DSCONF(8)

📦

version 3.3.1 · 15 versions

💖 DSCONF(8) — Generated Python Manual 💖

okay bestie, welcome to the dsconf man page, but make it fashion. this is part 1 of 33, so buckle up. 💅

✨ NAME ✨

dsconf — the whole entire vibe. that's the name. she's the command-line bestie for your 389 Directory Server instance. periodt.

✨ SYNOPSIS ✨

dsconf [-h] [-v] [-j] [-D BINDDN] [-w BINDPW] [-W] [-y PWDFILE] [-b
BASEDN] [-Z] instance
{backend,backup,chaining,config,directory_manager,logging,monitor,plugin,pwpolicy,localpwp,replication,repl,repl-
agmt,repl-winsync-agmt,repl-tasks,repl-conflict,sasl,security,schema}
...

🌈 POSITIONAL ARGUMENTS 🌈

dsconf backend — Manage database suffixes and backends. the whole backend situation, slay.
dsconf backup — Manage online backups. protect the bag. 💰
dsconf chaining — Manage database chaining and database links. linking databases like it's a group chat.
dsconf config — Manage the server configuration. the settings page but make it CLI.
dsconf directory_manager — Manage the Directory Manager account. the VIP account, no cap.
dsconf logging — Manage the server logs. receipts, but forever.
dsconf monitor — Monitor the state of the instance. vibe check on your server.
dsconf plugin — Manage plug-ins available on the server. add-ons, but UNIX.
dsconf pwpolicy — Manage the global password policy settings. rules for the passwords, periodt.
dsconf localpwp — Manage the local user and subtree password policies. more password rules, but local.
dsconf replication — Manage replication for a suffix. copy and paste but for databases.
dsconf repl-agmt — Manage replication agreements. the contracts between replicas.
dsconf repl-winsync-agmt — Manage Winsync agreements. syncing with Windows, iconic.
dsconf repl-tasks — Manage replication tasks. chores but for replication.
dsconf repl-conflict — Manage replication conflicts. when replicas argue, you mediate.
dsconf sasl — Manage SASL mappings. authentication glow-up.
dsconf security — Manage security settings. lock it down, bestie.
dsconf schema — Manage the directory schema. the blueprint of the whole thing.

🦋 COMMAND 'dsconf backend' 🦋

usage: dsconf [-v] [-j] instance backend [-h]
                                      {suffix,index,vlv-index,attr-encrypt,config,monitor,import,export,create,delete,get-tree,compact-db}
       ...

🌸 POSITIONAL ARGUMENTS 'dsconf backend' 🌸

dsconf backend suffix — Manage backend suffixes. the endings, but for databases.
dsconf backend index — Manage backend indexes. speed up your searches, lowkey essential.
dsconf backend vlv-index — Manage VLV searches and indexes. virtual list view, very fancy.
dsconf backend attr-encrypt — Manage encrypted attribute settings. secrets stay secret. 🤫
dsconf backend config — Manage the global database configuration settings. the big settings.
dsconf backend monitor — Displays global database or suffix monitoring information. see how your database is doing, emotionally.
dsconf backend import — Online import of a suffix. bring data in while the server is up.
dsconf backend export — Online export of a suffix. yeet data out while the server is up.
dsconf backend create — Create a backend database. build-a-bear but for databases.
dsconf backend delete — Delete a backend database. bye bye, bestie. 😭
dsconf backend get-tree — Display the suffix tree. family tree but for suffixes.
dsconf backend compact-db — Compact the database and the replication changelog. tidy up, clean girl aesthetic.

🎀 COMMAND 'dsconf backend suffix' 🎀

usage: dsconf [-v] [-j] instance backend suffix [-h]
                                                       {list,get,get-dn,get-sub-suffixes,set}
       ...

💅 POSITIONAL ARGUMENTS 'dsconf backend suffix' 💅

dsconf backend suffix list — List active backends and suffixes. show me the menu.
dsconf backend suffix get — Display the suffix entry. one suffix, all the tea.
dsconf backend suffix get-dn — Display the DN of a backend. the full distinguished name, okay.
dsconf backend suffix get-sub-suffixes — Display sub-suffixes. the children of suffixes.
dsconf backend suffix set — Set configuration settings for a specific backend. customize your backend, main character energy.

⭐ COMMAND 'dsconf backend suffix list' ⭐

usage: dsconf [-v] [-j] instance backend suffix list [-h] [--suffix]
                                                            [--skip-subsuffixes]

🔥 OPTIONS 'dsconf backend suffix list' 🔥

--suffix — Displays the suffixes without backend name. just the suffix, no last name.
--skip-subsuffixes — Displays the list of suffixes without sub-suffixes. no kids allowed on this list.

🍓 COMMAND 'dsconf backend suffix get' 🍓

usage: dsconf [-v] [-j] instance backend suffix get [-h] [selector]

selector — The backend database name to search for. tell me who you're looking for.

🧚 COMMAND 'dsconf backend suffix get-dn' 🧚

usage: dsconf [-v] [-j] instance backend suffix get-dn [-h] [dn]

dn — The DN to the database entry in cn=ldbm database,cn=plugins,cn=config. the whole address, periodt.

💜 COMMAND 'dsconf backend suffix get-sub-suffixes' 💜

usage: dsconf [-v] [-j] instance backend suffix get-sub-suffixes
              [-h] [--suffix] be_name

be_name — The backend name or suffix. which backend are we talking about, bestie?

✨ OPTIONS 'dsconf backend suffix get-sub-suffixes' ✨

--suffix — Displays the list of suffixes without backend name. again, just the suffix.

👑 COMMAND 'dsconf backend suffix set' 👑

usage: dsconf [-v] [-j] instance backend suffix set [-h]
       [--enable-readonly]
                                                           [--disable-readonly]
                                                           [--enable-orphan]
                                                           [--disable-orphan]
                                                           [--require-index]
                                                           [--ignore-index]
                                                           [--add-referral
       ADD_REFERRAL]
                                                           [--del-referral
       DEL_REFERRAL]
                                                           [--enable]
       [--disable]
                                                           [--cache-size
       CACHE_SIZE]
                                                           [--cache-memsize
       CACHE_MEMSIZE]
                                                           [--cache-preserved-entries
       CACHE_PRESERVED_ENTRIES]
                                                           [--dncache-memsize
       DNCACHE_MEMSIZE]
                                                           [--state STATE]
                                                           be_name

be_name — The backend name or suffix. which one are we setting up?

💚 OPTIONS 'dsconf backend suffix set' 💚

--enable-readonly — Enables read-only mode for the backend database. no writing, just reading. it's giving library.
--disable-readonly — Disables read-only mode for the backend database. writing is back on the menu.
--enable-orphan — Disconnect a subsuffix from its parent suffix. free the subsuffix, it's an orphan now.
--disable-orphan — Let the subsuffix be connected to its parent suffix. family reunion, we love to see it.
--require-index — Allows only indexed searches. if it's not indexed, it's not invited.
--ignore-index — Allows all searches even if they are unindexed. chaos, but make it searchable.
--add-referral ADD_REFERRAL — Adds an LDAP referral to the backend. sending people elsewhere, politely.
--del-referral DEL_REFERRAL — Removes an LDAP referral from the backend. no more forwarding address.
--enable — Enables the backend database. turn it on, bestie.
--disable — Disables the backend database. turn it off, bye.
--cache-size CACHE_SIZE — Sets the maximum number of entries to keep in the entry cache. how many entries can crash on your couch.
--cache-memsize CACHE_MEMSIZE — Sets the maximum size in bytes that the entry cache can grow to. memory limit, but for cache.
--cache-preserved-entries CACHE_PRESERVED_ENTRIES — Sets the maximum number of entries that are not evicted from the cache when trying to make space. This is typically used to keep very large groups in the cache. VIP entries that never get kicked out.
--dncache-memsize DNCACHE_MEMSIZE — Sets the maximum size in bytes that the DN cache can grow to. same, but for the DN cache.
--state STATE — Changes the backend state to: "backend", "disabled", "referral", or "referral on update". pick a state, any state.

🦋 COMMAND 'dsconf backend index' 🦋

usage: dsconf [-v] [-j] instance backend index [-h]
                                                      {add,set,get,list,delete,reindex}
       ...

🌸 POSITIONAL ARGUMENTS 'dsconf backend index' 🌸

dsconf backend index add — Add an index. new index, who dis?
dsconf backend index set — Update an index. glow-up for your index.
dsconf backend index get — Display an index entry. show me the index.
dsconf backend index list — Display the index. the whole index list, periodt.
dsconf backend index delete — Delete an index. cancel that index.
dsconf backend index reindex — Re-index the database for a single index or all indexes. rebuild the index, it's a reset.

🎀 COMMAND 'dsconf backend index add' 🎀

usage: dsconf [-v] [-j] instance backend index add [-h]
                                                          --index-type
       INDEX_TYPE
                                                          [--matching-rule
       MATCHING_RULE]
                                                          [--reindex] --attr
       ATTR
                                                          be_name

be_name — The backend name or suffix. which backend gets the new index?

💅 OPTIONS 'dsconf backend index add' 💅

--index-type INDEX_TYPE — Sets the indexing type (eq, sub, pres, or approx). choose your fighter.
--matching-rule MATCHING_RULE — Sets the matching rule for the index. the rule of matching, obviously.
--reindex — Re-indexes the database after adding a new index. rebuild after adding, no cap.
--attr ATTR — Sets the attribute name to index. which attribute? tell me.

⭐ COMMAND 'dsconf backend index set' ⭐

usage: dsconf [-v] [-j] instance backend index set [-h] --attr ATTR
                                                          [--add-type ADD_TYPE]
                                                          [--del-type DEL_TYPE]
                                                          [--add-mr ADD_MR]
                                                          [--del-mr DEL_MR]
                                                          [--reindex]
                                                          be_name

be_name — The backend name or suffix. which backend are we editing?

