Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition

Setting Referrals and Making a Suffix Read-Only

If you want to limit access to a suffix without disabling the suffix completely, you can modify the access permissions to allow read-only access. In this case you must define a referral to another server for write operations. You can also deny both read and write access, and define a referral for all operations on the suffix.

Referrals can also be used to temporarily point a client application to a different server. For example, while backing up the contents of the suffix, you might add a referral to another suffix.

If your suffix is a consumer in a replicated environment, the replication mechanism determines the value of the referral setting. Although you can manually modify the referral setting, the referral will be overwritten at the next replication update. For information about setting replication referrals, see To Perform Advanced Consumer Configuration.

Referrals are labeled URLs, that is, an LDAP URL optionally followed by a space character and a label. For example:




Because space characters are significant, any space characters in the URL part of the referral must be escaped using %20.

ProcedureTo Set Referrals to Make a Suffix Read-Only

  1. Set the referral URL.

    $ dsconf set-suffix-prop -h host -p port suffix-DN referral-url:LDAP-URL

    where LDAP-URL is a valid URL containing the host name, port number, and DN of the target.

    For example:


    You can specify any number of LDAP URLs.

  2. Set the referral mode in order to make the suffix read-only.

    $ dsconf set-suffix-prop -h host -p port suffix-DN referral-mode:only-on-write

    To make the suffix unavailable for both read and write operations, and to return referrals for all requests, set the referral-mode to enabled.

  3. As soon as the command is successful, the suffix is read-only or inaccessible and ready to return referrals.

  4. (Optional) When the suffix becomes available, disable the referrals to make the suffix read-write again.


    When referrals are disabled, the suffix automatically becomes read-write, unless you have disabled the suffix itself by setting the enabled property of the suffix to off.