alias mapped to the key-pair file and certificate file you associated it with in the Administration Server.

Password. Specifies the certificate key-pair password.

OK. Saves your entries. You must restart the server in order for your changes to take effect.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

• The Cluster Control Page
• The Add Remote Servers to Cluster Database Page


• The Modify Server Settings in Cluster Database Page


• The Remove Servers from Cluster Database Page

• About Clusters
• Preliminary Guidelines for Using Server Clusters


• Setting up a Cluster

Product selector. Specifies the type of server cluster you want to configure. All servers of that type appear listed by their unique server identifier. For example, if you select Web Server, Enterprise Edition, a list of all iPlanet Web Server, Enterprise Edition instances appear on the page. The cluster page changes to display fields that apply to that server type.

Check servers to control. Allows you the select any of the listed servers, change the information for all servers in the cluster, or unselect any servers you have chosen in the page.

Status. Displays whether the server is running or has stopped.

Start, stop, restart. Starts, stops, or restarts the remote servers.

View access, view error. Displays the specified number of lines from either the server's current access log or the error log.

Transfer. Transfers information in the selected configuration file from the selected server.

Status. Displays whether the server is running or has stopped.

Help. Displays online help.

Admin Server Protocol. Specifies the protocol used when contacting the remote administration server. Choose http for normal administration servers. Choose https if the remote administration server is running under SSL.

Admin Server Hostname. Specifies the host name of the remote administration server. If your DNS cannot resolve host names, enter the fully qualified host and domain name (for example, type www.mozilla.com).

Admin Server Port. Specifies the port number of the remote administration server.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Product Selector. Specifies the type of server you want to change. All servers of that type appear listed by their unique server identifier.

Check Servers To Be Modified. Allows you the select any of the listed servers, change the information for all servers in the cluster, or unselect any servers you have chosen in the page.

Admin Server Protocol. Specifies the protocol used when contacting the remote administration server. Choose http for normal administration servers. Choose https if the remote administration server is running under SSL.

Admin Server Hostname. Specifies the host name of the remote administration server. If your DNS cannot resolve host names, enter the fully qualified host and domain name (for example, type www.mozilla.com).

Admin Server Port. Specifies the port number of the remote administration server.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.

Product Selector. Specifies the type of server you want to delete. All servers of that type appear listed by their unique server identifier.

Check Servers To Be Removed. Allows you the select any of the listed servers, change the information for all servers in the cluster, or unselect any servers you have chosen in the page.

OK. Saves your entries.

Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.

Help. Displays online help.