dirxcp

-verbose

Used without an argument or option, the args help command returns brief information about each args operation. Use the operation argument to return a description of the options associated with the operation you specify. Alternatively, you can use the -verbose option to return a description of the args object itself.

The output of the sample command is as follows:

-bindid bid

-attributesizelimit {limit | INFINITE}

-automaticcontinuation {TRUE | FALSE}

-chainingprohibited {TRUE | FALSE}

-copyshalldo {TRUE | FALSE}

-default

-dontdereferencealias {TRUE | FALSE}

-dontusecopy {TRUE | FALSE}

-localscope {TRUE | FALSE}

-preferchain {TRUE | FALSE}

-priority {LOW | MEDIUM | HIGH}

-protectionrequest {TRUE | FALSE}

-scopeofreferral {COUNTRY | DMD | UNLIMITED}

-signedrequest {TRUE | FALSE}

-subentries {TRUE | FALSE}

-sizelimit {limit | INFINITE}

-timelimit {limit | INFINITE}

The modify operation changes one or more service control settings to be used in all subsequent directory operations using the specified DAP bind. Specify one or more of the options that correspond to the service controls you want to set. Alternatively, you can specify the -default option to set the control services to their default values.

Service control settings for a specific bind ID are lost when an unbind operation is issued for this bind ID. A subsequent bind operation resets the service controls to the default values for the specified bind ID. The service controls are not reset to the default values if the default bind is used. (See obj bind operation for details.)

The output of the sample command as follows:

modify show help operations

-bindid bid

-pretty

By default, the results of the show operation are returned as a Tcl list. Use the -pretty option to display the results in a tabular, more readable format.

The output of the sample command is as follows:

{attributesizelimit INFINITE} {automaticcontinuation TRUE} {chainingprohibited FALSE} {copyshalldo FALSE} {dontdereferencealias FALSE} {dontusecopy TRUE} {localscope FALSE} {preferchain TRUE} {priority MEDIUM} {protectionrequest FALSE} {scopeofreferral UNLIMITED} {signedrequest FALSE} {sizelimit INFINITE} {subentries FALSE} {timelimit INFINITE}

-verbose

Used without an argument or option, the ldapargs help command returns brief information about each ldapargs operation. Use the operation argument to return a description of the options associated with the operation you specify. Alternatively, you can use the -verbose option to return a description of the ldapargs object itself.

The output of the sample command as follows:

-bindid bid

-default

-dereferencealias {ALWAYS | NEVER | SEARCHING | FINDING}

-followreferral {TRUE | FALSE}

-sizelimit {limit | INFINITE}

-timelimit {limit | INFINITE}

The modify operation changes one or more service control settings to be used in all subsequent directory operations of the specified LDAP bind. Specify one or more of the options that correspond to the service controls you want to set. Alternatively, you can specify the -default option to set the control services to their default values.

Service control settings for a specific bind ID are lost when an unbind operation is issued for this bind ID. A subsequent bind operation resets the service controls to the default values for the specified bind ID. The service controls are not reset to the default values if the default bind is used. (See obj bind operation for details.)

The output of the sample command is as follows:

modify show help operations

-bindid bid

-pretty

By default, the results of the show operation are returned as a Tcl list. Use the -pretty option to display the results in a tabular, more readable format.

The output of the sample command is as follows:

-address ldap_server_address

-authentication auth_method

-bindid bid

-certsubject nickname

-dsa distinguished_name

-key3password key3_password

-mechanism mechanism

-password password[,totp]

-pwdfile password_file

-protocol protocol

-psap psap_address

-sasl

-server ldap_server_name

-ssl

-status [-bindid bid1 [bid2 …]]

-user username

-control control_ids[,criticality[,value]]

Multiple binds are supported using bind IDs and the concept of a default bind. A bind ID is a string specified in the option -bindid associated with either an LDAP or a DAP bind. Bind IDs may be used in other dirxcp commands to refer to a specific bind.

A bind operation (or any other operation) without specifying a bind ID opens (or refers to) a default bind. There is only one default bind at a time and this can be either an LDAP or a DAP bind.

