idsldapmodrdn, ldapmodrdn

Use the ldapmodrdn command to modify the relative distinguished name (RDN®) or to change the parent DN of an entry.

Description

The ldapmodrdn command is an LDAP modify RDN tool. The idsldapmodrdn command is a command-line interface to the ldap_rename library call.

The idsldapmodrdn command opens a connection to an LDAP server, binds to the LDAP server, modifies the RDN of an entry. An entry can be read from a standard input, a file by using the -i option, or from a command prompt by using the dn, rdn, or newSuperior option.

To see syntax help foridsldapmodrdn, type:

idsldapmodrdn -?

Synopsis

idsldapmodrdn | ldapmodrdn [-c] [-C charset] [-d debuglevel][-D binddn] 
              [-E token_pw] [-f file] [-G realm] [-h ldaphost] [-i file] 
              [-I] [-k] [-K keyfile] [-l] [-m mechanism] [-M] [-n] 
              [-N certificatename] [-O hopcount] [-p ldapport] 
              [-P keyfilepw] [-r] [-R] [-s newSuperior] [-S token_label]
              [-U username] [-v] [-V] [-w passwd | ?] [-x] [-X lib_path] 
              [-y proxydn] [-Y] [-Z] [-1 sec:usec] [dn newrdn | [-i file]]

Options

The options to the ldapmodrdn command.

-c

Specifies to run continuous operation, and do not stop processing on error. If the -c parameter is not specified, the command exits if an error is encountered.

-C charset

Specifies a string to the command be represented in a local character set, as specified by charset. Use -C charset to override the default, where string must be supplied in UTF-8. For information about the specific charset values that are supported for each operating system, seeSupported IANA character sets. The supported values for charset are the same values that are supported for the charset tag that is optionally defined in version 1 LDIF files.

-d debuglevel

Sets the LDAP debug level to debuglevel in LDAP library. This option causes the utility to generate debug output to stdout. The debuglevel is a bit mask that controls which output is generated with values from 1 to 65535. For information about debug levels, see Debugging levels.

-D bindDN

Specifies the bindDN to bind to an LDAP directory. The bindDN variable is a string-represented value. When used with -m DIGEST-MD5, it specifies the authorization ID. It can be either a DN or an authorization ID string that starts with dn: or u:.

-E token_pw

Specifies the token password to access a crypto device.

-f file

Specifies the file from which to read entry modification information.

-G realm

Specifies the realm name. When used with -m DIGEST-MD5, the value is passed to the server during a bind.

-h ldaphost

Specifies the host name of the system where an LDAP server is running.

-i file

Specifies to read entry modification information from the file instead of standard input or command line. Standard input can be supplied from a file, for example

<
file

-I

Specifies a crypto device with key storage by using PKCS11.

-k

Specifies to send the server administration control. For more information about the server administration control, see Programming Reference section of the IBM® Security Verify Directory documentation.

-K keyfile

Specifies the name of the SSL or TLS key database file with the default extension of kdb. If the key database file is not in the current directory, specify the fully qualified key database file name. If a key database file name is not specified, this utility first looks for the presence of the SSL_KEYRING environment variable with an associated file name. If the SSL_KEYRING environment variable is not defined, the default keyring file is used, if present.

A default keyring file, ldapkey.kdb, and the associated password stash file, ldapkey.sth, are installed in the etc directory in IDS_LDAP_HOME. Where, IDS_LDAP_HOME is the installation path of IBM Security Verify Directory. The value of the IDS_LDAP_HOME variable varies depending on the operating system. The default path on various operating system is listed.

AIX® operating systems: /opt/IBM/ldap/V10.0.1
Linux™ operating systems: /opt/ibm/ldap/V10.0.1
Windows™ operating systems: C:\Program Files\IBM\ldap\V10.0.1
Note: The C:\Program Files\IBM\ldap\V10.0.1 path is the default installation location. The actual IDS_LDAP_HOME is determined during the installation.

For more information about the default key database files and default certificate authorities (CAs), see Programming Reference section of the IBM Security Verify Directory documentation.

If a keyring database file cannot be located, a hard coded set of default trusted certificate authority roots is used. The key database file typically contains one or more certificates of CAs that are trusted by the client. These types of X.509 certificates are known as trusted roots. For more information about managing an SSL or TLS key database, see Administering section of the IBM Security Verify Directory documentation. Also, see the Security functions section.

This parameter effectively enables the -Z switch.

-l

Specifies not to replicate the entry.

This parameter sends the Do not replication control to the server. For information about this control, see Programming Reference section of the IBM Security Verify Directory documentation.

-m mechanism

Specifies the SASL mechanism to use when you bind to the server. The ldap_sasl_bind_s() API is used for this option. The -m parameter is ignored if -V 2 is set. If -m is not specified, simple authentication is used.

