IBM Verify Directory: Seed

This page documents the YAML schema which can be used to configure a Verify Directory Seed container.

The value of each YAML key entry can be provided in the YAML file as either plain text, base-64 encoded text (prefix: 'B64:'), retrieved from an environment variable (prefix: '$'), loaded from a local file (prefix: '@'), retrieved from a Kubernetes secret (format: secret:{name}/{field}), or retrieved from a Kubernetes ConfigMap (format: configmap:{name}/{field}).

In addition to this, each of the YAML keys can also be provided as an environment variable, using a normalized value of the key name as the environment variable name. For example, to skip the creation of indexes during a migration operation the following environment variable can be set: 'seed.migrate.skip-index'.

ℹ️ Click on section headers below to expand and view configuration details.

Configuration

▼

debug object

▼

The configuration entries which can be used to enable debugging within the container.

⚙️ Properties
startup boolean

A boolean which is used to indicate whether debugging should be
enabled while bootstrapping the container.

Default: False
runtime number

Specifies the debug level to assign to the runtime. The value is a bit mask that controls which output is generated, with values from 1 to 65535.

Default: 0
Validation Constraints:
• Minimum: 0
• Maximum: 65535

general object

▼

The general configuration elements of the container.

⚙️ Properties
admin object
▼

The credential information of the server. This object is only used when the seed container is performing a migration of data and is ignored if the seed container is copying replica data.

⚙️ Properties
dn string

The distinguished name of the user for the created LDAP instance.

Default: cn=root
pwd string

The password of the user for the created LDAP instance. This field is only required when using the seed container to migrate data.

key-stash string

The contents of the key stash file (.ksf) which is used to protect data. This file should be provided if the seed container is being used to migrate data and cryptographic synchronisation is required. The key stash can either be obtained from a software based directory server installation, or a new one can be generated by starting this image with the 'keystash' argument. For example: 'docker run --rm icr.io/isvd/verify-directory-seed:latest keystash'. Please note that this will send a base-64 encoded version of the key stash to the console of the container.

license object required
▼
⚙️ Properties
key string required

The license key, required to run the container.

accept string required

Which license agreement has been accepted, either 'limited' or 'standard' or 'enterprise'. To display a license agreement start the container with the 'license' command, for example: 'docker run --rm icr.io/isvd/verify-directory-seed:latest license standard'

Allowed values:
limited standard enterprise
json-logging boolean

Whether the logging and auditing messages should be formatted in JSON or not. Note that debug messages will not be formatted in JSON.

Default: False

pwd-policy object

▼

The configuration entries associated with the password policy which is enforced by the server.

⚙️ Properties
enabled boolean

Indicates if the IBM Administrative Password Policy is ON.

Default: True
failure-count-interval number

Specifies the number of seconds after which the password failures are purged from the failure counter, even though no successful authentication occurred.

Default: 0
lockout boolean

Enables replication of security attributes between master and read-only replica so that password policy for account lockout can be strongly enforced in replication topologies.

Default: True
lock-duration number

Specifies the number of seconds that the password cannot be used to authenticate due to too many failed bind attempts.

Default: 300
max-consecutive-repeated-chars number

Specifies the maximum number of consecutive repeated characters in the password field.

Default: 2
max-failures number

Specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate.

Default: 10
max-repeated-chars number

Specifies the maximum number of repeated characters allowed.

Default: 2
min-alpha-chars number

Specifies the minimum number of characters required for a users password.

Default: 2
min-diff-chars number

Specifies the minimum number of different (unique) characters required for a users password.

Default: 2
min-length number

Specifies the minimum number of characters that must be used in a password.

Default: 8
min-other-chars number

Specifies the minimum number of other characters required.

Default: 2
advanced object
▼

The configuration entries associated with rules for advanced password syntax checking.

⚙️ Properties
no-spaces boolean

Specifies whether the password can contain spaces.

no-user-id boolean

Specifies that the password cannot be the same, or contain the value of the configured login attribute. The login attribute is configured by using the login-attribute configuration entry. It is set to the name of the LDAP attribute, such as UID that is used as the user ID attribute for users. Note: Enabling this rule might have a performance impact on the user password update operation. To process this rule, an internal search is done on the user to obtain the value of the login attribute. It then checks whether the specified password is the same, or contains the value of the login attribute.

login-attribute string

The name of the attribute which contains the user identity. This is used by the no-user-id rule.

min-special-chars number

Specifies the minimum number of special characters that a password must contain.

min-numeric-chars number

Specifies the minimum number of numeric characters that a password must contain.

min-lowercase-chars number

Specifies the minimum number of lowercase characters that a password must contain.

min-uppercase-chars number

Specifies the minimum number of uppercase characters that a password must contain.

max-asc-chars number

Specifies the maximum number of ascending characters that a password can contain. The characters can be alphabetic or numeric.

max-dsc-chars number

Specifies the maximum number of descending characters that a password can contain. The characters can be alphabetic or numeric.

custom-policy-script string

Specifies a custom password policy written in the Lua scripting language.