🔥 OPTIONS 'dsconf backend index set' 🔥

--attr ATTR — Sets the indexed attribute to update. which attribute gets the update?
--add-type ADD_TYPE — Adds an index type to the index (eq, sub, pres, or approx). add a type, slay.
--del-type DEL_TYPE — Removes an index type from the index: (eq, sub, pres, or approx). remove a type, bye.
--add-mr ADD_MR — Adds a matching-rule to the index. more rules, more power.
--del-mr DEL_MR — Removes a matching-rule from the index. rule removed, periodt.
--reindex — Re-indexes the database after editing the index. rebuild after edit.

🧚 COMMAND 'dsconf backend index get' 🧚

usage: dsconf [-v] [-j] instance backend index get [-h] --attr ATTR
       be_name

be_name — The backend name or suffix. which backend?

💜 OPTIONS 'dsconf backend index get' 💜

--attr ATTR — Sets the index name to display. show me that index.

✨ COMMAND 'dsconf backend index list' ✨

usage: dsconf [-v] [-j] instance backend index list [-h] [--just-names]
                                                           be_name

be_name — The backend name or suffix. which backend's index list?

👑 OPTIONS 'dsconf backend index list' 👑

--just-names — Displays only the names of indexed attributes. no extra details, just names.

💚 COMMAND 'dsconf backend index delete' 💚

usage: dsconf [-v] [-j] instance backend index delete [-h] [--attr ATTR]
                                                             be_name

be_name — The backend name or suffix. which backend loses an index?

💧 OPTIONS 'dsconf backend index delete' 💧

--attr ATTR — Sets the name of the attribute to delete from the index. which attribute gets deleted?

🦋 COMMAND 'dsconf backend index reindex' 🦋

usage: dsconf [-v] [-j] instance backend index reindex [-h] [--attr
       ATTR]
                                                              [--wait]
       [--watch]
                                                              be_name

be_name — The backend name or suffix. which backend gets reindexed?
--attr _ATTR_ — names the attribute you wanna re-index. Leave it out and it re-indexes every attribute, no cap. ✨
--wait — waits for the index task to finish and then tells you the status
--watch — peeks at the reindexing task's status while it's running 👀

🦋 COMMAND `dsconf backend vlv-index` 🦋

usage: dsconf [-v] [-j] instance backend vlv-index [-h]
                                                          {list,get,add-search,edit-search,del-search,add-index,del-index,reindex}
       ...

VLV is the "virtual list view" situation — basically sorted, pre-built views so big result sets don't have to suffer. 💅

🌸 POSITIONAL ARGUMENTS `dsconf backend vlv-index` 🌸

dsconf backend vlv-index list — lists your VLV search and index entries
dsconf backend vlv-index get — displays a VLV search and its indexes
dsconf backend vlv-index add-search — adds a VLV search entry. Bestie, the search entry is the parent of the VLV index entries, and it's the thing that specifies the search parameters used to match entries for those indexes.
dsconf backend vlv-index edit-search — updates a VLV search and index
dsconf backend vlv-index del-search — deletes a VLV search & index
dsconf backend vlv-index add-index — creates a VLV index under a VLV search entry (that's the parent entry, formatter_class=CustomHelpFormatter). The VLV index is what specifies the attributes to sort
dsconf backend vlv-index del-index — deletes a VLV index under a VLV search entry (the parent entry)
dsconf backend vlv-index reindex — indexes/re-indexes the VLV database index

⭐ COMMAND `dsconf backend vlv-index list` ⭐

usage: dsconf [-v] [-j] instance backend vlv-index list [-h]
       [--just-names]
                                                               be_name

be_name — the backend name of the VLV index

🎀 OPTIONS `dsconf backend vlv-index list` 🎀

--just-names — shows you only the names of the VLV search entries, nothing else

🦄 COMMAND `dsconf backend vlv-index get` 🦄

usage: dsconf [-v] [-j] instance backend vlv-index get [-h] [--name
       NAME]
                                                              be_name

be_name — the backend name of the VLV index

💖 OPTIONS `dsconf backend vlv-index get` 💖

--name _NAME_ — displays the VLV search entry and its index entries

🌈 COMMAND `dsconf backend vlv-index add-search` 🌈

usage: dsconf instance [-v] [-j] backend vlv-index add-search
       [-h] --name NAME --search-base SEARCH_BASE --search-scope
SEARCH_SCOPE
       --search-filter SEARCH_FILTER
       be_name

be_name — the backend name of the VLV index

✨ OPTIONS `dsconf backend vlv-index add-search` ✨

--name _NAME_ — sets the name of the VLV search entry
--search-base _SEARCH_BASE_ — sets the VLV search base
--search-scope _SEARCH_SCOPE_ — sets the VLV search scope, and the vibes are strictly: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filter _SEARCH_FILTER_ — sets the VLV search filter

💜 COMMAND `dsconf backend vlv-index edit-search` 💜

usage: dsconf [-v] [-j] instance backend vlv-index edit-search
       [-h] --name NAME [--search-base SEARCH_BASE]
       [--search-scope SEARCH_SCOPE] [--search-filter SEARCH_FILTER]
       [--reindex]
       be_name

be_name — the backend name of the VLV index to update

🫶 OPTIONS `dsconf backend vlv-index edit-search` 🫶

--name _NAME_ — sets the name of the VLV index
--search-base _SEARCH_BASE_ — sets the VLV search base
--search-scope _SEARCH_SCOPE_ — sets the VLV search scope: 0 (base search), 1 (one-level search), or 2 (subtree search)
--search-filter _SEARCH_FILTER_ — sets the VLV search filter
--reindex — re-indexes all the VLV database indexes. all of them. no survivors. 🔥

🧚 COMMAND `dsconf backend vlv-index del-search` 🧚

usage: dsconf [-v] [-j] instance backend vlv-index del-search
       [-h] --name NAME be_name

be_name — the backend name of the VLV index

🌸 OPTIONS `dsconf backend vlv-index del-search` 🌸

--name _NAME_ — sets the name of the VLV search index

💀 COMMAND `dsconf backend vlv-index add-index` 💀

usage: dsconf instance [-v] [-j] backend vlv-index add-index
       [-h] --parent-name PARENT_NAME --index-name INDEX_NAME --sort
SORT
       [--index-it]
       be_name

be_name — the backend name of the VLV index

🎀 OPTIONS `dsconf backend vlv-index add-index` 🎀

--parent-name _PARENT_NAME_ — sets the name, or the "cn" attribute, of the parent VLV search entry
--index-name _INDEX_NAME_ — sets the name of the brand new VLV index
--sort _SORT_ — sets a space-separated list of attributes to sort for this VLV index
--index-it — actually creates the database index for this VLV index definition

⭐ COMMAND `dsconf backend vlv-index del-index` ⭐

usage: dsconf [-v] [-j] instance backend vlv-index del-index
       [-h] --parent-name PARENT_NAME [--index-name INDEX_NAME] [--sort
SORT]
       be_name

be_name — the backend name of the VLV index

🦋 OPTIONS `dsconf backend vlv-index del-index` 🦋

--parent-name _PARENT_NAME_ — sets the name, or the "cn" attribute value, of the parent VLV search entry
--index-name _INDEX_NAME_ — sets the name of the VLV index to delete
--sort _SORT_ — deletes a VLV index that has this vlvsort value

🌟 COMMAND `dsconf backend vlv-index reindex` 🌟

usage: dsconf [-v] [-j] instance backend vlv-index reindex [-h]
                                                                  [--index-name
       INDEX_NAME]
                                                                  --parent-name
       PARENT_NAME
                                                                  be_name

be_name — the backend name of the VLV index

💖 OPTIONS `dsconf backend vlv-index reindex` 💖

--index-name _INDEX_NAME_ — sets the name of the VLV index entry to re-index. If you don't set it, every index gets re-indexed
--parent-name _PARENT_NAME_ — sets the name, or the "cn" attribute value, of the parent VLV search entry

🔐 COMMAND `dsconf backend attr-encrypt` 🔐

usage: dsconf [-v] [-j] instance backend attr-encrypt [-h] [--list]
                                                             [--just-names]
                                                             [--add-attr
       ADD_ATTR]
                                                             [--del-attr
       DEL_ATTR]
                                                             be_name

be_name — the backend name or suffix

💅 OPTIONS `dsconf backend attr-encrypt` 💅

--list — lists every encrypted attribute in the backend
--just-names — when you use it with --list, it lists only the names of the encrypted attributes
--add-attr _ADD_ATTR_ — turns on encryption for the attribute you specify
--del-attr _DEL_ATTR_ — turns off encryption for the attribute you specify

👑 COMMAND `dsconf backend config` 👑

usage: dsconf [-v] [-j] instance backend config [-h] {get,set} ...

🌸 POSITIONAL ARGUMENTS `dsconf backend config` 🌸

dsconf backend config get — displays the global database configuration
dsconf backend config set — sets the global database configuration

🍓 COMMAND `dsconf backend config get` 🍓

usage: dsconf [-v] [-j] instance backend config get [-h]

🎀 COMMAND `dsconf backend config set` 🎀

usage: dsconf [-v] [-j] instance backend config set [-h]
                                                           [--lookthroughlimit
       LOOKTHROUGHLIMIT]
                                                           [--mode MODE]
                                                           [--idlistscanlimit
       IDLISTSCANLIMIT]
                                                           [--directory
       DIRECTORY]
                                                           [--dbcachesize
       DBCACHESIZE]
                                                           [--logdirectory
       LOGDIRECTORY]
                                                           [--txn-wait
       TXN_WAIT]
                                                           [--checkpoint-interval
       CHECKPOINT_INTERVAL]
                                                           [--compactdb-interval
       COMPACTDB_INTERVAL]
                                                           [--compactdb-time
       COMPACTDB_TIME]
                                                           [--txn-batch-val
       TXN_BATCH_VAL]
                                                           [--txn-batch-min
       TXN_BATCH_MIN]
                                                           [--txn-batch-max
       TXN_BATCH_MAX]
                                                           [--logbufsize
       LOGBUFSIZE]
                                                           [--locks LOCKS]
                                                           [--locks-monitoring-enabled
       LOCKS_MONITORING_ENABLED]
                                                           [--locks-monitoring-threshold
       LOCKS_MONITORING_THRESHOLD]
                                                           [--locks-monitoring-pause
       LOCKS_MONITORING_PAUSE]
                                                           [--import-cache-autosize
       IMPORT_CACHE_AUTOSIZE]
                                                           [--cache-autosize
       CACHE_AUTOSIZE]
                                                           [--cache-autosize-split
       CACHE_AUTOSIZE_SPLIT]
                                                           [--import-cachesize
       IMPORT_CACHESIZE]
                                                           [--exclude-from-export
       EXCLUDE_FROM_EXPORT]
                                                           [--pagedlookthroughlimit
       PAGEDLOOKTHROUGHLIMIT]
                                                           [--pagedidlistscanlimit
       PAGEDIDLISTSCANLIMIT]
                                                           [--rangelookthroughlimit
       RANGELOOKTHROUGHLIMIT]
                                                           [--backend-opt-level
       BACKEND_OPT_LEVEL]
                                                           [--deadlock-policy
       DEADLOCK_POLICY]
                                                           [--db-home-directory
       DB_HOME_DIRECTORY]
                                                           [--db-lib DB_LIB]
                                                           [--mdb-max-size
       MDB_MAX_SIZE]
                                                           [--mdb-max-readers
       MDB_MAX_READERS]
                                                           [--mdb-max-dbs
       MDB_MAX_DBS]
                                                           [--enable-dynamic-lists]
                                                           [--disable-dynamic-lists]
                                                           [--dynamic-oc
       DYNAMIC_OC]
                                                           [--dynamic-url-attr
       DYNAMIC_URL_ATTR]
                                                           [--dynamic-list-attr
       DYNAMIC_LIST_ATTR]

