Execute the following command:

bulkdelete connect="dbs1" basedn="cn=OracleContext" cleandb="FALSE"

Execute the following command:

bulkdelete connect="dbs1" basedn="cn=OracleContext"

This example uses a file that contains a list of DNs to delete.

bulkdelete connect="dbs1" file="~/myfiles/dn.txt"

Before running the bulkload tool:

This command adds the telephone number 408-123-4567 to the entries of all employees who have Anne Smith as their manager.

Example:

bulkmodify connect="orcl" basedn="c=US" add="TRUE" attribute="telephoneNumber" value="408-123-4567" filter="manager=Anne Smith"

The file must be correctly formatted. See LDIF File Format for information about formatting an LDIF file.

Example:

ldapadd -h myhost.company.com -D "cn=orcladmin" -q -p 3060 \
   -f ~/myfiles/input.ldif -v

For more information about the formatting DSML files, visit the OASIS Web site at http://www.oasis-open.org. The following example shows a sample DSML entry for a user.

Example:

<addRequest dn="CN=Alice,OU=HR,DC=Example,DC=COM">
     <attr name="objectclass"><value>top</value></attr>
     <attr name="objectclass"><value>person</value></attr>
     <attr name="objectclass"><value>organizationalPerson</value></attr>
     <attr name="sn"><value>Johnson</value></attr>
     <attr name="givenName"><value>Alice</value></attr>
     <attr name="title"><value>Software Design Engineer</value></attr>
</addRequest>

Once you have a correctly formatted DSML file, you can add data to the directory using ldapadd and supplying the DSML file as the input file.

Example:

ldapadd -h myhost.company.com -D "cn=orcladmin" -q -p 3060 \
    -X ~/myfiles/input.xml -v

Example:

ldapadd -h myhost.company.com -D "cn=orcladmin" -q -p 3060 \
    -X ~/myfiles/input.xml -v -n

Example:

ldapmoddn -h myhost.company.com -D "cn=orcladmin" -q -p 3060 \
    -b "cn=Mary Smith,dc=Americas,dc=IMC,dc=com" -R "cn=Mary Jones" -r

The entry with the RDN of Mary Smith is moved from the dc=Americas parent node to the dc=Australia parent node.

Example:

ldapmoddn -h myhost.company.com -D "cn=orcladmin" -q -p 3060 \
    -b "cn=Mary Smith,dc=Americas,dc=IMC,dc=com" -N "dc=Australia,dc=IMC,dc=com"

See Adding Schema Elements for examples.

Example:

ldapmodify -h myhost.company.com -D "cn=orcladmin" -q -p 3060  \
    -f /home/myfiles/modify.ldif  -v

See LDIF Format for Modifying Entries for examples.

Example:

ldapmodify -h myhost.company.com -D "cn=orcladmin" -q \
    -p 3060 -f /home/myfiles/modify.ldif  -v

From Oracle Internet Directory 11g Release 1 (11.1.1.6.0) onward, a new autocatalog feature is enabled by default in fresh installs. You can also enable it if you have upgraded from a previous release. When this feature is enabled, Oracle Internet Directory automatically invokes the catalog command to index attributes when you search for them. If the autocatalog feature is not enabled, and you want to use previously uncataloged attributes in search filters, you must add them to the catalog entry, as in previous releases.

To add an attribute, import an LDIF file by using ldapmodify. For example, to index the attribute displayName, import the following LDIF file by using ldapmodify:

Example:

dn: cn=catalogs 
changetype: modify 
add: orclindexedattribute 
orclindexedattribute: displayName 

Type a command similar to the following at the system prompt:

ldapmodify -D "cn=orcladmin" -q -h host -p port -f ldif_file_name

To index the attribute, the ldapmodify command invokes the Catalog Management tool, catalog. For information about that tool, see catalog.

To drop an index from an attribute by using ldapmodify, specify delete in the LDIF file. For example:

dn: cn=catalogs 
changetype: modify 
delete: orclindexedattribute
orclindexedattribute: displayName

• -b specifies base DN for the search, root in this case.

• -s specifies whether the search is a base search (base), one level search (one) or subtree search (sub).

• "objectclass=*" specifies the filter for search.

Example:

ldapsearch -p 3060 -h myhost -b "" -s base -v "objectclass=*"

Example:

ldapsearch -p 3060 -h myhost -b "ou=HR, ou=Americas, o=IMC, c=US" -s one \
           -v "objectclass=*"

Example:

ldapsearch -p 3060 -h myhost -b "c=US" -s sub -v "cn=Person*"

Example:

ldapsearch -p 3060 -h myhost -b "c=US" -s sub -v "objectclass=*" dn

The following example retrieves only the distinguished name along with the surname (sn) and description (description) attribute values:

Example:

ldapsearch -p 3060 -h myhost -b "c=US" -s sub -v "cn=Person*" dn sn description

The following example retrieves the distinguished name (dn), surname (sn), and description (description) attribute values. The entries are sorted by surname (sn). There are 10 entries returned per page.