Examples:
Example 1
general:
  pwd-policy:
    enabled: true
    lockout: false
    lock-duration: 1800
    max-failures: 5
    min-length: 5
    failure-count-interval: 0
    max-consecutive-repeated-chars: 2
    max-repeated-chars: 2
    min-alpha-chars: 2
    min-diff-chars: 2
    min-other-chars: 2

schemas array

▼

Any additional schema files (.ot or .at) which will be added to the server. The schema files specified here can also be used to replace the IBM Verify Directory standard schema files. Please note however that if you supply a schema file in the YAML this schema should not be subsequently modified using an LDAP modify operation, otherwise the updates will be lost when the container next starts.

📋 Array Items
Type: string

The name of a schema file (.ot or .at). The file must exist within the container file system.

Examples:
Example 1
general:
  schemas:
  - /volume/data/custom.at
  - /volume/data/custom.oc
  - /volume/data/V3.ibm.at
Examples:
Example 1
general:
  license:
    key: VGVzdDotMTowOjCCAaQG...
    accept: standard
  key-stash: B64:GAAAAHM1Q2lqMC...
  admin:
    pwd: passw0rd1

seed object

▼

The configuration entries associated with the seed container, used to seed a container environment with data.

⚙️ Properties

migrate object

▼

The configuration entries associated with the seed container when performing a migration.

⚙️ Properties
suffixes array
▼

An array of strings, used to designate the custom suffixes which are being migrated.

📋 Array Items
Type: string

A custom suffix which is to be migrated.

version string

The version of the directory server from which the seed data was obtained. If no version information is supplied it is assumed that the seed data has been obtained from the current version of the directory server.

process-acls boolean

Specifies whether to process the ACL information that is contained in the LDIF file. If set to false the default ACL is used.

Default: True
skip-index boolean

Controls whether the index should be created or not.

Default: False
drop-index boolean

Controls whether the existing index is dropped before the load operation starts.

Default: False
strip-trailing-spaces boolean

Controls whether trailing spaces are stripped in attribute values.

Default: True
add-group-members boolean

Controls whether members are added to existing static groups. This must not be set to true if a value has been supplied for the parse-load-cycle-size entry.

Default: False
parse-load-cycle-size number

Specifies the number of entries to process in one parse-load cycle. If a value is not supplied all of the entries will be loaded in a single cycle. This must not be set if the add-group-members entry has been set to true.

string-delimiter string

Specifies the string delimiting character that is used for importing.

Default: |
translate-data boolean

Specifies whether to translate entry data to database code page. Note: This parameter is necessary only when you use a database other than UTF-8.

Default: False
verify-definitions boolean

Verifies whether the directory entries are valid based on the object class definitions and attribute type definitions in the configuration files. Schema checking verifies that all object classes and attributes are defined. It also checks whether the attributes that are specified for each entry comply with the list of required and allowed attributes in the object class definition. Also verifies whether the binary attribute values are in the correct 64-bit encoded form.

Default: False
Examples:
Example 1
seed:
  migrate:
    suffixes:
    - dc=com

replica object

▼

The configuration entries associated with the seed container when initialising a new replica.

⚙️ Properties
clean boolean

Specifies whether to attempt to clean out any existing data from the '/var/isvd/data' directory prior to setting up the replica.

Default: False
Examples:
Example 1
seed:
  replica:
    clean: true
conf-to-yaml boolean

Specifies whether to migrate ibmslapd.conf file to YAML.

Default: False
Examples:
Example 1
seed:
  migrate:
    suffixes:
    - dc=com
Example 2
seed:
  replica:
    clean: true
Example 3
seed:
  conf-to-yaml: true

Examples

▼
Example 1
general:
  license:
    key: VGVzdDotMTowOjCCAaQG...
    accept: standard
seed:
  migrate:
    suffixes:
    - dc=com
Copyright IBM Corp. 2026