Tools Reference

You can find bundle tools under the folder where you installed OpenDJ directory server as listed in "Command-Line Tools" in the Administration Guide.

backendstat(1)

Name

backendstat - gather OpenDJ backend debugging information

Synopsis

backendstat {subcommand} {options}

Description

This utility can be used to debug a backend.

Options

The backendstat command takes the following options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Subcommands

The backendstat command supports the following subcommands:

backendstat dump-index

Dump records from an index, decoding keys and values. Depending on index size, this subcommand can generate lots of output.

Options

-n | --backendID {backendName}: The backend ID of the backend.
-b | --baseDN {baseDN}: The base DN within the backend.
-i | --indexName {indexName}: The name of the index.
-q | --statsOnly: Do not display backend data, just statistics.

Default: false
-K | --maxKeyValue {maxKeyValue}: Only show records with keys that should be ordered before the provided value using the comparator for the database container.
-k | --minKeyValue {minKeyValue}: Only show records with keys that should be ordered after the provided value using the comparator for the database container.
-X | --maxHexKeyValue {maxKeyValue}: Only show records with keys that should be ordered before the provided value using the comparator for the database container.
-x | --minHexKeyValue {minKeyValue}: Only show records with keys that should be ordered after the provided value using the comparator for the database container.
-S | --maxDataSize {maxDataSize}: Only show records whose data is no larger than the provided value.

Default: -1
-s | --minDataSize {minDataSize}: Only show records whose data is no smaller than the provided value.

Default: -1
-p | --skipDecode: Do not try to decode backend data to their appropriate types.

Default: false

backendstat dump-raw-db

Dump the raw records in hexadecimal format for a low-level database within the pluggable backend’s storage engine. Depending on index size, this subcommand can generate lots of output.

Options

-n | --backendID {backendName}: The backend ID of the backend.
-d | --dbName {databaseName}: The raw database name.
-q | --statsOnly: Do not display backend data, just statistics.

Default: false
-K | --maxKeyValue {maxKeyValue}: Only show records with keys that should be ordered before the provided value using the comparator for the database container.
-k | --minKeyValue {minKeyValue}: Only show records with keys that should be ordered after the provided value using the comparator for the database container.
-X | --maxHexKeyValue {maxKeyValue}: Only show records with keys that should be ordered before the provided value using the comparator for the database container.
-x | --minHexKeyValue {minKeyValue}: Only show records with keys that should be ordered after the provided value using the comparator for the database container.
-S | --maxDataSize {maxDataSize}: Only show records whose data is no larger than the provided value.

Default: -1
-s | --minDataSize {minDataSize}: Only show records whose data is no smaller than the provided value.

Default: -1
-l | --singleLine: Write hexadecimal data on a single line instead of pretty format.

Default: false

backendstat list-backends

List the pluggable backends.

backendstat list-base-dns

List the base DNs in a backend.

Options

-n | --backendID {backendName}: The backend ID of the backend.

backendstat list-indexes

List the indexes associated with a pluggable backend. This subcommand may take a long time to complete depending on the size of the backend.

Options

-n | --backendID {backendName}: The backend ID of the backend.
-b | --baseDN {baseDN}: The base DN within the backend.

backendstat list-raw-dbs

List the low-level databases within a pluggable backend’s storage engine. This subcommand may take a long time to complete depending on the size of the backend.

Options

-n | --backendID {backendName}: The backend ID of the backend.
-u | --useSIUnits: Uses SI Units for printing sizes.

Default: false

backendstat show-index-status

Shows the status of indexes for a backend base DN. This subcommand can take a long time to complete, as it reads all indexes for all backends.

<xinclude:include href="variablelist-backendstat-index-status.xml" />

Options

-n | --backendID {backendName}: The backend ID of the backend.
-b | --baseDN {baseDN}: The base DN within the backend.

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example displays index information.

$ bin/backendstat dump-index  -n userRoot -b dc=example,dc=com -i id2childrencount

    Key (len 2): 1#52
    Value (len 8): 1
    Key (len 2): 2#52
    Value (len 8): 500000
    Key (len 9): Total Children Count
    Value (len 8): 500001

    Total Records: 3
    Total / Average Key Size: 13 bytes / 4 bytes
    Total / Average Data Size: 24 bytes / 8 bytes

backup(1)

Name

backup - back up OpenDJ directory data

Synopsis

backup

Description

This utility can be used to back up one or more Directory Server backends.

Options

The backup command takes the following options:

Command options:

-a | --backUpAll: Back up all backends in the server.

Default: false
-A | --hash: Generate a hash of the backup contents.

Default: false
-B | --incrementalBaseID {backupID}: Backup ID of the source archive for an incremental backup.
-c | --compress: Compress the backup contents.

Default: false
-d | --backupDirectory {backupDir}: Path to the target directory for the backup file(s).
-i | --incremental: Perform an incremental backup rather than a full backup.

Default: false
-I | --backupID {backupID}: Use the provided identifier for the backup.
-n | --backendID {backendName}: Backend ID for the backend to archive.
--offline: Indicates that the command must be run in offline mode.

Default: false
-s | --signHash: Sign the hash of the backup contents.

Default: false
-y | --encrypt: Encrypt the backup contents.

Default: false

Task Backend Connection Options

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Task Scheduling Options

--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
1: An error occurred.

Examples

The following example backs up all user data while the server is online.

$ backup -p 4444 -D "cn=Directory Manager" -w password \
 -a -d /path/to/opendj/bak -t 0
Backup task 20110613143801866 scheduled to start ...

The following example schedules back up of all user data every night at 2 AM when the server is online, and notifies diradmin@example.com when finished, or on error.

$ backup -p 4444 -D "cn=Directory Manager" -w password -a \
 -d /path/to/opendj/bak --recurringTask "00 02 * * *" \
 --completionNotify diradmin@example.com --errorNotify diradmin@example.com
Recurring Backup task BackupTask-988d6adf-4d65-44bf-8546-6ea74a2480b0
scheduled successfully

The following example backs up all user data while the server is offline.

$ stop-ds
Stopping Server...
...

$ backup --backupAll --backupDirectory /path/to/opendj/bak
... msg=The backup process completed successfully

$ start-ds
... The Directory Server has started successfully

base64(1)

Name

base64 - encode and decode base64 strings

Synopsis

base64 {subcommand} {options}

Description

This utility can be used to encode and decode information using base64.

Options

The base64 command takes the following options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Subcommands

The base64 command supports the following subcommands:

base64 decode

Decode base64-encoded information into raw data. When no options are specified, this subcommand reads from standard input and writes to standard output.

Options

-d | --encodedData {data}: The base64-encoded data to be decoded.
-f | --encodedDataFile {path}: The path to a file containing the base64-encoded data to be decoded.
-o | --toRawFile {path}: The path to a file to which the raw base64-decoded data should be written.

base64 encode

Encode raw data using base64. When no options are specified, this subcommand reads from standard input and writes to standard output.

Options

-d | --rawData {data}: The raw data to be base64 encoded.
-f | --rawDataFile {path}: The path to a file containing the raw data to be base64 encoded.
-o | --toEncodedFile {path}: The path to a file to which the base64-encoded data should be written.

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following command shows the changes from the external change log in human-readable format.

$ base64 decode -d YWRkOiBkZXNjcmlwdGlvbgpkZXNjcmlwdGlvbjogQSB0aGlyZCBjaGFuZ2UK\
LQpyZXBsYWNlOiBtb2RpZmllcnNOYW1lCm1vZGlmaWVyc05hbWU6IGNuPURpcmVjdG9yeSBNYW5hZ2V\
yLGNuPVJvb3QgRE5zLGNuPWNvbmZpZwotCnJlcGxhY2U6IG1vZGlmeVRpbWVzdGFtcAptb2RpZnlUaW\
1lc3RhbXA6IDIwMTEwNjEzMDcxMjEwWgotCg==
add: description
description: A third change
-
replace: modifiersName
modifiersName: cn=Directory Manager,cn=Root DNs,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20110613071210Z
-

control-panel(1)

Name

control-panel - start the OpenDJ graphical admin interface

Synopsis

control-panel

Description

This utility can be used to display the Control Panel window which displays basic server information and allows to do some basic administration tasks on the server.

If no host name or port is provided, the tool will try to connect to the local server.

Options

The control-panel command takes the following options:

Command options:

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-r | --remote: Connect to a remote server.

Default: false

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-p | --port {port}: Directory server administration port number.

Default: 4444
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-X | --trustAll: Trust all server SSL certificates.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example starts the Control Panel on a remote host.

$ control-panel -r -h opendj.example.com -p 4444 &

create-rc-script(1)

Name

create-rc-script - script to manage OpenDJ as a service on UNIX

Synopsis

create-rc-script

Description

Create an RC script that may be used to start, stop, and restart the Directory Server on UNIX-based systems.

Options

The create-rc-script command takes the following options:

Command options:

-f | --outputFile {path}: The path to the output file to create.
-j | --javaHome {path}: The path to the Java installation that should be used to run the server.
-J | --javaArgs {args}: A set of arguments that should be passed to the JVM when running the server.
-u | --userName {userName}: The name of the user account under which the server should run.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example adds a script to start OpenDJ at boot time on a Debian-based system, and then updates the runlevel system to use the script.

$ sudo create-rc-script -f /etc/init.d/opendj -u opendj-user
$ sudo update-rc.d opendj

dsconfig(1)

Name

dsconfig - manage OpenDJ directory server configuration

Synopsis

dsconfig {subcommand} {options}

Description

This utility can be used to define a base configuration for the Directory Server.

The dsconfig command is the primary command-line tool for viewing and editing OpenDJ configuration. When started without arguments, dsconfig prompts you for administration connection information, including the host name, administration port number, administrator bind DN and administrator password. The dsconfig command then connects securely to the directory server over the administration port. Once connected it presents you with a menu-driven interface to the server configuration.

When you pass connection information, subcommands, and additional options to dsconfig, the command runs in script mode and so is not interactive, though it can prompt you to ask whether to apply changes and whether to trust certificates (unless you use the --no-prompt and --trustAll options, respectively).

You can prepare dsconfig batch scripts by running the tool with the --commandFilePath option in interactive mode, then reading from the batch file with the --batchFilePath option in script mode. Batch files can be useful when you have many dsconfig commands to run and want to avoid starting the JVM for each command. Alternatively, you can read commands from standard input by using the --batch option.

The dsconfig command categorizes directory server configuration into components, also called managed objects. Actual components often inherit from a parent component type. For example, one component is a Connection Handler. An LDAP Connection Handler is a type of Connection Handler. You configure the LDAP Connection Handler component to specify how OpenDJ directory server handles LDAP connections coming from client applications.

Configuration components have properties. For example, the LDAP Connection Handler component has properties such as listen-port and allow-start-tls. You can set the component’s listen-port property to 389 to use the default LDAP port number. You can set the component’s allow-start-tls property to true to permit LDAP client applications to use StartTLS. Much of the configuration you do with dsconfig involves setting component properties.

Options

The dsconfig command takes the following options:

Command options:

--batch: Reads from standard input a set of commands to be executed.

Default: false
--commandFilePath {path}: The full path to the file where the equivalent non-interactive commands will be written when this command is run in interactive mode.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
--displayCommand: Display the equivalent non-interactive argument in the standard output when this command is run in interactive mode.

Default: false
--help-all: Display all subcommands.

Default: false
--help-core-server: Display subcommands relating to core server.

Default: false
--help-database: Display subcommands relating to caching and back-ends.

Default: false
--help-logging: Display subcommands relating to logging.

Default: false
--help-replication: Display subcommands relating to replication.

Default: false
--help-security: Display subcommands relating to authentication and authorization.

Default: false
--help-service-discovery: Display subcommands relating to service discovery mechanism.

Default: false
--help-user-management: Display subcommands relating to user management.

Default: false

Configuration Options

--advanced: Allows the configuration of advanced components and properties.

Default: false

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-F | --batchFilePath {batchFilePath}: Path to a batch file containing a set of commands to be executed.
-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode.

Default: false
-s | --script-friendly: Use script-friendly mode.

Default: false
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Subcommands

The dsconfig command provides many subcommands.

Subcommands let you create, list, and delete entire configuration components, and also let you get and set component properties. Subcommands therefore have names that reflect these five actions.

create-component
list-components
delete-component
get-component-prop
set-component-prop

Here, component names are names of managed object types. Subcommand component names are lower-case, hyphenated versions of the friendly names. When you act on an actual configuration component, you provide the name of the component as an option argument. For example, the Log Publisher component has these corresponding subcommands.

create-log-publisher
list-log-publishers
delete-log-publisher
get-log-publisher-prop
set-log-publisher-prop

When you create or delete Log Publisher components and when you get and set their configuration properties, you provide the name of the actual log publisher, which you can find by using the list-log-publishers subcommand.