Example:

ldapsearch -p 3060 -h myhost -b "c=US" -s sub -v "cn=Person*" dn sn description \
    -T sn -j 10

The following example returns only operational attributes:

$ ldapsearch -h example.com -p 3060 -D cn=orcladmin -w password -b "c=uk" -L -s base "(objectclass=*)" +

Example:

ldapsearch -p 3060 -h myhost -b "c=US" -s sub "cn;lang-fr=R*"

Suppose that, in the entry for John, no value is set for the cn;lang-it language code attribute option. In this case, the following example does not return John's entry:

Example:

ldapsearch -p 3060 -h myhost -b "c=us" -s sub "cn;lang-it=Giovanni"

Example:

ldapsearch -p 3060 -h myhost -b "ou=Benefits,ou=HR,ou=Americas,o=IMC,c=US" \
           -s sub "cn=Person*" "*" createtimestamp orclguid

The following example retrieves entries modified by Anne Smith:

Example:

ldapsearch -h sun1 \
    -b "" "(&(objectclass=*)(modifiersname=cn=Anne Smith))"

The following example retrieves entries modified between 01 April 2001 and 06 April 2001:

Example:

ldapsearch -h sun1 -b "" \
     "(&(objectclass=*)(modifytimestamp >= 20000401000000) \
     (modifytimestamp <= 20000406235959))"

The following example searches for all entries with any value for the objectclass attribute.

ldapsearch -p 3060 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree "objectclass=*"

The following example searches for all entries that have orcl at the beginning of the value for the objectclass attribute.

ldapsearch -p 3060 -h sun1 -b "ou=hr, o=acme, c=us" -s subtree "objectclass=orcl*"

The following example searches for entries where the objectclass attribute begins with orcl and cn begins with foo.

ldapsearch -p 3060 -h sun1 -b "ou=hr, o=acme, c=us" \
          -s subtree "(&(objectclass=orcl*)(cn=foo*))"

The following example searches for entries in which cn begins with foo or sn begins with bar.

ldapsearch -p 3060 -h sun1 -b "ou=hr, o=acme, c=us" \
          -s subtree "(|(cn=foo*)(sn=bar*))"

The following example searches for entries in which employeenumber is less than or equal to 10000.

ldapsearch -p 3060 -h sun1 -b "ou=hr, o=acme, c=us" \
           -s subtree "employeenumber<=10000"

Example:

ldapsearch -h localhost -p 389 -b "dc=oracle,dc=com" -s base -L "objectclass=*" DC

If orclReqattrCase is 0 the output looks like this:

dn: dc=oracle,dc=comdc: oracle

If orclReqattrCase is 1, the output looks like this:

dn: dc=oracle,dc=comDC: oracle

In this example, Oracle Internet Directory server is present in the environment, and the migration tool looks up the directory server to figure out certain substitution variables specified in the LDIF input file.

Example:

$ldifmigrator "input_file=sample.dat" "output_file=sample.ldif" \
               -lookup "host=ldap.acme.com" "subscriber=acme" \
               "s_UserOrganization=Development"

This can be done by specifying the override value in the command-line. The following command line shows how one can set the UserNickNameAttribute to cn overriding the default of uid:

Example:

$ldifmigrator "input_file=sample.dat" "output_file=sample.ldif" \
              -lookup "host=ldap.acme.com" "subscriber=acme" \
             "s_UserOrganization=Development" "s_UserNicknameAttribute=cn"

Example:

$ldifmigrator "input_file=sample.dat" "output_file=sample.ldif"  \
              "s_UserContainerDN=cn=Users,o=Acme,dc=com" \
              "s_UserNicknameAttribute=uid" "s_UserOrganization=Development"

The Data Migration Tool gives your the option of loading the data directly into Oracle Internet Directory. Use the -load and -reconcile options to load data and safely reconcile any conflicts.

Example:

$ldifmigrator "input_file=sample.dat" "output_file=sample.ldif" \
               -lookup "host=ldap.acme.com" "subscriber=acme" \
               "s_UserOrganization=Development"
               -load -reconcile SAFE

To upgrade the user certificates:

perl $ORACLE_HOME/ldap/bin/upgradecert.pl -h myhost.company.com \
     -D "cn=orcladmin" -w password

• Syntax for bulkdelete

• Arguments for bulkdelete

• Related Command-Line Tools for bulkdelete

Syntax for bulkdelete

bulkdelete connect=connect_string {[basedn=Base_DN]|[file=file_name]}
[filter="LDAP_search_filter"] [encode=character_set] [debug="TRUE"|"FALSE"] 
[cleandb="TRUE"|"FALSE"] [skipcheck="TRUE"|"FALSE"] [size=transaction_size] 
[threads=num_of_threads] [verbose="TRUE"|"FALSE"]

Arguments for bulkdelete

connect

Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in $DOMAIN_HOME/config/fmwconfig/components/OID/config/ directory. (You can set the TNS_ADMIN environment variable if you want to use a different location.)

basedn | file

Required. The base DN of the subtree to be deleted, for example, "dc=company, dc=com". Enclose the DN in quotation marks. You can also specify multiple base DNs by putting them in a file and specifying the file name and path with the file argument.

filter

Optional. The LDAP filter for entries to be deleted. This filter option allows you to delete only entries that match a specific LDAP filter condition. Using this option, you can delete a huge amount of data in a reasonable amount of time.

encode

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

debug

Optional. The debug option reports the logging level. This is useful in case the command runs into errors. The output is logged to the bulkdelete.log file. This file can be found under $DOMAIN_HOME/tools/OID/logs.

cleandb

Optional. This is used to specify whether the deleted entries would be tomb stoned or deleted completely from the database. The default (cleandb="TRUE") is to delete the entries completely.

skipcheck

Optional. The skipcheck option allows you to execute bulkdelete without stopping OID services. This is possible by passing skipcheck="TRUE" in the command line. Default is skipcheck="FALSE".

size

Optional. The number of entries to be committed as a part of one transaction.

threads

Optional. The number of threads to create. The default value is the number of CPUs on the machine plus one.

verbose

Optional. This is used to run the command in verbose mode.