Alright bestie, we're still in the config set menu and this is where the real database knobs live. Buckle up. 💅

--lookthroughlimit LOOKTHROUGHLIMIT — the max number of entries the server will actually check when it's out here examining candidate entries in response to a search request. It's giving "how hard am I allowed to look for you" energy.
--mode MODE — the permissions that get slapped onto newly created index files.
--idlistscanlimit IDLISTSCANLIMIT — how many entry IDs get searched during a search operation.
--directory DIRECTORY — absolute path to the database instance. Absolute, bestie, not vibes-based relative nonsense.
--dbcachesize DBCACHESIZE — the database index cache size, in bytes.
--logdirectory LOGDIRECTORY — the path to the directory holding the database transaction logs.
--txn-wait TXN_WAIT — sets whether the server should wait when there are no db locks available.
--checkpoint-interval CHECKPOINT_INTERVAL — how much time, in seconds, before the server sends a checkpoint entry to the database transaction log.
--compactdb-interval COMPACTDB_INTERVAL — the interval in seconds when the database gets compacted.
--compactdb-time COMPACTDB_TIME — the actual time of day (HH:MM format) when the database should be compacted, but only after the "compactdb interval" has been reached.
--txn-batch-val TXN_BATCH_VAL — how many transactions will be batched up before being committed.
--txn-batch-min TXN_BATCH_MIN — controls when transactions should be flushed earliest, independent of the batch count. Requires that txn-batch-val is set. No txn-batch-val, no party.
--txn-batch-max TXN_BATCH_MAX — controls when transactions should be flushed latest, independent of the batch count. Also requires that txn-batch-val is set.
--logbufsize LOGBUFSIZE — the transaction log information buffer size.
--locks LOCKS — the maximum number of database locks.
--locks-monitoring-enabled LOCKS_MONITORING_ENABLED — turns monitoring of DB locks on or off, triggered when the value crosses the percentage set with "--locks-monitoring-threshold".
--locks-monitoring-threshold LOCKS_MONITORING_THRESHOLD — the DB lock exhaustion threshold as a percentage (valid range is 70-90 🫣). Once that threshold is hit, all searches get aborted until the number of active locks drops below the configured threshold and/or the administrator increases the number of database locks (nsslapd-db-locks). This threshold is literally a safeguard against DB corruption that locks exhaustion could cause. Respect it.
--locks-monitoring-pause LOCKS_MONITORING_PAUSE — the DB lock monitoring value in milliseconds for how long the monitoring thread sits there waiting between checks.
--import-cache-autosize IMPORT_CACHE_AUTOSIZE — enables or disables automatically setting the size of the import cache used during the import process of LDIF files.
--cache-autosize CACHE_AUTOSIZE — the percentage of free memory used in total for the database and entry cache.
--cache-autosize-split CACHE_AUTOSIZE_SPLIT — the percentage of RAM used for the database cache. Whatever's left over goes to the entry cache. Splitting the bag, basically.
--import-cachesize IMPORT_CACHESIZE — the size in bytes of the database cache used in the import process.
--exclude-from-export EXCLUDE_FROM_EXPORT — a list of attributes to not include during database export operations. Bye 👋
--pagedlookthroughlimit PAGEDLOOKTHROUGHLIMIT — the max number of entries the server will check when examining candidate entries for a search that uses the simple paged results control.
--pagedidlistscanlimit PAGEDIDLISTSCANLIMIT — the number of entry IDs that get searched, specifically for a search operation using the simple paged results control.
--rangelookthroughlimit RANGELOOKTHROUGHLIMIT — the max number of entries the server will check when examining candidate entries in response to a range search request.
--backend-opt-level BACKEND_OPT_LEVEL — sets the backend optimization level for write performance (0, 1, 2, or 4).

⚠️ WARNING: This parameter can trigger experimental code. Fr fr, tread carefully.

--deadlock-policy DEADLOCK_POLICY — adjusts the backend database deadlock policy. (Advanced setting 👑)
--db-home-directory DB_HOME_DIRECTORY — the directory for the database mmapped files. (Advanced setting 👑)
--db-lib DB_LIB — which db lib is used. Valid values are: bdb or mdb.
--mdb-max-size MDB_MAX_SIZE — the lmdb database maximum size (accepts bytes, or with a unit suffix: k, m, g, t).
--mdb-max-readers MDB_MAX_READERS — the lmdb database maximum number of readers. (Advanced setting 👑)
--mdb-max-dbs MDB_MAX_DBS — the lmdb database maximum number of sub databases. (Advanced setting 👑)
--enable-dynamic-lists — enables dynamic lists ✨
--disable-dynamic-lists — disables dynamic lists 💀
--dynamic-oc DYNAMIC_OC — sets the objectclass for dynamic lists.
--dynamic-url-attr DYNAMIC_URL_ATTR — sets the url attribute for dynamic lists.
--dynamic-list-attr DYNAMIC_LIST_ATTR — sets the list attribute for dynamic lists.

🦋 COMMAND 'dsconf backend monitor'

usage: dsconf [-v] [-j] instance backend monitor [-h] [--suffix SUFFIX]

🌸 OPTIONS 'dsconf backend monitor'

--suffix SUFFIX — displays monitoring information only for the suffix you name. One suffix, no chaos.

🎀 COMMAND 'dsconf backend import'

usage: dsconf [-v] [-j] instance backend import [-h] [-c CHUNKS_SIZE] [-E]
                                              [-g GEN_UNIQ_ID] [-O]
                                              [-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
                                              [-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
                                              [--timeout TIMEOUT] [-w]
                                              [be_name] [ldifs ...]

💖 POSITIONAL ARGUMENTS 'dsconf backend import'

be_name — the backend name or the root suffix.
ldifs — the filename(s) of the input LDIF files. Multiple files get imported in the order you specified them, so order matters bestie.

✨ OPTIONS 'dsconf backend import'

-c CHUNKS_SIZE, --chunks-size CHUNKS_SIZE — the number of chunks to have during the import operation.
-E, --encrypted — encrypt attributes configured in the database for encryption.
-g GEN_UNIQ_ID, --gen-uniq-id GEN_UNIQ_ID — generate a unique id. Set "none" for no unique ID to be generated, and "deterministic" for the generated unique ID to be name-based. By default, a time-based unique ID is generated. When you use the deterministic generation to get a name-based unique ID, you can also specify the namespace for the server to use. namespaceId is a string of characters in the format 00-xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx.
-O, --only-core — creates only the core database attribute indexes.
-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...], --include-suffixes INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...] — the suffixes or the subtrees to be included.
-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...], --exclude-suffixes EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...] — the suffixes to be excluded.
--timeout TIMEOUT — set a timeout to wait for the export task. Default is 0 (no timeout).
-w, --watch — watch the status of the import. Live updates, main character energy 🔥

🌈 COMMAND 'dsconf backend export'

usage: dsconf [-v] [-j] instance backend export [-h] [-l LDIF] [-C] [-E] [-m]
                                              [-N] [-r] [-u] [-U]
                                              [-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...]]
                                              [-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...]]
                                              [--timeout TIMEOUT] [-w]
                                              be_names [be_names ...]

🫶 POSITIONAL ARGUMENTS 'dsconf backend export'

be_names — the backend names or the root suffixes. Yes, plural, you can pile them on.

🍓 OPTIONS 'dsconf backend export'

-l LDIF, --ldif LDIF — the filename of the output LDIF file. Separate multiple file names with spaces.
-C, --use-id2entry — uses only the main database file.
-E, --encrypted — decrypts encrypted data during export. This option is used only if database encryption is enabled.
-m, --min-base64 — sets minimal base-64 encoding.
-N, --no-seq-num — suppresses printing the sequence numbers.
-r, --replication — exports the data with the information required to initialize a replica.
-u, --no-dump-uniq-id — omits exporting the unique ID.
-U, --not-folded — disables folding the output.
-s INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...], --include-suffixes INCLUDE_SUFFIXES [INCLUDE_SUFFIXES ...] — the suffixes or the subtrees to be included.
-x EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...], --exclude-suffixes EXCLUDE_SUFFIXES [EXCLUDE_SUFFIXES ...] — the suffixes to be excluded.
--timeout TIMEOUT — set a timeout to wait for the export task. Default is 0 (no timeout).
-w, --watch — watch the status of the export 👀

💜 COMMAND 'dsconf backend create'

usage: dsconf [-v] [-j] instance backend create [-h]
                                              [--parent-suffix PARENT_SUFFIX]
                                              --suffix SUFFIX
                                              --be-name BE_NAME
                                              [--create-entries]
                                              [--create-suffix]

👑 OPTIONS 'dsconf backend create'

--parent-suffix PARENT_SUFFIX — sets the parent suffix, but only if this backend is a sub-suffix.
--suffix SUFFIX — sets the database suffix DN.
--be-name BE_NAME — sets the database backend name.
--create-entries — adds sample entries to the database.
--create-suffix — creates the suffix object entry in the database. Only suffixes using the 'dc',

💀 COMMAND 'dsconf backend delete'

usage: dsconf [-v] [-j] instance backend delete [-h] [--do-it] be_name

🌟 POSITIONAL ARGUMENTS 'dsconf backend delete'

be_name — the backend name or suffix.