$ dsconfig \
 list-log-publishers \
 --hostname opendj.example.com \
 --port 4444 \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --trustAll

Log Publisher                 : Type                   : enabled
------------------------------:------------------------:--------
File-Based Access Logger      : file-based-access      : true
File-Based Audit Logger       : file-based-audit       : false
File-Based Debug Logger       : file-based-debug       : false
File-Based Error Logger       : file-based-error       : true
File-Based HTTP Access Logger : file-based-http-access : false
Replication Repair Logger     : file-based-error       : true

$ dsconfig \
 get-log-publisher-prop \
 --publisher-name "File-Based Access Logger" \
 --property rotation-policy \
 --hostname opendj.example.com \
 --port 4444 \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --trustAll
Property        : Value(s)
----------------:--------------------------------------------------------------
rotation-policy : 24 Hours Time Limit Rotation Policy, Size Limit Rotation
                : Policy

Many subcommands let you set property values. Notice in the reference for the subcommands below that specific options are available for handling multi-valued properties. Whereas you can assign a single property value by using the --set option, you assign multiple values to a multi-valued property by using the --add option. You can reset the values of the multi-valued property by using the --reset option. Some property values take a time duration. Durations are expressed as numbers followed by units. For example 1 s means one second, and 2 w means two weeks. Some durations have minimum granularity or maximum units, so you cannot necessary specify every duration in milliseconds or weeks for example. Some durations allow you to use a special value to mean unlimited. Units are specified as follows.

ms: milliseconds
s: seconds
m: minutes
h: hours
d: days
w: weeks

Use the following options to view help for subcommands.

dsconfig --help-all: Display all subcommands
dsconfig --help-core-server: Display subcommands relating to core server
dsconfig --help-database: Display subcommands relating to caching and back-ends
dsconfig --help-logging: Display subcommands relating to logging
dsconfig --help-replication: Display subcommands relating to replication
dsconfig --help-security: Display subcommands relating to authentication and authorization
dsconfig --help-user-management: Display subcommands relating to user management

For help with individual subcommands, either use dsconfig subcommand --help, or start dsconfig in interactive mode, without specifying a subcommand.

To view all component properties, use the dsconfig list-properties command.

The dsconfig command supports the following subcommands:

dsconfig create-access-log-filtering-criteria: Creates Access Log Filtering Criteria
dsconfig create-account-status-notification-handler: Creates Account Status Notification Handlers
dsconfig create-alert-handler: Creates Alert Handlers
dsconfig create-backend: Creates Backends
dsconfig create-backend-index: Creates Backend Indexes
dsconfig create-backend-vlv-index: Creates Backend VLV Indexes
dsconfig create-certificate-mapper: Creates Certificate Mappers
dsconfig create-connection-handler: Creates Connection Handlers
dsconfig create-debug-target: Creates Debug Targets
dsconfig create-entry-cache: Creates Entry Caches
dsconfig create-extended-operation-handler: Creates Extended Operation Handlers
dsconfig create-group-implementation: Creates Group Implementations
dsconfig create-http-authorization-mechanism: Creates HTTP Authorization Mechanisms
dsconfig create-http-endpoint: Creates HTTP Endpoints
dsconfig create-identity-mapper: Creates Identity Mappers
dsconfig create-key-manager-provider: Creates Key Manager Providers
dsconfig create-log-publisher: Creates Log Publishers
dsconfig create-log-retention-policy: Creates Log Retention Policies
dsconfig create-log-rotation-policy: Creates Log Rotation Policies
dsconfig create-monitor-provider: Creates Monitor Providers
dsconfig create-password-generator: Creates Password Generators
dsconfig create-password-policy: Creates Authentication Policies
dsconfig create-password-storage-scheme: Creates Password Storage Schemes
dsconfig create-password-validator: Creates Password Validators
dsconfig create-plugin: Creates Plugins
dsconfig create-replication-domain: Creates Replication Domains
dsconfig create-replication-server: Creates Replication Servers
dsconfig create-sasl-mechanism-handler: Creates SASL Mechanism Handlers
dsconfig create-schema-provider: Creates Schema Providers
dsconfig create-service-discovery-mechanism: Creates Service Discovery Mechanisms
dsconfig create-synchronization-provider: Creates Synchronization Providers
dsconfig create-trust-manager-provider: Creates Trust Manager Providers
dsconfig create-virtual-attribute: Creates Virtual Attributes
dsconfig delete-access-log-filtering-criteria: Deletes Access Log Filtering Criteria
dsconfig delete-account-status-notification-handler: Deletes Account Status Notification Handlers
dsconfig delete-alert-handler: Deletes Alert Handlers
dsconfig delete-backend: Deletes Backends
dsconfig delete-backend-index: Deletes Backend Indexes
dsconfig delete-backend-vlv-index: Deletes Backend VLV Indexes
dsconfig delete-certificate-mapper: Deletes Certificate Mappers
dsconfig delete-connection-handler: Deletes Connection Handlers
dsconfig delete-debug-target: Deletes Debug Targets
dsconfig delete-entry-cache: Deletes Entry Caches
dsconfig delete-extended-operation-handler: Deletes Extended Operation Handlers
dsconfig delete-group-implementation: Deletes Group Implementations
dsconfig delete-http-authorization-mechanism: Deletes HTTP Authorization Mechanisms
dsconfig delete-http-endpoint: Deletes HTTP Endpoints
dsconfig delete-identity-mapper: Deletes Identity Mappers
dsconfig delete-key-manager-provider: Deletes Key Manager Providers
dsconfig delete-log-publisher: Deletes Log Publishers
dsconfig delete-log-retention-policy: Deletes Log Retention Policies
dsconfig delete-log-rotation-policy: Deletes Log Rotation Policies
dsconfig delete-monitor-provider: Deletes Monitor Providers
dsconfig delete-password-generator: Deletes Password Generators
dsconfig delete-password-policy: Deletes Authentication Policies
dsconfig delete-password-storage-scheme: Deletes Password Storage Schemes
dsconfig delete-password-validator: Deletes Password Validators
dsconfig delete-plugin: Deletes Plugins
dsconfig delete-replication-domain: Deletes Replication Domains
dsconfig delete-replication-server: Deletes Replication Servers
dsconfig delete-sasl-mechanism-handler: Deletes SASL Mechanism Handlers
dsconfig delete-schema-provider: Deletes Schema Providers
dsconfig delete-service-discovery-mechanism: Deletes Service Discovery Mechanisms
dsconfig delete-synchronization-provider: Deletes Synchronization Providers
dsconfig delete-trust-manager-provider: Deletes Trust Manager Providers
dsconfig delete-virtual-attribute: Deletes Virtual Attributes
dsconfig get-access-control-handler-prop: Shows Access Control Handler properties
dsconfig get-access-log-filtering-criteria-prop: Shows Access Log Filtering Criteria properties
dsconfig get-account-status-notification-handler-prop: Shows Account Status Notification Handler properties
dsconfig get-administration-connector-prop: Shows Administration Connector properties
dsconfig get-alert-handler-prop: Shows Alert Handler properties
dsconfig get-backend-index-prop: Shows Backend Index properties
dsconfig get-backend-prop: Shows Backend properties
dsconfig get-backend-vlv-index-prop: Shows Backend VLV Index properties
dsconfig get-certificate-mapper-prop: Shows Certificate Mapper properties
dsconfig get-connection-handler-prop: Shows Connection Handler properties
dsconfig get-crypto-manager-prop: Shows Crypto Manager properties
dsconfig get-debug-target-prop: Shows Debug Target properties
dsconfig get-entry-cache-prop: Shows Entry Cache properties
dsconfig get-extended-operation-handler-prop: Shows Extended Operation Handler properties
dsconfig get-external-changelog-domain-prop: Shows External Changelog Domain properties
dsconfig get-global-configuration-prop: Shows Global Configuration properties
dsconfig get-group-implementation-prop: Shows Group Implementation properties
dsconfig get-http-authorization-mechanism-prop: Shows HTTP Authorization Mechanism properties
dsconfig get-http-endpoint-prop: Shows HTTP Endpoint properties
dsconfig get-identity-mapper-prop: Shows Identity Mapper properties
dsconfig get-key-manager-provider-prop: Shows Key Manager Provider properties
dsconfig get-log-publisher-prop: Shows Log Publisher properties
dsconfig get-log-retention-policy-prop: Shows Log Retention Policy properties
dsconfig get-log-rotation-policy-prop: Shows Log Rotation Policy properties
dsconfig get-monitor-provider-prop: Shows Monitor Provider properties
dsconfig get-password-generator-prop: Shows Password Generator properties
dsconfig get-password-policy-prop: Shows Authentication Policy properties
dsconfig get-password-storage-scheme-prop: Shows Password Storage Scheme properties
dsconfig get-password-validator-prop: Shows Password Validator properties
dsconfig get-plugin-prop: Shows Plugin properties
dsconfig get-plugin-root-prop: Shows Plugin Root properties
dsconfig get-replication-domain-prop: Shows Replication Domain properties
dsconfig get-replication-server-prop: Shows Replication Server properties
dsconfig get-root-dn-prop: Shows Root DN properties
dsconfig get-root-dse-backend-prop: Shows Root DSE Backend properties
dsconfig get-sasl-mechanism-handler-prop: Shows SASL Mechanism Handler properties
dsconfig get-schema-provider-prop: Shows Schema Provider properties
dsconfig get-service-discovery-mechanism-prop: Shows Service Discovery Mechanism properties
dsconfig get-synchronization-provider-prop: Shows Synchronization Provider properties
dsconfig get-trust-manager-provider-prop: Shows Trust Manager Provider properties
dsconfig get-virtual-attribute-prop: Shows Virtual Attribute properties
dsconfig get-work-queue-prop: Shows Work Queue properties
dsconfig list-access-log-filtering-criteria: Lists existing Access Log Filtering Criteria
dsconfig list-account-status-notification-handlers: Lists existing Account Status Notification Handlers
dsconfig list-alert-handlers: Lists existing Alert Handlers
dsconfig list-backend-indexes: Lists existing Backend Indexes
dsconfig list-backend-vlv-indexes: Lists existing Backend VLV Indexes
dsconfig list-backends: Lists existing Backends
dsconfig list-certificate-mappers: Lists existing Certificate Mappers
dsconfig list-connection-handlers: Lists existing Connection Handlers
dsconfig list-debug-targets: Lists existing Debug Targets
dsconfig list-entry-caches: Lists existing Entry Caches
dsconfig list-extended-operation-handlers: Lists existing Extended Operation Handlers
dsconfig list-group-implementations: Lists existing Group Implementations
dsconfig list-http-authorization-mechanisms: Lists existing HTTP Authorization Mechanisms
dsconfig list-http-endpoints: Lists existing HTTP Endpoints
dsconfig list-identity-mappers: Lists existing Identity Mappers
dsconfig list-key-manager-providers: Lists existing Key Manager Providers
dsconfig list-log-publishers: Lists existing Log Publishers
dsconfig list-log-retention-policies: Lists existing Log Retention Policies
dsconfig list-log-rotation-policies: Lists existing Log Rotation Policies
dsconfig list-monitor-providers: Lists existing Monitor Providers
dsconfig list-password-generators: Lists existing Password Generators
dsconfig list-password-policies: Lists existing Password Policies
dsconfig list-password-storage-schemes: Lists existing Password Storage Schemes
dsconfig list-password-validators: Lists existing Password Validators
dsconfig list-plugins: Lists existing Plugins
dsconfig list-properties: Describes managed objects and their properties
dsconfig list-replication-domains: Lists existing Replication Domains
dsconfig list-replication-server: Lists existing Replication Server
dsconfig list-sasl-mechanism-handlers: Lists existing SASL Mechanism Handlers
dsconfig list-schema-providers: Lists existing Schema Providers
dsconfig list-service-discovery-mechanisms: Lists existing Service Discovery Mechanisms
dsconfig list-synchronization-providers: Lists existing Synchronization Providers
dsconfig list-trust-manager-providers: Lists existing Trust Manager Providers
dsconfig list-virtual-attributes: Lists existing Virtual Attributes
dsconfig set-access-control-handler-prop: Modifies Access Control Handler properties
dsconfig set-access-log-filtering-criteria-prop: Modifies Access Log Filtering Criteria properties
dsconfig set-account-status-notification-handler-prop: Modifies Account Status Notification Handler properties
dsconfig set-administration-connector-prop: Modifies Administration Connector properties
dsconfig set-alert-handler-prop: Modifies Alert Handler properties
dsconfig set-backend-index-prop: Modifies Backend Index properties
dsconfig set-backend-prop: Modifies Backend properties
dsconfig set-backend-vlv-index-prop: Modifies Backend VLV Index properties
dsconfig set-certificate-mapper-prop: Modifies Certificate Mapper properties
dsconfig set-connection-handler-prop: Modifies Connection Handler properties
dsconfig set-crypto-manager-prop: Modifies Crypto Manager properties
dsconfig set-debug-target-prop: Modifies Debug Target properties
dsconfig set-entry-cache-prop: Modifies Entry Cache properties
dsconfig set-extended-operation-handler-prop: Modifies Extended Operation Handler properties
dsconfig set-external-changelog-domain-prop: Modifies External Changelog Domain properties
dsconfig set-global-configuration-prop: Modifies Global Configuration properties
dsconfig set-group-implementation-prop: Modifies Group Implementation properties
dsconfig set-http-authorization-mechanism-prop: Modifies HTTP Authorization Mechanism properties
dsconfig set-http-endpoint-prop: Modifies HTTP Endpoint properties
dsconfig set-identity-mapper-prop: Modifies Identity Mapper properties
dsconfig set-key-manager-provider-prop: Modifies Key Manager Provider properties
dsconfig set-log-publisher-prop: Modifies Log Publisher properties
dsconfig set-log-retention-policy-prop: Modifies Log Retention Policy properties
dsconfig set-log-rotation-policy-prop: Modifies Log Rotation Policy properties
dsconfig set-monitor-provider-prop: Modifies Monitor Provider properties
dsconfig set-password-generator-prop: Modifies Password Generator properties
dsconfig set-password-policy-prop: Modifies Authentication Policy properties
dsconfig set-password-storage-scheme-prop: Modifies Password Storage Scheme properties
dsconfig set-password-validator-prop: Modifies Password Validator properties
dsconfig set-plugin-prop: Modifies Plugin properties
dsconfig set-plugin-root-prop: Modifies Plugin Root properties
dsconfig set-replication-domain-prop: Modifies Replication Domain properties
dsconfig set-replication-server-prop: Modifies Replication Server properties
dsconfig set-root-dn-prop: Modifies Root DN properties
dsconfig set-root-dse-backend-prop: Modifies Root DSE Backend properties
dsconfig set-sasl-mechanism-handler-prop: Modifies SASL Mechanism Handler properties
dsconfig set-schema-provider-prop: Modifies Schema Provider properties
dsconfig set-service-discovery-mechanism-prop: Modifies Service Discovery Mechanism properties
dsconfig set-synchronization-provider-prop: Modifies Synchronization Provider properties
dsconfig set-trust-manager-provider-prop: Modifies Trust Manager Provider properties
dsconfig set-virtual-attribute-prop: Modifies Virtual Attribute properties
dsconfig set-work-queue-prop: Modifies Work Queue properties

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

Much of the OpenDJ Administration Guide consists of dsconfig examples with text in between. This section therefore remains short.