Related Command-Line Tools for bulkdelete

• See bulkload

• See bulkmodify

• See ldapdelete

• Syntax for bulkload

• Arguments for bulkload

• Related Command-Line Tools for bulkload

Syntax for bulkload

bulkload [connect=connect_string]
{[check="TRUE"|"FALSE"  [file=ldif_file]] [generate="TRUE"|"FALSE"
[append="TRUE"|"FALSE"] [restore="TRUE"|"FALSE"] [thread=num_of_threads]
file=ldif_file]
[load="TRUE"|"FALSE"  [append="TRUE"|"FALSE"] [threads=num_of_threads]]
[index="TRUE"|"FALSE"] [missing="TRUE"|"FALSE"] [recover="TRUE"|"FALSE"]}
[encode=character_set] [debug="TRUE"|"FALSE"] [verbose="TRUE"|"FALSE"]

Arguments for bulkload

connect

Optional. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in $DOMAIN_HOME/config/fmwconfig/components/OID/config/ directory. (You can set the TNS_ADMIN environment variable if you want to use a different location.) For loading data in single node, specify its connect string—for example orcl. For loading data in multiple nodes, specify connect strings of all nodes—for example:

bulkload connect="orcl1,orcl2,orcl3"

check | generate | load | recover | index | missing

Required. The operation to perform. The operations are:

• check - Checks the LDIF file provided for schema inconsistencies and for duplicate entry DNs. You must provide the full path or relative path and file name of an LDIF file. You can optionally specify the number of threads. The check and generate operations can be issued at the same time.

• generate - Creates intermediate files suitable for loading entries into Oracle Internet Directory using SQL*Loader. You must provide the full path or relative path and file name of an LDIF file from which to generate entries. You can optionally specify the number of threads. The check and generate operations can be issued at the same time.

  Note:

  • After the generate operation, the directory is left in the read-modify mode until you perform the load operation.

  • bulkload updates the mode to read-only when performing a load operation.

• load - Loads the files generated in the generate operation into the database. You can use the append option to specify if the data needs to be appended to the existing directory data. For load to succeed, the LDAP server must be stopped. You can optionally specify the number of threads. If you set the ldplonly option to "TRUE", then the data is loaded in parallel but index creation takes place in serial mode. You must run a generate operation before a load operation.

• recover - In case of a failure during a load operation, recovers the directory with the original data. You cannot use any other option when using the recover option.

• index - Recreates indexes on all catalog tables.

• missing - Creates only missing indexes on catalog tables.

file

Required for the check and generate operations. The fully qualified path or relative path and file name of the LDIF file that contains the entries you want to load.

threads

Optional for the check,generate, and load operations. The number of threads to create. The default value is the number of CPUs on the machine plus one.

restore

Optional with the check and generate operations. Assumes operational attributes, such as orclguid, creatorsname, and createtimestamp, are already present in the specified LDIF file. Duplicate operational attribute values are not created in the output SQL*Loader files.

When the restore option is set to TRUE, then the operational attributes specified in the LDIF file are honored. If restore option is not specified or it is set to FALSE, then the operational attributes might not be retained, depending on the type of attribute. Best practice is to avoid having operational attributes in the LDIF file when the restore option value is FALSE.

append

Optional with the generate and load operations. Loads entries in incremental mode rather than bulk mode, which is the default. Incremental mode appends data to existing directory data, and is intended for loading small amounts of data.

encode

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

debug

Optional. The debug option turns debugging on or off. Turning debugging on (debug="TRUE") is useful when the command runs into errors. The output is logged to the bulkload.log file. This file can be found under DOMAIN_HOME/tools/OID/logs.

verbose

This is used to run the command in verbose mode.

Related Command-Line Tools for bulkload

• See bulkdelete

• See bulkmodify

• See ldapadd

• See ldapaddmt

• Syntax for bulkmodify

• Arguments for bulkmodify

• Related Command-Line Tools for bulkmodify

Syntax for bulkmodify

bulkmodify connect=connect_string basedn=Base_DN
{[add="TRUE"|"FALSE"]|[replace="TRUE"|"FALSE"]} attribute=attribute_name
value=attribute_value [-q] [filter=filter_string] [size=transaction_size]
[threads=num_of_threads] [debug="TRUE"|"FALSE"] [encode=character_set]
[verbose="TRUE"|"FALSE"]

Arguments for bulkmodify

connect

Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in $DOMAIN_HOME/config/fmwconfig/components/OID/config/ directory. (You can set the TNS_ADMIN environment variable if you want to use a different location.)

basedn

Required. The DN of the subtree to be modified. Enclose the DN in quotes.

add | replace

Required. The operation to be performed on the attribute. Specifies whether you want to add an attribute value or replace an attribute value.

attribute

Required. The name of a single attribute for which a value needs to be added or replaced.

value

Required. The single attribute value to add or replace. If the value contains spaces, enclose it in quotes.

