IBM Tivoli Directory Server, Version 6.3

Client utilities

This section provides a description of the client utilities. The client utilities use the ldap_sasl_bind or ldap_sasl_bind_s API. When bind is invoked, several results can be returned. Following are the bind results using various combinations of user IDs and passwords.

If specifying the admin DN, the password must be correctly specified or the bind is not successful.
If a null DN is specified, or a 0 length DN is specified, you receive unauthenticated access unless you are using an external bind (SASL) such as Kerberos.
If a DN is specified, and is non-null, a password must also be specified or an error is returned.
If a DN and password are specified but do not fall under any suffix in the directory, a referral is returned.
If a DN and password are specified and are correct, the user is bound with that identity.
If a DN and password are specified but the DN does not exist, unauthenticated access is given.
If a DN and password are specified and the DN exists but the object does not have user password, an error message is returned.

Note:

You can change the source code for some of these LDAP client utilities and build your own version of these LDAP client utilities. You can change the following utilities:

idsldapchangepwd
idsldapdelete
idsldapexop
idsldapmodify, idsldapadd
idsldapmodrdn
idsldapsearch

However, any altered versions of these LDAP utilities are not supported.

LDAP C-client utilities (ibmdirctl, ldapadd, ldapchangepwd, ldapcompare, ldapdelete, ldapexop, ldapmodify, ldapmodrdn, ldapsearch, and ldaptrace) internally use the connect() system call to connect to the specified socket on the target system. When an LDAP client attempts to connect to a system that is down, then the connect() system call exits only when the TCP/IP timeout is met. In such case, it might appear as though the LDAP client operation is in hung state. You can configure an LDAP client to return earlier than the system-wide TCP/IP timeout value, by running an LDAP client command with the -1 option along with the timeout value in seconds and microseconds.

Note:

If the value provided is greater than the system-wide TCP/IP timeout, then the system-wide TCP/IP timeout will occur first and then the application will exit. The -1 option does not override the system-wide TCP/IP timeout value but gives an opportunity for LDAP C-client utilities to timeout early.

[ Top of Page | Previous Page | Next Page ]