Tue Mar 3 00:14:02 UTC 2009

Author: rmeggins

Update of /cvs/dirsec/directoryconsole/help/en/help
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11483/directoryconsole/help/en/help

Modified Files:
	configtab_chaindb.html configtab_chaindb7.html 
	configtab_replication.html configtab_replication2.html 
	configtab_replication3.html configtab_replication6.html 
	configtab_replication7.html configtab_synchronization3.html 
	replication_wizard.html replication_wizard5.html 
	synchronization_wizard1.html synchronization_wizard2.html 
Log Message:
Resolves: bug 481213
Bug Description: Update replication, winsync, chaining online help about connections and authentication
Reviewed by: nhosoi (Thanks!)
Fix Description: Updated the online help to reflect the new UI.
Platforms tested: RHEL5
Flag Day: no
Doc impact: no



Index: configtab_chaindb.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_chaindb.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3

--- configtab_chaindb.html	19 Nov 2007 18:21:38 -0000	1.2
+++ configtab_chaindb.html	3 Mar 2009 00:13:59 -0000	1.3
@@ -20,36 +20,92 @@
 </p>
 
 <p class="text">
-<b>Bind DN.</b> DN of an administrative user by the database link to bind to the remote server. If this field is left blank, the database link binds as anonymous. Note that the bind DN cannot be the directory manager.
+<b>Authentication Mechanism</b>
 </p>
 
 <p class="text">
-<b>Password.</b> Password for the administrative user, in plain text. If no password is provided, it means that the database link can bind as anonymous.
+<b>Server TLS/SSL Certificate (requires TLS/SSL server set up). </b>Select this option if you want the chaining server to use its TLS/SSL server certificate for authentication. You cannot use certificate authentication unless the "Use TLS/SSL" or the "Use StartTLS" radio button in the Remote Server(s) Information section is selected. Otherwise, this option will be disabled.  The "Bind As" and Password fields are unavailable with this option because the server will use its certificate to authenticate.
 </p>
 
 <p class="text">
-<b>Remote server(s) information. </b>In this section you provide information about the remote data sources used by the database link.
+To use this option, you must first do the following:
 </p>
 
 <ul>
+<li>
+Configure TLS/SSL for both the local and remote servers.
+</li>
+
+<li>
+Configure your remote server to recognize your local server's certificate as the chaining user DN (certificate mapping).
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/GSSAPI (requires Kerberos keytab). </b>Select this option if you want the local server to use its Kerberos server credentials for authentication.  You must have the "Use LDAP" radio button in the Remote Server(s) Information section selected.  Otherwise, this option sill be disabled.  Note that SASL/GSSAPI will use an encrypted channel, so TLS/SSL is not needed with this option.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
+</p>
+
+<ul>
+<li>
+Configure Kerberos for both your local and remote servers and assign each one a Kerberos server keytab.
+</li>
+
+<li>
+Configure a SASL mapping on your remote server to map the local server's Kerberos principal to a chaing user DN.
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/DIGEST-MD5 (SASL user id and password). </b>Select this option if you want the local server to use SASL/Digest-MD5 authentication.  This option requires a SASL user id and password.  You specify them in the Bind As and Password fields (see below).  You must configure the remote server with the appropriate SASL mapping to use this option.
+</p>
+
+<p class="text">
+<b>Simple Authentication. </b>Select this option if you want the local server to use simple authentication during communication. You can choose "Use SSL/TLS" or "Use StartTLS" if you want the simple authentication to take place over a secure channel but without certificates.
+</p>
+
+<p class="text">
+<b>Bind As. </b>DN of an administrative user by the database link to bind to the remote server. If this field is left blank, the database link binds as anonymous. Note that the bind DN cannot be the directory manager.
+</p>
+
+<p class="text">
+<b>Password. </b>Password for the administrative user, in plain text. If no password is provided, it means that the database link can bind as anonymous.
+</p>
+
+<p class="text">
+<b>Remote Server(s) Information. </b>In this section you provide information about the remote data sources used by the database link.
+</p>
+
+<ul>
+<p class="text">
+<b>Use LDAP (no encryption). </b>If you want the local server to use plain LDAP with no security, select this radio button.  This option must be selected to use SASL/GSSAPI authentication.
+</p>
+
+<p class="text">
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the local server to use TLS/SSL for secure communication using LDAPS, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
+</p>
+
 <p class="text">
-<b>Use a secure LDAP connection between servers.</b> Selecting this checkbox indicates that the connection between the server and the remote server is secure.
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the local server to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
 </p>
 