-q

Optional. The -q option causes the command to prompt for a secure value instead of the command line value. A secure value supplied at the command prompt is not visible on the screen.

filter

Optional. A filter string that contains a single attribute. Defaults to objectclass=*.

size

Optional. The number of entries to be committed as part of one transaction. Defaults to 100.

threads

Optional. The number of threads to create. The default value is the number of CPUs on the machine plus one.

debug

Optional. The debug option reports the logging level. This is useful in case the command runs into errors. The output is logged to the bulkmodify.log file. This file can be found under $DOMAIN_HOME/tools/OID/logs.

encode

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

verbose

This is used to run the command in verbose mode.

Related Command-Line Tools for bulkmodify

• See bulkdelete

• See bulkload

• See ldapmodify

• See ldapmodifymt

• Syntax for catalog

• Arguments for catalog

• Related Command-Line Tools for catalog

Syntax for catalog

catalog connect=connect_string {[add="TRUE"|"FALSE"]|[delete="TRUE"|"FALSE"]}
{[attribute=attribute_name]|[file=file_name]} [logging="TRUE"|"FALSE"]
[threads=num_of_threads] [debug="TRUE"|"FALSE"] [iot="TRUE"|"FALSE"] [verbose="TRUE"|"FALSE"]

Arguments for catalog

connect

Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in $DOMAIN_HOME/config/fmwconfig/components/OID/config/ directory. (You can set the TNS_ADMIN environment variable if you want to use a different location.)

add | delete

Required. The operation to perform. The add argument indexes the specified attribute. The delete argument drops the index for the specified attribute.

attribute | file

Required. The attribute or attributes to catalog. Use the attribute argument to specify a single attribute name on the command-line. Use the file argument to provide the full path and file name of a file that contains a list of several attribute names.

logging

Optional. This option is used to decide if redo logs are generated when a catalog is created.

threads

Optional. The number of threads to create. The default value is the number of CPUs on the machine plus one.

debug

Optional. The debug option reports the logging level. This is useful in case the command runs into errors. The output is logged to the catalog.log file. This file can be found under $DOMAIN_HOME/tools/OID/logs.

iot

Optional. If set to TRUE, this option causes an Index Organized Table (IOT) to be created for the specified attribute without creating an additional index. The IOT option improves both read and write performance for a normal LDAP operation and reduces the storage as well. Use the IOT option when you expect lot of updates for the cataloging attribute. The default is FALSE.

verbose

Optional. This option specifies whether the command should be run in verbose mode.

Related Command-Line Tools for catalog

• N/A

• Syntax for ldapadd

• Arguments for ldapadd

• Related Command-Line Tools for ldapadd

Syntax for ldapadd

ldapadd -h oid_hostname -D "binddn" -q | -w password [-Y "proxy_dn"] 
[-p ldap_port]  [-V ldap_version] {-f ldif_filename | -X dsml_filename} 
[-b] [-n] [-c [-o log_file_name]] [-M] [-v] [-O ref_hop_limit] [-i 1|0] 
[-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] 
[-d debug_level] [-E character_set]

Arguments for ldapadd

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D ""binddn

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-Y ""proxy_dn

Optional. The DN of a proxy user. After binding to the directory, the add operation is performed as this user.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-f ldif_filename | -X dsml_filename

Required. The full path and file name of the input file that contains the data you want to import.

Use the -f argument to supply an LDIF file. See LDIF File Format for information on formatting an LDIF file.

Use the -X argument to supply a Directory Service Markup Language (DSML) file. See Adding Data to the Directory Using a DSML File for more information about formatting a DSML file.

-b

Optional. Use this option if your input file has binary file names in it, which are preceded by the forward slash character. The tool retrieves the actual values from the file referenced.

-n

Optional. Enables you to preview what would occur in an operation without actually performing the operation.

-c

Optional. Proceeds in spite of errors. All errors are reported. If the -c argument is not used, the tool stops when an error occurs.

-o log_file_name

Optional. Used with the -c argument. Writes the LDIF entries with errors to a log file. Specify the full path and name of the log file.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-v

Optional. Runs the tool in verbose mode.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-i 1 | 0

Optional. Specifies whether to bind as the current user when following referrals. 1 means bind as the current user, 0 means bind anonymously. The default is 0 (zero).

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapadd

• See ldapaddmt

• See ldapmodify

• See bulkload

• Syntax for ldapaddmt

• Arguments for ldapaddmt

• Related Command-Line Tools for ldapaddmt

Syntax for ldapaddmt

ldapaddmt -h oid_hostname -D "binddn" -q | -w password -T number_threads 
[-p ldap_port] [-V ldap_version] {-f ldif_filename | -X dsml_filename}  [-b] [-c]
[-M] [-O ref_hop_limit] [-U SSL_auth_mode {-W wallet_location -Q | -P
wallet_password}] [-d debug_level] [-E character_set]

Arguments for ldapaddmt

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-T number_threads

Required. The number of threads for concurrently processing entries.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-f ldif_filename | -X dsml_filename

Required. The full path and file name of the input file that contains the data you want to import.