😭 OPTIONS 'dsconf backend delete'

--do-it — remove backend and its subsuffixes. Yeah it's really happening, no take-backs.

⭐ COMMAND 'dsconf backend get-tree'

usage: dsconf [-v] [-j] instance backend get-tree [-h]

💅 COMMAND 'dsconf backend compact-db' 💅

okay so you wanna squash that database into a lil compact lil guy, no cap. Here's the vibe:

usage: dsconf [-v] [-j] instance backend compact-db [-h]
              [--only-changelog]
              [--timeout TIMEOUT]

✨ OPTIONS 'dsconf backend compact-db' ✨

--only-changelog — bestie this one compacts only the replication change log. That's it, that's the whole job 💖
--timeout TIMEOUT — sets a timeout to wait for the compaction task. Default is 0 aka no timeout — she'll wait forever, devoted gf energy 🫶

🌈 COMMAND 'dsconf backup' 🌈

the backup mothership. She doesn't do anything herself, she just has two iconic children:

usage: dsconf [-v] [-j] instance backup [-h] {create,restore} ...

🎀 POSITIONAL ARGUMENTS 'dsconf backup' 🎀

dsconf backup create — creates a backup of the database 📦✨
dsconf backup restore — restores a database from a backup 🪄 back from the dead, literally

🔥 COMMAND 'dsconf backup create' 🔥

usage: dsconf [-v] [-j] instance backup create [-h] [-t DB_TYPE]
              [--timeout TIMEOUT] [--watch]
              [archive]

archive — sets the directory where to store the backup files. The format for these is instance_name-year_month_date_hour_minutes_seconds. Default: /var/lib/dirsrv/slapd-instance/bak/ — classic, timeless, we stan 🎀

✨ OPTIONS 'dsconf backup create' ✨

-t DB_TYPE, --db-type DB_TYPE — sets the database type. Default: ldbm database 💅
--timeout TIMEOUT — sets the task timeout. Default is 120 seconds 💀
--watch — watch the status of the backup task like it's your comfort show 👀🍿

🦋 COMMAND 'dsconf backup restore' 🦋

usage: dsconf [-v] [-j] instance backup restore [-h] [-t DB_TYPE]
              [--timeout TIMEOUT] [--watch]
              archive

archive — set the directory that contains the backup files (note: this one is required bestie, no skipping it 🙈)

✨ OPTIONS 'dsconf backup restore' ✨

-t DB_TYPE, --db-type DB_TYPE — sets the database type. Default: ldbm database 💅
--timeout TIMEOUT — sets the task timeout. Default is 120 seconds 💀
--watch — watch the status of the restore task, live, in real time, main character energy 👑

🌸 COMMAND 'dsconf chaining' 🌸

chaining!! this is where one server goes "hey bestie can u handle this for me" and forwards the request along. iconic behaviour, very group-chat of it honestly 💬✨

usage: dsconf [-v] [-j] instance chaining [-h]
              {config-get,config-set,config-get-def,config-set-def,link-create,
              link-get,link-set,link-delete,monitor,link-list}
              ...

🎀 POSITIONAL ARGUMENTS 'dsconf chaining' 🎀

dsconf chaining config-get — display the chaining controls and server component lists 👀
dsconf chaining config-set — set the chaining controls and server component lists ✍️
dsconf chaining config-get-def — display the default creation parameters for new database links 🌱
dsconf chaining config-set-def — set the default creation parameters for new database links 🔧
dsconf chaining link-create — create a database link to a remote server 🔗
dsconf chaining link-get — displays chaining database links 👁️
dsconf chaining link-set — edit a database link to a remote server 📝
dsconf chaining link-delete — delete a database link 🗑️ (so long, farewell)
dsconf chaining monitor — display monitor information for a database chaining link 📊
dsconf chaining link-list — list database links 📋

💜 COMMAND 'dsconf chaining config-get' 💜

usage: dsconf [-v] [-j] instance chaining config-get [-h]
              [--avail-controls]
              [--avail-comps]

✨ OPTIONS 'dsconf chaining config-get' ✨

--avail-controls — lists available chaining controls 🎛️
--avail-comps — lists available chaining plugin components 🧩

⭐ COMMAND 'dsconf chaining config-set' ⭐

usage: dsconf [-v] [-j] instance chaining config-set [-h]
              [--add-control ADD_CONTROL]
              [--del-control DEL_CONTROL]
              [--add-comp ADD_COMP]
              [--del-comp DEL_COMP]

✨ OPTIONS 'dsconf chaining config-set' ✨

--add-control ADD_CONTROL — adds a transmitted control OID ➕
--del-control DEL_CONTROL — deletes a transmitted control OID ➖
--add-comp ADD_COMP — adds a chaining component 🧩➕
--del-comp DEL_COMP — deletes a chaining component 🧩➖

🍓 COMMAND 'dsconf chaining config-get-def' 🍓

usage: dsconf [-v] [-j] instance chaining config-get-def [-h]

that's it. no options. she just tells u the defaults, slay, unproblematic queen 💖

🌈 COMMAND 'dsconf chaining config-set-def' 🌈

okay so THIS one is the big one. Eighteen options. Eighteen. She said "let me cook" and then cooked a whole five-course meal 🔥👑

usage: dsconf [-v] [-j] instance chaining config-set-def [-h]
              [--conn-bind-limit CONN_BIND_LIMIT]
              [--conn-op-limit CONN_OP_LIMIT]
              [--abandon-check-interval ABANDON_CHECK_INTERVAL]
              [--bind-limit BIND_LIMIT]
              [--op-limit OP_LIMIT]
              [--proxied-auth PROXIED_AUTH]
              [--conn-lifetime CONN_LIFETIME]
              [--bind-timeout BIND_TIMEOUT]
              [--return-ref RETURN_REF]
              [--check-aci CHECK_ACI]
              [--bind-attempts BIND_ATTEMPTS]
              [--size-limit SIZE_LIMIT]
              [--time-limit TIME_LIMIT]
              [--hop-limit HOP_LIMIT]
              [--response-delay RESPONSE_DELAY]
              [--test-response-delay TEST_RESPONSE_DELAY]
              [--use-starttls USE_STARTTLS]

✨ OPTIONS 'dsconf chaining config-set-def' ✨

--conn-bind-limit CONN_BIND_LIMIT — sets the max number of BIND connections the database link establishes with the remote server 🤝
--conn-op-limit CONN_OP_LIMIT — sets the max number of LDAP connections the database link establishes with the remote server 🔌
--abandon-check-interval ABANDON_CHECK_INTERVAL — sets the number of seconds that pass before the server checks for abandoned operations ⏱️ (checking on the ops that ghosted u, so real)
--bind-limit BIND_LIMIT — sets the max number of concurrent bind operations per TCP connection 🚦
--op-limit OP_LIMIT — sets the max number of concurrent operations allowed 🚧
--proxied-auth PROXIED_AUTH — enables or disables proxied authorization. If it's set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute 🎭
--conn-lifetime CONN_LIFETIME — specifies connection lifetime in seconds. "0" keeps the connection open forever — committed, ride or die 💞
--bind-timeout BIND_TIMEOUT — sets the amount of time in seconds before a bind attempt times out ⏳
--return-ref RETURN_REF — enables or disables whether referrals are returned by scoped searches ↩️
--check-aci CHECK_ACI — enables or disables whether the server evaluates ACIs on the database link as well as the remote data server 🔐
--bind-attempts BIND_ATTEMPTS — sets the number of times the server tries to bind to the remote server 🔁 (persistence!!)
--size-limit SIZE_LIMIT — sets the max number of entries to return from a search operation 📏
--time-limit TIME_LIMIT — sets the max number of seconds allowed for an operation ⌛
--hop-limit HOP_LIMIT — sets the max number of times a database is allowed to chain. That is the number of times a request can be forwarded from one database link to another 🐇🐇 (hop hop hop, then stop)
--response-delay RESPONSE_DELAY — sets the max amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected 😬
--test-response-delay TEST_RESPONSE_DELAY — sets the duration of the test issued by the database link to check whether the remote server is responding 🩺 ("u up?")
--use-starttls USE_STARTTLS — configured that database links use StartTLS if set to "on" 🔒✨

💖 COMMAND 'dsconf chaining link-create' 💖

making a brand new database link to a remote server. It's giving long-distance relationship but make it LDAP 💌

usage: dsconf instance [-v] [-j] chaining link-create [-h]
                       [--conn-bind-limit CONN_BIND_LIMIT]
                       [--conn-op-limit CONN_OP_LIMIT]
                       [--abandon-check-interval ABANDON_CHECK_INTERVAL]
                       [--bind-limit BIND_LIMIT]
                       [--op-limit OP_LIMIT]
                       [--proxied-auth PROXIED_AUTH]
                       [--conn-lifetime CONN_LIFETIME]
                       [--bind-timeout BIND_TIMEOUT]
                       [--return-ref RETURN_REF]
                       [--check-aci CHECK_ACI]
                       [--bind-attempts BIND_ATTEMPTS]
                       [--size-limit SIZE_LIMIT]
                       [--time-limit TIME_LIMIT]
                       [--hop-limit HOP_LIMIT]
                       [--response-delay RESPONSE_DELAY]
                       [--test-response-delay TEST_RESPONSE_DELAY]
                       [--use-starttls USE_STARTTLS]
                       --suffix SUFFIX
                       --server-url SERVER_URL
                       --bind-mech BIND_MECH
                       --bind-dn BIND_DN
                       [--bind-pw BIND_PW]
                       [--bind-pw-file BIND_PW_FILE]
                       [--bind-pw-prompt]
                       CHAIN_NAME

CHAIN_NAME — the name of the database link 🏷️✨

✨ OPTIONS — `dsconf chaining link-create` ✨

bestie we are SO deep in the chaining rabbit hole rn and honestly? iconic. here's every dial you can turn when you're creating a link 💅

