Exit Print View

Sun OpenDS Standard Edition 2.0 Administration Guide

Get PDF Book Print View
 
Previous Next

Document Information

Configuring the Directory Server

Configuring Security in the Directory Server

Managing Directory Data

Importing and Exporting Data

Populating a Stand-Alone Directory Server With Data

Importing Data Using import-ldif

To Import Data in Offline Mode

To Replace Existing Data During an Offline Import

To Append Imported Data to Existing Data

To Import Fractional Files

To Import Fractional Files by Using Filters

To Include or Exclude Attributes During Import

To Import a Compressed LDIF File

To Record Rejected or Skipped Entries During Import

To Import Data From a MakeLDIF Template

To Run an Import in Online Mode

To Schedule an Import

Exporting Data Using export-ldif

To Export Data to LDIF

To Export Partial Data

To Export Part of a Back End by Using Filters

To Include or Exclude Attributes During Export

To Export to LDIF and Then Compress the File

To Run an Export in Online Mode

To Schedule an Export

Importing and Exporting Entries With the Control Panel

To Import Entries With the Control Panel

To Export Entries to an LDIF File With the Control Panel

Creating MakeLDIF Template Files

The Template File Format

make-ldif Template File Tags

Defining Custom Tags

Backing Up and Restoring Data

Overview of the Backup and Restore Process

Backing Up Data

To Back Up All Back Ends

To Back Up All Back Ends with Encryption and Signed Hashes

To Perform an Incremental Backup on All Back Ends

To Back Up a Specific Back End

To Perform an Incremental Backup on a Specific Back End

To Schedule a Backup as a Task

Backing Up the Server Configuration

Backing Up for Disaster Recovery

To Back Up the Directory Server For Disaster Recovery

Restoring Data

To Restore a Back End

To Restore a Back End From Incremental Backups

To Schedule a Restore as a Task

To Restore the Configuration File

To Restore a Directory Server During Disaster Recovery

Restoring Replicated Directory Servers

Backing Up and Restoring Directory Data With the Control Panel

To Back Up Data With the Control Panel

To Restore Data With the Control Panel

Searching Directory Data

Overview of the ldapsearch Command

ldapsearch Location and Format

Understanding Search Criteria

ldapsearch Examples

To Return All Entries

To Search For a Specific User

To Search for Specific User Attributes

To Perform a Search With Base Scope

To Perform a Search With One-Level Scope

To Perform a Search With Subtree Scope

To Return Attribute Names Only

To Return User Attributes Only

To Return Base DNs Only

To Search For Specific Object Classes

To Return a Count of All Entries in the Directory

To Perform a Search With a Compound Filter

To Perform a Search Using a Filter File

To Limit the Number of Entries Returned in a Search

Using Advanced Search Features

Searching for Special Entries and Attributes

To Search for Operational Attributes

To Search the Root DSE Entry

To Search for ACI Attributes

To Search the Schema Entry

To Search the Configuration Entry

To Search the Monitoring Entry

Searching Over SSL

To Search Over SSL With Blind Trust

To Search Over SSL Using a Trust Store

To Search Over SSL With No Trust Store

To Search Over SSL Using a Keystore

To Search Using StartTLS

To Search Using SASL With DIGEST-MD5 Client Authentication

To Search Using SASL With the GSSAPI Mechanism

To Search Using SASL With the PLAIN Mechanism

Searching Using Controls

To View the Available Controls

To Search Using the Account Usability Request Control

To Search Using the Authorization Identity Request Control

To Search Using the Get Effective Rights Control

To Search Using the LDAP Assertion Control

To Search Using the LDAP Subentry Control

To Search Using the Manage DSA IT Control

To Search Using the Matched Values Filter Control

To Search Using the Password Policy Control

To Search Using the Persistent Search Control

To Search Using the Proxied Authorization Control

To Search Using the Server-Side Sort Control

To Search Using the Simple Paged Results Control

Searching Using the Virtual List View Control

