Skip Headers

Oracle Internet Directory Application Developer's Guide
Release 2 (9.0.2)

Part Number A95193-01
Go To Documentation Library
Home
Go To Product List
Solution Area
Go To Table Of Contents
Contents
Go To Index
Index

Go to previous page Go to next page

9
Command-Line Tools Syntax

This chapter provides syntax, usage notes, and examples for using LDAP Data Interchange Format (LDIF) and LDAP command-line tools. It contains these topics:

LDAP Data Interchange Format (LDIF) Syntax

The standardized file format for directory entries is as follows:

dn: distinguished_name
attribute_type: attribute_value
.
.
. objectClass: object_class_value .
.
.

Property Value Description

dn:

RDN,RDN,RDN, ...

Separate RDNs with commas.

attribute:

attribute_value

This line repeats for every attribute in the entry, and for every attribute value in multi-valued attributes.

objectClass:

object_class_ value

This line repeats for every object class.

The following example shows a file entry for an employee. The first line contains the DN. The lines that follow the DN begin with the mnemonic for an attribute, followed by the value to be associated with that attribute. Note that each entry ends with lines defining the object classes for the entry.

dn: cn=Suzie Smith,ou=Server Technology,o=Acme, c=US
cn: Suzie Smith
cn: SuzieS
sn: Smith
email: ssmith@us.Acme.com
telephoneNumber: 69332
photo:/ORACLE_HOME/empdir/photog/ssmith.jpg
objectClass: organizational person
objectClass: person objectClass: top

The next example shows a file entry for an organization.

dn: o=Acme,c=US
o: Acme
ou: Financial Applications
objectClass: organization 
objectClass: top

LDIF Formatting Notes

A list of formatting rules follows. This list is not exhaustive.

Command-Line Tools Syntax

This section tells you how to use the following tools:

ldapadd Syntax

The ldapadd command-line tool enables you to add entries, their object classes, attributes, and values to the directory. To add attributes to an existing entry, use the ldapmodify command, explained in "ldapmodify Syntax".

See Also:

Oracle Internet Directory Administrator's Guide. for an explanation of using ldapadd to configure a server with an input file

ldapadd uses this syntax:

ldapadd [arguments] -f filename

where filename is the name of an LDIF file written with the specifications explained in the section "LDAP Data Interchange Format (LDIF) Syntax".

The following example adds the entry specified in the LDIF file my_ldif_file.ldi:

ldapadd -p 389 -h myhost -f my_ldif_file.ldi

Optional Arguments Descriptions

-b

Specifies that you have included binary file names in the file, which are preceded by a forward slash character. The tool retrieves the actual values from the file referenced.

-c

Tells ldapadd to proceed in spite of errors. The errors will be reported. (If you do not use this option, ldapadd stops when it encounters an error.)

-D binddn

When authenticating to the directory, specifies doing so as the entry specified in binddn. Use this with the -w password option.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-f filename

Specifies the input name of the LDIF format import data file. For a detailed explanation of how to format an LDIF file, see "LDAP Data Interchange Format (LDIF) Syntax".

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-K

Same as -k, but performs only the first step of the Kerberos bind

-k

Authenticates using Kerberos authentication instead of simple authentication. To enable this option, you must compile with KERBEROS defined.

You must already have a valid ticket granting ticket.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would occur without actually performing the operation

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p directory_server_port_number

Connects to the directory on TCP port directory_server_port_number. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapaddmt Syntax

ldapaddmt is like ldapadd: It enables you to add entries, their object classes, attributes, and values to the directory. It is unlike ldapadd in that it supports multiple threads for adding entries concurrently.

While it is processing LDIF entries, ldapaddmt logs errors in the add.log file in the current directory.

ldapaddmt uses this syntax:

ldapaddmt -T number_of_threads -h host -p port -f filename

where filename is the name of an LDIF file written with the specifications explained in the section "LDAP Data Interchange Format (LDIF) Syntax".

The following example uses five concurrent threads to process the entries in the file myentries.ldif.

ldapaddmt -T 5 -h node1 -p 3000 -f myentries.ldif


Note:

Increasing the number of concurrent threads improves the rate at which LDIF entries are created, but consumes more system resources.