--conn-bind-limit CONN_BIND_LIMIT — caps how many BIND connections the database link is allowed to open up with the remote server. it's giving "know your limits" 🎀
--conn-op-limit CONN_OP_LIMIT — same energy but for LDAP connections: the max number the database link establishes with the remote server.
--abandon-check-interval ABANDON_CHECK_INTERVAL — how many seconds go by before the server peeks around for abandoned operations. like checking the group chat for messages nobody replied to 🙈
--bind-limit BIND_LIMIT — the max number of concurrent bind operations allowed per TCP connection. concurrency queen 👑
--op-limit OP_LIMIT — the max number of concurrent operations allowed, periodt.
--proxied-auth PROXIED_AUTH — turns proxied authorization on or off. if you set it to "off", the server runs the bind for chained operations as the user set in the nsMultiplexorBindDn attribute. iykyk ✨
--conn-lifetime CONN_LIFETIME — connection lifetime in seconds. set it to "0" and the connection stays open forever, no cap, main character energy fr fr.
--bind-timeout BIND_TIMEOUT — how many seconds the server waits before a bind attempt times out. we do not wait around here ⏰
--return-ref RETURN_REF — toggles whether referrals get returned by scoped searches.
--check-aci CHECK_ACI — toggles whether the server evaluates ACIs on the database link and on the remote data server. double the checks, double the slay 🦋
--bind-attempts BIND_ATTEMPTS — how many times the server tries to bind to the remote server. resilience bestie 💖
--size-limit SIZE_LIMIT — the max number of entries a search operation hands back.
--time-limit TIME_LIMIT — the max number of seconds an operation is allowed to take.
--hop-limit HOP_LIMIT — the max number of times a database is allowed to chain. as in, how many times a request can get forwarded from one database link to another. hops on hops on hops 🐇
--response-delay RESPONSE_DELAY — the max amount of time a remote server can take to respond to an LDAP operation request made by a database link before the server starts suspecting an error. ghosting is not tolerated 💀
--test-response-delay TEST_RESPONSE_DELAY — how long the test the database link sends out lasts, the one checking whether the remote server is even responding. are you there?? 👀
--use-starttls USE_STARTTLS — configures the database links to use StartTLS when set to "on".
--suffix SUFFIX — sets the suffix the database link manages.
--server-url SERVER_URL — the LDAP/LDAPS URL pointing at the remote server.
--bind-mech BIND_MECH — which authentication method to use against the remote server. valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI". pick your fighter 🔥
--bind-dn BIND_DN — the DN of the administrative entry used to talk to the remote server.
--bind-pw BIND_PW — the password of that administrative user. keep it secret, keep it safe 🫶
--bind-pw-file BIND_PW_FILE — file containing the password.
--bind-pw-prompt — prompt for the password instead.

COMMAND — `dsconf chaining link-get` 🌸

usage: dsconf [-v] [-j] instance chaining link-get [-h] CHAIN_NAME

CHAIN_NAME the chaining link name or suffix you want to retrieve. yes, either one works, we love options 💖

COMMAND — `dsconf chaining link-set` 🌈

this one is a long synopsis bestie, brace yourself, every flag from link-create shows up again because it's the setter:

usage: dsconf instance [-v] [-j] chaining link-set [-h]
                                                          [--conn-bind-limit
       CONN_BIND_LIMIT]
                                                          [--conn-op-limit
       CONN_OP_LIMIT]
                                                          [--abandon-check-interval
       ABANDON_CHECK_INTERVAL]
                                                          [--bind-limit
       BIND_LIMIT]
                                                          [--op-limit OP_LIMIT]
                                                          [--proxied-auth
       PROXIED_AUTH]
                                                          [--conn-lifetime
       CONN_LIFETIME]
                                                          [--bind-timeout
       BIND_TIMEOUT]
                                                          [--return-ref
       RETURN_REF]
                                                          [--check-aci
       CHECK_ACI]
                                                          [--bind-attempts
       BIND_ATTEMPTS]
                                                          [--size-limit
       SIZE_LIMIT]
                                                          [--time-limit
       TIME_LIMIT]
                                                          [--hop-limit
       HOP_LIMIT]
                                                          [--response-delay
       RESPONSE_DELAY]
                                                          [--test-response-delay
       TEST_RESPONSE_DELAY]
                                                          [--use-starttls
       USE_STARTTLS]
                                                          [--suffix SUFFIX]
                                                          [--server-url
       SERVER_URL]
                                                          [--bind-mech
       BIND_MECH]
                                                          [--bind-dn BIND_DN]
                                                          [--bind-pw BIND_PW]
                                                          [--bind-pw-file
       BIND_PW_FILE]
                                                          [--bind-pw-prompt]
                                                          CHAIN_NAME

CHAIN_NAME the name of the database link. that's it, that's the whole thing 🎀

✨ OPTIONS — `dsconf chaining link-set` ✨

same squad as link-create, but now we're editing an existing link. glow-up time 💅

--conn-bind-limit CONN_BIND_LIMIT — the max number of BIND connections the database link establishes with the remote server.
--conn-op-limit CONN_OP_LIMIT — the max number of LDAP connections the database link establishes with the remote server.
--abandon-check-interval ABANDON_CHECK_INTERVAL — how many seconds pass before the server checks for abandoned operations.
--bind-limit BIND_LIMIT — the max number of concurrent bind operations per TCP connection.
--op-limit OP_LIMIT — the max number of concurrent operations allowed.
--proxied-auth PROXIED_AUTH — enables or disables proxied authorization. if it's set to "off", the server executes bind for chained operations as the user set in the nsMultiplexorBindDn attribute.
--conn-lifetime CONN_LIFETIME — connection lifetime in seconds. "0" keeps the connection open forever.
--bind-timeout BIND_TIMEOUT — the amount of time in seconds before a bind attempt times out.
--return-ref RETURN_REF — enables or disables whether referrals are returned by scoped searches.
--check-aci CHECK_ACI — enables or disables whether the server evaluates ACIs on the database link as well as the remote data server.
--bind-attempts BIND_ATTEMPTS — the number of times the server tries to bind to the remote server.
--size-limit SIZE_LIMIT — the max number of entries to return from a search operation.
--time-limit TIME_LIMIT — the max number of seconds allowed for an operation.
--hop-limit HOP_LIMIT — the max number of times a database is allowed to chain. that is, the number of times a request can be forwarded from one database link to another.
--response-delay RESPONSE_DELAY — the max amount of time it can take a remote server to respond to an LDAP operation request made by a database link before an error is suspected.
--test-response-delay TEST_RESPONSE_DELAY — the duration of the test issued by the database link to check whether the remote server is responding.
--use-starttls USE_STARTTLS — configured that database links use StartTLS if set to "on".
--suffix SUFFIX — sets the suffix managed by the database link.
--server-url SERVER_URL — sets the LDAP/LDAPS URL to the remote server.
--bind-mech BIND_MECH — sets the authentication method to use to authenticate to the remote server: valid values: "SIMPLE" (default), "EXTERNAL", "DIGEST-MD5", or "GSSAPI".
--bind-dn BIND_DN — sets the DN of the administrative entry used to communicate with the remote server.
--bind-pw BIND_PW — sets the password of the administrative user.
--bind-pw-file BIND_PW_FILE — file containing the password.
--bind-pw-prompt — prompt for password.

COMMAND — `dsconf chaining link-delete` 🗑️

usage: dsconf [-v] [-j] instance chaining link-delete [-h] CHAIN_NAME

CHAIN_NAME the name of the database link. bye bestie 👋

COMMAND — `dsconf chaining monitor` 👀

usage: dsconf [-v] [-j] instance chaining monitor [-h] CHAIN_NAME

CHAIN_NAME the name of the database link. we're just watching it live its life 🦋

COMMAND — `dsconf chaining link-list` 📋

usage: dsconf [-v] [-j] instance chaining link-list [-h]

no args, no drama, just the list. we love a low-effort icon 💖

COMMAND — `dsconf config` ⚙️

usage: dsconf [-v] [-j] instance config [-h] {get,add,replace,delete}
       ...

POSITIONAL ARGUMENTS — `dsconf config` 🎀

dsconf config get — get
dsconf config add — Add attribute value to configuration
dsconf config replace — Replace attribute value in configuration
dsconf config delete — Delete attribute value in configuration

COMMAND — `dsconf config get` 🔍

usage: dsconf [-v] [-j] instance config get [-h] [attrs ...]

attrs Configuration attribute(s) to get. plural friendly, bring as many as you want ✨

COMMAND — `dsconf config add` ➕

usage: dsconf [-v] [-j] instance config add [-h] [attr ...]

attr Configuration attribute to add.

COMMAND — `dsconf config replace` 🔁

usage: dsconf [-v] [-j] instance config replace [-h] [attr ...]

attr Configuration attribute to replace.

COMMAND — `dsconf config delete` 🚮

usage: dsconf [-v] [-j] instance config delete [-h] [attr ...]

attr Configuration attribute to delete.

COMMAND — `dsconf directory_manager` 👑

usage: dsconf [-v] [-j] instance directory_manager [-h]
{password_change} ...

POSITIONAL ARGUMENTS — `dsconf directory_manager` 💜

dsconf directory_manager password_change — Changes the password of the Directory Manager account

COMMAND — `dsconf directory_manager password_change` 🔐

usage: dsconf [-v] [-j] instance directory_manager password_change [-h]

that's the whole synopsis, no extra args. short and powerful, like all the best people 💅

COMMAND — `dsconf logging` 📝

usage: dsconf [-v] [-j] instance logging [-h]
                                      {access,audit,auditfail,error,security}
       ...

💅 POSITIONAL ARGUMENTS 'dsconf logging'

Bestie, dsconf logging is the ✨umbrella✨ and under it you've got five whole flavor options. Pick your fighter:

dsconf logging access — Manage access log settings 🔥
dsconf logging audit — Manage audit log settings 📝
dsconf logging auditfail — Manage auditfail log settings 💀
dsconf logging error — Manage error log settings 🚨
dsconf logging security — Manage security log settings 🔐

🌸 COMMAND 'dsconf logging access'

Okay so this is the access log. Every time somebody touches your directory, this is the log that's like "noted 📸". Here's the shape of it:

usage: dsconf [-v] [-j] instance logging access [-h] {get,set,list-levels} ...