Use the -f argument to supply an LDIF file. See LDIF File Format for information on formatting an LDIF file.

Use the -X argument to supply a Directory Service Markup Language (DSML) file. See Adding Data to the Directory Using a DSML File for more information about formatting a DSML file.

-b

Optional. Use this option if your input file has binary file names in it, which are preceded by the forward slash character. The tool retrieves the actual values from the file referenced.

-c

Optional. Proceeds in spite of errors. All errors are reported. If the -c argument is not used, the tool stops when an error occurs.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapaddmt

• See ldapadd

• See bulkload

• Syntax for ldapbind

• Arguments for ldapbind

• Related Command-Line Tools for ldapbind

Syntax for ldapbind

ldapbind -h oid_hostname -D "binddn" -q | -w password [-p ldap_port] 
[-V ldap_version] [-n] [-O "auth"] [-Y "DIGEST-MD5|EXTERNAL"] 
[-R SASL_realm] [-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}]
[-E character_set]

Arguments for ldapbind

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-O "auth"

Optional. Specifies SASL security properties. The security property supported is -O "auth". This security property is for DIGEST-MD5 SASL mechanism. It enables authentication with no data integrity or data privacy.

-Y "DIGEST-MD5 | EXTERNAL"

Optional. Specifies a Simple Authentication and Security Layer (SASL) mechanism. The following mechanisms are supported:

• DIGEST-MD5

• EXTERNAL - The SASL authentication in this mechanism is done on top of two-way SSL authentication. In this case the identity of the user stored in the SSL wallet is used for SASL authentication.

-R SASL_realm

Optional. A SASL realm.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapbind

• N/A

• Syntax for ldapcompare

• Arguments for ldapcompare

• Related Command-Line Tools for ldapcompare

Syntax for ldapcompare

ldapcompare -h oid_hostname -D "binddn" -q | -w password [-Y "proxy_dn"] 
[-p ldap_port] -a attribute_name -b "base" -v "attribute_value" 
[-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] 
[-d debug_level] [-E character_set]

Arguments for ldapcompare

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-Y ""proxy_dn

Optional. The DN of a proxy user. After binding to the directory, the add operation is performed as this user.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-a attribute_name

Required. The attribute for which to perform the comparison of values.

-b "base"

Required. The DN of the entry for which to perform the comparison.

-v "attribute_value"

Required. The attribute value that you want to compare to the value in the entry.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapcompare

• N/A

• Syntax for ldapdelete

• Arguments for ldapdelete

• Related Command-Line Tools for ldapdelete

Syntax for ldapdelete

ldapdelete -h oid_hostname -D "binddn" -q | -w password [-Y proxy_dn] 
[-p ldap_port] [-V ldap_version] {-f ldif_filename | "entry_dn"} 
[-n] [-M] [-v] [-O ref_hop_limit] 
[-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] [-E character_set]

Arguments for ldapdelete

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-Y "proxy_dn"

Optional. The DN of a proxy user. After binding to the directory, the add operation is performed as this user.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-f ldif_filename | "entry_dn"

Required. The full path and file name of the input file that contains the entry DNs you want to delete, or a single entry DN supplied on the command-line.

Use the -f argument to supply an LDIF file. See LDIF File Format for information on formatting an LDIF file.

To delete one entry, supply the DN of the entry in quotes.

-n

Optional. Enables you to preview what would occur in an operation without actually performing the operation.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-v

Optional. Runs the tool in verbose mode.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapdelete

• See bulkdelete

• Syntax for ldapmoddn

• Arguments for ldapmoddn

• Related Command-Line Tools for ldapmoddn

Syntax for ldapmoddn

ldapmoddn -h oid_hostname -D "binddn" -q | -w password [-p ldap_port] 
[-V ldap_version] -b "base_dn" {-R "new_rdn"|-N "new_parent"} 
[-r] [-M] [-O ref_hop_limit] 
[-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] [-E character_set]

Arguments for ldapmoddn

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-b "base_dn"

Required. The DN of the entry to be moved to a new parent DN or have its RDN updated.

-R "new_rdn" | -N "new_parent"

Required. The action to perform. Use the -R argument to change the RDN of the entry. Use the -N argument to move the entry to a new parent node in the directory tree.

-r

Optional. Specifies that the old RDN is not retained as a value in the modified entry. If not included, the old RDN is retained as an attribute in the modified entry.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

Related Command-Line Tools for ldapmoddn

• See ldapmodify

• Syntax for ldapmodify

• Arguments for ldapmodify

• Related Command-Line Tools for ldapmodify

Syntax for ldapmodify

ldapmodify -h oid_hostname -D "binddn" [-Y "proxy_dn"] -q | -w password 
[-p ldap_port] [-V ldap_version] {-f ldif_filename | -X dsml_filename}  
[-a] [-b] [-c [-o log_file_name]] [-n] [-v] [-M] [-O ref_hop_limit] 
[-i 1|0] [-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] 
[-E character_set] [-d debug_level]

Arguments for ldapmodify

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-Y "proxy_dn"

Optional. The DN of a proxy user. After binding to the directory, the add operation is performed as this user.

