Manage administrative server groups or the global administrative user accounts that are used to configure servers within server groups.
Server groups and global administrator accounts are useful for managing servers that need to exhibit similar configurations, such as a set of servers in a replication topology. This administrative domain information is stored in the 'cn=admin data' entry and is replicated among all servers instances in a replicated topology, thus allowing a global administrative account to manage all servers in a single group.
Global administrative accounts and server groups are created when setting up a replication topology. New servers are automatically added to the default 'all-servers' server group. Replicated servers are unregistered from their peers during uninstall operations. The dsframework tool allows you to further define and manage server groups and global user accounts to fit your administrative requirements.
dsframework list-servers --bindDN "cn=Directory Manager" \ --bindPassword password
dsframework list-members --bindDN "cn=Directory Manager" \ --bindPassword password --groupName all-servers
Add a server to a server group
dsframework add-to-group --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers \ --memberName server1.example.com:389
-m {memberName}
--memberName {memberName}
Description | The server to add. To see the list of currently defined servers use the 'list-servers' subcommand |
Required | Yes |
Multi-Valued | No |
-g {groupName}
--groupName {groupName}
Description | The group's identifier. This is a required argument. To see the list of current groups use the 'list-groups' subcommand |
Required | Yes |
Multi-Valued | No |
Create a new global administrator account
The user is created under the 'cn=administrators,cn=admin data' tree and can be referenced with the --userID argument when using the dsreplication and dsframework tools. Since the account is defined in the admin data backend, it is replicated to all servers in the "replication-servers" group. This account is created with privileges similar to a Root DN. The privileges can be displayed using the 'get-admin-user-properties' subcommand and modified using the 'set-admin-user-properties' subcommand
dsframework create-admin-user --userID "Global Administrator" \ --set password:password --set "description:External group manager"
--userID {userID}
Description | The administrator's unique identifier. To see a list of current user IDs use the 'list-admin-users' subcommand |
Required | No |
Multi-Valued | No |
--set {PROP:VALUE}
Description | Assign a value to a property, where PROP is the name of the property and VAL is the single value to be assigned. The list of properties can be viewed using the 'list-admin-user-properties' subcommand |
Required | No |
Multi-Valued | Yes |
Create a new server group
dsframework create-group --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers \ --description "DMZ servers"
-d {description}
--description {description}
Description | The server group description. If not specified, the description will be empty |
Default Value | |
Required | No |
Multi-Valued | No |
-g {groupName}
--groupName {groupName}
Description | The new group's identifier |
Required | Yes |
Multi-Valued | No |
Delete an existing global administrator account
dsframework delete-admin-user --userID "Global Administrator"
--userID {userID}
Description | The administrator's unique identifier. To see a list of current user IDs use the 'list-admin-users' subcommand |
Required | No |
Multi-Valued | No |
Delete an existing server group
dsframework delete-group --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers
-g {groupName}
--groupName {groupName}
Description | The group's identifier. This is a required argument. To see the list of current groups use the 'list-groups' subcommand |
Required | Yes |
Multi-Valued | No |
View a global administrator account's properties
dsframework get-admin-user-properties --bindDN "cn=Directory Manager" \ --bindPassword password --userID "Global Administrator"
--userID {userID}
Description | The administrator's unique identifier. To see a list of current user IDs use the 'list-admin-users' subcommand |
Required | No |
Multi-Valued | Yes |
View the properties of the reference to a server registered with this administrative domain
dsframework get-server-properties --bindDN "cn=Directory Manager" \ --bindPassword password --serverID server1.example.com:5389
--serverID {serverID}
Description | The registered server's unique identifier. The list of registered server IDs can be obtained using the 'list-servers' subcommand |
Required | No |
Multi-Valued | Yes |
Print a table of all properties of administrators, listing their syntax, default values, and other attributes
Properties for global administrator account instances can be viewed using the 'get-admin-user-properties' subcommand
dsframework list-admin-user-properties
List current global administrator accounts
dsframework list-admin-users --bindDN "cn=Directory Manager" \ --bindPassword password
List currently defined server groups
dsframework list-groups --bindDN "cn=Directory Manager" --bindPassword password
List servers belonging to a server group
dsframework list-members --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers
-g {groupName}
--groupName {groupName}
Description | The group's identifier. This is a required argument. To see the list of current groups use the 'list-groups' subcommand |
Required | Yes |
Multi-Valued | No |
List server groups to which a server belongs
dsframework list-membership --bindDN "cn=Directory Manager" \ --bindPassword password --memberName server1.example.com:389
-m {memberName}
--memberName {memberName}
Description | The member's identifier. This is a required argument |
Required | Yes |
Multi-Valued | No |
Print a table of all properties of server references, listing their syntax, default values, and other attributes
Properties for registered server instances can be viewed using the 'get-server-properties' subcommand
dsframework list-server-properties --bindDN "cn=Directory Manager" \ --bindPassword password
List servers registered with this administrative domain
dsframework list-servers --bindDN "cn=Directory Manager" \ --bindPassword password
Modify a server group's properties or change its name
dsframework modify-group --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers \ --newGroupName internal --description "Servers within the firewall"
-d {description}
--description {description}
Description | If specified, the new description |
Default Value | |
Required | No |
Multi-Valued | No |
-n {groupName}
--newGroupName {groupName}
Description | If specified, the new server group's identifier |