So you get three moves: get, set, list-levels.

🎀 POSITIONAL ARGUMENTS 'dsconf logging access'

Pick one, bestie:

dsconf logging access get — Get access log configuration 👀
dsconf logging access set — Set access log configuration ✍️
dsconf logging access list-levels — List all the log levels 📋

💖 COMMAND 'dsconf logging access get'

Reading the config, no notes, just vibes:

usage: dsconf [-v] [-j] instance logging access get [-h]

🦋 COMMAND 'dsconf logging access set'

This is the main character right here. Look at ALL these options — she's giving menu, she's giving buffet, she's giving infinite scroll:

usage: dsconf [-v] [-j] instance logging access set [-h]
                                                   {level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format}
       ...

🌈 POSITIONAL ARGUMENTS 'dsconf logging access set'

Take your pick, queen:

dsconf logging access set level — Set the log level 🎚️
dsconf logging access set logging-enabled — Enable access logging ✅
dsconf logging access set logging-disabled — Disable access logging 🚫
dsconf logging access set mode — Set the log file permissions. Default is 600 🔒
dsconf logging access set location — Set the log name and location 📍
dsconf logging access set compress-enabled — Enable log compression for rotated logs 🗜️
dsconf logging access set compress-disabled — Disable log compression for rotated logs 📂
dsconf logging access set buffering-enabled — Enable log buffering 🧺
dsconf logging access set buffering-disabled — Disable log buffering 🪣
dsconf logging access set max-logs — Set the maximum number of rotated logs the server will maintain 🔢
dsconf logging access set max-logsize — Set the maximum size for a log in MB 📏
dsconf logging access set rotation-interval — Set the interval for when a log is rotated. This works with the interval unit ⏰
dsconf logging access set rotation-interval-unit — Set the time unit for the rotation interval for when a log is rotated. Choose between: "minute", "hour", "day", "week", and "month" 🕰️
dsconf logging access set rotation-tod-enabled — Enable "time of day" rotation for expired logs 🌅
dsconf logging access set rotation-tod-disabled — Disable "time of day" rotation for expired logs 🌙
dsconf logging access set rotation-tod-hour — Set the hour when an expired log should be rotated 🕐
dsconf logging access set rotation-tod-minute — Set the minute when an expired log should be rotated 🕑
dsconf logging access set deletion-interval — Set the interval a rotated log should be deleted. This works with the deletion internal unit setting 🗑️
dsconf logging access set deletion-interval-unit — Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" 📅
dsconf logging access set max-disk-space — Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. 💾
dsconf logging access set free-disk-space — The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. 🆓
dsconf logging access set log-format — Choose between "default", "json", or "json-pretty" 🎨
dsconf logging access set time-format — Time format for JSON logging (strftime) ⌚

⭐ COMMAND 'dsconf logging access set level'

usage: dsconf [-v] [-j] instance logging access set level [-h] levels [levels ...]

levels — log level 🎚️

💜 COMMAND 'dsconf logging access set logging-enabled'

usage: dsconf [-v] [-j] instance logging access set logging-enabled [-h]

🍓 COMMAND 'dsconf logging access set logging-disabled'

usage: dsconf [-v] [-j] instance logging access set logging-disabled [-h]

🧚 COMMAND 'dsconf logging access set mode'

usage: dsconf [-v] [-j] instance logging access set mode [-h] values

values — File permissions. Default is 600 🔐

🌸 COMMAND 'dsconf logging access set location'

usage: dsconf [-v] [-j] instance logging access set location [-h] values

values — Log name and location 📍

🎀 COMMAND 'dsconf logging access set compress-enabled'

usage: dsconf [-v] [-j] instance logging access set compress-enabled [-h]

✨ COMMAND 'dsconf logging access set compress-disabled'

usage: dsconf [-v] [-j] instance logging access set compress-disabled [-h]

🦋 COMMAND 'dsconf logging access set buffering-enabled'

usage: dsconf [-v] [-j] instance logging access set buffering-enabled [-h]

🫶 COMMAND 'dsconf logging access set buffering-disabled'

usage: dsconf [-v] [-j] instance logging access set buffering-disabled [-h]

🔢 COMMAND 'dsconf logging access set max-logs'

usage: dsconf [-v] [-j] instance logging access set max-logs [-h] values

values — Set the maximum number of rotated logs the server will maintain 🔢

📏 COMMAND 'dsconf logging access set max-logsize'

usage: dsconf [-v] [-j] instance logging access set max-logsize [-h] values

values — Set the maximum size for a log in MB 📏

⏰ COMMAND 'dsconf logging access set rotation-interval'

usage: dsconf [-v] [-j] instance logging access set rotation-interval [-h] values

values — Set the interval for when a log is rotated. This works with the interval unit ⏰

🕰️ COMMAND 'dsconf logging access set rotation-interval-unit'

usage: dsconf [-v] [-j] instance logging access set rotation-interval-unit [-h] values

values — Set the time unit for the rotation interval for when a log is rotated. Choose between: "minute", "hour", "day", "week", and "month" 🕰️

🌅 COMMAND 'dsconf logging access set rotation-tod-enabled'

usage: dsconf [-v] [-j] instance logging access set rotation-tod-enabled [-h]

🌙 COMMAND 'dsconf logging access set rotation-tod-disabled'

usage: dsconf [-v] [-j] instance logging access set rotation-tod-disabled [-h]

🕐 COMMAND 'dsconf logging access set rotation-tod-hour'

usage: dsconf [-v] [-j] instance logging access set rotation-tod-hour [-h] values

values — Set the hour when an expired log should be rotated 🕐

🕑 COMMAND 'dsconf logging access set rotation-tod-minute'

usage: dsconf [-v] [-j] instance logging access set rotation-tod-minute [-h] values

values — Set the minute when an expired log should be rotated 🕑

🗑️ COMMAND 'dsconf logging access set deletion-interval'

usage: dsconf [-v] [-j] instance logging access set deletion-interval [-h] values

values — Set the interval a rotated log should be deleted. This works with the deletion internal unit setting 🗑️

📅 COMMAND 'dsconf logging access set deletion-interval-unit'

usage: dsconf [-v] [-j] instance logging access set deletion-interval-unit [-h] values

values — Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" 📅

💾 COMMAND 'dsconf logging access set max-disk-space'

usage: dsconf [-v] [-j] instance logging access set max-disk-space [-h] values

values — Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. 💾

🆓 COMMAND 'dsconf logging access set free-disk-space'

usage: dsconf [-v] [-j] instance logging access set free-disk-space [-h] values

values — Set the minimum available disk space in MB that triggers the server to delete rotated log files. 🆓

🎨 COMMAND 'dsconf logging access set log-format'

usage: dsconf [-v] [-j] instance logging access set log-format [-h] values

values — Choose between "default", "json", or "json-pretty" 🎨

⌚ COMMAND 'dsconf logging access set time-format'

usage: dsconf [-v] [-j] instance logging access set time-format [-h] values

values — Time format for JSON logging (strftime) ⌚

📋 COMMAND 'dsconf logging access list-levels'

All the levels, laid out like a little mood board:

usage: dsconf [-v] [-j] instance logging access list-levels [-h]

📝 COMMAND 'dsconf logging audit'

The audit log — she's the one who writes EVERYTHING down and remembers it forever, iconic behavior honestly. Only two moves here:

usage: dsconf [-v] [-j] instance logging audit [-h] {get,set} ...

🔐 POSITIONAL ARGUMENTS 'dsconf logging audit'

dsconf logging audit get — Get audit log configuration 👀
dsconf logging audit set — Set audit log configuration ✍️

💌 COMMAND 'dsconf logging audit get'

usage: dsconf [-v] [-j] instance logging audit get [-h]

🗂️ COMMAND 'dsconf logging audit set'

Look at this lineup, bestie — she brought nearly the whole access-log menu AND display-attrs as a little treat:

usage: dsconf [-v] [-j] instance logging audit set [-h]
                                                  {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format,display-attrs}
       ...

…and that's exactly where we're picking up next, so don't go anywhere 💖

POSITIONAL ARGUMENTS 'dsconf logging audit set' 💅

okay so all the little levers you can pull on the audit log config live here, bestie. every single one:

dsconf logging audit set logging-enabled — turn access logging ON ✨
dsconf logging audit set logging-disabled — turn audit logging OFF 💀
dsconf logging audit set mode — sets the log file permissions. default is 600 🔒
dsconf logging audit set location — sets the log name and where it lives 📍
dsconf logging audit set compress-enabled — turn on log compression for rotated logs 🗜️
dsconf logging audit set compress-disabled — turn off log compression for rotated logs
dsconf logging audit set buffering-enabled — turn log buffering ON 🫧
dsconf logging audit set buffering-disabled — turn log buffering OFF
dsconf logging audit set max-logs — the max number of rotated logs the server will keep around
dsconf logging audit set max-logsize — the max size for a log, in MB
dsconf logging audit set rotation-interval — how often a log gets rotated. this works with the interval unit 🌀
dsconf logging audit set rotation-interval-unit — the time unit for that rotation interval, for when a log gets rotated. pick from: "minute", "hour", "day", "week", and "month" ⏰
dsconf logging audit set rotation-tod-enabled — enable "time of day" rotation for expired logs 🌅
dsconf logging audit set rotation-tod-disabled — disable "time of day" rotation for expired logs
dsconf logging audit set rotation-tod-hour — sets the hour when an expired log should get rotated 🕐
dsconf logging audit set rotation-tod-minute — sets the minute when an expired log should get rotated
dsconf logging audit set deletion-interval — the interval at which a rotated log should be deleted. this works with the deletion internal unit setting 🗑️
dsconf logging audit set deletion-interval-unit — the interval unit at which a rotated log should be deleted. choose from: "day", "week", or "month"
dsconf logging audit set max-disk-space — the max amount of disk space in MB rotated logs can eat before rotated logs get deleted 💾
dsconf logging audit set free-disk-space — the server deletes the oldest rotated log file when the available disk space in MB drops below this amount
dsconf logging audit set log-format — choose between "default", "json", or "json-pretty" 🎀
dsconf logging audit set time-format — time format for JSON logging (strftime)
dsconf logging audit set display-attrs — sets additional identifying attrs to display 👀