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-f ldif_filename | -X dsml_filename

Required. The full path and file name of the input file that contains the data you want to import.

Use the -f argument to supply an LDIF file. See LDIF File Format for information on formatting an LDIF file.

Use the -X argument to supply a Directory Service Markup Language (DSML) file. See Adding Data to the Directory Using a DSML File for more information about formatting a DSML file.

-a

Optional. Denotes that the LDIF or DSML input file has new entries to be added.

-b

Optional. Use this option if your input file has binary file names in it, which are preceded by the forward slash character. The tool retrieves the actual values from the file referenced.

-c

Optional. Proceeds in spite of errors. All errors are reported. If the -c argument is not used, the tool stops when an error occurs.

-n

Optional. Enables you to preview what would occur in an operation without actually performing the operation.

-v

Optional. Runs the tool in verbose mode.

-o log_file_name

Optional. Used with the -c argument. Writes the LDIF entries with errors to a log file. Specify the full path and name of the log file.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-i 1 | 0

Optional. Specifies whether to bind as the current user when following referrals. 1 means bind as the current user, 0 means bind anonymously. The default is 0 (zero).

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

Related Command-Line Tools for ldapmodify

• See ldapadd

• See ldapdelete

• See ldapmoddn

• Syntax for ldapmodifymt

• Arguments for ldapmodifymt

• Related Command-Line Tools for ldapmodifymt

Syntax for ldapmodifymt

ldapmodifymt -h oid_hostname -D "binddn" -q | -w password [-p ldap_port] 
[-V ldap_version] -T number_of_threads {-f ldif_filename | -X dsml_filename}  
[-a] [-b] [-c [-o log_file_name]] [-M] [-O ref_hop_limit 
[-U SSL_auth_mode {-W wallet_location -Q | -P wallet_password}] 
[-E character_set] [-d debug_level]

Arguments for ldapmodifymt

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-T number_threads

Required. The number of threads for concurrently processing entries.

-f ldif_filename | -X dsml_filename

Required. The full path and file name of the input file that contains the data you want to import.

Use the -f argument to supply an LDIF file. See LDIF File Format for information on formatting an LDIF file.

Use the -X argument to supply a Directory Service Markup Language (DSML) file. See Adding Data to the Directory Using a DSML File for more information about formatting a DSML file.

-a

Optional. Denotes that the LDIF file has entries to be added.

-b

Optional. Use this option if your input file has binary file names in it, which are preceded by the forward slash character. The tool retrieves the actual values from the file referenced.

-c

Optional. Proceeds in spite of errors. All errors are reported. If the -c argument is not used, the tool stops when an error occurs.

-o log_file_name

Optional. Used with the -c argument. Writes the LDIF entries with errors to a log file. Specify the full path and name of the log file.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

Related Command-Line Tools for ldapmodifymt

• See ldapaddmt

• See ldapmodify

• Syntax for ldapsearch

• Arguments for ldapsearch

• Related Command-Line Tools for ldapsearch

Syntax for ldapsearch

ldapsearch -h oid_hostname -D "binddn" -q | -w password [-Y "proxy_dn"] 
[-p ldap_port] [-V ldap_version] -b "basedn" {-s base|one|sub} {"filter_string"
attributes]|-f input_file} [-F separator] [-T [-]sort_attribute] [-j page_size]
[-A] [-a never|always|search|find] [-S] [-R] [-i 1|0] [-t] [-u] [-L|-X] [-B] [-M]
[-v] [-n] [-l time_limit] [-z size_limit] [-O ref_hop_limit] [-U SSL_auth_mode 
{-W wallet_location -Q | -P wallet_password}] [-d debug_level] 
[-E character_set][-c]

Arguments for ldapsearch

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D "binddn"

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-Y "proxy_dn"

Optional. The DN of a proxy user. After binding to the directory, the add operation is performed as this user.

-p ldap_port

Optional. The port number used to connect to the Oracle Internet Directory server. Defaults to port 3060.

-V ldap_version

Optional. The version of the LDAP protocol to use. Allowed values are 2 or 3. Defaults to 3 (LDAP v3).

-b "basedn"

Required. The base DN for the search.

-s base | one | sub

Required. The scope of the search within the DIT. The options are:

• base - Retrieves a particular directory entry. Along with this search depth, you use the search criteria bar to select the attribute objectClass and the filter Present.

• one - Limits your search to all entries beginning one level down from the root of your search.

• sub - Searches entries within the entire subtree, including the root of your search.

"filter_string" [attributes] | -f input_file

Required. Supply a single filter on the command-line within quotes followed by the attribute names whose values you want returned. Separate attributes with a space. If you do not list any attributes, all attributes are retrieved.

By default, ldapsearch does not return operational attributes. If you add the character "+" to the list of attributes in the search request, however, ldapsearch returns all operational attributes.

You can also supply an input file with the -f argument that contains a sequence of search operations to perform.

In the output, the attribute names are shown in lower case if the attribute orclReqattrCase is 0 in the instance-specific config entry. If orclReqattrCase is set to 1, the attribute names in the output are shown in the same case in which they were entered on the command line. See Attribute Case in ldapsearch Output.

-F separator

Optional. Enables you to choose a separator to use between attribute names and values in the search output. The default is = (equal sign).