 <p class="text">
-<b>Remote Server.</b> The name of the remote data source. 
+<b>Remote Server. </b>The name of the remote data source.  If using one of the TLS/SSL or SASL/GSSAPI connection types, you must use the fully qualified host and domain name, and this name must be able to be resolved on both the local and remote servers.
 </p>
 
 <p class="text">
-<b>Remote server port.</b> The port number on the remote data source used by the database link.
+<b>Remote server port. </b>The port number on the remote data source used by the database link.  If using LDAPS, use the secure LDAPS port number (default 636).  Otherwise, use the regular LDAP port number (default 389).  StartTLS uses the regular LDAP port number.
 </p>
 
 <p class="text">
-<b>Failover Server(s).</b> You can specify optional servers for failover in the event that the primary remote server is unavailable. This field contains the name of an alternative remote server. Click Add to add the name and port number to the list.
+<b>Failover Server(s). </b>You can specify optional servers for failover in the event that the primary remote server is unavailable. This field contains the name of an alternative remote server.  If using one of the TLS/SSL or SASL/GSSAPI connection types, you must use the fully qualified host and domain name, and this name must be able to be resolved on both the local and remote servers.  Click Add to add the name and port number to the list.
 </p>
 
 <p class="text">
-<b>Port.</b> Port number of an alternative remote server.
+<b>Port.</b> Port number of an alternative remote server.  If using LDAPS, use the secure LDAPS port number (default 636).  Otherwise, use the regular LDAP port number (default 389).  StartTLS uses the regular LDAP port number.
 </p>
 </ul>
 


Index: configtab_chaindb7.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_chaindb7.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- configtab_chaindb7.html	13 Aug 2007 22:28:09 -0000	1.1
+++ configtab_chaindb7.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -3,7 +3,7 @@
 </p>
 
 <p class="text">
-Use the authentication tab to set the attributes required for your new database link to connect with a remote data source on another server.
+Use the authentication tab to set the attributes required for your new database link to authenticate to and connect with a remote data source on another server.
 </p>
 
 <p class="text">
@@ -11,7 +11,71 @@
 </p>
 
 <p class="text">
-<b>Remote server URL. </b>The LDAP URL of the remote server to which this database link connects. The LDAP URL syntax is <br><code>ldap://</code><span class="variable">server</span><code>:[</code><span class="variable">port</span><code>][</code> <span class="variable">server</span><code>[:</code><span class="variable">port</span><code>]]/</code>
+<b>Connection Type</b>
+</p>
+
+<p class="text">
+<b>Use LDAP (no encryption). </b>If you want the local server to use plain LDAP with no security, select this radio button.  This option must be selected to use SASL/GSSAPI authentication.
+</p>
+
+<p class="text">
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the local server to use TLS/SSL for secure communication using LDAPS, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
+</p>
+
+<p class="text">
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the local server to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
+</p>
+
+<p class="text">
+<b>Remote server URL. </b>The LDAP URL of the remote server to which this database link connects. The LDAP URL syntax is <br><code>ldap(s)://</code><span class="variable">server</span><code>:[</code><span class="variable">port</span><code>][</code> <span class="variable">server</span><code>[:</code><span class="variable">port</span><code>]]/</code>  NOTE: If using LDAPS, all servers specified in the URL must use LDAPS, and you must specify the LDAPS port number.  You cannot mix LDAP with LDAPS.
+</p>
+
+<p class="text">
+<b>Authentication Mechanism</b>
+</p>
+
+<p class="text">
+<b>Server TLS/SSL Certificate (requires TLS/SSL server set up). </b>Select this option if you want the chaining server to use its TLS/SSL server certificate for authentication. You cannot use certificate authentication unless the "Use TLS/SSL" or the "Use StartTLS" radio button in the Remote Server(s) Information section is selected. Otherwise, this option will be disabled.  The "Bind As" and Password fields are unavailable with this option because the server will use its certificate to authenticate.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
+</p>
+
+<ul>
+<li>
+Configure TLS/SSL for both the local and remote servers.
+</li>
+
+<li>
+Configure your remote server to recognize your local server's certificate as the chaining user DN (certificate mapping).
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/GSSAPI (requires Kerberos keytab). </b>Select this option if you want the local server to use its Kerberos server credentials for authentication.  You must have the "Use LDAP" radio button in the Remote Server(s) Information section selected.  Otherwise, this option sill be disabled.  Note that SASL/GSSAPI will use an encrypted channel, so TLS/SSL is not needed with this option.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
+</p>
+
+<ul>
+<li>
+Configure Kerberos for both your local and remote servers and assign each one a Kerberos server keytab.
+</li>
+
+<li>
+Configure a SASL mapping on your remote server to map the local server's Kerberos principal to a chaing user DN.
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/DIGEST-MD5 (SASL user id and password). </b>Select this option if you want the local server to use SASL/Digest-MD5 authentication.  This option requires a SASL user id and password.  You specify them in the Bind As and Password fields (see below).  You must configure the remote server with the appropriate SASL mapping to use this option.
+</p>
+
+<p class="text">
+<b>Simple Authentication. </b>Select this option if you want the local server to use simple authentication during communication. You can choose "Use SSL/TLS" or "Use StartTLS" if you want the simple authentication to take place over a secure channel but without certificates.
 </p>
 