COMMAND 'dsconf logging audit set logging-enabled' ✨

usage:

dsconf [-v] [-j] instance logging audit set logging-enabled [-h]

no values needed, she's just a vibe flip. 💖

COMMAND 'dsconf logging audit set logging-disabled' 💤

usage:

dsconf [-v] [-j] instance logging audit set logging-disabled [-h]

COMMAND 'dsconf logging audit set mode' 🔐

usage:

dsconf [-v] [-j] instance logging audit set mode [-h] values

values — file permissions. default is 600

COMMAND 'dsconf logging audit set location' 📍

usage:

dsconf [-v] [-j] instance logging audit set location [-h] values

values — log name and location

COMMAND 'dsconf logging audit set compress-enabled' 🗜️

usage:

dsconf [-v] [-j] instance logging audit set compress-enabled [-h]

COMMAND 'dsconf logging audit set compress-disabled' 🚫

usage:

dsconf [-v] [-j] instance logging audit set compress-disabled [-h]

COMMAND 'dsconf logging audit set buffering-enabled' 🫧

usage:

dsconf [-v] [-j] instance logging audit set buffering-enabled [-h]

COMMAND 'dsconf logging audit set buffering-disabled' 🙈

usage:

dsconf [-v] [-j] instance logging audit set buffering-disabled [-h]

COMMAND 'dsconf logging audit set max-logs' 🗂️

usage:

dsconf [-v] [-j] instance logging audit set max-logs [-h] values

values — set the maximum number of rotated logs the server will maintain

COMMAND 'dsconf logging audit set max-logsize' 📏

usage:

dsconf [-v] [-j] instance logging audit set max-logsize [-h] values

values — set the maximum size for a log in MB

COMMAND 'dsconf logging audit set rotation-interval' 🌀

usage:

dsconf [-v] [-j] instance logging audit set rotation-interval [-h] values

values — set the interval for when a log is rotated.This works with the interval unit

COMMAND 'dsconf logging audit set rotation-interval-unit' ⏰

usage:

dsconf [-v] [-j] instance logging audit set rotation-interval-unit [-h] values

values — set the time unit for the rotation interval for whena log is rotated. choose between: "minute", "hour", "day", "week", and "month"

COMMAND 'dsconf logging audit set rotation-tod-enabled' 🌅

usage:

dsconf [-v] [-j] instance logging audit set rotation-tod-enabled [-h]

COMMAND 'dsconf logging audit set rotation-tod-disabled' 🌙

usage:

dsconf [-v] [-j] instance logging audit set rotation-tod-disabled [-h]

COMMAND 'dsconf logging audit set rotation-tod-hour' 🕐

usage:

dsconf [-v] [-j] instance logging audit set rotation-tod-hour [-h] values

values — set the hour when an expired log should be rotated

COMMAND 'dsconf logging audit set rotation-tod-minute' ⌚

usage:

dsconf [-v] [-j] instance logging audit set rotation-tod-minute [-h] values

values — set the minute when an expired log should be rotated

COMMAND 'dsconf logging audit set deletion-interval' 🗑️

usage:

dsconf [-v] [-j] instance logging audit set deletion-interval [-h] values

values — set the interval a rotated log should be deleted. this works with the deletion internal unit setting

COMMAND 'dsconf logging audit set deletion-interval-unit' 📆

usage:

dsconf [-v] [-j] instance logging audit set deletion-interval-unit [-h] values

values — set the interval unit a rotated log should be deleted. choose from: "day", "week", or "month"

COMMAND 'dsconf logging audit set max-disk-space' 💾

usage:

dsconf [-v] [-j] instance logging audit set max-disk-space [-h] values

values — set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted.

COMMAND 'dsconf logging audit set free-disk-space' 🧹

usage:

dsconf [-v] [-j] instance logging audit set free-disk-space [-h] values

values — set the minimum available disk space in MB that triggers the server to delete rotated log files.

COMMAND 'dsconf logging audit set log-format' 🎀

usage:

dsconf [-v] [-j] instance logging audit set log-format [-h] values

values — choose between "default", "json", or "json-pretty"

COMMAND 'dsconf logging audit set time-format' 🕰️

usage:

dsconf [-v] [-j] instance logging audit set time-format [-h] values

values — time format for JSON logging (strftime)

COMMAND 'dsconf logging audit set display-attrs' 👀

usage:

dsconf [-v] [-j] instance logging audit set display-attrs [-h] values [values ...]

values — sets additional identifying attrs to display

COMMAND 'dsconf logging auditfail' 🚨

usage:

dsconf [-v] [-j] instance logging auditfail [-h] {get,set} ...

this is the auditfail log, aka the place where failed-audit receipts go. she has two moves: get and set. 💅

POSITIONAL ARGUMENTS 'dsconf logging auditfail' 🫶

dsconf logging auditfail get — get auditfail log configuration
dsconf logging auditfail set — set auditfail log configuration

COMMAND 'dsconf logging auditfail get' 📖

usage:

dsconf [-v] [-j] instance logging auditfail get [-h]

COMMAND 'dsconf logging auditfail set' ✍️

usage:

dsconf [-v] [-j] instance logging auditfail set [-h]
                                                              {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space}
       ...

look at that giant menu, bestie. pick your fighter from the brace list. 👑

POSITIONAL ARGUMENTS 'dsconf logging auditfail set' 🌈

dsconf logging auditfail set logging-enabled — enable access logging ✨
dsconf logging auditfail set logging-disabled — disable auditfail logging 💀
dsconf logging auditfail set mode — sets the log file permissions. default is 600 🔒
dsconf logging auditfail set location — sets the log name and location 📍
dsconf logging auditfail set compress-enabled — turn on log compression for rotated logs 🗜️
dsconf logging auditfail set compress-disabled — turn off log compression for rotated logs
dsconf logging auditfail set max-logs — the max number of rotated logs the server will keep around
dsconf logging auditfail set max-logsize — the max size for a log, in MB
dsconf logging auditfail set rotation-interval — how often a log gets rotated. this works with the interval unit 🌀
dsconf logging auditfail set rotation-interval-unit — the time unit for the rotation interval, for when a log gets rotated. pick from: "minute", "hour", "day", "week", and "month" ⏰
dsconf logging auditfail set rotation-tod-enabled — enable "time of day" rotation for expired logs 🌅
dsconf logging auditfail set rotation-tod-disabled — disable "time of day" rotation for expired logs
dsconf logging auditfail set rotation-tod-hour — sets the hour when an expired log should get rotated 🕐
dsconf logging auditfail set rotation-tod-minute — sets the minute when an expired log should get rotated
dsconf logging auditfail set deletion-interval — the interval at which a rotated log should be deleted. this works with the deletion internal unit setting 🗑️
dsconf logging auditfail set deletion-interval-unit — the interval unit at which a rotated log should be deleted. choose from: "day", "week", or "month"
dsconf logging auditfail set max-disk-space — the max amount of disk space in MB rotated logs can consume before rotated logs get deleted 💾
dsconf logging auditfail set free-disk-space — the server deletes the oldest rotated log file when the available disk space in MB drops below this amount

COMMAND 'dsconf logging auditfail set logging-enabled' 💖

usage:

dsconf [-v] [-j] instance logging auditfail set logging-enabled [-h]

COMMAND 'dsconf logging auditfail set logging-disabled' 😴

usage:

dsconf [-v] [-j] instance logging auditfail set logging-disabled [-h]

COMMAND 'dsconf logging auditfail set mode' 🔐

usage:

dsconf [-v] [-j] instance logging auditfail set mode [-h] values

values — file permissions. default is 600

COMMAND 'dsconf logging auditfail set location' 📍

usage:

dsconf [-v] [-j] instance logging auditfail set location [-h] values

values — log name and location

COMMAND 'dsconf logging auditfail set compress-enabled' 🧚

usage:

dsconf [-v] [-j] instance logging auditfail set compress-enabled [-h]

COMMAND 'dsconf logging auditfail set compress-disabled' 🙅

usage:

dsconf [-v] [-j] instance logging auditfail set compress-disabled [-h]

🎀 COMMAND 'dsconf logging auditfail set max-logs'

okay so the usage is literally:

dsconf [-v] [-j] instance logging auditfail set max-logs [-h] values

values — set the max number of rotated logs your server is gonna keep around. girl, after that many, they're gone bestie 💅

🎀 COMMAND 'dsconf logging auditfail set max-logsize'

dsconf [-v] [-j] instance logging auditfail set max-logsize [-h] values

values — the biggest a log can get, in MB, before it's giving rotated 🌀

🎀 COMMAND 'dsconf logging auditfail set rotation-interval'

dsconf [-v] [-j] instance logging auditfail set rotation-interval
       [-h] values

values — sets the interval for when a log gets rotated. lowkey important: this works together with the interval unit, so don't set one and ghost the other 🫶

🎀 COMMAND 'dsconf logging auditfail set rotation-interval-unit'

dsconf [-v] [-j] instance logging auditfail set
       rotation-interval-unit
       [-h] values

values — the time unit for that rotation interval, aka when a log gets rotated. you pick from exactly: "minute", "hour", "day", "week", and "month" ✨

🎀 COMMAND 'dsconf logging auditfail set rotation-tod-enabled'

dsconf [-v] [-j] instance logging auditfail set
       rotation-tod-enabled
       [-h]

no args, no values, no drama — it just turns it on, periodt 💅

🎀 COMMAND 'dsconf logging auditfail set rotation-tod-disabled'

dsconf [-v] [-j] instance logging auditfail set
       rotation-tod-disabled
       [-h]

and this one turns it off. that's the whole post 🦋

🎀 COMMAND 'dsconf logging auditfail set rotation-tod-hour'

dsconf [-v] [-j] instance logging auditfail set rotation-tod-hour
       [-h] values

values — the hour when an expired log should get rotated 🕐

🎀 COMMAND 'dsconf logging auditfail set rotation-tod-minute'

dsconf [-v] [-j] instance logging auditfail set
       rotation-tod-minute
       [-h] values

values — the minute when an expired log should get rotated ⏱️

🎀 COMMAND 'dsconf logging auditfail set deletion-interval'

dsconf [-v] [-j] instance logging auditfail set deletion-interval
       [-h] values

values — the interval after which a rotated log gets deleted. and yes, this works with the deletion internal unit setting, they're a package deal fr fr 📦

