idsldapchangepwd, ldapchangepwd

Description

The ldapchangepwd command is an LDAP modify password tool. This command sends modify password requests to an LDAP server.

Synopsis

idsldapchangepwd | ldapchangepwd -D binddn -w passwd | ? -n newpassword | ? 
                 [-C charset] [-d debuglevel] [-E token_pw] [-G realm] 
                 [-h ldaphost] [-I] [-K keyfile] [-m mechanism] [-M] 
                 [-N certificatename] [-O maxhops] [-p ldapport] 
                 [-P keyfilepw] [-Q operation] [-R] [-S token_label] 
                 [-U username] [-v] [-V version] [-x] [-X lib_path]
                 [-y proxydn] [-Y] [-Z] [-1 sec:usec] [-?]

Options

-C charset

Specifies that the DNs supplied as parameter to the ldapchangepwd utility are represented in a local character set, as specified by charset. Use-C charset to override the default, where strings must be supplied in UTF-8. For more information about the specific charset values that are supported for each operating system, see Supported IANA character sets. The supported values for charset are the same values that are supported for the charset tag that is optionally defined in version 1 LDIF files.

-d debuglevel

Sets the LDAP debugging level to debuglevel. This option causes the utility to generate debug output to stdout. The debuglevel is a bit mask that controls which output is generated with values up to 65535. For information about debug levels, see Debugging levels.

-D bindDN

Specifies the bindDN to bind to an LDAP directory. The bindDN variable is a string-represented value. When used with -m DIGEST-MD5, it specifies the authorization ID. It can be either a DN or an authorization ID string that starts with dn: or u:.

-E token_pw

Specifies the token password to access a crypto device.

-G realm

Specifies the realm name. When used with -m DIGEST-MD5, the value is passed to the server during a bind.

-h ldaphost

Specifies the host name of the system where an LDAP server is running.

-I

Specifies a crypto device with key storage by using PKCS11.

-K keyfile

Specifies the name of the SSL or TLS key database file with the default extension of kdb. If the key database file is not in the current directory, specify the fully qualified key database file name. If a key database file name is not specified, this utility first looks for the presence of the SSL_KEYRING environment variable with an associated file name. If the SSL_KEYRING environment variable is not defined, the default keyring file is used, if present.

A default keyring file, ldapkey.kdb, and the associated password stash file, ldapkey.sth, are installed in the etc directory in IDS_LDAP_HOME. Where, IDS_LDAP_HOME is the installation path of IBM® Security Verify Directory. The value of the IDS_LDAP_HOME variable varies depending on operating system. The default path on various operating system is listed.

• AIX® operating systems: /opt/IBM/ldap/V10.0.1
• Linux™ operating systems: /opt/ibm/ldap/V10.0.1
• Windows™ operating systems: C:\Program Files\IBM\ldap\V10.0.1
  Note: The C:\Program Files\IBM\ldap\V10.0.1 path is the default installation location. The actual IDS_LDAP_HOME is determined during the installation.

For more information about the default key database files and default certificate authorities (CAs), see Programming Reference section of the IBM Security Verify Directory documentation.

If a keyring database file cannot be located, a hard coded set of default trusted certificate authority roots is used. The key database file typically contains one or more certificates of CAs that are trusted by the client. These types of X.509 certificates are known as trusted roots. For more information about managing an SSL or TLS key database, see Administering section in the IBM Security Verify Directory documentation. Also, see the Security functions section.

This parameter effectively enables the -Z switch.

-m mechanism

Specifies the SASL mechanism to use when you bind to the server. The ldap_sasl_bind_s() function is used. The -m parameter is ignored if -V 2 is set. If -m is not specified, simple authentication is used.

-M

Specifies to manage referral objects as regular entries.

-n newpassword | ?

Specifies the new password. Use ? to generate a password prompt. If you use the password prompt, it prevents your password from being visible through the ps command.

-N certificatename

Specifies the label that is associated with the client certificate in the key database file. If an LDAP server is configured to use server authentication only, a client certificate is not required. If the LDAP server is configured to use client and server authentication, a client certificate might be required. This parameter is not required if a default certificate / private key pair is assigned as the default. Similarly, certificatename is not required if there is a single certificate / private key pair in the designated key database file. This parameter is ignored if -Z or -K parameter is not specified.

-O maxhops

Specify maxhops to set the maximum number of hops that the client library takes when it chases the referrals. The default hop count is 10.

-p ldapport

Specifies a port for the LDAP server to listen. The default LDAP port is 389. If -p is not specified and -Z is specified, the default LDAP secure port 636 is used.

-P keyfilepw

Specifies the key database password. Password is required to access the encrypted information in the key database file, which might include one or more private keys. If a password stash file is associated with the key database file, then the password is obtained from the password stash file. In this case, the -P parameter is not required. This parameter is ignored if -Z or -K is not specified.

-Q operation

Specifies the crypto device operation with PKCS11. The operation variable must be assigned one of the following values:

0: No accelerator mode
1: Symmetric 
2: Digest
3: Digest and Symmetric 
4: Random 
5: Random and Symmetric
6: Random and Digest
7: Random , Digest and Symmetric

-R

Specifies not to chase referrals automatically.

-S token_label

Specifies the token label of the crypto device.

-U username

Specifies the user name. This name is required with -m DIGEST-MD5, and is ignored when any other mechanism is used. The value of username depends on what attribute the server is configured to use. It might be a uid or any other value that is used to locate the entry.

-v

Indicates to run in verbose mode. With this option, messages are written to the standard output.

-V version

Specifies the LDAP version to use. By default, an LDAP V3 connection is established. To explicitly select LDAP V3, specify -V 3. To run as an LDAP V2 application, specify -V 2. An application, like ldapdchangepwd, selects LDAP V3 as the preferred protocol by using ldap_init instead of ldap_open.

-w passwd | ?

Specifies the password for authentication. Use the ? to generate a non-echoed password prompt. If you use the password prompt, it prevents your password from being visible through the ps command.

-x

Specifies to use FIPS mode processing. This mode is applicable with SSL or TLS only.

-X lib_path

Specifies the library path of the crypto device.

-y proxydn

Specifies the DN to use for proxied authorization.

-Y

Specifies to use a secure LDAP connection by using the startTLS protocol. The -Y option is only supported when GSKit is installed.

-Z

Specifies to use a secure LDAP connection by using Secure Sockets Layer (SSL) and Transport Layer Security (TLS). The -Z option is only supported for SSL component entry, and only when GSKit is installed.

-9 p

Sets criticality for paging to false. The search is handled without paging.

-9 s

Sets criticality for sorting to false. The search is handled without sorting.

-?

Specifies to show the syntax format.

Exit status

Security functions

See also