Optional Arguments Descriptions

-b

Specifies that you have included binary file names in the data file, which are preceded by a forward slash character. The tool retrieves the actual values from the file referenced.

-c

Tells the tool to proceed in spite of errors. The errors will be reported. (If you do not use this option, the tool stops when it encounters an error.)

-D binddn

When authenticating to the directory, specifies doing so as the entry is specified in binddn. Use this with the -w password option.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-K

Same as -k, but performs only the first step of the kerberos bind

-k

Authenticates using Kerberos authentication instead of simple authentication. To enable this option, you must compile with KERBEROS defined.

You must already have a valid ticket granting ticket.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would occur without actually performing the operation.

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-T

Sets the number of threads for concurrently processing entries

-U SSLAuth

Specifies SSL Authentication Mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapbind Syntax

The ldapbind command-line tool enables you to see whether you can authenticate a client to a server.

ldapbind uses this syntax:

ldapbind [arguments]

Optional Arguments Descriptions

-D binddn

When authenticating to the directory, specifies doing so as the entry specified in binddn. Use this with the -w password option.

-E ".character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-n

Shows what would occur without actually performing the operation

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies the wallet password required for one-way or two-way SSL connections

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapcompare Syntax

The ldapcompare command-line tool enables you to match attribute values you specify in the command line with the attribute values in the directory entry.

ldapcompare uses this syntax:

ldapcompare [arguments]

The following example tells you whether Person Nine's title is associate.

ldapcompare -p 389 -h myhost -b "cn=Person Nine, ou=EuroSInet Suite, o=IMC, 
c=US" -a title -v associate

Mandatory Arguments Descriptions

-a attribute name

Specifies the attribute on which to perform the compare

-b "basedn"

Specifies the distinguished name of the entry on which to perform the compare

-v attribute value

Specifies the attribute value to compare

Optional Arguments Descriptions

-D binddn

When authenticating to the directory, specifies doing so as the entry is specified in binddn. Use this with the -w password option.

-d debug-level

Sets the debugging level. See the chapter on managing a directory server in Oracle Internet Directory Administrator's Guide.

-E "character_set"

Specifies native character set encoding. See chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-f filename

Specifies the input filename

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password (required for one-way or two-way SSL connections)

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapdelete Syntax

The ldapdelete command-line tool enables you to remove entire entries from the directory that you specify in the command line.

ldapdelete uses this syntax:

ldapdelete [arguments] ["entry_DN" | -f input_filename]

Note:

If you specify the entry DN, then do not use the -f option.


The following example uses port 389 on a host named myhost.

ldapdelete -p 389 -h myhost "ou=EuroSInet Suite, o=IMC, c=US"

Optional Arguments Descriptions

-D binddn

When authenticating to the directory, uses a full DN for the binddn parameter; typically used with the -w password option.

-d debug-level

Sets the debugging level. See the chapter on managing a directory server in Oracle Internet Directory Administrator's Guide.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-f input_filename

Specifies the input filename

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-k

Authenticates using authentication instead of simple authentication. To enable this option, you must compile with Kerberos defined.

You must already have a valid ticket granting ticket.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would be done, but doesn't actually delete

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect.

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapmoddn Syntax

The ldapmoddn command-line tool enables you to modify the DN or RDN of an entry.

ldapmoddn uses this syntax:

ldapmoddn [arguments]

The following example uses ldapmoddn to modify the RDN component of a DN from "cn=dcpl" to "cn=thanh mai". It uses port 389, and a host named myhost.

ldapmoddn -p 389 -h myhost -b "cn=dcpl,dc=Americas,dc=imc,dc=com" -R "cn=thanh 
mai"

Mandatory Argument Description

-b "basedn"

Specifies DN of the entry to be moved

Optional Arguments Descriptions

-D binddn

When authenticating to the directory, do so as the entry is specified in binddn. Use this with the -w password option.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-f filename

Specifies the input filename

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-N newparent

Specifies new parent of the RDN

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-r

Specifies that the old RDN is not retained as a value in the modified entry. If this argument is not included, the old RDN is retained as an attribute in the modified entry.

-R newrdn

Specifies new RDN

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Provides the password required to connect.