 <p class="text">


Index: configtab_replication.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_replication.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- configtab_replication.html	20 Nov 2007 17:35:08 -0000	1.2
+++ configtab_replication.html	3 Mar 2009 00:13:59 -0000	1.3
@@ -3,11 +3,11 @@
 </p>
 
 <p class="text">
-The replication model used in Directory Server 4.1x and the current replication model are different. The former replication model is termed Legacy Replication.  Only use this tab if you wish to accept replication updates from a  4.1x Directory Server using legacy replication.
+The replication model used in Directory Server 4.1x and the current replication model are different. The former replication model is termed Legacy Replication.  Only use this tab if you wish to accept replication updates from a 4.1x Directory Server using legacy replication.
 </p>
 
 <p class="text">
-<b>Enable Legacy Consumer. </b> Select this checkbox if you want this current Directory Server, to act as a legacy consumer. This means that this server can accept updates from a 4.1x supplier server. You must check this checkbox to activate the other fields in this window.
+<b>Enable Legacy Consumer. </b> Select this checkbox if you want this Directory Server to act as a legacy consumer. This means that this server can accept updates from a 4.1x supplier server. You must check this checkbox to activate the other fields in this window.
 </p>
 
 <p class="text">


Index: configtab_replication2.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_replication2.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- configtab_replication2.html	20 Nov 2007 17:35:08 -0000	1.2
+++ configtab_replication2.html	3 Mar 2009 00:13:59 -0000	1.3
@@ -3,11 +3,11 @@
 </p>
 
 <p class="text">
-Use this tab to configure a server as a supplier server. You must specify supplier attributes on any server that holds the master copy of a directory database.
+Use this tab to configure a server as a supplier server.  This applies to any server which supplies updates to another server, whether the server is one of several masters, a single master, or a read-only hub.
 </p>
 
 <p class="text">
-<b>Enable Changelog. </b>Check this box if you want this server to record all update operations in a change log so that these changes can be replayed on a consumer server.
+<b>Enable Changelog. </b>A supplier server must keep track of changes that it needs to replay to other servers.  The database that keeps track of these changes is called the <b>Changelog</b> database.  Check this box if you want this server to record all update operations in a change log so that these changes can be replayed on a consumer server.
 </p>
 
 <p class="text">


Index: configtab_replication3.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_replication3.html,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- configtab_replication3.html	26 Feb 2009 17:49:06 -0000	1.3
+++ configtab_replication3.html	3 Mar 2009 00:13:59 -0000	1.4
@@ -24,7 +24,7 @@
 </p>
 
