Release Summary › New and Changed Features › New and Changed Features in SP5

New and Changed Features in SP5

The following features were added or enhanced in r12 SP5.

SHA-2 Hash Family Support

CA Directory now supports SHA-2 for hashing operations, following the requirements in the following standard: US NIST FIPS 180-3 (Oct 2008) Secure Hash Standard (SHS) Requirements.

This affects the following tools:

• DXcertgen can now create certificates with SHA-2 signatures
• DXpassword can now hash passwords using SHA-2 algorithms

More information:

About the DXcertgen Tool

DXcertgen Tool—Generate and Work with Certificates

Password Policies

DXpassword Tool—Hash a Password

set password-storage Command

DXloaddb Checks the Syntax for telephoneNumber and facsimileTelephoneNumber

The following attributes must not contain a space character only:

• telephoneNumber
• facsimileTelephoneNumber

If one of these attributes does contain a space only, any DISP updates will fail.

To help you avoid this problem, DXloaddb now checks the syntax of these attributes for space-only values, and rejects any it finds with an error similar to the following:

Invalid syntax for fax/telephone number
Wrong syntax for value " " on line 19

DXloaddb Rejects Entries with Multiple Passwords

DXloaddb now rejects entries with multiple passwords in the userPassword attribute.

To permit DXloaddb to load an entry with multiple passwords, use the following command:

set enable-nonstandard-behaviour=true;

If your data has an entry with multiple passwords and you upgrade to CA Directory r12 SP5, you will receive an error message similar to the following:

Entry on line 20 contains multiple values for single-valued attribute 'userPassword'

You will need to fix the problem entries before you run DXloaddb.

Change to iTechPoz Schema

The pozLocation attribute in the iTechPoz.dxc schema is now of syntax caseIgnoreString, to allow searches to be case insensitive.

Prevent the Creation of an Entry with Multiple Unrelated Structural Object Classes

It is now possible to prevent adding an entry which has more than one unrelated structural object classes as specified in Section 8.3.2 of X.501 and Section 2.4.2 of RFC4512.

To enforce this, add the following command to your settings:

set check-structural-oc = true;

More information:

set check-structural-oc—Prevent Entries with Multiple Unrelated Structural Object Classes from Being Created

A Multiwrite Group Cannot Contain LDAP Servers Only

A multiwrite group can no longer contain LDAP servers only. Each multiwrite group must contain at least one CA Directory DSA.

If a multiwrite group contains only LDAP servers, peer DSAs send updates only to the first LDAP server in the group. It does not pass the updates on to the other LDAP servers.

If you currently have a multiwrite group that contains only LDAP servers, you should make one of the following changes:

• Move the other LDAP servers into groups serviced by CA Directory DSAs.
• Add each LDAP server to its own group, so they are replicated to asynchronously.
• Remove the other LDAP servers from multi-write or from the configuration altogether.

Add Prefixes and Suffixes to the Search Results from a View

When you set up a view, you can add a constant prefix or suffix to search results in a view.

For example, you could add a prefix to search results from a particular source, to help you distinguish these results from results from other sources.

For more information, see Set Up Views in the Administration Guide.

More information:

Add a Prefix or Suffix to a Search Result

set view Command—Define a View

New SNMP Counters for Tracking Datastore Usage

You can now track data store usage using the following SNMP counters:

• dxCacheEntries
• dxCacheFilesize
• dxCacheUsedBytes
• dxCacheReclaimable

Certifications

CA Directory and CA Directory Management are now certified on SLES 11.1 and Windows 7 64-bit.

Note: For more information see Operating System Support.

DXmanager

CA Directory r12 SP5 does not include a new version of the Directory Manager package (which includes DXmanager). It contains a new version of the Directory package only (which includes DXserver).

You can safely upgrade the Directory package without updating Directory Management.

If you are installing for the first time, install the following versions of these packages:

• Directory r12 SP5
• Directory Management r12 SP2

Note: For more information about the installation packages, see Installation Components in the Installation Guide.