To Search Using the Virtual List View Control

To Search Using Virtual List View With a Specific Target

To Search Using Virtual List View With a Known Total

Searching in Verbose Mode and With a Properties File

To Search in Verbose Mode

To Search Using a Properties File

Searching Internationalized Entries

Adding, Modifying, and Deleting Directory Data

Adding Directory Entries

To Create a Root Entry

To Add an Entry Using the --defaultAdd Option With ldapmodify

To Add Entries Using an LDIF Update Statement With ldapmodify

Adding Attributes

To Add an Attribute to an Entry

To Add an ACI Attribute

To Add an International Attribute

Modifying Directory Entries

To Modify an Attribute Value

To Modify an Attribute With Before and After Snapshots

To Delete an Attribute

To Change an RDN

To Move an Entry

Deleting Directory Entries

To Delete an Entry With ldapmodify

To Delete an Entry With ldapdelete

To Delete Multiple Entries by Using a DN File

Indexing Directory Data

Configuring Indexes on the Local DB Back End

To Create a New Local DB Index

Configuring VLV Indexes

To Create a New VLV Index

Managing Indexes With the Control Panel

To Display a List of Indexes

To Add an Index

To Add a VLV Index

To Delete an Index

To Verify Indexes

To Rebuild Indexes

Reducing Stored Data Size

To Enable or Disable Compact Encoding

To Enable or Disable Entry Compression

Managing Directory Data With the Control Panel

Managing Entries With the Control Panel

To Display A List of All Directory Entries

To Add a New Entry With the Control Panel

To Add a New Entry From an LDIF Specification With the Control Panel

To Change the Values of an Entry's Attributes With the Control Panel

To Delete an Entry With the Control Panel

Managing Base DNs With the Control Panel

Adding a New Base DN

Deleting a Base DN

Copying an Entry's DN to the Clipboard

Managing Users

To Reset a User's Password

To Create a Group

To Add a User to a Group

Deleting a Back End With the Control Panel

To Delete a Back End With the Control Panel

Selecting a View of Entry Data

To Select a View of Entry Data

Ensuring Attribute Value Uniqueness

Overview of the Unique Attribute Plug-In

Configuring the Unique Attribute Plug-In Using dsconfig

To Ensure Uniqueness of the Value of the uid Attribute

To Ensure Uniqueness of the Value of Any Other Attribute

Replication and the Unique Attribute Plug-In

Configuring Virtual Attributes

To List the Existing Virtual Attributes

To Create a New Virtual Attribute

To Enable or Disable a Virtual Attribute

To Display the Configuration of a Virtual Attribute

To Change the Configuration of a Virtual Attribute

Configuring Referrals

Configuring LDAP URLs

To Create a Referral

To Modify a Referral

To Delete a Referral

Controlling Access To Data

Replicating Data

Managing Users and Groups

Directory Server Monitoring

Improving Performance

Advanced Administration

ldapsearch Examples

The following examples show the use of the ldapsearch command with various search options. These examples all assume that your current working directory is install-dir/bin (install-dir\bat on Windows systems).

The following points pertain to all the examples in this section:

Note - Many UNIX and Linux operating systems provide an installed version of common LDAP-client tools, such as ldapsearch, ldapmodify, and ldapdelete in the /usr/bin directory. You should use the ldapsearch provided with the directory server to search the directory server. You can check which version of ldapsearch you are using by typing the following command:

$ which ldapsearch

If you are using the ldapsearch in /usr/bin, put install-dir/bin at the beginning of your $PATH.

To Return All Entries

You can return all entries below a specified branch DN using the presence search filter (objectclass=*). The search filter looks for all entries that have one or more object classes with any value. Because all entries have several object class definitions, the filter guarantees that all entries will be returned.

To Search For a Specific User

You can use an equality filter to locate a specific user in the directory. This example locates an employee with the common name of "Frank Albers".