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapmodify Syntax

The ldapmodify tool enables you to act on attributes.

ldapmodify uses this syntax:

ldapmodify [arguments] -f filename

where filename is the name of an LDIF file written with the specifications explained the section "LDAP Data Interchange Format (LDIF) Syntax".

The list of arguments in the following table is not exhaustive.

Optional Arguments Description

-a

Denotes that entries are to be added, and that the input file is in LDIF format.

-b

Specifies that you have included binary file names in the data file, which are preceded by a forward slash character.

-c

Tells ldapmodify to proceed in spite of errors. The errors will be reported. (If you do not use this option, ldapmodify stops when it encounters an error.)

-D binddn

When authenticating to the directory, specifies doing so as the entry is specified in binddn. Use this with the -w password option.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would occur without actually performing the operation.

-o log_file_name

Can be used with the -c option to write the erroneous LDIF entries in the logfile. You must specify the absolute path for the log file name.

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Overrides the default, unauthenticated, null bind. To force authentication, use this option with the -D option.

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

To run modify, delete, and modifyrdn operations using the -f flag, use LDIF for the input file format (see "LDAP Data Interchange Format (LDIF) Syntax") with the specifications noted below:

If you are making several modifications, then, between each modification you enter, add a line that contains a hyphen (-) only. For example:

dn:cn=Barbara Fritchy,ou=Sales,o=Oracle,c=US
changetype:modify
add: work-phone
work-phone:510/506-7000
work-phone:510/506-7001
-
delete: home-fax

Unnecessary space characters in the LDIF input file, such as a space at the end of an attribute value, will cause the LDAP operations to fail.

Line 1: Every change record has, as its first line, the literal dn: followed by the DN value for the entry, for example:

dn:cn=Barbara Fritchy,ou=Sales,o=Oracle,c=US

Line 2: Every change record has, as its second line, the literal "changetype:" followed by the type of change (add, delete, modify, modrdn), for example:

changetype:modify

or

changetype:modrdn

Format the remainder of each record according to the following requirements for each type of change:

Example: Using ldapmodify to Add an Attribute

This example adds a new attribute called myAttr. The LDIF file for this operation is:

dn: cn=subschemasubentry 
changetype: modify 
add: attributetypes 
attributetypes: (1.2.3.4.5.6.7 NAME `myAttr' DESC `New attribute definition' 
EQUALITY caseIgnoreMatch SYNTAX
`1.3.6.1.4.1.1466.115.121.1.15' ) 

On the first line, enter the DN specifying where this new attribute is to be located. All attributes and object classes they are stored in cn=subschemasubentry.

The second and third lines show the proper format for adding a new attribute.

The last line is the attribute definition itself. The first part of this is the object identifier number: 1.2.3.4.5.6.7. It must be unique among all other object classes and attributes. Next is the NAME of the attribute. In this case the attribute NAME is myAttr. It must be surrounded by single quotes. Next is a description of the attribute. Enter whatever description you want between single quotes. At the end of this attribute definition in this example are optional formatting rules to the attribute. In this case we are adding a matching rule of EQUALITY caseIgnoreMatch and a SYNTAX of Directory String. This example uses the object ID number of 1.3.6.1.4.1.1466.115.121.1.15 instead of the SYNTAXES name which is "Directory String".

Put your attribute information in a file formatted like this example. Then run the following command to add the attribute to the schema of your Oracle directory server.

ldapmodify -h yourhostname -p 389 -D orcladmin -w "welcome" -v -f 
/tmp/newattr.ldif 

This ldapmodify command assumes that your Oracle directory server is running on port 389, that your super user account name is orcladmin, that your super user password is welcome and that the name of your LDIF file is newattr.ldif. Substitute the host name of your computer where you see yourhostname.

If you are not in the directory where the LDIF file is located, then you must enter the full directory path to the file at the end of your command. This example assumes that your LDIF file is located in the /tmp directory.

ldapmodifymt Syntax

The ldapmodifymt command-line tool enables you to modify several entries concurrently.

ldapmodifymt uses this syntax:

ldapmodifymt -T number_of_threads [arguments] -f filename

where filename is the name of an LDIF file written with the specifications explained the section "LDAP Data Interchange Format (LDIF) Syntax".