The following example starts dsconfig in interactive, menu-driven mode on the default port of the current host.

$ dsconfig -h opendj.example.com -p 4444 -D "cn=Directory Manager" -w password

>>>> OpenDJ configuration console main menu

What do you want to configure?

    1)   Access Control Handler               23)  Log Publisher
    2)   Access Log Filtering Criteria        24)  Log Retention Policy
    3)   Account Status Notification Handler  25)  Log Rotation Policy
    4)   Administration Connector             26)  Matching Rule
    5)   Alert Handler                        27)  Monitor Provider
    6)   Attribute Syntax                     28)  Password Generator
    7)   Backend                              29)  Password Policy
    8)   Backend Index                        30)  Password Storage Scheme
    9)   Backend VLV Index                    31)  Password Validator
    10)  Certificate Mapper                   32)  Plugin
    11)  Connection Handler                   33)  Plugin Root
    12)  Crypto Manager                       34)  Replication Domain
    13)  Debug Target                         35)  Replication Server
    14)  Entry Cache                          36)  Root DN
    15)  Extended Operation Handler           37)  Root DSE Backend
    16)  External Changelog Domain            38)  SASL Mechanism Handler
    17)  Global Configuration                 39)  Schema Provider
    18)  Group Implementation                 40)  Synchronization Provider
    19)  HTTP Authorization Mechanism         41)  Trust Manager Provider
    20)  HTTP Endpoint                        42)  Virtual Attribute
    21)  Identity Mapper                      43)  Work Queue
    22)  Key Manager Provider

    q)   quit

Enter choice:

The following example demonstrates generating a batch file that corresponds to an interactive session enabling the debug log. The example then demonstrates using a modified batch file to disable the debug log.

$ dsconfig \
 --hostname opendj.example.com \
 --port 4444 \
 --bindDN "cn=Directory Manager" \
 --bindPassword password \
 --commandFilePath ~/enable-debug-log.batch
 ...
$ cat ~/enable-debug-log.batch
# dsconfig session start date: 19/Oct/2011:08:52:22 +0000

# Session operation number: 1
# Operation date: 19/Oct/2011:08:55:06 +0000
dsconfig set-log-publisher-prop \
          --publisher-name File-Based\ Debug\ Logger \
          --set enabled:true \
          --hostname opendj.example.com \
          --port 4444 \
          --trustStorePath /path/to/opendj/config/admin-truststore \
          --bindDN cn=Directory\ Manager \
          --bindPassword ****** \
          --no-prompt

$ cp ~/enable-debug-log.batch ~/disable-debug-log.batch
$ vi ~/disable-debug-log.batch
$ cat ~/disable-debug-log.batch
set-log-publisher-prop \
          --publisher-name File-Based\ Debug\ Logger \
          --set enabled:false \
          --hostname opendj.example.com \
          --port 4444 \
          --trustStorePath /path/to/opendj/config/admin-truststore \
          --bindDN cn=Directory\ Manager \
          --bindPassword password \
          --no-prompt

$ dsconfig --batchFilePath ~/disable-debug-log.batch --no-prompt
set-log-publisher-prop
--publisher-name
File-Based Debug Logger
--set
enabled:false
--hostname
opendj.example.com
--port
4444
--trustStorePath
/path/to/opendj/config/admin-truststore
--bindDN
cn=Directory Manager
--bindPassword
password
--no-prompt

$

Notice that the original command file looks like a shell script with the bind password value replaced by asterisks. To pass the content as a batch file to dsconfig, strip dsconfig itself, and include t he bind password for the administrative user or replace that option with an alternative, such as reading the password from a file.

dsjavaproperties(1)

Name

dsjavaproperties - apply OpenDJ Java home and JVM settings

Synopsis

dsjavaproperties

Description

This utility can be used to change the java arguments and java home that are used by the different server commands.

Before launching the command, edit the properties file located in /path/to/opendj/config/java.properties to specify the java arguments and java home. When you have edited the properties file, run this command for the changes to be taken into account.

Note that the changes will only apply to this server installation. No modifications will be made to your environment variables.

Options

The dsjavaproperties command takes the following options:

Utility input/output options:

-Q | --quiet: Use quiet mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Files

This command depends on the content of the config/java.properties file.

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example demonstrates a successful run.

$ dsjavaproperties
The operation was successful.  The server commands will use the java arguments
 and java home specified in the properties file located in
 /path/to/opendj/config/java.properties

dsreplication(1)

Name

dsreplication - manage OpenDJ directory data replication

Synopsis

dsreplication {subcommand} {options}

Description

This utility can be used to configure replication between servers so that the data of the servers is synchronized. For replication to work you must first enable replication using the 'enable' subcommand and then initialize the contents of one of the servers with the contents of the other using the 'initialize' subcommand.

Options

The dsreplication command takes the following options:

Command options:

-b | --baseDN {baseDN}: Base DN of the data to be replicated, initialized or for which we want to disable replication. Multiple base DNs can be provided by using this option multiple times.
--commandFilePath {path}: The full path to the file where the equivalent non-interactive commands will be written when this command is run in interactive mode.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
--displayCommand: Display the equivalent non-interactive argument in the standard output when this command is run in interactive mode.

Default: false
-j | --adminPasswordFile {bindPasswordFile}: The file containing the password of the global administrator.
-w | --adminPassword {bindPassword}: The global administrator password.

Configuration Options

--advanced: Allows the configuration of advanced components and properties.

Default: false

LDAP connection options:

-I | --adminUID {adminUID}: User ID of the Global Administrator to use to bind to the server. For the 'enable' subcommand if no Global Administrator was defined previously for none of the server the Global Administrator will be created using the provided data.

Default: admin
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Subcommands

The dsreplication command supports the following subcommands:

dsreplication disable

Disables replication on the specified server for the provided base DN and removes references in the other servers with which it is replicating data.

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444
-D | --bindDN {bindDN}: DN to use to bind to the server where we want to disable replication. This option must be used when no Global Administrator has been defined on the server or if the user does not want to remove references in the other replicated servers. The password provided for the Global Administrator will be used when specifying this option.

Default: cn=Directory Manager
-a | --disableReplicationServer: Disable the replication server. The replication port and change log are disabled on the specified server.

Default: false
--disableAll: Disable the replication configuration on the specified server. The contents of the server are no longer replicated and the replication server (changelog and replication port) is disabled if it is configured.

Default: false

dsreplication enable

Updates the configuration of the servers to replicate the data under the specified base DN. If one of the specified servers is already replicating the data under the base DN with other servers, executing this subcommand will update the configuration of all the servers (so it is sufficient to execute the command line once for each server we add to the replication topology).

Options

-h | --host1 {host}: Fully qualified host name or IP address of the first server whose contents will be replicated.

Default: localhost.localdomain
-p | --port1 {port}: Directory server administration port number of the first server whose contents will be replicated.

Default: 4444
-D | --bindDN1 {bindDN}: DN to use to bind to the first server whose contents will be replicated. If not specified the global administrator will be used to bind.

Default: cn=Directory Manager
--bindPassword1 {bindPassword}: Password to use to bind to the first server whose contents will be replicated. If no bind DN was specified for the first server the password of the global administrator will be used to bind.
--bindPasswordFile1 {bindPasswordFile}: File containing the password to use to bind to the first server whose contents will be replicated. If no bind DN was specified for the first server the password of the global administrator will be used to bind.
-r | --replicationPort1 {port}: Port that will be used by the replication mechanism in the first server to communicate with the other servers. You have to specify this option only if replication was not previously configured in the first server.

Default: 8989
--secureReplication1: Specifies whether the communication through the replication port of the first server is encrypted or not. This option will only be taken into account the first time replication is configured on the first server.

Default: false
--noReplicationServer1: Do not configure a replication port or change log on the first server. The first server will contain replicated data but will not contain a change log of modifications made to the replicated data. Note that each replicated topology must contain at least two servers with a change log to avoid a single point of failure.

Default: false
--onlyReplicationServer1: Configure only a change log and replication port on the first server. The first server will not contain replicated data, but will contain a change log of the modifications made to the replicated data on other servers.

Default: false
-O | --host2 {host}: Fully qualified host name or IP address of the second server whose contents will be replicated.

Default: localhost.localdomain
--port2 {port}: Directory server administration port number of the second server whose contents will be replicated.

Default: 4444
--bindDN2 {bindDN}: DN to use to bind to the second server whose contents will be replicated. If not specified the global administrator will be used to bind.

Default: cn=Directory Manager
--bindPassword2 {bindPassword}: Password to use to bind to the second server whose contents will be replicated. If no bind DN was specified for the second server the password of the global administrator will be used to bind.
-F | --bindPasswordFile2 {bindPasswordFile}: File containing the password to use to bind to the second server whose contents will be replicated. If no bind DN was specified for the second server the password of the global administrator will be used to bind.
-R | --replicationPort2 {port}: Port that will be used by the replication mechanism in the second server to communicate with the other servers. You have to specify this option only if replication was not previously configured in the second server.

Default: 8989
--secureReplication2: Specifies whether the communication through the replication port of the second server is encrypted or not. This option will only be taken into account the first time replication is configured on the second server.

Default: false
--noReplicationServer2: Do not configure a replication port or change log on the second server. The second server will contain replicated data but will not contain a change log of modifications made to the replicated data. Note that each replicated topology must contain at least two servers with a change log to avoid a single point of failure.

Default: false
--onlyReplicationServer2: Configure only a change log and replication port on the second server. The second server will not contain replicated data, but will contain a change log of the modifications made to the replicated data on other servers.

Default: false
-S | --skipPortCheck: Skip the check to determine whether the specified replication ports are usable.

Default: false
--noSchemaReplication: Do not replicate the schema between the servers.

Default: false
--useSecondServerAsSchemaSource: Use the second server to initialize the schema of the first server. If this option nor option --noSchemaReplication are specified the schema of the first server will be used to initialize the schema of the second server.

Default: false

dsreplication initialize

Initialize the contents of the data under the specified base DN on the destination server with the contents on the source server. This operation is required after enabling replication in order replication to work ('initialize-all' can also be used for this purpose).

Options

-h | --hostSource {host}: Fully qualified host name or IP address of the source server whose contents will be used to initialize the destination server.

Default: localhost.localdomain
-p | --portSource {port}: Directory server administration port number of the source server whose contents will be used to initialize the destination server.

Default: 4444
-O | --hostDestination {host}: Fully qualified host name or IP address of the destination server whose contents will be initialized.

Default: localhost.localdomain
--portDestination {port}: Directory server administration port number of the destination server whose contents will be initialized.

Default: 4444

dsreplication initialize-all

Initialize the contents of the data under the specified base DN on all the servers whose contents are being replicated with the contents on the specified server. This operation is required after enabling replication for replication to work ('initialize' applied to each server can also be used for this purpose).

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444

dsreplication post-external-initialization

This subcommand must be called after initializing the contents of all the replicated servers using the tool import-ldif or the binary copy method. You must specify the list of base DNs that have been initialized and you must provide the credentials of any of the servers that are being replicated. See the usage of the subcommand 'pre-external-initialization' for more information.

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444

dsreplication pre-external-initialization

This subcommand must be called before initializing the contents of all the replicated servers using the tool import-ldif or the binary copy method. You must specify the list of base DNs that will be initialized and you must provide the credentials of any of the servers that are being replicated. After calling this subcommand, initialize the contents of all the servers in the topology (use the same LDIF file/binary copy on each of the servers), then call the subcommand 'post-external-initialization'.

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444

dsreplication purge-historical

Launches a purge processing of the historical informations stored in the user entries by replication. Since this processing may take a while, you must specify the maximum duration for this processing.

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444
--maximumDuration {maximum duration}: This argument specifies the maximum duration the purge processing must last expressed in seconds.

Default: 3600
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.

dsreplication reset-change-number

Re-synchronizes the change-log changenumber on one server with the change-log changenumber of another.

Options

-h | --hostSource {host}: Fully qualified host name or IP address of the source server whose contents will be used to initialize the destination server.

Default: localhost.localdomain
-p | --portSource {port}: Directory server administration port number of the source server whose contents will be used to initialize the destination server.

Default: 4444
-O | --hostDestination {host}: Fully qualified host name or IP address of the destination server whose contents will be initialized.

Default: localhost.localdomain
--portDestination {port}: Directory server administration port number of the destination server whose contents will be initialized.

Default: 4444
--change-number {change number}: The change number to use as the basis for re-synchronization.

dsreplication status

Displays a list with the basic replication configuration of the base DNs of the servers defined in the registration information. If no base DNs are specified as parameter the information for all base DNs is displayed.

Options

-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-p | --port {port}: Directory server administration port number.

Default: 4444
-s | --script-friendly: Use script-friendly mode.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example enables and then initializes replication for a new replica on opendj2.example.com from an existing replica on opendj.example.com.