To Search for Specific User Attributes

You can use an equality filter to locate an entry's attribute(s) in the directory. Specify one or more attributes by placing them after the search filter. This example locates the telephoneNumber and mail attributes from the user entry for Frank Albers.

To Perform a Search With Base Scope

Together with the search base DN, the scope determines what part of the directory information tree (DIT) is examined. A base scope examines only the level specified by the base DN (and none of its child entries). You specify a base scope by using the --searchScope base option or its short form equivalent -s base.

To Perform a Search With One-Level Scope

A one-level scope examines only the level immediately below the base DN. You specify a one-level scope by using the --searchScope one option or its short form equivalent -s one. This example displays the entries immediately below the base DN.

To Perform a Search With Subtree Scope

The subtree scope examines the subtree below the base DN and includes the base DN level. You specify a subtree scope using the --searchScope sub option, or its short form equivalent -s sub. If you do not specify the --searchScope, ldapsearch assumes a subtree scope.

To Return Attribute Names Only

The ldapsearch command provides a convenient option to check if an attribute is present in the directory. Use the --typesOnly option or its short form equivalent -A to instruct the directory server to display the attribute names but not their values.

To Return User Attributes Only

You can use ldapsearch to return only user attributes for entries that match the search filter, by including an asterisk *. User attributes (as opposed to operational attributes) store user information in the directory. If you do not specify the asterisk, the user attributes are returned by default. You must escape the asterisk appropriately for your shell.

To Return Base DNs Only

You can use ldapsearch to return only the base DNs for entries that match the search filter by including a 1.1 string after the search filter.

To Search For Specific Object Classes

You can search all entries where the attributes are referenced by a specific object class by prepending a @ character to the object class name. For example, to view all entries that have an object class of groupOfUniqueNames, include @groupOfUniqueNames after the search filter.

To Return a Count of All Entries in the Directory

The ldapsearch command provides the --countentries to return the total number of entries in the directory. The directory server returns all entries that match the search filter and displays the total number on the last line. This example determines the number of employee entries whose location is Cincinnati.

To Perform a Search With a Compound Filter

Compound search filters involve multiple tests using the boolean operators AND (&), OR (|), or NOT (!). You can combine and nest boolean operators and filters together to form complex expressions. The following example searches for all entries for employees named Jensen who work in Cupertino. The command returns two results.

To Perform a Search Using a Filter File

You can place complex or multiple filters in a file by using the --filename option. If the file contains multiple filters, the file should be structured with one filter per line. Searches are performed using the same connection to the directory server in the order in which they appear in the filter file. If the --filename option is used, any trailing options are treated as separate attributes. Otherwise, the first trailing option must be the search filter.

This example searches all entries for employees named Jensen who work in Cupertino and who do not work in the Accounting department.

  1. Create the filter file.

    For this example, create a file called myfilter.txt with the following content:(&(sn=jensen)(l=Cupertino)(!(ou=Accounting)))

    2. 

  2. Run the ldapsearch command, specifying the file name as a filter.
    $ ldapsearch --hostname localhost --port 1389 --bindDN "cn=Directory Manager" \
--bindPassword password --baseDN dc=example,dc=com --filename myfilter.txt
dn: uid=bjensen,ou=People,dc=example,dc=com 
objectClass: person 
objectClass: inetOrgPerson
objectClass: top
objectClass: organizationalPerson
ou: Product Development
ou: People
sn: Jensen
l: Cupertino
cn: Barbara Jensen
cn: Babs Jensen
telephoneNumber: +1 408 555 1862
givenName: Barbara
uid: bjensen
mail: bjensen@example.com





To Limit the Number of Entries Returned in a Search



You can limit the number of entries that are returned by using
the -z or --sizeLimit option. If the number of entries exceeds the number
that is specified, the search returns the specified number of entries, then returns
an error stating that the size limit was exceeded. The following example requests
a maximum of 5 entries.






	

		

			
				

					Legal
					Copyright 1994-2009 Sun Microsystems, Inc.
				

					
			
				Previous
				Next