 <p class="text">
-<b>Hub. </b>Select this radio button if you want this Directory Server to accept updates from a supplier server, and replicate changes to consumer servers.
+<b>Hub. </b>Select this radio button if you want this Directory Server to accept updates from one or more supplier server, and replicate changes to consumer servers.  Except for replicated operations from suppliers, a hub can service search operations but not update operations. Update operations will be referred to a supplier server.
 </p>
 
 <p class="text">
@@ -42,15 +42,15 @@
 </p>
 
 <p class="text">
-If the ID is incorrect, the field labels turn red and the Save button is disabled. Dedicated Consumer does not require Replica ID.
+If the ID is incorrect, the field labels turn red and the Save button is disabled. Hub and Dedicated Consumer do not require Replica ID.
 </p>
 
 <p class="text">
-<b>Purge delay.</b> The delay you specify in these fields determines how often the state information stored in the replicated entries is purged. Check the Never checkbox if you want to save this information indefinitely.
+<b>Purge delay. </b>The delay you specify in these fields determines how long the server keeps replication state information in the database before it is purged.  A longer time means that the risk of needing to perform a replication re-initialization is lower, but you will need more disk space to store the extra data and more memory to cache the extra data.  A shorter time means the risk of needing to perform a replication re-initializtion is higher, but you will need less disk space and memory.  Check the Never checkbox if you want to save this information indefinitely.  
 </p>
 
 <p class="text">
-<b>Updatable by a 4.x Replica.</b> Check this checkbox if you want this Directory Server to act as a legacy consumer of a 4.x supplier server.
+<b>Updatable by a 4.x Replica. </b>Check this checkbox if you want this Directory Server to act as a legacy consumer of a 4.x supplier server.
 </p>
 </ul>
 
@@ -60,10 +60,10 @@
 
 <ul>
 <p class="text">
-<b>Current Supplier DNs.</b> This field lists the supplier bind DNs that supplier servers must use to update this replica. You can now specify multiple supplier bind DNs per replica, but only one supplier DN per replication agreement. Use the "<b>Enter a new Supplier DN</b>" field to specify a new supplier DN and click Add to add it to this list. If you have configured replication over SSL, specify the DN of the entry that contains the supplier's certificate in the "<b>Enter a new Supplier DN</b>" field and click Add to add it to this list.
+<b>Current Supplier DNs. </b>This field lists the supplier bind DNs that supplier servers must use to update this replica. You can specify multiple supplier bind DNs per replica, but only one supplier DN per replication agreement. Use the "<b>Enter a new Supplier DN</b>" field to specify a new supplier DN and click Add to add it to this list. If you have configured replication over SSL, specify the DN of the entry that contains the supplier's certificate in the "<b>Enter a new Supplier DN</b>" field and click Add to add it to this list.
 </p>
 
 <p class="text">
-<b>Current URLs for referrals (Optional).</b> Directory Server uses the information contained in the replication agreement to create referrals from the consumer server to the appropriate supplier servers. This field lists the URLs you specify in addition to the automatic URLs which will be set up automatically. If you want the consumer to return an <code>ldaps://</code> URL, so that clients will bind to the supplier servers using SSL, enter the URL in the "Enter a new URL" field and click Add to add it to this list of current URLs. In the same way, if you have a cascading replication scenario and you want the referral returned to clients to point to the original supplier instead of the hub supplier, enter the corresponding URL in the "Enter a new URL" field and click Add to add it to this list of current URLs.
+<b>Current URLs for referrals (Optional). </b>Directory Server uses the information contained in the replication agreement to create referrals from the consumer server to the appropriate supplier servers. This field lists the URLs you specify in addition to the automatic URLs which will be set up automatically. If you want the consumer to return an <code>ldaps://</code> URL, so that clients will bind to the supplier servers using SSL, enter the URL in the "Enter a new URL" field and click Add to add it to this list of current URLs. In the same way, if you have a cascading replication scenario and you want the referral returned to clients to point to the original supplier instead of the hub supplier, enter the corresponding URL in the "Enter a new URL" field and click Add to add it to this list of current URLs.
 </p>
 </ul>