$ dsreplication enable -I admin -w password -X -n -b dc=example,dc=com \
 --host1 opendj.example.com --port1 4444 --bindDN1 "cn=Directory Manager" \
 --bindPassword1 password --replicationPort1 8989 \
 --host2 opendj2.example.com --port2 4444 --bindDN2 "cn=Directory Manager" \
 --bindPassword2 password --replicationPort2 8989

Establishing connections ..... Done.
Checking registration information ..... Done.
Updating remote references on server opendj.example.com:4444 ..... Done.
Configuring Replication port on server opendj2.example.com:4444 ..... Done.
Updating replication configuration for baseDN dc=example,dc=com on server
 opendj.example.com:4444 ..... Done.
Updating replication configuration for baseDN dc=example,dc=com on server
 opendj2.example.com:4444 ..... Done.
Updating registration configuration on server
 opendj.example.com:4444 ..... Done.
Updating registration configuration on server
 opendj2.example.com:4444 ..... Done.
Updating replication configuration for baseDN cn=schema on server
 opendj.example.com:4444 ..... Done.
Updating replication configuration for baseDN cn=schema on server
 opendj2.example.com:4444 ..... Done.
Initializing registration information on server opendj2.example.com:4444 with
 the contents of server opendj.example.com:4444 ..... Done.
Initializing schema on server opendj2.example.com:4444 with the contents of
 server opendj.example.com:4444 ..... Done.

Replication has been successfully enabled.  Note that for replication to
 work you must initialize the contents of the base DN's that are being
  replicated (use dsreplication initialize to do so).

See
/var/.../opends-replication-7958637258600693490.log
for a detailed log of this operation.

$ dsreplication initialize-all -I admin -w password -X -n -b dc=example,dc=com \
 -h opendj.example.com -p 4444

Initializing base DN dc=example,dc=com with the contents from
 opendj.example.com:4444: 160 entries processed (100 % complete).
Base DN initialized successfully.

See
/var/.../opends-replication-5020375834904394170.log
for a detailed log of this operation.

encode-password(1)

Name

encode-password - encode a password with an OpenDJ storage scheme

Synopsis

encode-password

Description

This utility can be used to encode user passwords with a specified storage scheme, or to determine whether a given clear-text value matches a provided encoded password.

Options

The encode-password command takes the following options:

Command options:

-a | --authPasswordSyntax: Use the authentication password syntax rather than the user password syntax.

Default: false
-c | --clearPassword {clearPW}: Clear-text password to encode or to compare against an encoded password.
-e | --encodedPassword {encodedPW}: Encoded password to compare against the clear-text password.
-E | --encodedPasswordFile {file}: Encoded password file.
-f | --clearPasswordFile {file}: Clear-text password file.
-i | --interactivePassword: The password to encode or to compare against an encoded password is interactively asked to the user.

Default: false
-l | --listSchemes: List available password storage schemes.

Default: false
-r | --useCompareResultCode: Use the LDAP compare result as an exit code for the password comparison.

Default: false
-s | --storageScheme {scheme}: Scheme to use for the encoded password.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
5: The -r option was used, and the compare did not match.
6: The -r option was used, and the compare did match.
other: An error occurred.

Examples

The following example encodes a password, and also shows comparison of a password with the encoded value.

$ encode-password -l
3DES
AES
BASE64
BLOWFISH
CLEAR
CRYPT
MD5
RC4
SHA
SMD5
SSHA
SSHA256
SSHA384
SSHA512

$ encode-password -c secret12 -s CRYPT
Encoded Password:  "{CRYPT}ZulJ6Dy3TFnrE"

$ encode-password -c secret12 -s CRYPT -e "{CRYPT}ZulJ6Dy3TFnrE" -r
The provided clear-text and encoded passwords match

$ echo $?
6

export-ldif(1)

Name

export-ldif - export OpenDJ directory data in LDIF

Synopsis

export-ldif

Description

This utility can be used to export data from a Directory Server backend in LDIF form.

Options

The export-ldif command takes the following options:

Command options:

-a | --appendToLDIF: Append an existing LDIF file rather than overwriting it.

Default: false
-b | --includeBranch {branchDN}: Base DN of a branch to include in the LDIF export.
-B | --excludeBranch {branchDN}: Base DN of a branch to exclude from the LDIF export.
-c | --compress: Compress the LDIF data as it is exported.

Default: false
-e | --excludeAttribute {attribute}: Attribute to exclude from the LDIF export.
-E | --excludeFilter {filter}: Filter to identify entries to exclude from the LDIF export.
-i | --includeAttribute {attribute}: Attribute to include in the LDIF export.
-I | --includeFilter {filter}: Filter to identify entries to include in the LDIF export.
-l | --ldifFile {ldifFile}: Path to the LDIF file to be written.
-n | --backendID {backendName}: Backend ID for the backend to export.
-O | --excludeOperational: Exclude operational attributes from the LDIF export.

Default: false
--offline: Indicates that the command must be run in offline mode.

Default: false

Task Backend Connection Options

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Task Scheduling Options

--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
--wrapColumn {wrapColumn}: Column at which to wrap long lines (0 for no wrapping).

Default: 0

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example exports data to a file, Example.ldif, with the server offline.

$ export-ldif -b dc=example,dc=com -n userRoot -l ../ldif/Example.ldif
... category=BACKEND severity=INFORMATION ...
...Exported 160 entries and skipped 0 in 0 seconds (average rate 1428.6/sec)

import-ldif(1)

Name

import-ldif - import OpenDJ directory data from LDIF

Synopsis

import-ldif

Description

This utility can be used to import LDIF data into a Directory Server backend, overwriting existing data. It cannot be used to append data to the backend database.

Options

The import-ldif command takes the following options:

Command options:

-A | --templateFile {templateFile}: Path to a MakeLDIF template to use to generate the import data.
-b | --includeBranch {branchDN}: Base DN of a branch to include in the LDIF import.
-B | --excludeBranch {branchDN}: Base DN of a branch to exclude from the LDIF import.
-c | --isCompressed: LDIF file is compressed.

Default: false
--countRejects: Count the number of entries rejected by the server and return that value as the exit code (values > 255 will be reduced to 255 due to exit code restrictions).

Default: false
-e | --excludeAttribute {attribute}: Attribute to exclude from the LDIF import.
-E | --excludeFilter {filter}: Filter to identify entries to exclude from the LDIF import.
-F | --clearBackend: Remove all entries for all base DNs in the backend before importing. Set to true when running in the offline mode (i.e. the --offline flag is set).

Default: false
-i | --includeAttribute {attribute}: Attribute to include in the LDIF import.
-I | --includeFilter {filter}: Filter to identify entries to include in the LDIF import.
-l | --ldifFile {ldifFile}: Path to the LDIF file to be imported.
-n | --backendID {backendName}: Backend ID for the backend to import.
-O | --overwrite: Overwrite an existing rejects and/or skip file rather than appending to it.

Default: false
--offline: Indicates that the command must be run in offline mode. Forces old data replacement with imported data.

Default: false
-R | --rejectFile {rejectFile}: Write rejected entries to the specified file.
-s | --randomSeed {seed}: Seed for the MakeLDIF random number generator.

Default: 0
-S | --skipSchemaValidation: Skip schema validation during the LDIF import.

Default: false
--skipFile {skipFile}: Write skipped entries to the specified file.
--threadCount {count}: Number of threads used to read LDIF file during import. Default value (0) equals: 2 x (number of CPUs).

Default: 0
--tmpdirectory {directory}: Path to temporary directory for index scratch files during LDIF import.

Default: import-tmp

Task Backend Connection Options

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Task Scheduling Options

--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode (no output).

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example imports the content of a file, Example.ldif, with the server offline.

$ import-ldif -b dc=example,dc=com -n userRoot -l /path/to/Example.ldif
... category=RUNTIME_INFORMATION severity=NOTICE...
... msg=Import LDIF environment close took 0 seconds

ldapcompare(1)

Name

ldapcompare - perform LDAP compare operations

Synopsis

ldapcompare attribute:value DN

Description

This utility can be used to perform LDAP compare operations in the Directory Server.

Options

The ldapcompare command takes the following options:

Command options:

--assertionFilter {filter}: Use the LDAP assertion control with the provided filter.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-J | --control {controloid[:criticality[:value|::b64value|:<filePath]]}: Use a request control with the provided information.

For some controloid values, you can replace object identifiers with user-friendly strings. The strings are listed here in lower case, but the case is not important. You can use camelCase if you prefer, for example.

accountusable,accountusability: Account Usability Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
authzid,authorizationidentity: Authorization Identity Request Control, Object Identifier: 2.16.840.1.113730.3.4.16
effectiverights,geteffectiverights: Get Effective Rights Request Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
managedsait: Manage DSAIT Request Control, Object Identifier: 2.16.840.1.113730.3.4.2
noop,no-op: No-Op Control, Object Identifier: 1.3.6.1.4.1.4203.1.10.2
pwpolicy,passwordpolicy: Password Policy Control, Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
realattrsonly,realattributesonly: Real Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.17
subtreedelete,treedelete: Subtree Delete Request Control, Object Identifier: 1.2.840.113556.1.4.805
virtualattrsonly,virtualattributesonly: Virtual Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.19

-m | --useCompareResultCode: Use the LDAP compare result as an exit code for the LDAP compare operations.

Default: false
-n | --dry-run: Show what would be done but do not perform any operation.

Default: false
-S | --scriptFriendly: Use script-friendly mode.

Default: false
-Y | --proxyAs {authzID}: Use the proxied authorization control with the given authorization ID.

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default:
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.

Default: 389
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-q | --useStartTLS: Use StartTLS to secure communication with the server.

Default: false
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false
-Z | --useSSL: Use SSL for secure communication with the server.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
5: The LDAP compare operation did not match.
6: The -m option was used, and the LDAP compare operation did match.
ldap-error: An LDAP error occurred while processing the operation.

LDAP result codes are described in RFC 4511. Also see the additional information for details.
89: An error occurred while parsing the command-line arguments.

Files

You can use ~/.opendj/tools.properties to set the defaults for bind DN, host name, and port number as in the following example.

hostname=directory.example.com
port=1389
bindDN=uid=kvaughan,ou=People,dc=example,dc=com

ldapcompare.port=1389
ldapdelete.port=1389
ldapmodify.port=1389
ldappasswordmodify.port=1389
ldapsearch.port=1389

ini

The location on Windows is %UserProfile%/.opendj/tools.properties.

Examples

The following examples demonstrate comparing Babs Jensen’s UID.

The following example uses a matching UID value.

$ ldapcompare -p 1389 uid:bjensen uid=bjensen,ou=people,dc=example,dc=com
Comparing type uid with value bjensen in entry
uid=bjensen,ou=people,dc=example,dc=com
Compare operation returned true for entry
uid=bjensen,ou=people,dc=example,dc=com

The following example uses a UID value that does not match.

$ ldapcompare -p 1389 uid:beavis uid=bjensen,ou=people,dc=example,dc=com
Comparing type uid with value beavis in entry
uid=bjensen,ou=people,dc=example,dc=com
Compare operation returned false for entry
uid=bjensen,ou=people,dc=example,dc=com

ldapdelete(1)

Name

ldapdelete - perform LDAP delete operations

Synopsis

ldapdelete [DN]

Description

This utility can be used to perform LDAP delete operations in the Directory Server. If standard input is used to specify entries to remove, end your input with EOF (Ctrl+D on UNIX, Ctrl+Z on Windows).

Options

The ldapdelete command takes the following options:

Command options:

-c | --continueOnError: Continue processing even if there are errors.

Default: false
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-J | --control {controloid[:criticality[:value|::b64value|:<filePath]]}: Use a request control with the provided information.

accountusable,accountusability: Account Usability Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
authzid,authorizationidentity: Authorization Identity Request Control, Object Identifier: 2.16.840.1.113730.3.4.16
effectiverights,geteffectiverights: Get Effective Rights Request Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
managedsait: Manage DSAIT Request Control, Object Identifier: 2.16.840.1.113730.3.4.2
noop,no-op: No-Op Control, Object Identifier: 1.3.6.1.4.1.4203.1.10.2
pwpolicy,passwordpolicy: Password Policy Control, Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
realattrsonly,realattributesonly: Real Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.17
subtreedelete,treedelete: Subtree Delete Request Control, Object Identifier: 1.2.840.113556.1.4.805
virtualattrsonly,virtualattributesonly: Virtual Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.19

-n | --dry-run: Show what would be done but do not perform any operation.

Default: false
-x | --deleteSubtree: Delete the specified entry and all entries below it.

Default: false

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default:
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.

Default: 389
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-q | --useStartTLS: Use StartTLS to secure communication with the server.

Default: false
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false
-Z | --useSSL: Use SSL for secure communication with the server.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
ldap-error: An LDAP error occurred while processing the operation.

LDAP result codes are described in RFC 4511. Also see the additional information for details.
89: An error occurred while parsing the command-line arguments.

Files

You can use ~/.opendj/tools.properties to set the defaults for bind DN, host name, and port number as in the following example.

hostname=directory.example.com
port=1389
bindDN=uid=kvaughan,ou=People,dc=example,dc=com

ldapcompare.port=1389
ldapdelete.port=1389
ldapmodify.port=1389
ldappasswordmodify.port=1389
ldapsearch.port=1389

ini

The location on Windows is %UserProfile%/.opendj/tools.properties.

Examples

The following command deletes a user entry from the directory.

$ ldapdelete -p 1389 -D "cn=Directory Manager" -w password \
 uid=bjensen,ou=people,dc=example,dc=com
Processing DELETE request for uid=bjensen,ou=people,dc=example,dc=com
DELETE operation successful for DN uid=bjensen,ou=people,dc=example,dc=com

The following command deletes the ou=Groups entry and all entries underneath ou=Groups.

$ ldapdelete -p 1389 -D "cn=Directory Manager" -w password -x \
 ou=groups,dc=example,dc=com
Processing DELETE request for ou=groups,dc=example,dc=com
DELETE operation successful for DN ou=groups,dc=example,dc=com

ldapmodify(1)

Name

ldapmodify - perform LDAP modify, add, delete, mod DN operations

Synopsis

ldapmodify [changes_files …]

Description

This utility can be used to perform LDAP modify, add, delete, and modify DN operations in the Directory Server. When not using file(s) to specify modifications, end your input with EOF (Ctrl+D on UNIX, Ctrl+Z on Windows).

