ldappasswordmodify

Description

Update the password for a user in an LDAP directory server using the password modify extended operation (as defined in RFC 3062), a standard LDAP modify operation, or an Active Directory-specific modification.

Unless the password change method is explicitly specified (using the --passwordChangeMethod argument), this tool will attempt to automatically determine which method is the most appropriate for the target server using information provided in the server's root DSE. If the server advertises support for the password modify extended operation, then that method will be used. If it appears to be an Active Directory server, then an Active Directory-specific password change method will be selected, using a regular LDAP modify to update the unicodePwd attribute with a specially encoded value. Otherwise, a regular LDAP modify operation will be used to update the value of a specified password attribute.

The new password to set for the user may be specified in one of several ways. It may be directly provided on the command line, read from a specified file, interactively prompted from the user, or automatically generated by this tool. If the new password is not specified using any of those methods, and if the password is to be updated using the password modify extended operation, then the new password field of the request will be left blank to indicate that the server should generate a new password for the user and include it in the response to the client. If no new password is specified and some other password change method is selected, then the tool will exit with an error.

The current password for the user may also be specified. This is optional, although some servers may require a user to provide their current password when setting a new one. If a current password is provided (whether given as a command-line argument, read from a specified file, or interactively requested from the user), and if a regular LDAP modify operation is used to change the password, then the resulting modify request will include a delete of the current value and an add of the new value. If no current password is provided, then the modify request will replace any existing password(s) with the new value.

Examples

ldappasswordmodify --hostname ds.example.com --port 636 --useSSL \
     --userIdentity u:jdoe --promptForCurrentPassword --promptForNewPassword

ldappasswordmodify --hostname ds.example.com --port 636 --useSSL \
     --bindDN uid=admin,dc=example,dc=com --bindPasswordFile admin-password.txt \
     --userIdentity uid=jdoe,ou=People,dc=example,dc=com \
     --generateClientSideNewPassword --passwordChangeMethod ldap-modify

Arguments

-V
--version

-H
--help

--help-ldap

--help-sasl

--help-debug

-h {host}
--hostname {host}

-p {port}
--port {port}

-D {dn}
--bindDN {dn}

-w {password}
--bindPassword {password}

-j {path}
--bindPasswordFile {path}

--promptForBindPassword

-Z
--useSSL

-q
--useStartTLS

--defaultTrust

-X
--trustAll

-K {path}
--keyStorePath {path}

-W {password}
--keyStorePassword {password}

-u {path}
--keyStorePasswordFile {path}

--promptForKeyStorePassword

--keyStoreFormat {format}

-P {path}
--trustStorePath {path}

-T {password}
--trustStorePassword {password}

-U {path}
--trustStorePasswordFile {path}

--promptForTrustStorePassword

--trustStoreFormat {format}

--certNickname {nickname}

--enableSSLDebugging

-o {name=value}
--saslOption {name=value}

--useSASLExternal

--helpSASL

-a {dnOrAuthzID}
--userIdentity {dnOrAuthzID}

-A
--provideBindDNAsUserIdentity

--usernameAttribute {attributeName}

-b {dn}
--searchBaseDN {dn}

-n {password}
--newPassword {password}

-N {path}
--newPasswordFile {path}

--promptForNewPassword

--generateClientSideNewPassword

--generatedPasswordLength {length}

--generatedPasswordCharacterSet {chars}

-c {password}
--currentPassword {password}

-C {path}
--currentPasswordFile {path}

--promptForCurrentPassword

--bindControl {oid}[:{criticality}[:{stringValue}|::{base64Value}]]

--useAuthorizationIdentityControl

--usePasswordPolicyControlOnBind

--getAuthorizationEntryAttribute {attributeName}

--getUserResourceLimits

-J {oid}[:{criticality}[:{stringValue}|::{base64Value}]]
--updateControl {oid}[:{criticality}[:{stringValue}|::{base64Value}]]

--usePasswordPolicyControlOnUpdate

--noOperation

--getPasswordValidationDetails

--retireCurrentPassword

--purgeCurrentPassword

--passwordUpdateBehavior {name=value}

--useAssuredReplication

--assuredReplicationLocalLevel {level}

--assuredReplicationRemoteLevel {level}

--assuredReplicationTimeout {timeout}

--operationPurpose {purpose}

--passwordChangeMethod {password-modify-extended-operation|ldap-modify|active-directory}

--followReferrals

--useAdministrativeSession

-v
--verbose

--interactive

--outputFile {path}

--appendToOutputFile

--teeOutput

--propertiesFilePath {path}

--generatePropertiesFile {path}

--noPropertiesFile

--suppressPropertiesFileComment