Managing Root Users With dsconfig

Use the dsconfig command to manage root users. For more information, see Configuring the Server With dsconfig.

To View the Default Root User Privileges

The default root user has a number of privileges, which are stored as values of the default-root-privilege-name property.

• View the default root user privileges by running the following dsconfig command:

  $ dsconfig -h localhost -p 4444 -D "cn=directory manager" -w password -n \
    get-root-dn-prop
  
  Property                    : Value(s)
  ----------------------------:--------------------------------------------------
  default-root-privilege-name : backend-backup, backend-restore, bypass-acl,
                                      : cancel-request, config-read, config-write,
                                      : disconnect-client, ldif-export, ldif-import,
                                      : modify-acl, password-reset, privilege-change,
                                      : server-restart, server-shutdown,
                                      : unindexed-search, update-schema

To Edit the Default Root User Privileges

The easiest way to manage root user privileges is to use dsconfig in interactive mode. Interactive mode walks you through the root user configuration, and is therefore not documented here.

To add or remove privileges for the default root user, add or remove the values of the default-root-privilege-name property. This property can hold the following values:

• backend-backup

• backend-restore

• bypass-acl

• cancel-request

• config-read

• config-write

• data-sync

• disconnect-client

• jmx-notify

• jmx-read

• jmx-write

• ldif-export

• ldif-import

• modify-acl

• password-reset

• privilege-change

• proxied-auth

• server-restart

• server-shutdown

• unindexed-search

• update-schema

This example adds the data-sync privilege to the default root user, by using dsconfig in non-interactive mode.

• Run the dsconfig command as follows:

  $ dsconfig -h localhost -p 4444 -D "cn=directory manager" -w password -n \
    set-root-dn-prop --add default-root-privilege-name:data-sync

To Create a Root User

Root users are stored below the entry cn=Root DNs,cn=config. To create a new root user, create the entry in LDIF and add it by using the ldapmodify command.

Root users automatically inherit the set of default root user privileges on the server. For information about adding or removing privileges for a specific root user, see To Change a Root User's Privileges.

1. Create a root user entry below the cn=Root DNs,cn=config entry.

   The following LDIF file represents a new root user named “Administration Manager”. The entry is saved in a file named add-root-user.ldif.

   dn: cn=MyRootUser,cn=Root DNs,cn=config
   objectClass: inetOrgPerson
   objectClass: person
   objectClass: top
   objectClass: ds-cfg-root-dn-user
   objectClass: organizationalPerson
   userPassword: password
   cn: MyRootUser
   sn: MyRootUser
   ds-cfg-alternate-bind-dn: cn=MyRootUser
   givenName: Directory

2. Use the ldapmodify command to add the entry.

   $ ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password \
     --defaultAdd --filename "add-root-user.ldif"
   Processing ADD request for cn=MyRootUser,cn=Root DNs,cn=config
   ADD operation successful for DN cn=MyRootUser,cn=Root DNs,cn=config

3. (Optional) Use the ldapsearch command to display all the root users defined in the server.

   $ ldapsearch -p 1389 -b "cn=root DNs,cn=config" -D "cn=directory manager" -w password \
     "objectclass=*" dn
   dn: cn=Root DNs,cn=config
   
   dn: cn=MyRootUser,cn=Root DNs,cn=config
   
   dn: cn=Directory Manager,cn=Root DNs,cn=config

To Change a Root User's Password

1. Create a password in a secure file.
2. Use ldappasswordmodify to change the password.

   $ ldappasswordmodify -h localhost -p 1389 -D "cn=MyRootUser" -w password \
     --newPasswordFile rootuser_pwd.txt
   The LDAP password modify operation was successful

To Change a Root User's Privileges

If you want to have a different set of privileges for a specific root user, add the ds-privilege-name attribute to that root user's entry.

The following example gives the root user "cn=MyRootUser,cn=Root DNs,cn=config" the ability to use proxied authorization. The example removes the ability to change user privileges or access the configuration. The minus sign before the privilege indicates that the privilege is being removed rather than granted.

• Apply the following LDIF statement to the root user's entry:

  dn: cn=MyRootUser,cn=Root DNs,cn=config
  changetype: modify
  add: ds-privilege-name
  ds-privilege-name: proxied-auth
  ds-privilege-name: -config-read
  ds-privilege-name: -config-write 

  In this example, the root user "cn=MyRootUser,cn=Root DNs,cn=config" would inherit all privileges automatically granted to root users with the exception of the config-read and config-write privileges. The user would also be given the proxied-auth privilege.