This topic describes security-related settings in LDAP that cannot be modified using APIs, the administration console, or provided command-line tools. Security-related settings are provided in Horizon LDAP. If you have full administrative privileges, you can use an LDAP editor such as the ADSI Edit utility to change the value of these settings on a connection broker instance. The change propagates automatically to all other connection broker instances in a cluster.
| Attribute | Description |
|---|---|
pae-AgentLogCollectionDisabled | This setting can be used to prevent downloading of DCT archives from Horizon Agents, using either APIs or the administration console. Log collection is still possible from Connection Servers in Horizon 8 environments. Set to 1 to deactivate agent log collection. |
pae-DisallowEnhancedSecurityMode |
Note: This attribute can be set only if the Connection Server has been installed in FIPS mode.
This setting can be used in FIPS mode to prevent the use of Enhanced message security. Once this is set to 1, the Horizon 8 environment begins the transition to Enabled message security mode automatically. Setting this attribute back to 0 or removing it allows Enhanced message security to be chosen once more, but does not trigger an automatic transition. Note: This setting is a prerequisite for deactivating automatic certificate management. See pae-noManagedCertificate. |
pae-enableDbSSL | If you configure an Event Database, the connection is not protected by TLS by default. Set this attribute to 1 to enable TLS on the connection. |
pae-managedCertificateAdvanceRollOver | For auto-managed certificates, this attribute can be set to force certificates to be renewed before they expire. Specify the number of days in advance of the expiry date that this should be done. The maximum period is 90 days. If not specified, this setting defaults to 0 days, and so roll-over happens at expiry. |
pae-MsgSecOptions |
This is a multi-valued attribute where each value is itself a name-value pair (for example, course=fish).
Warning: When adding or modifying a name-value pair, be very careful not to remove other values.
Currently the only name-value pair that can be set is keysize. This specifies the length of the DSA message signing key. If not specified, it defaults to 512 bits.
|
pae-noManagedCertificate |
This setting can be used in FIPS mode to deactivate automatic certificate management. When set to 0 or not set, the Machine Identity (“vdm”) certificate must be CA signed but others need not be. When set to 1, all certificates must be CA signed and admin-managed; certificates are no longer renewed automatically and self-signed certificates in the certificate stores are ignored.
NOTE: This setting is not compatible with Enhanced message security. Before setting to 1, you must switch message security to Enabled. NOTE: In a CPA configuration, inter-pod communication will use the Cluster Identity certificate (“vdm.ec”). All Connection Servers in the federation should trust the issuer of the Cluster Identity certificate for all other pods. |
pae-SSLCertificateSignatureAlgorithm |
This specifies the certificate signature algorithm to use for auto-managed certificates. If not specified, it defaults to rsa_pkcs1_sha384.
For more examples see Default Global Policies for Security Protocols and Cipher Suites. |
Was this page helpful?