Index: configtab_replication6.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_replication6.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- configtab_replication6.html	13 Aug 2007 22:28:09 -0000	1.1
+++ configtab_replication6.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -3,39 +3,73 @@
 </p>
 
 <p class="text">
-Use the Connection tab to display the type of connection used by your replica during replication. You can use this tab to modify the user bind name and password. You cannot change the connection type. To change the connection type, re-create the replication agreement.
+Use the Connection tab to display and configure the type of connection and authentication used by your replica during replication.   You cannot change the connection type to or from "Use TLS/SSL (TLS/SSL encryption with LDAPS)" since this would require changing the port number.  If you want to do this, re-create the agreement.
 </p>
 
 <p class="text">
-<b>Using Encrypted SSL Connection. </b>When selected, specifies that the supplier and consumer servers use SSL for secure communication.
+<b>Use LDAP (no encryption). </b>If you want the supplier and consumer servers to use plain LDAP with no security, select this radio button.  This option must be selected to use SASL/GSSAPI authentication (see below).
 </p>
 
 <p class="text">
-<b>SSL Client Authentication. </b>When selected, this option specifies that the supplier and consumer servers use certificates for secure communication. SSL client authentication is not used unless the "Using Encrypted SSL Connection" checkbox is selected. The Bind As and Password fields are unavailable with this option because the server will use its security certificate to authenticate to the consumer server.
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the supplier and consumer servers to use TLS/SSL for secure communication using LDAPS, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
 </p>
 
 <p class="text">
-To select this option, you must first do the following:
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the supplier and consumer servers to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
+</p>
+
+<p class="text">
+<b>Authentication Mechanism</b>
+</p>
+
+<p class="text">
+<b>Server TLS/SSL Certificate (requires TLS/SSL server set up). </b>Select this option if you want the supplier to use its TLS/SSL server certificate for authentication. You cannot use certificate authentication unless the "Use TLS/SSL" or the "Use StartTLS" radio button in the Connection section is selected. Otherwise, this option will be disabled.  The "Bind As" and Password fields are unavailable with this option because the server will use its certificate to authenticate.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
+</p>
+
+<ul>
+<li>
+Configure TLS/SSL for both your supplier and consumer servers.
+</li>
+
+<li>
+Configure your consumer server to recognize your supplier server's certificate as the supplier DN (certificate mapping).
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/GSSAPI (requires Kerberos keytab). </b>Select this option if you want the supplier to use its Kerberos server credentials for authentication.  You must have the "Use LDAP" radio button in the Connection section selected.  Otherwise, this option sill be disabled.  Note that SASL/GSSAPI will use an encrypted channel, so TLS/SSL is not needed with this option.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
 </p>
 
 <ul>
 <li>
-Configure SSL for both your supplier and consumer server.
+Configure Kerberos for both your supplier and consumer servers and assign each one a Kerberos server keytab.
 </li>
 
 <li>
-Configure your consumer server to recognize your supplier server's certificate as the supplier DN.
+Configure a SASL mapping on your consumer server to map the supplier's server Kerberos principal to a supplier DN.
 </li>
 </ul>
 
 <p class="text">
-<b>Simple Authentication. </b>When selected, this option specifies that the supplier and consumer servers use simple authentication during communication.
+<b>SASL/DIGEST-MD5 (SASL user id and password). </b>Select this option if you want the supplier to use SASL/Digest-MD5 authentication.  This option requires a SASL user id and password.  You specify them in the Bind As and Password fields (see below).  You must configure the consumer server with the appropriate SASL mapping to use this option.
+</p>
+
+<p class="text">
+<b>Simple Authentication. </b>Select this option if you want the supplier to use simple authentication during communication. You can choose "Use SSL/TLS" or "Use StartTLS" if you want the simple authentication to take place over a secure channel but without certificates.
 </p>
 
 <p class="text">
-<b>Bind As. </b>You can update the supplier bind DN in the Bind As text box.
+<b>Bind As. </b>If you are using Simple or SASL/DIGEST-MD5 authentication, enter the supplier bind DN or SASL user id defined on the consumer server in the Bind As text box.
 </p>
 