Options

The ldapmodify command takes the following options:

Command options:

-a | --defaultAdd: Legacy argument for ForgeRock OpenDJ compatibility.

Default: false
--assertionFilter {filter}: Use the LDAP assertion control with the provided filter.
-c | --continueOnError: Continue processing even if there are errors.

Default: false
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-J | --control {controloid[:criticality[:value|::b64value|:<filePath]]}: Use a request control with the provided information.

accountusable,accountusability: Account Usability Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
authzid,authorizationidentity: Authorization Identity Request Control, Object Identifier: 2.16.840.1.113730.3.4.16
effectiverights,geteffectiverights: Get Effective Rights Request Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
managedsait: Manage DSAIT Request Control, Object Identifier: 2.16.840.1.113730.3.4.2
noop,no-op: No-Op Control, Object Identifier: 1.3.6.1.4.1.4203.1.10.2
pwpolicy,passwordpolicy: Password Policy Control, Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
realattrsonly,realattributesonly: Real Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.17
subtreedelete,treedelete: Subtree Delete Request Control, Object Identifier: 1.2.840.113556.1.4.805
virtualattrsonly,virtualattributesonly: Virtual Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.19

-n | --dry-run: Show what would be done but do not perform any operation.

Default: false
--postReadAttributes {attrList}: Use the LDAP ReadEntry post-read control.
--preReadAttributes {attrList}: Use the LDAP ReadEntry pre-read control.
-Y | --proxyAs {authzID}: Use the proxied authorization control with the given authorization ID.

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default:
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.

Default: 389
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-q | --useStartTLS: Use StartTLS to secure communication with the server.

Default: false
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false
-Z | --useSSL: Use SSL for secure communication with the server.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
ldap-error: An LDAP error occurred while processing the operation.

LDAP result codes are described in RFC 4511. Also see the additional information for details.
89: An error occurred while parsing the command-line arguments.

Files

You can use ~/.opendj/tools.properties to set the defaults for bind DN, host name, and port number as in the following example.

hostname=directory.example.com
port=1389
bindDN=uid=kvaughan,ou=People,dc=example,dc=com

ldapcompare.port=1389
ldapdelete.port=1389
ldapmodify.port=1389
ldappasswordmodify.port=1389
ldapsearch.port=1389

ini

The location on Windows is %UserProfile%/.opendj/tools.properties.

Examples

The following example demonstrates use of the command to add an entry to the directory.

$ cat newuser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
uid: newuser
facsimileTelephoneNumber: +1 408 555 1213
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
givenName: New
cn: New User
cn: Real Name
telephoneNumber: +1 408 555 1212
sn: Jensen
roomNumber: 1234
homeDirectory: /home/newuser
uidNumber: 10389
mail: newuser@example.com
l: South Pole
ou: Product Development
ou: People
gidNumber: 10636

$ ldapmodify -p 1389 -a -f newuser.ldif \
 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery
Processing ADD request for uid=newuser,ou=People,dc=example,dc=com
ADD operation successful for DN uid=newuser,ou=People,dc=example,dc=com

The following listing shows a UNIX shell script that adds a user entry.

#!/bin/sh
#
# Add a new user with the ldapmodify utility.
#

usage(){
        echo "Usage: $0 uid firstname lastname"
        exit 1
}
[[ $# -lt 3 ]] && usage

LDAPMODIFY=/path/to/opendj/bin/ldapmodify
HOST=opendj.example.com
PORT=1389
ADMIN=uid=kvaughan,ou=people,dc=example,dc=com
PWD=bribery

$LDAPMODIFY -h $HOST -p $PORT -D $ADMIN -w $PWD -a <<EOF
dn: uid=$1,ou=people,dc=example,dc=com
uid: $1
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
cn: $2 $3
givenName: $2
sn: $3
mail: $1@example.com
EOF

shell

The following example demonstrates adding a Description attribute to the new user’s entry.

$ cat newdesc.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
changetype: modify
add: description
description: A new user's entry

$ ldapmodify -p 1389 -f newdesc.ldif \
 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery
Processing MODIFY request for uid=newuser,ou=People,dc=example,dc=com
MODIFY operation successful for DN uid=newuser,ou=People,dc=example,dc=com

The following example demonstrates changing the Description attribute for the new user’s entry.

$ cat moddesc.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
changetype: modify
replace: description
description: Another description

$ ldapmodify -p 1389 -f moddesc.ldif \
 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery
Processing MODIFY request for uid=newuser,ou=People,dc=example,dc=com
MODIFY operation successful for DN uid=newuser,ou=People,dc=example,dc=com

The following example demonstrates deleting the new user’s entry.

$ cat deluser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
changetype: delete

$ ldapmodify -p 1389 -f deluser.ldif \
 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery
Processing DELETE request for uid=newuser,ou=People,dc=example,dc=com
DELETE operation successful for DN uid=newuser,ou=People,dc=example,dc=com

ldappasswordmodify(1)

Name

ldappasswordmodify - perform LDAP password modifications

Synopsis

ldappasswordmodify

Description

This utility can be used to perform LDAP password modify operations in the Directory Server.

Options

The ldappasswordmodify command takes the following options:

Command options:

-a | --authzID {authzID}: Authorization ID for the user entry whose password should be changed. The authorization ID is a string having either the prefix "dn:" followed by the user’s distinguished name, or the prefix "u:" followed by a user identifier that depends on the identity mapping used to match the user identifier to an entry in the directory. Examples include "dn:uid=bjensen,ou=People,dc=example,dc=com", and, if we assume that "bjensen" is mapped to Barbara Jensen’s entry, "u:bjensen".
-c | --currentPassword {currentPassword}: Current password for the target user.
-C | --currentPasswordFile {file}: Path to a file containing the current password for the target user.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-F | --newPasswordFile {file}: Path to a file containing the new password to provide for the target user.
-J | --control {controloid[:criticality[:value|::b64value|:<filePath]]}: Use a request control with the provided information.

accountusable,accountusability: Account Usability Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
authzid,authorizationidentity: Authorization Identity Request Control, Object Identifier: 2.16.840.1.113730.3.4.16
effectiverights,geteffectiverights: Get Effective Rights Request Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
managedsait: Manage DSAIT Request Control, Object Identifier: 2.16.840.1.113730.3.4.2
noop,no-op: No-Op Control, Object Identifier: 1.3.6.1.4.1.4203.1.10.2
pwpolicy,passwordpolicy: Password Policy Control, Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
realattrsonly,realattributesonly: Real Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.17
subtreedelete,treedelete: Subtree Delete Request Control, Object Identifier: 1.2.840.113556.1.4.805
virtualattrsonly,virtualattributesonly: Virtual Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.19

-n | --newPassword {newPassword}: New password to provide for the target user.

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default:
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.

Default: 389
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-q | --useStartTLS: Use StartTLS to secure communication with the server.

Default: false
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false
-Z | --useSSL: Use SSL for secure communication with the server.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
ldap-error: An LDAP error occurred while processing the operation.

LDAP result codes are described in RFC 4511. Also see the additional information for details.
89: An error occurred while parsing the command-line arguments.

Files

You can use ~/.opendj/tools.properties to set the defaults for bind DN, host name, and port number as in the following example.

hostname=directory.example.com
port=1389
bindDN=uid=kvaughan,ou=People,dc=example,dc=com

ldapcompare.port=1389
ldapdelete.port=1389
ldapmodify.port=1389
ldappasswordmodify.port=1389
ldapsearch.port=1389

ini

The location on Windows is %UserProfile%/.opendj/tools.properties.

Examples

The following example demonstrates a user changing their own password.

$ cat /tmp/currpwd.txt /tmp/newpwd.txt
bribery
secret12

$ ldappasswordmodify -p 1389 -C /tmp/currpwd.txt --newPasswordFile /tmp/newpwd.txt \
 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery
The LDAP password modify operation was successful

ldapsearch(1)

Name

ldapsearch - perform LDAP search operations

Synopsis

ldapsearch filter [attributes …]

Description

This utility can be used to perform LDAP search operations in the Directory Server.

Options

The ldapsearch command takes the following options:

Command options:

-a | --dereferencePolicy {dereferencePolicy}: Alias dereference policy ('never', 'always', 'search', or 'find').

Default: never
-A | --typesOnly: Only retrieve attribute names but not their values.

Default: false
--assertionFilter {filter}: Use the LDAP assertion control with the provided filter.
-b | --baseDN {baseDN}: Search base DN.
-c | --continueOnError: Continue processing even if there are errors.

Default: false
-C | --persistentSearch ps[:changetype[:changesonly[:entrychgcontrols]]]: Use the persistent search control.

A persistent search allows the client to continue receiving new results whenever changes are made to data that is in the scope of the search, thus using the search as a form of change notification.

The optional changetype setting defines the kinds of updates that result in notification. If you do not set the changetype, the default behavior is to send notifications for all updates.

add: Send notifications for LDAP add operations.
del,delete: Send notifications for LDAP delete operations.
mod,modify: Send notifications for LDAP modify operations.
moddn,modrdn,modifydn: Send notifications for LDAP modify DN (rename and move) operations.
all,any: Send notifications for all LDAP update operations.

The optional changesonly setting defines whether the server returns existing entries as well as changes.

true: Do not return existing entries, but instead only notifications about changes.

This is the default setting.
false: Also return existing entries.

The optional entrychgcontrols setting defines whether the server returns an Entry Change Notification control with each entry notification. The Entry Change Notification control provides additional information about the change that caused the entry to be returned by the search. In particular, it indicates the change type, the change number if available, and the previous DN if the change type was a modify DN operation.

true: Do request the Entry Change Notification control.

This is the default setting.
false: Do not request the Entry Change Notification control.

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
--countEntries: Count the number of entries returned by the server.

Default: false
-e | --getEffectiveRightsAttribute {attribute}: Specifies geteffectiverights control specific attribute list.
-g | --getEffectiveRightsAuthzid {authzID}: Use geteffectiverights control with the provided authzid.
-G | --virtualListView {before:after:index:count | before:after:value}: Use the virtual list view control to retrieve the specified results page.
-J | --control {controloid[:criticality[:value|::b64value|:<filePath]]}: Use a request control with the provided information.

accountusable,accountusability: Account Usability Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.8
authzid,authorizationidentity: Authorization Identity Request Control, Object Identifier: 2.16.840.1.113730.3.4.16
effectiverights,geteffectiverights: Get Effective Rights Request Control, Object Identifier: 1.3.6.1.4.1.42.2.27.9.5.2
managedsait: Manage DSAIT Request Control, Object Identifier: 2.16.840.1.113730.3.4.2
noop,no-op: No-Op Control, Object Identifier: 1.3.6.1.4.1.4203.1.10.2
pwpolicy,passwordpolicy: Password Policy Control, Object Identifier: 1.3.6.1.4.1.42.2.27.8.5.1
realattrsonly,realattributesonly: Real Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.17
subtreedelete,treedelete: Subtree Delete Request Control, Object Identifier: 1.2.840.113556.1.4.805
virtualattrsonly,virtualattributesonly: Virtual Attributes Only Request Control, Object Identifier: 2.16.840.1.113730.3.4.19

-l | --timeLimit {timeLimit}: Maximum length of time in seconds to allow for the search.

Default: 0
--matchedValuesFilter {filter}: Use the LDAP matched values control with the provided filter.
-n | --dry-run: Show what would be done but do not perform any operation.

Default: false
-s | --searchScope {searchScope}: Search scope ('base', 'one', 'sub', or 'subordinates'). Note: 'subordinates' is an LDAP extension that might not work with all LDAP servers.

Default: sub
-S | --sortOrder {sortOrder}: Sort the results using the provided sort order.
--simplePageSize {numEntries}: Use the simple paged results control with the given page size.

Default: 1000
--subEntries: Use subentries control to specify that subentries are visible and normal entries are not.

Default: false
-Y | --proxyAs {authzID}: Use the proxied authorization control with the given authorization ID.
-z | --sizeLimit {sizeLimit}: Maximum number of entries to return from the search.

Default: 0

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default:
-E | --reportAuthzID: Use the authorization identity control.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.

Default: 389
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-q | --useStartTLS: Use StartTLS to secure communication with the server.

Default: false
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
--usePasswordPolicyControl: Use the password policy request control.

Default: false
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false
-Z | --useSSL: Use SSL for secure communication with the server.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-t | --wrapColumn {wrapColumn}: Maximum length of an output line (0 for no wrapping).

Default: 0
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Filters

The filter argument is a string representation of an LDAP search filter as in (cn=Babs Jensen), (&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*))), or (cn:caseExactMatch:=Fred Flintstone).

Attributes

The optional attribute list specifies the attributes to return in the entries found by the search. In addition to identifying attributes by name such as cn sn mail and so forth, you can use the following notations, too.

*: Return all user attributes such as cn, sn, and mail.
+: Return all operational attributes such as etag and pwdPolicySubentry.
@objectclass: Return all attributes of the specified object class, where objectclass is one of the object classes on the entries returned by the search.
1.1: Return no attributes, only the DNs of matching entries.

Exit Codes

0: The command completed successfully.
ldap-error: An LDAP error occurred while processing the operation.

LDAP result codes are described in RFC 4511. Also see the additional information for details.
89: An error occurred while parsing the command-line arguments.

Files

You can use ~/.opendj/tools.properties to set the defaults for bind DN, host name, and port number as in the following example.

hostname=directory.example.com
port=1389
bindDN=uid=kvaughan,ou=People,dc=example,dc=com

ldapcompare.port=1389
ldapdelete.port=1389
ldapmodify.port=1389
ldappasswordmodify.port=1389
ldapsearch.port=1389

ini

The location on Windows is %UserProfile%/.opendj/tools.properties.