See Also:

"ldapmodify Syntax" for additional formatting specifications used by ldapmodifymt

For example:

ldapmodifymt -T 5 -h node1 -p 3000 -f myentries.ldif

Optional Arguments Descriptions

-a

Denotes that entries are to be added, and that the input file is in LDIF format. (If you are running ldapadd, this flag is not required.)

-b

Specifies that you have included binary file names in the data file, which are preceded by a forward slash character.

-c

Tells ldapmodify to proceed in spite of errors. The errors will be reported. (If you do not use this option, ldapmodify stops when it encounters an error.)

-D "binddn"

When authenticating to the directory, specifies doing so as the entry is specified in binddn. Use this with the -w password option.

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would occur without actually performing the operation.

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password required for one-way or two-way SSL connections

-T

Sets the number of threads for concurrently processing entries

-U SSLAuth

Specifies SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w password

Overrides the default, unauthenticated, null bind. To force authentication, use this option with the -D option.

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

ldapsearch Syntax

The ldapsearch command-line tool enables you to search for and retrieve specific entries in the directory.

ldapsearch uses this syntax:

ldapsearch [arguments] filter [attributes]

The filter format must be compliant with RFC-2254.

See Also:

http://www.ietf.org/rfc/rfc2254.txt for further information about the standard for the filter format

Separate attributes with a space. If you do not list any attributes, all attributes are retrieved.

Mandatory Arguments Descriptions

-b "basedn"

Specifies the base DN for the search

-s scope

Specifies search scope: base, one, or sub.

Optional Arguments Descriptions

-A

Retrieves attribute names only (no values)

-a deref

Specifies alias dereferencing: never, always, search, or find

-B

Allows printing of non-ASCII values

-D binddn

When authenticating to the directory, specifies doing so as the entry specified in binddn. Use this with the -w password option.

-d debug level

Sets debugging level to the level specified (see the chapter on managing a directory server in Oracle Internet Directory Administrator's Guide.)

-E "character_set"

Specifies native character set encoding. See the chapter on Globalization Support in Oracle Internet Directory Administrator's Guide.

-f file

Performs sequence of searches listed in file

-F sep

Prints `sep' instead of `=' between attribute names and values

-h ldaphost

Connects to ldaphost, rather than to the default host, that is, your local computer. ldaphost can be a computer name or an IP address.

-L

Prints entries in LDIF format (-B is implied)

-l timelimit

Specifies maximum time (in seconds) to wait for ldapsearch command to complete

-M

Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Shows what would be done without actually searching

-O ref_hop_limit

Specifies the number of referral hops that a client should process. The default value is 5.

-p ldapport

Connects to the directory on TCP port ldapport. If you do not specify this option, the tool connects to the default port (389).

-P wallet_password

Specifies wallet password (required for one-way or two-way SSL connections)

-S attr

Sorts the results by attribute attr

-t

Writes to files in /tmp

-u

Includes user friendly entry names in the output

-U SSLAuth

Specifies the SSL authentication mode:

  • 1 for no authentication required

  • 2 for one way authentication required

  • 3 for two way authentication required

-v

Specifies verbose mode

-V ldap_version

Specifies the version of the LDAP protocol to use. The default value is 3, which causes the tool to use the LDAP v3 protocol. A value of 2 causes the tool to use the LDAP v2 protocol.

-w passwd

Specifies bind passwd for simple authentication

-W wallet_location

Specifies wallet location required for one-way or two-way SSL connections. For example, on Solaris, you could set this parameter as follows:

-W "file:/home/my_dir/my_wallet"

On Windows NT, you could set this parameter as follows:

-W "file:C:\my_dir\my_wallet"

-z sizelimit

Specifies maximum number of entries to retrieve

Examples of ldapsearch Filters

Study the following examples to see how to build your own search commands.