When used without options, the bind operation creates an anonymous default bind to the default DSA, which is the first DSA listed in the client configuration file dirxcl.cfg.

Use the -dsa or -psap options to bind to a specific DSA.

Use the -server or -address options to bind to a specific LDAP server.

The option -dsa can be used synonymously for -server and -address synonymously for -psap.

If no DSA or LDAP server is specified in the options (i.e., none of the options -dsa, -psap,
-server, and -address is specified) the obj bind operation searches the client configuration file dirxcl.cfg for the first line that matches the protocol type specified in the option -protocol (or DAP if -protocol is not specified). The address from this line is used to establish a bind.

If LDAPv2 or LDAPv3 is specified in the -protocol option and no LDAP server address line is specified in the client configuration file dirxcl.cfg a bind to the local LDAP server is established.

Use the -authentication option to establish a specific authentication method. If you specify simple or simple-protected authentication, you must supply the -user option and one of the following options: -password or -pwdfile. The password you supply for simple authentication is sent as clear text, even if the password_file is used. The password you supply for simple-protected authentication is sent encrypted.

Use the -ssl option to establish Secure Socket Layer (SSL)/Transport Layer Security (TLS) for the bind operation when the -protocol option specifies LDAPv2 or LDAPv3. When you specify this option, the obj bind operation authenticates the LDAP server using the certificate information in the file specified in the DIRX_TRUSTED_CA environment variable or in the install_path*/client/conf/cert8.db* certificate database, if the environment variable is not set. See the SSL/TLS Certificate Database section in the DirX Directory Files chapter for more information about SSL/TLS certificate authentication.

Use the -sasl option to establish Simple Authentication and Security Layer (SASL) client authentication and Secure Socket Layer (SSL)/Transport Layer Security (TLS) for the bind operation when the -protocol option specifies LDAPv3. See the recommendations made in the document entitled Authentication Methods for LDAP (RFC 2829) and Lightweight Directory Access Protocol (v3): Extensions for Transport Layer Security (RFC 2830) for details.

The -sasl option includes the -ssl option.

When an obj bind operation is called with a specific bind ID, the operation sets the service controls for the bind to the default values; see the reference page for the ldapargs modify operation for a list of default values for LDAP binds and the reference page for the args modify operation for a list of default values for DAP binds. When an obj bind operation is called without a bind ID (a default bind), the operation sets the service controls to the default values when the protocol to be used changes. For example, the operation sets the service controls to their default values when the last default bind used LDAPv2 protocol and the default bind to be performed uses LDAPv3 protocol.

The command output is as follows:

-attribute attribute

-bindid bid

-control control_ids[,criticality[,value]]

Use the obj compare operation to determine whether an attribute contains a specific value. By default, the compare operation compares the specified attribute and value with the attributes and values of the current working object.

Specify a distinguished name to perform the operation on a specific object. If the specified attribute contains the specified value, the operation returns the text M=TRUE (meaning Matched=TRUE); if the value is not present, it returns M=FALSE.

If the specified attribute was found in a shadow entry, the operation returns the text FE=false (meaning From-Entry=FALSE). This is not supported for LDAP binds.

If the match was achieved in a subtype, the operation returns text in the form MS=*attribute (meaning Matched-Subtype=attribute), where attribute is the attribute abbreviation (or object identifier, if no abbreviation is present in an abbreviation file) that corresponds to the subtype; for example, *MS=CN, or MS=2.5.6.91. This is not supported for LDAP binds.

You can abandon an outstanding compare operation by interrupting dirxcp. (Press the Del or Ctrl and C key, dependent on your keyboard configuration, and dirxcp will send out an Abandon operation to the directory server.) This is not supported for LDAP binds.

-attribute attribute_list

-bindid bid

-control control_ids[,criticality[,value]]

The create operation creates a new object in the directory information tree. The distinguished_name argument is the name of the object to be created and can be specified as a complete distinguished name or a distinguished name relative to the current working object (cwo Tcl variable). Note that the current working object is supported only for a default DAP bind. See the DirX Directory String Representation for DAP Binds and DirX Directory String Representation for LDAP Binds chapters in _DirX Directory Syntaxes and Attributes for a complete description of distinguished name formats.