Examples

The following example searches for entries with UID containing jensen, returning only DNs and uid values.

$ ldapsearch -p 1389 -b dc=example,dc=com "(uid=*jensen*)" uid
dn: uid=ajensen,ou=People,dc=example,dc=com
uid: ajensen

dn: uid=bjensen,ou=People,dc=example,dc=com
uid: bjensen

dn: uid=gjensen,ou=People,dc=example,dc=com
uid: gjensen

dn: uid=jjensen,ou=People,dc=example,dc=com
uid: jjensen

dn: uid=kjensen,ou=People,dc=example,dc=com
uid: kjensen

dn: uid=rjensen,ou=People,dc=example,dc=com
uid: rjensen

dn: uid=tjensen,ou=People,dc=example,dc=com
uid: tjensen


Result Code:  0 (Success)

You can also use @objectclass notation in the attribute list to return the attributes of a particular object class. The following example shows how to return attributes of the inetOrgPerson object class.

$ ldapsearch -p 1389 -b dc=example,dc=com "(uid=bjensen)" @inetorgperson
dn: uid=bjensen,ou=People,dc=example,dc=com
givenName: Barbara
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
uid: bjensen
cn: Barbara Jensen
cn: Babs Jensen
telephoneNumber: +1 408 555 1862
sn: Jensen
roomNumber: 0209
mail: bjensen@example.com
l: San Francisco
ou: Product Development
ou: People
facsimileTelephoneNumber: +1 408 555 1992

You can use + in the attribute list to return all operational attributes, as in the following example.

$ ldapsearch -p 1389 -b dc=example,dc=com "(uid=bjensen)" +
dn: uid=bjensen,ou=People,dc=example,dc=com
numSubordinates: 0
structuralObjectClass: inetOrgPerson
etag: 0000000073c29972
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config
subschemaSubentry: cn=schema
hasSubordinates: false
entryDN: uid=bjensen,ou=people,dc=example,dc=com
entryUUID: fc252fd9-b982-3ed6-b42a-c76d2546312c

ldifdiff(1)

Name

ldifdiff - compare small LDIF files

Synopsis

ldifdiff source target

Description

This utility can be used to compare two LDIF files and report the differences in LDIF format. If standard input is used to specify source or target, end your input with EOF (Ctrl+D on UNIX, Ctrl+Z on Windows).

Options

The ldifdiff command takes the following options:

Command options:

-o | --outputLDIF {file}: Write differences to {file} instead of stdout.

Default: stdout

Utility input/output options:

-t | --wrapColumn {wrapColumn}: Maximum length of an output line (0 for no wrapping).

Default: 0

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: No differences were found.
1: Differences were found.
other: An error occurred.

Examples

The following example demonstrates use of the command with two small LDIF files.

$ cat /path/to/newuser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
uid: newuser
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
cn: New User
sn: User
ou: People
mail: newuser@example.com
userPassword: changeme

$ cat /path/to/neweruser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
uid: newuser
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
cn: New User
sn: User
ou: People
mail: newuser@example.com
userPassword: secret12
description: A new description.

$ ldifdiff -s /path/to/newuser.ldif -t /path/to/neweruser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
changetype: modify
add: userPassword
userPassword: secret12
-
delete: userPassword
userPassword: changeme
-
add: description
description: A new description.

ldifmodify(1)

Name

ldifmodify - apply LDIF changes to LDIF

Synopsis

ldifmodify source_file [changes_files…]

Description

This utility can be used to apply a set of modify, add, and delete operations to entries contained in an LDIF file. If standard input is used to specify source or changes, end your input with EOF (Ctrl+D on UNIX, Ctrl+Z on Windows).

Options

The ldifmodify command takes the following options:

Command options:

-c | --continueOnError: Continue processing even if there are errors.

Default: false
-o | --outputLDIF {file}: Write updated entries to {file} instead of stdout.

Default: stdout

Utility input/output options:

-t | --wrapColumn {wrapColumn}: Maximum length of an output line (0 for no wrapping).

Default: 0

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example demonstrates use of the command.

$ cat /path/to/newuser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
uid: newuser
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
cn: New User
sn: User
ou: People
mail: newuser@example.com
userPassword: changeme

$ cat /path/to/newdiff.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
changetype: modify
add: userPassword
userPassword: secret12
-
delete: userPassword
userPassword: changeme
-
add: description
description: A new description.

$ ldifmodify -o neweruser.ldif /path/to/newuser.ldif /path/to/newdiff.ldif

$ cat neweruser.ldif
dn: uid=newuser,ou=People,dc=example,dc=com
uid: newuser
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
cn: New User
sn: User
ou: People
mail: newuser@example.com
userPassword: secret12
description: A new description.

ldifsearch(1)

Name

ldifsearch - search LDIF with LDAP filters

Synopsis

ldifsearch source filter [attributes …]

Description

This utility can be used to perform search operations against entries contained in an LDIF file. If standard input is used to specify source, end your input with EOF (Ctrl+D on UNIX, Ctrl+Z on Windows).

Options

The ldifsearch command takes the following options:

Command options:

-A | --typesOnly: Only retrieve attribute names but not their values.

Default: false
-b | --baseDN {baseDN}: The base DN for the search. If no base DN is provided, then the root DSE will be used.

Default:
-l | --timeLimit {timeLimit}: Maximum length of time in seconds to allow for the search.

Default: 0
-o | --outputLDIF {file}: Write search results to {file} instead of stdout.

Default: stdout
-s | --searchScope {searchScope}: Search scope ('base', 'one', 'sub', or 'subordinates'). Note: 'subordinates' is an LDAP extension that might not work with all LDAP servers.

Default: sub
-z | --sizeLimit {sizeLimit}: Maximum number of entries to return from the search.

Default: 0

Utility input/output options:

-t | --wrapColumn {wrapColumn}: Maximum length of an output line (0 for no wrapping).

Default: 0

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example demonstrates use of the command.

$ ldifsearch -b dc=example,dc=com Example.ldif uid=bjensen
dn: uid=bjensen,ou=People,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
uid: bjensen
userpassword: hifalutin
facsimiletelephonenumber: +1 408 555 1992
givenname: Barbara
cn: Barbara Jensen
cn: Babs Jensen
telephonenumber: +1 408 555 1862
sn: Jensen
roomnumber: 0209
homeDirectory: /home/bjensen
mail: bjensen@example.com
l: San Francisco
ou: Product Development
ou: People
uidNumber: 1076
gidNumber: 1000

$ ldifsearch -b dc=example,dc=com Example.ldif "(uid=bjensen)" @posixaccount
dn: uid=bjensen,ou=People,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
uid: bjensen
userpassword: hifalutin
cn: Barbara Jensen
cn: Babs Jensen
homeDirectory: /home/bjensen
uidNumber: 1076
gidNumber: 1000

list-backends(1)

Name

list-backends - list OpenDJ backends and base DNs

Synopsis

list-backends

Description

This utility can be used to list the backends and base DNs configured in the Directory Server.

Options

The list-backends command takes the following options:

Command options:

-b | --baseDN {baseDN}: Base DN for which to list the backend ID.
-n | --backendID {backendName}: Backend ID of the backend for which to list the base DNs.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example demonstrates a successful run.

$ list-backends
Backend ID         : Base DN
-------------------:----------------------
adminRoot          : cn=admin data
ads-truststore     : cn=ads-truststore
backup             : cn=backups
config             : cn=config
monitor            : cn=monitor
myCompanyRoot      : "dc=myCompany,dc=com"
myOrgRoot          : o=myOrg
schema             : cn=schema
tasks              : cn=tasks
userRoot           : "dc=example,dc=com"

makeldif(1)

Name

makeldif - generate test LDIF

Synopsis

makeldif template-file-path

Description

This utility can be used to generate LDIF data based on a definition in a template file.

Options

The makeldif command takes the following options:

Command options:

-c | --constant {name=value}: A constant that overrides the value set in the template file.
-o | --outputLDIF {file}: The path to the LDIF file to be written.
-r | --resourcePath {path}: Path to look for MakeLDIF resources (e.g., data files).
-s | --randomSeed {seed}: The seed to use to initialize the random number generator.

Default: 0

Utility input/output options:

-t | --wrapColumn {wrapColumn}: Maximum length of an output line (0 for no wrapping).

Default: 0

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
1: An error occurred.

Examples

The following example uses the default template to generate LDIF.

$ makeldif -o ../ldif/generated.ldif ../config/MakeLDIF/example.template
Processed 1000 entries
Processed 2000 entries
...
Processed 10000 entries
LDIF processing complete.  10003 entries written

Name

makeldif-template - template file for the make-ldif command

Synopsis

# Comment lines start with #.
#
# Notice that this synopsis includes blank lines after entries.
# In the same way you would use blank lines after entries in normal LDIF,
# leave empty lines after "entries" in template files.

# Optionally include classes that define custom tags.
# Custom tag classes extend org.opends.server.tools.makeldif.Tag and
# must be on the class path when you run make-ldif.
#
include custom.makeldif.tag.ClassName
...

# Optionally define constants used in the template.
# To reference constants later, put brackets around the name: [constant-name]
#
define constant-name=value
...

# Define branches by suffix DN, such as the following:
#
#  dc=example,dc=com
#  ou=People,dc=example,dc=com
#  ou=Groups,dc=example,dc=com
#
# make-ldif generates the necessary object class definitions and RDNs.
#
# A branch can have subordinateTemplates that define templates to use for
# the branch entry.
#
# A branch can have additional attributes generated on the branch entry. See
# the Description below for more information on specifying attribute values.
#
branch: suffix-dn
[subordinateTemplate: template-name:number
...]
[attribute: attr-value
...]

...

# Define entries using templates.
#
# A template can extend another template.
# A template defines the RDN attribute(s) used for generated entries.
# A template can have a subordinateTemplate that defines a template to use for
# the generated entries.
#
# A template then defines attributes. See the Description below for more
# information on specifying attribute values.
#
template: template-name
[extends: template-name]
rdnAttr: attribute[+attribute ...]
[subordinateTemplate: template-name:number]
[attribute: attr-value
...]

...

Description

Template files specify how to build LDIF. They allow you to define variables, insert random values from other files, and generally build arbitrarily large LDIF files for testing purposes. You pass template files to the make-ldif command when generating LDIF.

The Synopsis above shows the layout for a make-ldif template file. This section focuses on what you can do to specify entry attribute values, called attr-value in the Synopsis section. .Specifying Attribute Values

When specifying attribute values in make-ldif templates, you can use static text and constants that you have defined, enclosing names for constants in brackets, [myConstant]. You can use more than one constant per line, as in the following example.

description: Description for [org] under [suffix]

ldif

You can also use two kinds of tags when specifying attribute values. One kind of tag gets replaced with the value of another attribute in the generated entry. Such tags are delimited with braces, { }. For example, if your template includes definitions for first name and last name attributes:

givenName: <first>
sn: <last>

ldif

Then you can define a mail attribute that uses the values of both attributes, and an initials attribute that takes the first character of each.

mail: {givenName}.{sn}@[myDomain]
initials: {givenName:1}{sn:1}

ldif

The other kind of tag is delimited with < and >, as shown above in the example with <first> and <last>. Tag names are not case sensitive. Many tags can take arguments separated by colons, :, from the tag names within the tag.

Use backslashes to escape literal start tag characters (< [ {) as shown in the following example, and to escape literal end tag characters within tags (> ] }).

scimMail: \{"emails": \[\{"value": "{mail}", "type": "work", "primary": true}]}
xml: \<id>{uid}\</id>

ldif

OpenDJ supports the following tags.

<DN>

The DN tag gets replaced by the distinguished name of the current entry. An optional integer argument specifies the subcomponents of the DN to generate. For example, if the DN of the entry is uid=bjensen,ou=People,dc=example,dc=com <DN:1> gets replaced by uid=bjensen, and <DN:-2> gets replaced by dc=example,dc=com.

<File>

The File tag gets replaced by a line from a text file you specify. The File tag takes a required argument, the path to the text file, and an optional second argument, either random or sequential. For the file argument, either you specify an absolute path to the file such as <file:/path/to/myDescriptions>, or you specify a path relative to the /path/to/opendj/config/MakeLDIF/ directory such as <file:streets>. For the second argument, if you specify sequential then lines from the file are read in sequential order. Otherwise, lines from the file are read in random order.

<First>

The first name tag gets replaced by a random line from /path/to/opendj/config/MakeLDIF/first.names. Combinations of generated first and last names are unique, with integers appended to the name strings if not enough combinations are available.

<GUID>

The GUID tag gets replaced by a 128-bit, type 4 (random) universally unique identifier such as f47ac10b-58cc-4372-a567-0e02b2c3d479.

<IfAbsent>

The IfAbsent tag takes as its first argument the name of another attribute, and optionally as its second argument a value to use. This tag causes the attribute to be generated only if the named attribute is not present on the generated entry. Use this tag when you have used <Presence> to define another attribute that is not always present on generated entries.

<IfPresent>

The IfPresent takes as its first argument the name of another attribute, and optionally as its second argument a value to use. This tag causes the attribute to be generated only if the named attribute is also present on the generated entry. Use this tag when you have used <Presence> to define another attribute that is sometimes present on generated entries.

<Last>

The last name tag gets replaced by a random line from /path/to/opendj/config/MakeLDIF/last.names. Combinations of generated first and last names are unique, with integers appended to the name strings if not enough combinations are available.

<List>

The List tag gets replaced by one of the values from the list of arguments you provide. For example, <List:bronze:silver:gold> gets replaced with bronze, silver, or gold.

You can weight arguments to ensure some arguments are selected more often than others. For example, if you want two bronze for one silver and one gold, use <List:bronze;2:silver;1:gold;1>.