Example 1: Base Object Search

The following example performs a base-level search on the directory from the root.

ldapsearch -p 389 -h myhost -b "" -s base -v "objectclass=*"

Example 2: One-Level Search

The following example performs a one level search starting at "ou=HR, ou=Americas, o=IMC, c=US".

ldapsearch -p 389 -h myhost -b "ou=HR, ou=Americas, o=IMC, c=US" -s one -v 
"objectclass=*"
Example 3: Subtree Search

The following example performs a sub-tree search and returns all entries having a DN starting with "cn=Person".

ldapsearch -p 389 -h myhost -b "c=US" -s sub -v "cn=Person*"
Example 4: Search Using Size Limit

The following example actually retrieves only two entries, even if there are more than two matches.

ldapsearch -h myhost -p 389 -z 2 -b "ou=Benefits,ou=HR,ou=Americas,o=IMC,c=US" 
-s one "objectclass=*"
Example 5: Search with Required Attributes

The following example returns only the DN attribute values of the matching entries:

ldapsearch -p 389 -h myhost -b "c=US" -s sub -v "objectclass=*" dn

The following example retrieves only the distinguished name (dn) along with the surname (sn) and description (description) attribute values:

ldapsearch -p 389 -h myhost -b "c=US" -s sub -v "cn=Person*" dn sn description

Example 6: Search for Entries with Attribute Options

The following example retrieves entries with common name (cn) attributes that have an option specifying a language code attribute option. This particular example retrieves entries in which the common names are in French and begin with the letter R.

ldapsearch -p 389 -h myhost -b "c=US" -s sub "cn;lang-fr=R*"

Suppose that, in the entry for John, no value is set for the cn;lang-it language code attribute option. In this case, the following example does not return John's entry:

ldapsearch -p 389 -h myhost -b "c=us" -s sub "cn;lang-it=Giovanni"
Example 7: Searching for All User Attributes and Specified Operational Attributes

The following example retrieves all user attributes and the createtimestamp and orclguid operational attributes:

ldapsearch -p 389 -h myhost -b "ou=Benefits,ou=HR,ou=Americas,o=IMC,c=US" -s sub 
"cn=Person*" * createtimestamp orclguid

The following example retrieves entries modified by Anne Smith:

ldapsearch -h sun1 -b "" "(&(objectclass=*)(modifiersname=cn=Anne
Smith))"

The following example retrieves entries modified between 01 April 2001 and 06 April 2001:

ldapsearch -h sun1 -b "" "(&(objectclass=*)(modifytimestamp>=20000401000000)
(modifytimestamp<= 20000406235959))"


Note:

Because modifiersname and modifytimestamp are not indexed attributes, use catalog.sh to index these two attributes. Then, restart the Oracle directory server before issuing the two previous ldapsearch commands.


Other Examples:

Each of the following examples searches on port 389 of host sun1, and searches the whole subtree starting from the DN "ou=hr,o=acme,c=us".

The following example searches for all entries with any value for the objectclass attribute.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree "objectclass=*"

The following example searches for all entries that have orcle at the beginning of the value for the objectclass attribute.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree 
"objectclass=orcle*"

The following example searches for entries where the objectclass attribute begins with orcle and cn begins with foo.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree 
"(&(objectclass=orcle*)(cn=foo*))"

The following example searches for entries in which the common name (cn) is not foo.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree "(!(cn=foo))"

The following example searches for entries in which cn begins with foo or sn begins with bar.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree 
"(|(cn=foo*)(sn=bar*))"

The following example searches for entries in which employeenumber is less than or equal to 10000.

ldapsearch -p 389 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree 
"employeenumber<=10000"

Catalog Management Tool Syntax

Oracle Internet Directory uses indexes to make attributes available for searches. When Oracle Internet Directory is installed, the entry cn=catalogs lists available attributes that can be used in a search. Only those attributes that have an equality matching rule can be indexed.

If you want to use additional attributes in search filters, you must add them to the catalog entry. You can do this at the time you create the attribute by using Oracle Directory Manager. However, if the attribute already exists, then you can index it only by using the Catalog Management tool.

Before running the Catalog Management tool, unset the LANG variable. After you finish running Catalog Management tool, set the LANG variable back to its original value.

To unset LANG:

The Catalog Management tool uses this syntax:

catalog.sh -connect net_service_name {add|delete} {-attr attr_name|-file 
filename}

Mandatory Argument Description

- connect net_service_name

Specifies the net service name to connect to the directory database

See Also: Oracle9i Net Services Administrator's Guide

Optional Arguments Descriptions

- add -attr attr_name

Indexes the specified attribute

- delete -attr attr_name

Drops the index from the specified attribute

- add -file filename

Indexes attributes (one per line) in the specified file

-delete -file filename

Drops the indexes from the attributes in the specified file

When you enter the catalog.sh command, the following message appears:

This tool can only be executed if you know the OiD user password.
Enter OiD password:

If you enter the correct password, the command is executed. If you give an incorrect password, the following message is displayed:

Cannot execute this tool

After you finish running the Catalog Management tool, set the LANG variable back to its original value.