Use the -attribute option to specify the attributes to be applied to the newly created object. You must specify the ObjectClass (OCL) attribute as an attribute_list element; specifying additional attributes is optional. See the DirX Directory String Representation for DAP Binds and DirX Directory String Representation for LDAP Binds chapters in DirX Directory Syntaxes and Attributes for a complete list of the supported attribute types and attribute list formats. By default, the dirxcp program creates the operational attributes creation-time, creators-name, structural-object-class, and governing-structure-rule.

-bindid bid

-control control_ids[,*criticality[,*value]]

The delete operation deletes objects from the directory information tree.

-verbose

Used without an argument or option, the help command returns brief information about each obj operation. Use the operation argument to return a description of the options associated with the operation you specify. Alternatively, you can use the -verbose option to return a description of the obj object itself.

The output of the sample command is as follows:

Lists the distinguished names of the children of an object. The syntax is as follows:

-bindid bid

-pretty

-control control_ids[,criticality[,value]]

Used without arguments or options, the list operation returns a Tcl list that contains the complete distinguished names of the immediate subordinates of the current working object. Use the distinguished_name argument to specify an object. Use the -pretty option to return the results of the operation in a tabular, more readable format.

You can abandon an outstanding list operation by interrupting dirxcp. (Press the Del or Ctrl and C key, dependent on your keyboard configuration, and dirxcp will send out an Abandon operation to the directory server.) This is not supported for LDAP binds.

-bindid bid

-dontdeleteoldrdn

-rdn name_part

-newsuperior new_superior

-control control_ids[,*criticality[,*value]]

The moddn operation changes the last relative distinguished name of an object or subtree or moves an object or subtree to a new superior. The distinguished_name argument specifies the object or subtree to modify; if no distinguished_name argument is specified, the operation acts on the current working object. Refer to the DirX Directory String Representation for DAP Binds and DirX Directory String Representation for LDAP Binds chapters in DirX Directory Syntaxes and Attributes for a complete description of distinguished name format. By default, the operation removes the attributes and attribute values that do not exist in the new RDN.

When a distinguished name is modified by the moddn operation all references inside a single DSA to the complete name are updated automatically.

In the following sample command, the object is renamed but the old name (zahn) is kept in the new object. The resulting CN attribute has two values: zahn and soeder, where soeder is the naming value of CN.

The result of a obj show /O=ibis/OU=staff/CN=soeder –attr CN command after performing the command above is:

/O=ibis/OU=staff/CN=soeder {CN=soeder;zahn}

-bindid bid

-addattr attribute_list

-changeattr old_attribute new_attribute

-removeattr attribute_list

-replaceattr attribute_list

-control control_ids[,criticality[,value]]

The modify operation changes attributes and attribute values of objects. The distinguished_name argument specifies the object to modify; if no distinguished_name argument is specified, the operation acts on the current working object. Refer to the DirX Directory String Representation for DAP Binds and DirX Directory String Representation for LDAP Binds chapters in DirX Directory Syntaxes and Attributes for a complete description of distinguished name format.

Use the -addattr option to add new attributes and their attribute values to an object or add new attribute values to an existing attribute.

Use the -changeattr option to modify values of an existing attribute; you must specify the option name and the desired values for each attribute you want to change. For example, to modify attr1 and attr2 for an object, enter the -changeattr option twice as follows: -changeattr attr1_old attr1_new -changeattr attr2_old attr2_new

Use the -removeattr option to remove existing attribute values or remove existing attributes.

Use the -replaceattr option to replace all existing attribute values by the new attribute values, to add new attributes, or to delete the specified attribute.

You may combine the options -addattr, -changeattr, -removeattr, and -replaceattr in any order as often as you like.

-bindid bid

-pretty

-terminate

-vpagesize page_size

-control control_ids[,criticality[,value]]

obj nextpage is used to return the next page of a search result once the initial search with simple paging has already been performed.