<ParentDN>

The ParentDN tag gets replaced by the distinguished name of the parent entry. For example, if the DN of the entry is uid=bjensen,ou=People,dc=example,dc=com, <ParentDN> gets replaced by ou=People,dc=example,dc=com.

<Presence>

The Presence tag takes a percent argument. It does not get replaced by a value itself, but instead results in the attribute being generated on the percentage of entries you specify in the argument. For example, description: <Presence:50>A description generates description: A description on half the entries.

<Random>

The Random tag lets you generate a variety of random numbers and strings. The Random tag has the following subtypes, which you include as arguments, that is <Random:subtype>.

alpha:length
alpha:minlength:maxlength
numeric:length
numeric:minvalue:maxvalue
numeric:minvalue:maxvalue:format, where format is a java.text.DecimalFormat pattern
alphanumeric:length
alphanumeric:minlength:maxlength
chars:characters:length
chars:characters:minlength:maxlength
hex:length
hex:minlength:maxlength
base64:length
base64:minlength:maxlength
month
month:maxlength
telephone, a telephone number starting with the country code +1

<RDN>

The RDN tag gets replaced with the RDN of the entry. Use this in the template after you have specified rdnAttr so that the RDN has already been generated when this tag is replaced.

An optional integer argument specifies the subcomponents of the RDN to generate.

<Sequential>

The Sequential tag gets replaced by a sequentially increasing generated integer. The first optional integer argument specifies the starting number. The second optional boolean argument specifies whether to start over when generating entries for a new parent entry. For example, <Sequential>:42:true starts counting from 42, and starts over when the parent entry changes from o=Engineering to o=Marketing.

<_DN>

The _DN tag gets replaced by the DN of the current entry with underscores in the place of commas.

<_ParentDN>

The _ParentDN tag gets replaced by the DN the parent entry with underscores in the place of commas.

Examples

The following example generates 10 organization units, each containing 50 entries.

define suffix=dc=example,dc=com
define maildomain=example.com
define numusers=50
define numorgs=10

branch: [suffix]

branch: ou=People,[suffix]
subordinateTemplate: orgunit:[numorgs]
description: This is the People container
telephoneNumber: +33 00010002

template: orgunit
subordinateTemplate: person:[numusers]
rdnAttr: ou
ou: Org-<sequential:0>
objectClass: top
objectClass: organizationalUnit
description: This is the {ou} organizational unit

template: person
rdnAttr: uid
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
givenName: <first>
sn: <last>
cn: {givenName} {sn}
initials: {givenName:1}<random:chars:ABCDEFGHIJKLMNOPQRSTUVWXYZ:1>{sn:1}
employeeNumber: <sequential:0>
uid: user.{employeeNumber}
mail: {uid}@[maildomain]
userPassword: password
telephoneNumber: <random:telephone>
homePhone: <random:telephone>
pager: <random:telephone>
mobile: <random:telephone>
street: <random:numeric:5> <file:streets> Street
l: <file:cities>
st: <file:states>
postalCode: <random:numeric:5>
postalAddress: {cn}${street}${l}, {st}  {postalCode}
description: This is the description for {cn}.

manage-account(1)

Name

manage-account - manage state of OpenDJ server accounts

Synopsis

manage-account {subcommand} {options}

Description

This utility can be used to retrieve and manipulate the values of password policy state variables.

Options

The manage-account command takes the following options:

Command options:

-b | --targetDN {targetDN}: The DN of the user entry for which to get and set password policy state information.

LDAP connection options:

-D | --bindDN {bindDN}: The DN to use to bind to the server.
-h | --hostname {host}: Directory server hostname or IP address.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: The path to the file containing the bind password.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of certificate for SSL client authentication.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: The password to use to bind to the server.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Subcommands

The manage-account command supports the following subcommands:

manage-account clear-account-is-disabled

Clear account disabled state information from the user account.

manage-account get-account-expiration-time

Display when the user account will expire.

manage-account get-account-is-disabled

Display information about whether the user account has been administratively disabled.

manage-account get-all

Display all password policy state information for the user.

manage-account get-authentication-failure-times

Display the authentication failure times for the user.

Display the grace login use times for the user.

Display the time that the user last authenticated to the server.

manage-account get-password-changed-by-required-time

Display the required password change time with which the user last complied.

manage-account get-password-changed-time

Display the time that the user’s password was last changed.

manage-account get-password-expiration-warned-time

Display the time that the user first received an expiration warning notice.

manage-account get-password-history

Display password history state values for the user.

manage-account get-password-is-reset

Display information about whether the user will be required to change his or her password on the next successful authentication.

manage-account get-password-policy-dn

Display the DN of the password policy for the user.

manage-account get-remaining-authentication-failure-count

Display the number of remaining authentication failures until the user’s account is locked.

Display the number of grace logins remaining for the user.

manage-account get-seconds-until-account-expiration

Display the length of time in seconds until the user account expires.

manage-account get-seconds-until-authentication-failure-unlock

Display the length of time in seconds until the authentication failure lockout expires.

manage-account get-seconds-until-idle-lockout

Display the length of time in seconds until user’s account is locked because it has remained idle for too long.

manage-account get-seconds-until-password-expiration

Display length of time in seconds until the user’s password expires.

manage-account get-seconds-until-password-expiration-warning

Display the length of time in seconds until the user should start receiving password expiration warning notices.

manage-account get-seconds-until-password-reset-lockout

Display the length of time in seconds until user’s account is locked because the user failed to change the password in a timely manner after an administrative reset.

manage-account get-seconds-until-required-change-time

Display the length of time in seconds that the user has remaining to change his or her password before the account becomes locked due to the required change time.

manage-account set-account-is-disabled

Specify whether the user account has been administratively disabled.

Options

-O | --operationValue {true|false}: 'true' to indicate that the account is disabled, or 'false' to indicate that it is not disabled.

Exit Codes

0: The command completed successfully.
89: An error occurred while parsing the command-line arguments.

Examples

For the following examples the directory admin user, Kirsten Vaughan, has ds-privilege-name: password-reset and the following ACI on ou=People,dc=example,dc=com.

(target="ldap:///ou=People,dc=example,dc=com") (targetattr ="*||+")(
 version 3.0;acl "Admins can run amok"; allow(all) groupdn =
 "ldap:///cn=Directory Administrators,ou=Groups,dc=example,dc=com";)

The following command locks a user account.

$ manage-account -p 4444 -D "uid=kvaughan,ou=people,dc=example,dc=com" \
 -w bribery set-account-is-disabled -O true \
 -b uid=bjensen,ou=people,dc=example,dc=com -X
Account Is Disabled:  true

The following command unlocks a user account.

$ manage-account -p 4444 -D "uid=kvaughan,ou=people,dc=example,dc=com" \
 -w bribery clear-account-is-disabled \
 -b uid=bjensen,ou=people,dc=example,dc=com -X
Account Is Disabled:  false

manage-tasks(1)

Name

manage-tasks - manage OpenDJ server administration tasks

Synopsis

manage-tasks

Description

This utility can be used to obtain a list of tasks scheduled to run within the Directory Server as well as information about individual tasks.

Options

The manage-tasks command takes the following options:

Command options:

-c | --cancel {taskID}: ID of a particular task to cancel.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-i | --info {taskID}: ID of a particular task about which this tool will display information.
-s | --summary: Print a summary of tasks.

Default: false

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example demonstrates use of the command with a server that does daily backups at 2:00 AM.

$ manage-tasks -p 4444 -h opendj.example.com -D "cn=Directory Manager" \
 -w password -s

  ID                                Type    Status
  ---------------------------------------------------------------
  example-backup                    Backup  Recurring
  example-backup-20110622020000000  Backup  Waiting on start time

rebuild-index(1)

Name

rebuild-index - rebuild index after configuration change

Synopsis

rebuild-index

Description

This utility can be used to rebuild index data within an indexed backend database.

Options

The rebuild-index command takes the following options:

Command options:

-b | --baseDN {baseDN}: Base DN of a backend supporting indexing. Rebuild is performed on indexes within the scope of the given base DN.
--clearDegradedState: Indicates that indexes do not need rebuilding because they are known to be empty and forcefully marks them as valid. This is an advanced option which must only be used in cases where a degraded index is known to be empty and does not therefore need rebuilding. This situation typically arises when an index is created for an attribute which has just been added to the schema.

Default: false
-i | --index {index}: Names of index(es) to rebuild. For an attribute index this is simply an attribute name. At least one index must be specified for rebuild. Cannot be used with the "--rebuildAll" option.
--offline: Indicates that the command must be run in offline mode.

Default: false
--rebuildAll: Rebuild all indexes, including any DN2ID, DN2URI, VLV and extensible indexes. Cannot be used with the "-i" option or the "--rebuildDegraded" option.

Default: false
--rebuildDegraded: Rebuild all degraded indexes, including any DN2ID, DN2URI, VLV and extensible indexes. Cannot be used with the "-i" option or the "--rebuildAll" option.

Default: false
--tmpdirectory {directory}: Path to temporary directory for index scratch files during index rebuilding.

Default: import-tmp

Task Backend Connection Options

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Task Scheduling Options

--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example schedules a task to start immediately that rebuilds the cn (common name) index.

$ rebuild-index -p 4444 -h opendj.example.com -D "cn=Directory Manager" \
 -w password -b dc=example,dc=com -i cn -t 0
Rebuild Index task 20110607160349596 scheduled to start Jun 7, 2011 4:03:49 PM

restore(1)

Name

restore - restore OpenDJ directory data backups

Synopsis

restore

Description

This utility can be used to restore a backup of a Directory Server backend.

Options

The restore command takes the following options:

Command options:

-d | --backupDirectory {backupDir}: Path to the directory containing the backup file(s).
-I | --backupID {backupID}: Backup ID of the backup to restore.
-l | --listBackups: List available backups in the backup directory.

Default: false
-n | --dry-run: Verify the contents of the backup but do not restore it.

Default: false
--offline: Indicates that the command must be run in offline mode.

Default: false

Task Backend Connection Options

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Task Scheduling Options

--completionNotify {emailAddress}: Email address of a recipient to be notified when the task completes. This option may be specified more than once.
--dependency {taskID}: ID of a task upon which this task depends. A task will not start execution until all its dependencies have completed execution.
--errorNotify {emailAddress}: Email address of a recipient to be notified if an error occurs when this task executes. This option may be specified more than once.
--failedDependencyAction {action}: Action this task will take should one if its dependent tasks fail. The value must be one of PROCESS,CANCEL,DISABLE. If not specified defaults to CANCEL.
--recurringTask {schedulePattern}: Indicates the task is recurring and will be scheduled according to the value argument expressed in crontab(5) compatible time/date pattern.
-t | --start {startTime}: Indicates the date/time at which this operation will start when scheduled as a server task expressed in YYYYMMDDhhmmssZ format for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the task to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example schedules a restore as a task to begin immediately while OpenDJ directory server is online.

$ restore -p 4444 -D "cn=Directory Manager" -w password
 -d /path/to/opendj/bak -I 20110613080032 -t 0
Restore task 20110613155052932 scheduled to start Jun 13, 2011 3:50:52 PM CEST

The following example restores data while OpenDJ is offline.

$ stop-ds
Stopping Server...
...

$ restore --backupDirectory /path/to/opendj/bak/userRoot \
 --listBackups
Backup ID:          20120928102414Z
Backup Date:        28/Sep/2012:12:24:17 +0200
Is Incremental:     false
Is Compressed:      false
Is Encrypted:       false
Has Unsigned Hash:  false
Has Signed Hash:    false
Dependent Upon:     none

$ restore --backupDirectory /path/to/opendj/bak/userRoot \
 --backupID 20120928102414Z
[28/Sep/2012:12:26:20 +0200] ... msg=Restored: 00000000.jdb (size 355179)

$ start-ds
[28/Sep/2012:12:27:29 +0200] ... The Directory Server has started successfully

setup(1)

Name

setup - install OpenDJ directory server

Synopsis

setup

Description

This utility can be used to setup the Directory Server.

Options

The setup command takes the following options:

Command options:

-a | --addBaseEntry: Indicates whether to create the base entry in the Directory Server database.

Default: false
--acceptLicense: Automatically accepts the product license (if present).

Default: false
--adminConnectorPort {port}: Port on which the Administration Connector should listen for communication.

Default: 4444
-b | --baseDN {baseDN}: Base DN for user information in the Directory Server. Multiple base DNs may be provided by using this option multiple times.
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-d | --sampleData {numEntries}: Specifies that the database should be populated with the specified number of sample entries.

Default: 0
-D | --rootUserDN {rootUserDN}: DN for the initial root user for the Directory Server.

Default: cn=Directory Manager
--generateSelfSignedCertificate: Generate a self-signed certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.

Default: false
-h | --hostname {host}: The fully-qualified directory server host name that will be used when generating self-signed certificates for LDAP SSL/StartTLS, the administration connector, and replication.

Default: localhost.localdomain
-i | --cli: Use the command line install. If not specified the graphical interface will be launched. The rest of the options (excluding help and version) will only be taken into account if this option is specified.

Default: false
-j | --rootUserPasswordFile {rootUserPasswordFile}: Path to a file containing the password for the initial root user for the Directory Server.
-l | --ldifFile {ldifFile}: Path to an LDIF file containing data that should be added to the Directory Server database. Multiple LDIF files may be provided by using this option multiple times.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-O | --doNotStart: Do not start the server when the configuration is completed.

Default: false
-p | --ldapPort {port}: Port on which the Directory Server should listen for LDAP communication.

Default: 1389
-q | --enableStartTLS: Enable StartTLS to allow secure communication with the server using the LDAP port.

Default: false
-R | --rejectFile {rejectFile}: Write rejected entries to the specified file.
-S | --skipPortCheck: Skip the check to determine whether the specified ports are usable.