-M

Specifies to manage referral objects as regular entries.

-n

Specifies to demonstrate the action of the operation without actually doing it.

Tip: The -n option with the -v option is useful when you debug any related problem.

-N certificatename

Specifies the label that is associated with the client certificate in the key database file. If an LDAP server is configured to use server authentication only, a client certificate is not required. If the LDAP server is configured to use client and server authentication, a client certificate might be required. This parameter is not required if a default certificate / private key pair is assigned as the default. Similarly, certificatename is not required if there is a single certificate / private key pair in the designated key database file. This parameter is ignored if -Z or -K parameter is not specified.

-O hopcount

Specify hopcount to set the maximum number of hops that the client library takes when it chases the referrals. The default hop count is 10.

-p ldapport

Specifies a port for the LDAP server to listen. The default LDAP port is 389. If -p is not specified and -Z is specified, the default LDAP secure port, 636, is used.

-P keyfilepw

Specifies the key database password. Password is required to access the encrypted information in the key database file, which might include one or more private keys. If a password stash file is associated with the key database file, then the password is obtained from the password stash file. In this case, the -P parameter is not required. This parameter is ignored if -Z or -K is not specified.

-Q operation

Specifies the crypto device operation with PKCS11. The operation variable must be assigned one of the following values:

0: No accelerator mode
1: Symmetric 
2: Digest
3: Digest and Symmetric 
4: Random 
5: Random and Symmetric
6: Random and Digest
7: Random, Digest and Symmetric

-r

Removes the old RDN value from an entry. The default action is to keep the old value.

-R

Specifies not to chase referrals automatically.

-s newSuperior

Specifies the DN of the new parent entry under which the renamed RDN is relocated. The newSuperior value can be a zero-length string, for example -s "".

-S token_label

Specifies the token label of the crypto device.

-U username

Specifies the user name. This name is required with -m DIGEST-MD5, and is ignored when any other mechanism is used. The value of username depends on what attribute the server is configured to use. It might be a uid or any other value that is used to locate the entry.

-v

Indicates to run in verbose mode.

-V version

Specifies the LDAP protocol version to use. By default, an LDAP V3 connection is established. To explicitly select LDAP V3, specify -V 3. To run as an LDAP V2 application, specify -V 2.

-w passwd | ?

Specifies the password for authentication. Use the ? to generate a non-echoed password prompt. In UNIX™, use backslash \? to avoid matching single character file names.

-x

Specifies to use FIPS mode processing. This mode is applicable with SSL or TLS only.

-X lib_path

Specifies the library path of the crypto device.

-y proxydn

Specifies the DN to use for proxied authorization.

-Y

Specifies to use a secure LDAP connection by using the startTLS protocol. The -Y option is only supported when GSKit is installed.

-Z

Specifies to use a secure LDAP connection by using Secure Sockets Layer (SSL) and Transport Layer Security (TLS). The -Z option is only supported for SSL component entry, and only when GSKit is installed.

-1 sec:usec

Specifies the timeout for the connect() function in seconds and microseconds. The values that are provided for seconds and microseconds must be positive integers.

dn newrdn

Specifies the RDN value to substitute for the existing RDN value. For more information, see the Input format section.

-?

Specifies to show the syntax format.

Input format

If the command-line arguments dn and newrdn are provided, newrdn replaces the RDN of the entry that is specified by the DN, dn. Otherwise, the contents of file or standard input consist of one or more entries of DN and RDN.

Notes®

If you do not provide entry information by using the file with -i or from command line by using dn and newrdn arguments, ldapmodrdn waits to read entries from standard input. To exit from the command prompt, use Ctrl+D on UNIX systems. On Windows systems, use Ctrl+Z.

Exit status

Exit status is 0 if no errors occur. If exit status is non-zero, then an error occurred. When error occurs, messages are written to the standard error.

Security functions

To use the SSL or TLS-related functions that are associated with this utility, seeSSL and TLS notes.

Examples

Example 1:

Consider a file /tmp/entrymods contains the following entries:

cn=Modify Me, o=University of Life, c=US
cn=The New Me

To change the cn=Modify Me RDN from Modify Me to The New Me, run the following command:

idsldapmodrdn -r -i /tmp/entrymods

After you run the command, the cn=Modify Me RDN is removed.

To change the RDN and to move the entry under a different subtree, run the following command:

idsldapmodrdn –s "o=sample" "cn=Modify Me,o=University of Life,c=US" 
          "cn=The New Me"

This command changes the RDN from cn=Modify Me to cn=The New Me. The entry is also moved from the o=University of Life, c=US subtree to o=sample.

Note: The o=sample entry must exist for the operation to be successful.

idsldapmodrdn, ldapmodrdn

Description

Synopsis

Options

Input format

Notes®

Exit status

Security functions

See also

Examples