-T [-]sort_attribute

Optional. Instructs the tool to send a sort request to the server. The server returns entries sorted on the attribute, sort_attribute. A dash (-) before sort_attribute instructs the tool to sort the entries in reverse order.

-j page_size

Optional. Instructs the tool to send a page request to the server. The server returns paged entries with pages of size, page_size.

-A

Optional. Retrieves attribute names only (no values).

-a never | always | search | find

Optional. Specifies alias dereferencing. An alias entry in an LDAP directory is an entry that points to another entry. Following an alias pointer is known as dereferencing an alias. The options are:

• never - Never dereference alias entries. Choose this option to improve search performance if there are no alias entries in the directory that require dereferencing.

• always - Always dereference aliases. This selection is the default.

• search - Dereference alias entries subordinate to a specified search base, but do not dereference an alias search base entry.

• find - Deference an alias entry for a specified search base, but do not dereference alias entries subordinate to the search base.

-S attr

Optional. Sorts the results by the attribute specified.

-R

Optional. Disables the automatic following of referrals.

-i 1 | 0

Optional. Specifies whether to bind as the current user when following referrals. 1 means bind as the current user, 0 means bind anonymously. The default is 0 (zero).

-t

Optional. Writes files to /tmp.

-u

Optional. Includes user-friendly names in the output.

-L | -X

Optional. Prints entries in LDIF (-L) or DSML format (-X).

With the -L option, all attributes, including binary attributes are printed in LDAP Data Interchange Format (LDIF). Binary attributes are transformed into printable characters using BASE64 encoding.

-B

Optional. Allows printing of non-ASCII values. Binary attributes are printed as is, without encoding. The complete value might not be printed, as it might contain non-printable characters.

-M

Optional. Instructs the tool to send the ManageDSAIT control to the server. The ManageDSAIT control instructs the server not to send referrals to clients. Instead a referral entry is returned as a regular entry.

-n

Optional. Enables you to preview what would occur in an operation without actually performing the operation.

-v

Optional. Runs the tool in verbose mode.

-l time_limit

Optional. The maximum time in seconds to wait for an ldapsearch command to complete.

-z size_limit

Optional. The maximum number of entries to return.

-O ref_hop_limit

Optional. The number of referral hops that a client should process. Defaults to 5.

-U SSL_auth_mode

Optional. The SSL authentication mode:

• 1 for no authentication required.

• 2 for one way authentication required. You must also supply a wallet location and wallet password.

• 3 for two way authentication required. You must also supply a wallet location and wallet password.

-W wallet_location

Required if using one way or two way SSL authentication (-U 2|3). The location of the wallet file that contains the server's SSL certificates.

Example for UNIX:

-W "file:/home/my_dir/my_wallet"

Example for Microsoft Windows:

-W "file:C:\my_dir\my_wallet"

-Q

Required, unless -P is used, if using one way or two way SSL authentication (-U 2|3). Causes the command to prompt for the wallet password for the wallet specified in the -W argument. A password supplied at the command prompt is not visible on the screen.

-P wallet_password

Required, unless -Q is used, if using one way or two way SSL authentication (-U 2|3). The wallet password for the wallet specified in the -W argument. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -P wallet_password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-d debug_level

Optional. If not specified the default of 0 (not enabled) is used. Debug levels are additive. Add the numbers representing the functions that you want to activate, and use the sum of those in the command-line option. For example, to trace search filter processing (512) and active connection management (256), enter 768 as the debug level (512 + 256 = 768). Debug levels are as follows:

• 1 — Heavy trace debugging

• 128 — Debug packet handling

• 256 — Connection management, related to network activities

• 512 — Search filter processing

• 1024 — Entry parsing

• 2048 — Configuration file processing

• 8192 — Access control list processing

• 491520 — Log of communication with the database

• 524288 — Schema related operations

• 4194304 — Replication specific operations

• 8388608 — Log of entries, operations and results for each connection

• 16777216 — Trace function call arguments

• 67108864 — Number and identity of clients connected to this server

• 117440511 — All possible operations and data

-E character_set

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

-C

Optional. ldapsearch -C option causes ldapsearch to traverse a hierarchy and report direct memberships. The ldapsearch -C option essentially includes the CONNECT_BY control (2.16.840.1.113894.1.8.3) in the request sent to the client. ldapsearch doesn't have any means to pass values with a control. So, it sends the CONNECT_BY control without values. In this case the default values are assumed, that is, the hierarchy-establishing attribute name is obtained from the filter, and the number of levels is 0. Thus, the -C option can only be used to fetch all containers of a containee queries, for example, fetch all groups of a user, fetch all employees of a manager and so forth. Also, all levels of the hierarchy are traversed. For more information, see Table 6-2.

Related Command-Line Tools for ldapsearch

• See ldapcompare

• See catalog

• Syntax for ldifmigrator

• Arguments for ldifmigrator

• Related Command-Line Tools for ldifmigrator

• Error Messages for ldifmigrator

Syntax for ldifmigrator

ldifmigrator "input_file=filename" "output_file=filename"
[-lookup -h oid_hostname "dn=binddn" -w password [-p ldap_port]
[subscriber=subscriberDN]] ["s_VariableName1=replacement_value" 
"s_VariableName2=replacement_value"...] 
[-load -reconcile SAFE|SAFE_EXTENDED|NORMAL]

Arguments for ldifmigrator

"input_file=filename"

The full path and file name of the LDIF file that contains directory entry data and one or more substitution variables.

