mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-26 17:01:14 -06:00
113 lines
5.2 KiB
Groff
113 lines
5.2 KiB
Groff
.\" A man page for ipa-ldap-updater
|
|
.\" Copyright (C) 2008 Red Hat, Inc.
|
|
.\"
|
|
.\" This program is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the GNU General Public License as published by
|
|
.\" the Free Software Foundation, either version 3 of the License, or
|
|
.\" (at your option) any later version.
|
|
.\"
|
|
.\" This program is distributed in the hope that it will be useful, but
|
|
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
.\" General Public License for more details.
|
|
.\"
|
|
.\" You should have received a copy of the GNU General Public License
|
|
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
.\"
|
|
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
|
.\"
|
|
.TH "ipa-ldap-updater" "1" "Sep 12 2008" "FreeIPA" "FreeIPA Manual Pages"
|
|
.SH "NAME"
|
|
ipa\-ldap\-updater \- Update the IPA LDAP configuration
|
|
.SH "SYNOPSIS"
|
|
ipa\-ldap\-updater [options] input_file(s)
|
|
ipa\-ldap\-updater [options]
|
|
.SH "DESCRIPTION"
|
|
ipa\-ldap\-updater is used to apply updates to the IPA LDAP server when the IPA packages are being updated. It is not intended to be executed by end\-users.
|
|
|
|
When run with no file arguments, ipa\-ldap\-updater will process all files with the extension .update in /usr/share/ipa/updates.
|
|
|
|
An update file describes an LDAP entry and a set of operations to be performed on that entry. It can be used to add new entries or modify existing entries.
|
|
|
|
Blank lines and lines beginning with # are ignored.
|
|
|
|
There are 7 keywords:
|
|
|
|
* default: the starting value
|
|
* add: add a value (or values) to an attribute
|
|
* remove: remove a value (or values) from an attribute
|
|
* only: set an attribute to this
|
|
* onlyifexist: set an attribute to this only if the entry exists
|
|
* deleteentry: remove the entry
|
|
* replace: replace an existing value, format is old: new
|
|
* addifnew: add a new attribute and value only if the attribute doesn't already exist. Only works with single\-value attributes.
|
|
* addifexist: add a new attribute and value only if the entry exists. This is used to update optional entries.
|
|
|
|
Values is a comma\-separated field so multi\-values may be added at one time. Double or single quotes may be put around individual values that contain embedded commas.
|
|
|
|
The difference between the default and add keywords is if the DN of the entry exists then default is ignored. So for updating something like schema, which will be under cn=schema, you must always use add (because cn=schema is guaranteed to exist). It will not re\-add the same information again and again.
|
|
|
|
It also provides some things that can be templated such as architecture (for plugin paths), realm and domain name.
|
|
|
|
The available template variables are:
|
|
|
|
* $REALM \- the kerberos realm (EXAMPLE.COM)
|
|
* $FQDN \- the fully\-qualified domain name of the IPA server being updated (ipa.example.com)
|
|
* $DOMAIN \- the domain name (example.com)
|
|
* $SUFFIX \- the IPA LDAP suffix (dc=example,dc=com)
|
|
* $ESCAPED_SUFFIX \- the ldap\-escaped IPA LDAP suffix
|
|
* $LIBARCH \- set to 64 on x86_64 systems to be used for plugin paths
|
|
* $TIME \- an integer representation of current time
|
|
|
|
A few rules:
|
|
|
|
1. Only one rule per line
|
|
2. Each line stands alone (e.g. an only followed by an only results in the last only being used)
|
|
3. Adding a value that exists is ok. The request is ignored, duplicate values are not added
|
|
4. Removing a value that doesn't exist is ok. It is simply ignored.
|
|
5. If a DN doesn't exist it is created from the 'default' entry and all updates are applied
|
|
6. If a DN does exist the default values are skipped
|
|
7. Only the first rule on a line is respected
|
|
|
|
Adds and updates are applied from shortest to longest length of DN. Deletes are done from longest to shortest.
|
|
|
|
Additionally, ipa-ldap-updater can update the schema based on LDIF files.
|
|
Any missing object classes and attribute types are added, and differing ones are updated to match the LDIF file.
|
|
To enable this behavior, use the \-\-schema or \-\-schema-file options.
|
|
Schema files should be in LDIF format, and may only specify attributeTypes and objectClasses attributes of cn=schema.
|
|
|
|
.SH "OPTIONS"
|
|
.TP
|
|
\fB\-d\fR, \fB\-\-debug\fR
|
|
Enable debug logging when more verbose output is needed
|
|
.TP
|
|
\fB\-t\fR, \fB\-\-test\fR
|
|
Run through the update without changing anything. If changes are available then the command returns 2. If no updates are available it returns 0.
|
|
.TP
|
|
\fB\-y\fR
|
|
File containing the Directory Manager password
|
|
.TP
|
|
\fB\-l\fR, \fB\-\-ldapi\fR
|
|
Connect to the LDAP server using the ldapi socket
|
|
.TP
|
|
\fB\-p\fR, \fB\-\-plugins\fR
|
|
Execute update plugins as well as any update files. There is no way to execute only the plugins.
|
|
.TP
|
|
\fB\-u\fR, \fB\-\-upgrade\fR
|
|
Upgrade an installed server in offline mode (implies \-\-ldapi, \-\-plugins, and \-\-schema)
|
|
.TP
|
|
\fB\-W\fR, \fB\-\-password\fR
|
|
Prompt for the Directory Manager password
|
|
.TP
|
|
\fB\-s\fR, \fB\-\-schema\fR
|
|
Also update the LDAP schema. If no \-\-schema-file is specified, update to the built-in IPA schema.
|
|
.TP
|
|
\fB\-S\fR, \fB\-\-schema\-file\fR
|
|
Specify a schema file. May be used multiple times. Implies \-\-schema.
|
|
.SH "EXIT STATUS"
|
|
0 if the command was successful
|
|
|
|
1 if an error occurred
|
|
|
|
2 if run with in test mode (\-t) and updates are available
|