 <p class="text">
-<b>Password. </b>You can update the password corresponding to the supplier bind DN in the Password field.
+<b>Password. </b>Enter the password for the Supplier DN or SASL user id in the Password field.
 </p>


Index: configtab_replication7.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_replication7.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- configtab_replication7.html	13 Aug 2007 22:28:09 -0000	1.1
+++ configtab_replication7.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -7,9 +7,9 @@
 </p>
 
 <p class="text">
-<b>Host Name. </b>Enter the host name of the supplier or consumer server as appropriate.
+<b>Host Name. </b>Enter the host name of the consumer server.  If you are using TLS/SSL or SASL/GSSAPI, you should use a fully qualified host and domain name.  Make sure the host name you use will resolve correctly on both the supplier and consumer server.
 </p>
 
 <p class="text">
-<b>Port Number. </b>Enter the port number of the supplier or consumer server as appropriate.
+<b>Port Number. </b>Enter the port number of the supplier or consumer server as appropriate.  If you are using TLS/SSL over LDAPS, you must enter the secure LDAPS port number (default 636).  Otherwise, enter the regular LDAP port number (default 389).
 </p>


Index: configtab_synchronization3.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/configtab_synchronization3.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- configtab_synchronization3.html	13 Aug 2007 22:28:09 -0000	1.1
+++ configtab_synchronization3.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -3,15 +3,19 @@
 </p>
 
 <p class="text">
-Use the Connection tab to display the type of connection used by your servers during synchronization. You can use this tab to modify the user bind name and password. You cannot change the connection type since this would require changing the port number.  To change the connection type, re-create the synchronization agreement.
+Use the Connection tab to display the type of connection used by your servers during synchronization. You can use this tab to modify the user bind name and password. You cannot change the connection type to or from "Use TLS/SSL (TLS/SSL encryption with LDAPS)" since this would require changing the port number.  If you want to do this, re-create the synchronization agreement.
 </p>
 
 <p class="text">
-<b>Using Encrypted SSL Connection. </b>When selected, specifies that the supplier and consumer servers use SSL for secure communication.
+<b>Use LDAP (no encryption). </b>If you want the directory server to use plain LDAP with no security to connect to Windows, select this radio button.
 </p>
 
 <p class="text">
-<b>SSL Client Authentication. </b>Client authentication is no used for synchronization; this option is ignored if selected.
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the directory server to use TLS/SSL for secure communication using LDAPS to connect to Windows, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
+</p>
+
+<p class="text">
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the directory server to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
 </p>
 
 <p class="text">
@@ -25,3 +29,12 @@
 <p class="text">
 <b>Password. </b>You can update the password corresponding to the bind DN in the Password field.
 </p>
+
+<p class="text">
+<b>New Windows User Sync </b>Check this checkbox if you want to add new Windows users automatically to the Directory Server.
+</p>
+
+<p class="text">
+<b>New Windows Group Sync </b>Check this checkbox if you want to add new Windows groups automatically to the Directory Server.
+</p>
+


Index: replication_wizard.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/replication_wizard.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- replication_wizard.html	20 Nov 2007 17:35:08 -0000	1.2
+++ replication_wizard.html	3 Mar 2009 00:13:59 -0000	1.3
@@ -7,7 +7,7 @@
 </p>
 
 <p class="text">
-<b>Supplier. </b>This field contains a static display of the name and port number of the supplier server in this agreement.
+<b>Supplier. </b>This field contains a static display of the name and port number of the supplier server in this agreement. <b>NOTE:</b> This field is only used for naming purposes.  If you have chosen to perform replication using TLS/SSL with LDAPS, using the secure port, the <b>Supplier</b> field may still display the non-secure port number - this is ok.  Please refer to the Connection and Authentication values below to see if the connection is really using TLS/SSL or not.
 </p>
 
 <p class="text">
@@ -20,11 +20,25 @@
 
 <ul>
 <p class="text">
-<b>Using Encrypted SSL Connection. </b>If you want the supplier and consumer servers to use SSL for secure communication, select this checkbox. To use this option, you must have first configured your servers to use SSL.
+<b>Use LDAP (no encryption). </b>If you want the supplier and consumer servers to use plain LDAP with no security, select this radio button.  This option must be selected to use SASL/GSSAPI authentication (see below).
 </p>
 
