PingDirectory

Restricting server access using client connection policies

A client-established connection to the PingDirectory server is associated with a client connection policy. Use client connection policies to restrict the kinds of requests that the client can issue and impose resource limits for that connection.

Steps

  1. Create a simple connection criteria.

    Example:

    The following example uses the dsconfig tool in non-interactive mode. It allows only the PingDirectory server’s IP address and loopback to have access.

    $ bin/dsconfig set-connection-criteria-prop \
  --criteria-name allowed-ip-addrs \
  --add included-client-address:10.6.1.80 \
  --add included-client-address:127.0.0.1

  2. Assign the criteria to the client connection policy.

    Example:

    $ bin/dsconfig set-client-connection-policy-prop \
  --policy-name new-policy \
  --set connection-criteria:allowed-ip-addrs

    Result:

    After you have run the command, access is denied to remote IP addresses. The PingDirectory server does not require a restart.

  3. Add a remote IP range to the criteria.

    For the following example, add 10.6.1.*.

    Example:

    $ bin/dsconfig set-connection-criteria-prop \
  --criteria-name allowed-ip-addrs \
  --add "included-client-address:10.6.1.*"

    Result:

    Access from any remote servers is allowed. The PingDirectory server does not require a restart.

  4. To restore default behavior, remove the criteria from the connection policy.

    Example:

    Include the LDAP or LDAPS connection parameters, such as host name, port, bindDN, bindPassword, with the dsconfig command.

    Example:

    $ bin/dsconfig set-client-connection-policy-prop \
  --policy-name new-policy --remove connection-criteria:allowed-ip-addrs

    Result:

    The PingDirectory server does not require a restart.