By default, the obj nextpage operation returns results as Tcl lists. Use the -pretty option to return formatted results.

Use the option -vpagesize to specify the maximum number of objects that should be returned in a page.

Use the option -terminate if you are no longer receiving search pages from the server. That option cannot be combined with any other option. The result of this command is that the server discards the search result.

The output of the sample command is as follows:

bind compare create delete list modify moddn search show unbind help operations verify_abbr

-bindid bid

-allattr

-alloperationalattr

-alluserattr

-attribute abbreviation

-baseobject

-filter filter

-matchedvaluesonly

-noaliases

-onelevel[none] * Limits the search scope to the children of the base object.

-pretty

-subtree[none] * Limits the search scope to the subtree below the base object.

-types

-vpagesize page_size

-vsortkey attr_type

-vtype \{SUBENTRY | SIMPLE}

-control control_ids[,*criticality[,*value]]

The search operation searches for objects starting from the specified distinguished name or the current working object. You must specify one of the search scope options
-baseobject, -onelevel, or -subtree.

By default, the operation does not search for attribute information. Use the -attribute, *
-alloperationalattr*, or -alluserattr options to return selected attribute information, or use the
-allattr option to return information about all attributes.

By default, the search operation returns results as Tcl lists. Use the -pretty option to return formatted results.

The directory server may return incomplete results if a size limit or time limit has been encountered or if referrals to other servers are returned. In the event of an incomplete result the search operation returns the partial-outcome-qualifier as the last element of the search result. (See also the Partial-Outcome-Qualifier attribute syntax in DirX Directory Syntaxes and Attributes.)

In order to avoid huge search results you can use the Simple Paging mechanism by specifying the option –vtype SIMPLE. However, if the DSA must perform chaining simple paging does not work at all. Then the search operation returns no result and no refarral but the error message Directory system is unwilling to perform the operation.

Use the option -vpagesize to specify the maximum number of objects that should be returned in a page.

Use the option -vsortkey to specify the sort criteria.

-bindid bid

-allattr

-alloperationalattr

-alluserattr

-attribute abbreviation

For LDAP binds, the LDAP name or the OID of the attribute must be specified. It is not possible to write the attribute value in a file for LDAP binds.

-pretty

-types

-control control_ids[,criticality[,value]]

Used without arguments or options, the show operation returns the distinguished name the current working object. Use the distinguished_name argument to specify an object to show.

By default, the operation does not return attribute information. Use the -attribute, -alloperationalattr, or -alluserattr options to return selected attribute information, or use the -allattr option to return information about all attributes. If you have selected to return attribute information, the show operation returns attribute types and values by default. Use the -types option to limit the results returned to attribute types only.

By default, the results of the show operation are displayed as a Tcl list. Use the -pretty option to return the results in a tabular, more readable format.

If the show operation is unable to access information because of access restrictions, it returns IE=TRUE (meaning Incomplete-Entry=TRUE) in the Tcl list or displays the following line in the formatted output produced by the -pretty option:

Incomplete-Entry :TRUE

Note that this function is not supported for LDAP binds.

You can abandon an outstanding show operation by interrupting dirxcp. (Press the Del or Ctrl and C key, depending on your keyboard configuration, and dirxcp will send out an Abandon operation to the directory server.) This function is not supported for LDAP binds.

-bindid bid

This operation is only supported for a connection that was created by a bind operation over plain LDAPv3 protocol and requires the same kind of access to LDAP server SSL key material that is required by a bind over SSL-protected LDAPv3 protocol. The operation enables SSL/TLS security for the current LDAP connection. If a new plain LDAPv3 bind operation is issued, dirxcp creates the new connection without SSL/TLS protection.

-bindid bid

Verifies the abbreviations used in DirX Directory abbreviation files against a DSA schema. See the section Abbreviation Files in the chapter DirX Directory Files for detailed information about these files. The syntax is as follows:

-dsa distinguished_name

The verify_abbr operation takes the abbreviation files from the client and the schema from the DSA, compares the two for inconsistencies, and outputs all errors discovered in the abbreviation files. Use this error output to fix issues with the abbreviation files.