 <p class="text">
-<b>SSL Client Authentication. </b>Select this option if you want the supplier and consumer servers to use certificates for secure communication. You cannot use SSL client authentication unless the "Using Encrypted SSL Connection" checkbox is selected. The "Bind As" and Password fields are unavailable with this option because the servers will use security certificates to authenticate to each other.
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the supplier and consumer servers to use TLS/SSL for secure communication using LDAPS, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
+</p>
+
+<p class="text">
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the supplier and consumer servers to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
+</p>
+
+</ul>
+<p class="text">
+<b>Authentication Mechanism</b>
+</p>
+
+<ul>
+<p class="text">
+<b>Server TLS/SSL Certificate (requires TLS/SSL server set up). </b>Select this option if you want the supplier to use its TLS/SSL server certificate for authentication. You cannot use certificate authentication unless the "Use TLS/SSL" or the "Use StartTLS" radio button in the Connection section is selected. Otherwise, this option will be disabled.  The "Bind As" and Password fields are unavailable with this option because the server will use its certificate to authenticate.
 </p>
 
 <p class="text">
@@ -33,24 +47,46 @@
 
 <ul>
 <li>
-Configure SSL for both your supplier and consumer servers.
+Configure TLS/SSL for both your supplier and consumer servers.
 </li>
 
 <li>
-Configure your consumer server to recognize your supplier server's certificate as the supplier DN.
+Configure your consumer server to recognize your supplier server's certificate as the supplier DN (certificate mapping).
 </li>
 </ul>
 
 <p class="text">
-<b>Simple Authentication. </b>Select this option if you want the supplier and consumer servers to use simple authentication during communication. If you select the "Using Encrypted SSL Connection" checkbox and you specify this option, the simple authentication will take place over a secure channel but without certificates.
+<b>SASL/GSSAPI (requires Kerberos keytab). </b>Select this option if you want the supplier to use its Kerberos server credentials for authentication.  You must have the "Use LDAP" radio button in the Connection section selected.  Otherwise, this option sill be disabled.  Note that SASL/GSSAPI will use an encrypted channel, so TLS/SSL is not needed with this option.
+</p>
+
+<p class="text">
+To use this option, you must first do the following:
+</p>
+
+<ul>
+<li>
+Configure Kerberos for both your supplier and consumer servers and assign each one a Kerberos server keytab.
+</li>
+
+<li>
+Configure a SASL mapping on your consumer server to map the supplier's server Kerberos principal to a supplier DN.
+</li>
+</ul>
+
+<p class="text">
+<b>SASL/DIGEST-MD5 (SASL user id and password). </b>Select this option if you want the supplier to use SASL/Digest-MD5 authentication.  This option requires a SASL user id and password.  You specify them in the Bind As and Password fields (see below).  You must configure the consumer server with the appropriate SASL mapping to use this option.
+</p>
+
+<p class="text">
+<b>Simple Authentication. </b>Select this option if you want the supplier to use simple authentication during communication. You can choose "Use SSL/TLS" or "Use StartTLS" if you want the simple authentication to take place over a secure channel but without certificates.
 </p>
 
 <p class="text">
-<b>Bind As. </b>If you are not using SSL, or you are using SSL with simple authentication, enter the supplier bind DN defined on the consumer server in the Bind As text box.
+<b>Bind As. </b>If you are using Simple or SASL/DIGEST-MD5 authentication, enter the supplier bind DN or SASL user id defined on the consumer server in the Bind As text box.
 </p>
 
 <p class="text">
-<b>Password. </b>If you are not using SSL, or you are using SSL with simple authentication, enter the Supplier DN password in the Password field.
+<b>Password. </b>Enter the password for the Supplier DN or SASL user id in the Password field.
 </p>
 </ul>
 


Index: replication_wizard5.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/replication_wizard5.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- replication_wizard5.html	13 Aug 2007 22:28:09 -0000	1.1
+++ replication_wizard5.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -7,7 +7,7 @@
 </p>
 