Default Value | |
Required | No |
Multi-Valued | No |
-g {groupName}
--groupName {groupName}
Description | The group's identifier. This is a required argument. To see the list of current groups use the 'list-groups' subcommand |
Required | Yes |
Multi-Valued | No |
Create a new reference to a server, registering it for this administrative domain
This tool creates an entry in the administrative data that refers to an existing server. Properties that reflect the server's configuration should be supplied during registration. Registered servers are available for inclusion in server groups
dsframework register-server --bindDN "cn=Directory Manager" \ --bindPassword password --serverID server1.example.com:5389 \ --set ldapport:5389 --set ldapEnabled:true \ --set hostname:server1.example.com
--serverID {serverID}
Description | The registered server's unique identifier. The list of registered server IDs can be obtained using the 'list-servers' subcommand |
Required | No |
Multi-Valued | No |
--set {PROP:VALUE}
Description | Assign a value to a property, where PROP is the name of the property and VAL is the single value to be assigned. The list of properties can be viewed using the 'list-server-properties' subcommand |
Required | No |
Multi-Valued | Yes |
Remove a server from a server group
dsframework remove-from-group --bindDN "cn=Directory Manager" \ --bindPassword password --groupName external-servers \ --memberName server1.example.com:389
-m {memberName}
--memberName {memberName}
Description | The server to remove. To see the list of servers belonging to a particular group use the 'list-members' subcommand |
Required | Yes |
Multi-Valued | No |
-g {groupName}
--groupName {groupName}
Description | The group's identifier. This is a required argument. To see the list of current groups use the 'list-groups' subcommand |
Required | Yes |
Multi-Valued | No |
Modify a global administrator account's properties
dsframework set-admin-user-properties --bindDN "cn=Directory Manager" \ --bindPassword password --userID "Global Administrator" \ --set password:password
dsframework set-admin-user-properties --bindDN "cn=Directory Manager" \ --bindPassword password --userID "Global Administrator" \ --set privilege:config-write --set privilege:-update-schema
--userID {userID}
Description | The administrator's unique identifier. To see a list of current user IDs use the 'list-admin-users' subcommand |
Required | No |
Multi-Valued | No |
--set {PROP:VALUE}
Description | Assign a value to a property, where PROP is the name of the property and VAL is the single value to be assigned. The list of properties can be viewed using the 'list-admin-user-properties' subcommand |
Required | No |
Multi-Valued | Yes |
Modify the properties of the reference to a server registered with this administrative domain
dsframework set-server-properties --bindDN "cn=Directory Manager" \ --bindPassword password --serverID server1.example.com:5389 \ --set location:datacenter --set ldapsport:5636
--serverID {serverID}
Description | The registered server's unique identifier. The list of registered server IDs can be obtained using the 'list-servers' subcommand |
Required | Yes |
Multi-Valued | No |
--set {PROP:VALUE}
Description | Assign a value to a property, where PROP is the name of the property and VAL is the single value to be assigned. The list of properties can be viewed using the 'list-server-properties' subcommand |
Required | No |
Multi-Valued | Yes |
Remove an existing reference to a server, unregistering it from this administrative domain
dsframework unregister-server --bindDN "cn=Directory Manager" \ --bindPassword password --serverID server1.example.com:5389
--serverID {serverID}
Description | The registered server's unique identifier. The list of registered server IDs can be obtained using the 'list-servers' subcommand |
Required | No |
Multi-Valued | No |
-V
--version
Description | Display Identity Broker version information |
-H
--help
Description | Display general usage information |
--help-ldap
Description | Display help for using LDAP options |
--help-sasl
Description | Display help for using SASL options |
--help-debug
Description | Display help for using debug options |
Advanced | Yes |
-Z
--useSSL
Description | Use SSL for secure communication with the server |
-q
--useStartTLS
Description | Use StartTLS to secure communication with the server |
--useNoSecurity
Description | Use no security when communicating with the server |
-h {host}
--hostname {host}
Description | Identity Broker hostname or IP address |
Default Value | localhost |
Required | No |
Multi-Valued | No |
-p {port}
--port {port}
Description | Identity Broker port number |
Default Value | 389 |
Required | No |
Multi-Valued | No |
-D {bindDN}
--bindDN {bindDN}
Description | DN used to bind to the server |
Default Value | cn=Directory Manager |
Required | No |
Multi-Valued | No |
-w {bindPassword}
--bindPassword {bindPassword}
Description | Password used to bind to the server |
Required | No |
Multi-Valued | No |
-j {bindPasswordFile}
--bindPasswordFile {bindPasswordFile}
Description | Bind password file |
Required | No |
Multi-Valued | No |
-o {name=value}
--saslOption {name=value}
Description | SASL bind options |
Required | No |
Multi-Valued | Yes |
-X
--trustAll
Description | Trust all server SSL certificates |
-P {trustStorePath}
--trustStorePath {trustStorePath}
Description | Certificate trust store path |
Required | No |
Multi-Valued | No |
-K {keyStorePath}
--keyStorePath {keyStorePath}
Description | Certificate key store path |
Required | No |
Multi-Valued | No |
-W {keyStorePassword}
--keyStorePassword {keyStorePassword}
Description | Certificate key store PIN |
Required | No |
Multi-Valued | No |
-u {keyStorePasswordFile}
--keyStorePasswordFile {keyStorePasswordFile}
Description | Certificate key store PIN file |
Required | No |
Multi-Valued | No |
-N {nickname}
--certNickname {nickname}
Description | Nickname of the certificate for SSL client authentication |
Required | No |
Multi-Valued | No |
-v
--verbose
Description | Use verbose mode |
--propertiesFilePath {propertiesFilePath}
Description | Path to the file that contains default property values used for command-line arguments |
Required | No |
Multi-Valued | No |
--noPropertiesFile
Description | Specify that no properties file will be used to get default command-line argument values |
--script-friendly
Description | Use script-friendly mode |
--help-server-group
Description | Display subcommands relating to server-group |
--help-admin-user
Description | Display subcommands relating to admin-user |
--help-server
Description | Display subcommands relating to server |
--help-subcommands
Description | Display all subcommands |