"output_file=filename"

The full path and file name of the output file produced by the ldifmigrator tool.

-lookup

If this flag is specified, then values of certain substitution variables are obtained by looking up the correct values in the directory server. See Substitution Variables for Migration Input Files for a list of substitution variables that can be looked up.

-h oid_hostname

Required if the -lookup flag is used. The host name or IP address of the Oracle Internet Directory server.

"dn=binddn"

Required if the -lookup flag is used. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

subscriber=subscriberDN

Optional. The subscriber whose attribute values is used in place of the substitution variables. If not specified, then the default identity management realm specified in the Root Oracle Context is used.

"s_VariableName=replacement_value"

Optional. You can specify a value for a substitution variable on the command-line. See Substitution Variables for Migration Input Files for instructions on adding a substitution variable to the input LDIF file. The ldifmigrator tool replaces all occurrences of the variable with the value you specify.

-load

Optional. Loads the data output by the ldifmigrator tool directly into Oracle Internet Directory. If an entry is already present in the directory then that directory entry is logged to the file. The addition of the directory entries could fail for other reasons as well, for instance not enough permission to add or parent entry not being present.

-reconcile SAFE | SAFE_EXTENDED | NORMAL

Optional. The -reconcile option enables you to specify different modes if the tool tries to load data for entries that already exist, or modify attributes of entries that may have conflicts. The following modes are available:

• SAFE - This mode only adds new entries that don't exist or appends new attributes to existing entries.

• SAFE-EXTENDED - This mode only adds new entries that don't exist or appends new attributes to existing entries. If you try to add a new value for existing attributes, then it adds it to the existing set of values.

• NORMAL - This mode applies all directives as intended, overwriting any conflicting attributes or entries with the data specified in the ldifmigrator output.

See Reconciliation Modes for Migrated Entries for more information about LDIF directives supported by the -reconcile option.

Related Command-Line Tools for ldifmigrator

• See ldapadd

• See ldapmodify

• See ldifwrite

Error Messages for ldifmigrator

The Data Migration Tool can display these error messages:

When an error condition occurs, the log messages are logged to this file:

$DOMAIN_HOME/tools/OID/logs/LDIFMig_YYYY_MM_DD_HH_SS.log.

• Syntax for ldifwrite

• Arguments for ldifwrite

• Related Command-Line Tools for ldifwrite

Syntax for ldifwrite

ldifwrite connect=connect_string basedn=Base_DN ldiffile=LDIF_Filename [filter=LDAP_Filter] [threads=num_of_threads] [debug="TRUE"|"FALSE"] [encode=character_set] [verbose="TRUE"|"FALSE"]

Arguments for ldifwrite

connect

Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in $DOMAIN_HOME/config/fmwconfig/components/OID/config/ directory. (You can set the TNS_ADMIN environment variable if you want to use a different location.)

basedn

Required. The base DN of the subtree to be written out in LDIF format.

If the base DN is a replication agreement entry, then you can back up part of the naming context based on the LDAP naming context configuration. Specify the replication agreement DN in this case.

ldiffile

Required. The full path and file name of the output LDIF file.

filter

Optional. This is the LDAP filter to be used. You can specify a filter to select entries that match a particular criteria. Only these entries would be written to the LDIF file.

threads

Optional. The number of threads used to read from the directory store and write to the LDIF output file. The default is the number of CPUs plus one.

debug

Optional. The debug option reports the logging level. This is useful in case the command runs into errors. The output is logged to the ldifwrite.log file. This file can be found under $DOMAIN_HOME/tools/OID/logs.

encode

Optional. The native character set encoding. Defaults to the character set of the user's terminal. Each supported character set has a unique acronym, for example, WE8MSWIN1252, JA16SJIS, or AL32UTF8.

verbose

Related Command-Line Tools for ldifwrite

• ldapsearch

• ldifmigrator

• bulkload

• Syntax for upgradecert.pl

• Arguments for upgradecert.pl

• Related Command-Line Tools for upgradecert.pl

Syntax for upgradecert.pl

perl ORACLE_HOME/ldap/bin/upgradecert.pl -h oid_hostname -D "binddn"
-w password [-p ldap_port] [-t temp_dir]

Arguments for upgradecert.pl

-h oid_hostname

Required. The host name or IP address of the Oracle Internet Directory server.

-D ""binddn

Required. The DN of the Oracle Internet Directory user needed to bind to the directory (for example, cn=orcladmin).

-q

Required unless -w is used. Causes the command to prompt for the user password needed to bind to the directory. A password supplied at the command prompt is not visible on the screen.

-w password

Required unless -q is used. The user password needed to bind to the directory. Avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. The -w password option is disabled when LDAP_PASSWORD_PROMPTONLY is set to true. See Overview of Passwords with Command-Line Tools.

-t temp_dir

Optional. The location of the temporary working directory. This is where the log file is found. The default is $DOMAIN_HOME/tools/OID/logs if the DOMAIN_HOME environment variable is set. If this variable is not set, the default is the current directory.

Related Command-Line Tools for upgradecert.pl

• N/A