 <p class="text">
-<b>Name. </b>Enter a meaningful name for the replication agreement. This field is required.
+<b>Name. </b>Enter a meaningful name for the replication agreement. This field is required.  This field will be used to create the name of the configuration entry (the CN value), so it's better to choose something short yet meaningful and without a lot of special characters.
 </p>
 
 <p class="text">


Index: synchronization_wizard1.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/synchronization_wizard1.html,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- synchronization_wizard1.html	13 Aug 2007 22:28:09 -0000	1.1
+++ synchronization_wizard1.html	3 Mar 2009 00:13:59 -0000	1.2
@@ -7,7 +7,7 @@
 </p>
 
 <p class="text">
-<b>Name. </b>Enter a meaningful name for the synchronization agreement. This field is required.
+<b>Name. </b>Enter a meaningful name for the agreement. This field is required.  This field will be used to create the name of the configuration entry (the CN value), so it's better to choose something short yet meaningful and without a lot of special characters.
 </p>
 
 <p class="text">


Index: synchronization_wizard2.html
===================================================================
RCS file: /cvs/dirsec/directoryconsole/help/en/help/synchronization_wizard2.html,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- synchronization_wizard2.html	20 Nov 2007 17:35:08 -0000	1.2
+++ synchronization_wizard2.html	3 Mar 2009 00:13:59 -0000	1.3
@@ -36,11 +36,11 @@
 </p>
 
 <p class="text">
-<b>Domain Controller Host. </b>This is the hostname of the domain controller in the Windows domain you wish to use for sync operations. This name must be resolvable and, if SSL is being used, must match the CN of the certificate issued to the domain controller. That is normally the fully qualified DNS name. For example: <span style="font-family: courier new,courier,monospace;">dc01.example.com</span>
+<b>Domain Controller Host. </b>This is the hostname of the domain controller in the Windows domain you wish to use for sync operations. This name must be resolvable and, if TLS/SSL (StartTLS or LDAPS) is being used, must match the CN of the certificate issued to the domain controller. That is normally the fully qualified DNS name. For example: <span style="font-family: courier new,courier,monospace;">dc01.example.com</span>
 </p>
 
 <p class="text">
-<b>Port Num. </b>The Windows domain controller port number. By default, this is 389; this is automatically reset to 636 if you check the "Using encrypted SSL connection" checkbox (even if you had previously set a different value).
+<b>Port Num. </b>The Windows domain controller port number. By default, this is 389; this is automatically reset to 636 if you check the "Use TLS/SSL (TLS/SSL encryption with LDAPS)." checkbox (even if you had previously set a different value).  It is better to choose the connection type first, then change this port number field if necessary.
 </p>
 </ul>
 
@@ -50,11 +50,19 @@
 
 <ul>
 <p class="text">
-<b>Using Encrypted SSL Connection. </b>If you want the Directory Server and Windows servers to use SSL for secure communication, select this checkbox. To use this option, you must have first configured your servers to use SSL. It is strongly recommended that you use an SSL connection. Passwords will not be synchronized if you do not enable SSL.
+<b>Use LDAP (no encryption). </b>If you want the supplier and consumer servers to use plain LDAP with no security, select this radio button.
 </p>
 
 <p class="text">
-<b>Bind As. </b>Enter the supplier bind DN defined on the Windows server in the Bind As text box. This must be a valid DN.
+<b>Use TLS/SSL (TLS/SSL encryption with LDAPS). </b><b>Deprecated.</b>  If you want the supplier and consumer servers to use TLS/SSL for secure communication using LDAPS, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.  <b>This is Deprecated - use StartTLS instead.</b>
+</p>
+
+<p class="text">
+<b>Use StartTLS (TLS/SSL encryption with LDAP). </b>If you want the supplier and consumer servers to use TLS/SSL for secure communication using StartTLS to start an encrypted channel using LDAP, select this radio button. To use this option, you must have first configured your servers to use TLS/SSL.
+</p>
+
+<p class="text">
+<b>Bind As. </b>Enter the supplier bind DN defined on the Windows server in the Bind As text box. This must be a valid DN.  This user must be able to read, write, and use the DirSync control in the specified subtree.
 </p>
 
 <p class="text">