Default: false
--skipFile {skipFile}: Write skipped entries to the specified file.
-t | --backendType {backendType}: The type of the userRoot backend.

Default: je for standard edition, pdb for OEM edition.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate (JKS, JCEKS, PKCS#12 or PKCS#11) as server certificate.
--useBcfksKeystore {keyStorePath}: Path of a BCFKS key store containing the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
--useJavaKeystore {keyStorePath}: Path of a Java Key Store (JKS) containing a certificate to be used as the server certificate. This does not apply to the administration connector, which uses its own key store and certificate (default: config/admin-keystore and admin-cert).
--useJCEKS {keyStorePath}: Path of a JCEKS containing a certificate to be used as the server certificate.
--usePkcs11Keystore: Use a certificate in a PKCS#11 token that the server should use when accepting SSL-based connections or performing StartTLS negotiation.

Default: false
--usePkcs12keyStore {keyStorePath}: Path of a PKCS#12 key store containing the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-w | --rootUserPassword {rootUserPassword}: Password for the initial root user for the Directory Server.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate (JKS, JCEKS, PKCS#12 or PKCS#11) as server certificate.
-x | --jmxPort {jmxPort}: Port on which the Directory Server should listen for JMX communication.

Default: 1689
-Z | --ldapsPort {port}: Port on which the Directory Server should listen for LDAPS communication. The LDAPS port will be configured and SSL will be enabled only if this argument is explicitly specified.

Default: 1636

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode.

Default: false
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following command installs OpenDJ directory server, enabling StartTLS and importing 100 example entries without interaction.

$ /path/to/opendj/setup --cli -b dc=example,dc=com -d 100 \
 -D "cn=Directory Manager" -w password -h opendj.example.com -p 1389 \
 --generateSelfSignedCertificate --enableStartTLS -n

OpenDJ version
 Please wait while the setup program initializes...

See /var/.../opends-setup-484...561.log for a detailed log of this operation.

Configuring Directory Server ..... Done.
Configuring Certificates ..... Done.
Importing Automatically-Generated Data (100 Entries) ......... Done.
Starting Directory Server .......... Done.

To see basic server configuration status and configuration you can launch
 /path/to/opendj/bin/status

start-ds(1)

Name

start-ds - start OpenDJ directory server

Synopsis

start-ds

Description

This utility can be used to start the Directory Server, as well as to obtain the server version and other forms of general server information.

Options

The start-ds command takes the following options:

Command options:

-L | --useLastKnownGoodConfig: Attempt to start using the configuration that was in place at the last successful startup (if it is available) rather than using the current active configuration.

Default: false
-N | --nodetach: Do not detach from the terminal and continue running in the foreground. This option cannot be used with the -t, --timeout option.

Default: false
-s | --systemInfo: Display general system information.

Default: false
-t | --timeout {seconds}: Maximum time (in seconds) to wait before the command returns (the server continues the startup process, regardless). A value of '0' indicates an infinite timeout, which means that the command returns only when the server startup is completed. The default value is 60 seconds. This option cannot be used with the -N, --nodetach option.

Default: 200

Utility input/output options:

-Q | --quiet: Use quiet mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following command starts the server without displaying information about the startup process.

$ start-ds -Q

status(1)

Name

status - display basic OpenDJ server information

Synopsis

status {options}

Description

This utility can be used to display basic server information.

Options

The status command takes the following options:

Command options:

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.

Default: cn=Directory Manager
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-r | --refresh {period}: When this argument is specified, the status command will display its contents periodically. Used to specify the period (in seconds) between two displays of the status.
-s | --script-friendly: Use script-friendly mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

$ status -D "cn=Directory Manager" -w password

          --- Server Status ---
Server Run Status:        Started
Open Connections:         1

          --- Server Details ---
Host Name:                localhost.localdomain
Administrative Users:     cn=Directory Manager
Installation Path:        /path/to/opendj
Version:                  OpenDJ version
Java Version:             version
Administration Connector: Port 4444 (LDAPS)

          --- Connection Handlers ---
Address:Port : Protocol    : State
-------------:-------------:---------
--           : LDIF        : Disabled
8989         : Replication : Enabled
0.0.0.0:161  : SNMP        : Disabled
0.0.0.0:636  : LDAPS       : Disabled
0.0.0.0:1389 : LDAP        : Enabled
0.0.0.0:1689 : JMX         : Disabled

          --- Data Sources ---
Base DN:                      dc=example,dc=com
Backend ID:                   userRoot
Entries:                      160
Replication:                  Enabled
Missing Changes:              0
Age of Oldest Missing Change: <not available>

Base DN:     dc=myCompany,dc=com
Backend ID:  myCompanyRoot
Entries:     3
Replication: Disabled

Base DN:     o=myOrg
Backend ID:  myOrgRoot
Entries:     3
Replication: Disabled

stop-ds(1)

Name

stop-ds - stop OpenDJ directory server

Synopsis

stop-ds

Description

This utility can be used to request that the Directory Server stop running or perform a restart. When run without connection options, this utility sends a signal to the OpenDJ process to stop the server. When run with connection options, this utility connects to the OpenDJ administration port and creates a shutdown task to stop the server.

Options

The stop-ds command takes the following options:

Command options:

-r | --stopReason {stopReason}: Reason the server is being stopped or restarted.
-R | --restart: Attempt to automatically restart the server once it has stopped.

Default: false
-t | --stopTime {stopTime}: Indicates the date/time at which the shutdown operation will begin as a server task expressed in format YYYYMMDDhhmmssZ for UTC time or YYYYMMDDhhmmss for local time. A value of '0' will cause the shutdown to be scheduled for immediate execution. When this option is specified the operation will be scheduled to start at the specified time after which this utility will exit immediately.
-Y | --proxyAs {authzID}: Use the proxied authorization control with the given authorization ID.

LDAP connection options:

-D | --bindDN {bindDN}: DN to use to bind to the server.
-h | --hostname {host}: Directory server hostname or IP address.

Default: localhost.localdomain
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of certificate for SSL client authentication.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server administration port number.

Default: 4444
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following example restarts OpenDJ directory server.

$ stop-ds --restart
Stopping Server...

...The Directory Server has started successfully

uninstall(1)

Name

uninstall - remove OpenDJ directory server software

Synopsis

uninstall {options}

Description

This utility can be used to uninstall the Directory Server.

Options

The uninstall command takes the following options:

Command options:

-a | --remove-all: Remove all components of the server (this option is not compatible with the rest of remove options).

Default: false
-b | --backup-files: Remove backup files.

Default: false
-c | --configuration-files: Remove configuration files.

Default: false
--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out.

Default: 30000
-d | --databases: Remove database contents.

Default: false
-e | --ldif-files: Remove LDIF files.

Default: false
-f | --forceOnError: Specifies whether the uninstall should continue if there is an error updating references to this server in remote server instances or not. This option can only be used with the --no-prompt no prompt option.

Default: false
-i | --cli: Use the command line install. If not specified the graphical interface will be launched. The rest of the options (excluding help and version) will only be taken into account if this option is specified.

Default: false
-l | --server-libraries: Remove Server Libraries and Administrative Tools.

Default: false
-L | --log-files: Remove log files.

Default: false

LDAP connection options:

-h | --referencedHostName {host}: The name of this host (or IP address) as it is referenced in remote servers for replication.

Default: localhost.localdomain
-I | --adminUID {adminUID}: User ID of the Global Administrator to use to bind to the server.

Default: admin
-j | --bindPasswordFile {bindPasswordFile}: Bind password file.
-K | --keyStorePath {keyStorePath}: Certificate key store path.
-N | --certNickname {nickname}: Nickname of the certificate that the server should use when accepting SSL-based connections or performing StartTLS negotiation.
-o | --saslOption {name=value}: SASL bind options.
-P | --trustStorePath {trustStorePath}: Certificate trust store path.
-T | --trustStorePassword {trustStorePassword}: Certificate trust store PIN.
-u | --keyStorePasswordFile {keyStorePasswordFile}: Certificate key store PIN file. A PIN is required when you specify to use an existing certificate as server certificate.
-U | --trustStorePasswordFile {path}: Certificate trust store PIN file.
-w | --bindPassword {bindPassword}: Password to use to bind to the server. Use -w - to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword {keyStorePassword}: Certificate key store PIN. A PIN is required when you specify to use an existing certificate as server certificate.
-X | --trustAll: Trust all server SSL certificates.

Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values.

Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-Q | --quiet: Use quiet mode.

Default: false
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Examples

The following command removes OpenDJ directory server without interaction.

$ /path/to/opendj/uninstall -a --cli -I admin -w password -n

Stopping Directory Server ..... Done.
Deleting Files under the Installation Path ..... Done.

The Uninstall Completed Successfully.
To complete the uninstallation, you must delete manually the following files
and directories:
/path/to/opendj/lib
See /var/.../opends-uninstall-3...0.log for a detailed log of this operation.

$ rm -rf /path/to/opendj

upgrade(1)

Name

upgrade - upgrade OpenDJ configuration and application data

Synopsis

upgrade {options}

Description

Upgrades OpenDJ configuration and application data so that it is compatible with the installed binaries.

This tool should be run immediately after upgrading the OpenDJ binaries and before restarting the server.

this tool does not provide backup or restore capabilities. Therefore, it is the responsibility of the OpenDJ administrator to take necessary precautions before performing the upgrade.

<xinclude:include href="description-upgrade.xml" />

Options

The upgrade command takes the following options:

Command options:

--acceptLicense: Automatically accepts the product license (if present).

Default: false
--force: Forces a non-interactive upgrade to continue even if it requires user interaction. In particular, long running or critical upgrade tasks, such as re-indexing, which require user confirmation will be skipped. This option may only be used with the 'no-prompt' option.

Default: false
--ignoreErrors: Ignores any errors which occur during the upgrade. This option should be used with caution and may be useful in automated deployments where potential errors are known in advance and resolved after the upgrade has completed.

Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail.

Default: false
-Q | --quiet: Use quiet mode.

Default: false
-v | --verbose: Use verbose mode.

Default: false

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
2: The command was run in non-interactive mode, but could not complete because confirmation was required to run a long or critical task.

See the error message or the log for details.
other: An error occurred.

See the OpenDJ Installation Guide for an example upgrade process for OpenDJ directory server installed from the cross-platform (.zip) delivery.

Native packages (.deb, .rpm) perform more of the upgrade process, stopping OpenDJ if it is running, overwriting older files with newer files, running this utility, and starting OpenDJ if it was running when you upgraded the package(s).

verify-index(1)

Name

verify-index - check index for consistency or errors

Synopsis

verify-index

Description

This utility can be used to ensure that index data is consistent within an indexed backend database.

Options

The verify-index command takes the following options:

Command options:

-b | --baseDN {baseDN}: Base DN of a backend supporting indexing. Verification is performed on indexes within the scope of the given base DN.
-c | --clean: Specifies that a single index should be verified to ensure it is clean. An index is clean if each index value references only entries containing that value. Only one index at a time may be verified in this way.

Default: false
--countErrors: Count the number of errors found during the verification and return that value as the exit code (values > 255 will be reduced to 255 due to exit code restrictions).

Default: false
-i | --index {index}: Name of an index to be verified. For an attribute index this is simply an attribute name. Multiple indexes may be verified for completeness, or all indexes if no indexes are specified. An index is complete if each index value references all entries containing that value.

General options:

-V | --version: Display Directory Server version information.

Default: false

-H | --help: Display this usage information.

Default: false

Exit Codes

0: The command completed successfully.
1: The command was run in non-interactive mode, but could not complete because confirmation was required to run a long or critical task.

See the error message or the log for details.
0-255: The number of errors in the index, as indicated for the --countErrors option.

Examples

The following example shows how to verify the sn (surname) index for completeness and for errors. The messages shown are for a backend of type pdb. The output is similar for other backend types:

$ verify-index -b dc=example,dc=com -i sn --clean --countErrors
[20/05/2015:14:24:18 +0200] category=...PDBStorage seq=0 severity=INFO
 msg=The PDB storage for backend 'userRoot' initialized
 to use 57528 buffers of 16384 bytes (total 920448kb)
[20/05/2015:14:24:18 +0200] category=...pluggable.VerifyJob seq=1 severity=INFO
 msg=Checked 478 records and found 0 error(s) in 0 seconds
 (average rate 3594.0/sec)
[20/05/2015:14:24:18 +0200] category=...pluggable.VerifyJob seq=2 severity=FINE
 msg=Number of records referencing more than one entry: 224
[20/05/2015:14:24:18 +0200] category=...pluggable.VerifyJob seq=3 severity=FINE
 msg=Number of records that exceed the entry limit: 0
[20/05/2015:14:24:18 +0200] category=...pluggable.VerifyJob seq=4 severity=FINE
 msg=Average number of entries referenced is 2.00/record
[20/05/2015:14:24:18 +0200] category=...pluggable.VerifyJob seq=5 severity=FINE
 msg=Maximum number of entries referenced by any record is 32

windows-service(1)

Name

windows-service - register OpenDJ as a Windows Service

Synopsis

windows-service {options}

Description

This utility can be used to run OpenDJ directory server as a Windows Service.

Service Options

-c, --cleanupService serviceName: Disable the service and clean up the windows registry information associated with the provided service name
-d, --disableService: Disable the server as a Windows service and stop the server
-e, --enableService: Enable the server as a Windows service
-s, --serviceState: Provide information about the state of the server as a Windows service

General Options

-V, --version: Display version information
-?, -H, --help: Display usage information

Exit Codes

0: The command completed successfully.
> 0: An error occurred.

Example

The following command registers OpenDJ directory server as a Windows Service.

C:\path\to\opendj\bat> windows-service.bat --enableService

After running this command, you can manage the service using Windows administration tools.