To set LANG:

To effect the changes after running the Catalog Management tool, stop, then restart, the Oracle directory server.

See Also:

The chapter on preliminary tasks in Oracle Internet Directory Administrator's Guide. for instructions on starting and restarting directory servers

Provisioning Subscription Tool Syntax

Use the Provisioning Subscription Tool to administer provisioning profile entries in the directory. More specifically, use it to perform these activities:

The Provisioning Subscription Tool shields the location and schema details of the provisioning profile entries from the callers of the tool. From the callers' perspective, the combination of an application and a subscriber uniquely identify a provisioning profile. The constraint in the system is that there can only be one provisioning profile per application per subscriber.


Note:

To run shell script tools on the Windows operating system, you need one of the following UNIX emulation utilities:


The name of the executable is oidProvTool, located in $ORACLE_HOME/bin.

To invoke this tool, use this command:

oidprovtool param1=param1_value  param2=param2_value param3=param3_value ...

The Provisioning Subscription Tool accepts the following parameters:

Table 9-1 Provisioning Subscription Tool Parameters
Name Operations Mandatory/Optional Description

operation

all

M

The subscription operation to be performed. The legal values for this parameter are: create, enable, disable, delete, status and reset. Only one operation can be performed per invocation of the tool.

ldap_host

all

O

Host-name of the LDAP server on which the subscription operations are to be performed. If not specified, the default value of `localhost' is assumed.

ldap_port

all

O

The TCP/IP port on which the LDAP server is listening for requests. If not specified, the default value of `389' is assumed.

ldap_user_dn

all

M

The LDAP distinguished name of the user on whose behalf the operation is to be performed. Not all users have the necessary permissions to perform Provisioning Subscription operations. Please see the administrative guide to grant or deny LDAP users the permission to perform Provisioning Subscription operations.

ldap_user_password

all

M

The password of the user on whose behalf the operation is to be performed.

application_dn

all

M

The LDAP distinguished name of the application for which the Provisioning Subscription Operation is being performed. The combination of the application_dn and the organization_dn parameters help the subscription tool to uniquely identify a provisioning profile.

organization_dn

all

M

The LDAP distinguished name of the organization for which the Provisioning Subscription Operation is being performed. The combination of the application_dn and the organization_dn parameters help the subscription tool to uniquely identify a provisioning profile.

interface_name

create only

M

Database schema name for the PLSQL package. Format of the value should be: [Schema].[PACKAGE_NAME]

interface_type

create only

O

The type of the interface to which events have to be propagated.Valid Values: PLSQL (if not specified this is assumed as the default)

interface_connect_info

create only

M

Database connect string Format of this string:[HOST]:[PORT]:[SID]:[USER_ID]:[PASSWORD]

interface_version

create only

O

The version of the interface protocol. Valid Values: 1.0 or 1.11.0 will be the old interface. If not specified, this is used as the default.

interface_additional_info

create only

O

Additional information for the interface. This is not currently used.

schedule

create only

O

The scheduling information for this profile. The value is the length of the time interval in seconds after which DIP will process this profile. If not specified, a default of 3600 is assumed.

max_retries

create only

O

The number of times the Provisioning Service should retry a failed event delivery. If not specified, a default value of 5 is assumed.

event_subscription

create only

O

Events for which DIP should send notification to this application. Format of this string:"[USER]GROUP]:[Domain of interest>]:[DELETE]ADD]MODIFY(<list of attributes separated by comma>)]"Multiple values may be specified by listing the parameter multiple times each with different values. If not specified the following defaults are assumed:USER:<org. DN>:DELETEGROUP:<org. DN>:DELETE(i.e. send user and group delete notifications under the organization DN).


Go to previous page Go to next page
Oracle
Copyright © 2002 Oracle Corporation.

All Rights Reserved.
Go To Documentation Library
Home
Go To Product List
Solution Area
Go To Table Of Contents
Contents
Go To Index
Index