🎀 COMMAND 'dsconf logging auditfail set deletion-interval-unit'

dsconf [-v] [-j] instance logging auditfail set
       deletion-interval-unit
       [-h] values

values — the interval unit for when a rotated log gets deleted. choose from: "day", "week", or "month" 🌈

🎀 COMMAND 'dsconf logging auditfail set max-disk-space'

dsconf [-v] [-j] instance logging auditfail set max-disk-space
       [-h] values

values — the max amount of disk space, in MB, that rotated logs are allowed to consume before the rotated logs get deleted. it's giving "you've had enough bestie" 💀

🎀 COMMAND 'dsconf logging auditfail set free-disk-space'

dsconf [-v] [-j] instance logging auditfail set free-disk-space
       [-h] values

values — the minimum available disk space, in MB, that triggers the server to delete rotated log files 🗑️✨

💜 COMMAND 'dsconf logging error'

dsconf [-v] [-j] instance logging error [-h]
       {get,set,list-levels} ...

this is the error log's whole world, and it's super manageable:

POSITIONAL ARGUMENTS 'dsconf logging error'

dsconf logging error get — get the error log configuration 👀
dsconf logging error set — set the error log configuration ✍️
dsconf logging error list-levels — list all the log levels 📋

🎀 COMMAND 'dsconf logging error get'

dsconf [-v] [-j] instance logging error get [-h]

just go get it, no extra args needed bestie 🫶

🎀 COMMAND 'dsconf logging error set'

dsconf [-v] [-j] instance logging error set [-h]
                                                          {level,logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space,log-format,time-format}
       ...

look at that menu of options, she ate 💅

POSITIONAL ARGUMENTS 'dsconf logging error set'

dsconf logging error set level — set the log level
dsconf logging error set logging-enabled — enable access logging
dsconf logging error set logging-disabled — disable error logging
dsconf logging error set mode — set the log file permissions. default is 600
dsconf logging error set location — set the log name and location
dsconf logging error set compress-enabled — enable log compression for rotated logs
dsconf logging error set compress-disabled — disable log compression for rotated logs
dsconf logging error set buffering-enabled — enable log buffering
dsconf logging error set buffering-disabled — disable log buffering
dsconf logging error set max-logs — set the maximum number of rotated logs the server will maintain
dsconf logging error set max-logsize — set the maximum size for a log in MB
dsconf logging error set rotation-interval — set the interval for when a log is rotated. this works with the interval unit
dsconf logging error set rotation-interval-unit — set the time unit for the rotation interval for when a log is rotated. choose between: "minute", "hour", "day", "week", and "month"
dsconf logging error set rotation-tod-enabled — enable "time of day" rotation for expired logs
dsconf logging error set rotation-tod-disabled — disable "time of day" rotation for expired logs
dsconf logging error set rotation-tod-hour — set the hour when an expired log should be rotated
dsconf logging error set rotation-tod-minute — set the minute when an expired log should be rotated
dsconf logging error set deletion-interval — set the interval a rotated log should be deleted. this works with the deletion internal unit setting
dsconf logging error set deletion-interval-unit — set the interval unit a rotated log should be deleted. choose from: "day", "week", or "month"
dsconf logging error set max-disk-space — set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted.
dsconf logging error set free-disk-space — the server deletes the oldest rotated log file when the available disk space in MB is less than this amount.
dsconf logging error set log-format — choose between "default", "json", or "json-pretty"
dsconf logging error set time-format — time format for JSON logging (strftime)

🎀 COMMAND 'dsconf logging error set level'

dsconf [-v] [-j] instance logging error set level [-h]
                                                                levels [levels
       ...]

levels — log level. yes you can pass more than one, she's flexible like that 💅

🎀 COMMAND 'dsconf logging error set logging-enabled'

dsconf [-v] [-j] instance logging error set logging-enabled [-h]

🎀 COMMAND 'dsconf logging error set logging-disabled'

dsconf [-v] [-j] instance logging error set logging-disabled [-h]

🎀 COMMAND 'dsconf logging error set mode'

dsconf [-v] [-j] instance logging error set mode [-h] values

values — file permissions. default is 600 🔐

🎀 COMMAND 'dsconf logging error set location'

dsconf [-v] [-j] instance logging error set location [-h] values

values — log name and location 📍

🎀 COMMAND 'dsconf logging error set compress-enabled'

dsconf [-v] [-j] instance logging error set compress-enabled [-h]

🎀 COMMAND 'dsconf logging error set compress-disabled'

dsconf [-v] [-j] instance logging error set compress-disabled
       [-h]

🎀 COMMAND 'dsconf logging error set buffering-enabled'

dsconf [-v] [-j] instance logging error set buffering-enabled
       [-h]

🎀 COMMAND 'dsconf logging error set buffering-disabled'

dsconf [-v] [-j] instance logging error set buffering-disabled
       [-h]

🎀 COMMAND 'dsconf logging error set max-logs'

dsconf [-v] [-j] instance logging error set max-logs [-h] values

values — set the maximum number of rotated logs the server will maintain 📚

🎀 COMMAND 'dsconf logging error set max-logsize'

dsconf [-v] [-j] instance logging error set max-logsize [-h]
       values

values — set the maximum size for a log in MB 📏

🎀 COMMAND 'dsconf logging error set rotation-interval'

dsconf [-v] [-j] instance logging error set rotation-interval
       [-h] values

values — set the interval for when a log is rotated. this works with the interval unit, they're besties 🫂

🎀 COMMAND 'dsconf logging error set rotation-interval-unit'

dsconf [-v] [-j] instance logging error set
       rotation-interval-unit
       [-h] values

values — set the time unit for the rotation interval for when a log is rotated. choose between: "minute", "hour", "day", "week", and "month" ⏳

🎀 COMMAND 'dsconf logging error set rotation-tod-enabled'

dsconf [-v] [-j] instance logging error set rotation-tod-enabled
       [-h]

🎀 COMMAND 'dsconf logging error set rotation-tod-disabled'

dsconf [-v] [-j] instance logging error set rotation-tod-disabled
       [-h]

🎀 COMMAND 'dsconf logging error set rotation-tod-hour'

dsconf [-v] [-j] instance logging error set rotation-tod-hour
       [-h] values

values — set the hour when an expired log should be rotated 🕛

🎀 COMMAND 'dsconf logging error set rotation-tod-minute'

dsconf [-v] [-j] instance logging error set rotation-tod-minute
       [-h] values

values — set the minute when an expired log should be rotated 🕜

🎀 COMMAND 'dsconf logging error set deletion-interval'

dsconf [-v] [-j] instance logging error set deletion-interval
       [-h] values

values — set the interval a rotated log should be deleted. this works with the deletion internal unit setting ✂️

🎀 COMMAND 'dsconf logging error set deletion-interval-unit'

dsconf [-v] [-j] instance logging error set
       deletion-interval-unit
       [-h] values

values — set the interval unit a rotated log should be deleted. choose from: "day", "week", or "month" 🗓️

🎀 COMMAND 'dsconf logging error set max-disk-space'

dsconf [-v] [-j] instance logging error set max-disk-space [-h]
       values

values — set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. 💾

🎀 COMMAND 'dsconf logging error set free-disk-space'

dsconf [-v] [-j] instance logging error set free-disk-space [-h]
       values

values — set the minimum available disk space in MB that triggers the server to delete rotated log files. 🧹

🎀 COMMAND 'dsconf logging error set log-format'

dsconf [-v] [-j] instance logging error set log-format [-h]
       values

values — choose between "default", "json", or "json-pretty" ✨

🎀 COMMAND 'dsconf logging error set time-format'

dsconf [-v] [-j] instance logging error set time-format [-h]
       values

values — time format for JSON logging (strftime) 🕰️

🎀 COMMAND 'dsconf logging error list-levels'

dsconf [-v] [-j] instance logging error list-levels [-h]

show me every single level, no gatekeeping 💅

🦋 COMMAND 'dsconf logging security'

dsconf [-v] [-j] instance logging security [-h] {get,set} ...

security log time, and it's a whole vibe:

POSITIONAL ARGUMENTS 'dsconf logging security'

dsconf logging security get — get security log configuration 🔍
dsconf logging security set — set security log configuration 🔧

🫶 COMMAND `'dsconf logging security get'` 🫶

usage: dsconf [-v] [-j] instance logging security get [-h]

That's it bestie, that's the whole thing. No flags, no args, she just gets. 💅

✨ COMMAND `'dsconf logging security set'` ✨

usage: dsconf [-v] [-j] instance logging security set [-h]
                                                      {logging-enabled,logging-disabled,mode,location,compress-enabled,compress-disabled,buffering-enabled,buffering-disabled,max-logs,max-logsize,rotation-interval,rotation-interval-unit,rotation-tod-enabled,rotation-tod-disabled,rotation-tod-hour,rotation-tod-minute,deletion-interval,deletion-interval-unit,max-disk-space,free-disk-space}
...

Look at that menu of choices, it's giving ✨ options ✨. Every single one is a positional argument you can pick, and we're about to run through all twenty of them, one by one, no skips. 🌸

💖 POSITIONAL ARGUMENTS `'dsconf logging security set'` 💖

dsconf logging security set logging-enabled — Enable access logging 👑
dsconf logging security set logging-disabled — Disable security logging 🙈
dsconf logging security set mode — Set the log file permissions. Default is 600 🔐
dsconf logging security set location — Set the log name and location 📍
dsconf logging security set compress-enabled — Enable log compression for rotated logs 🗜️
dsconf logging security set compress-disabled — Disable log compression for rotated logs
dsconf logging security set buffering-enabled — Enable log buffering 🫧
dsconf logging security set buffering-disabled — Disable log buffering
dsconf logging security set max-logs — Set the maximum number of rotated logs the server will maintain 🗂️
dsconf logging security set max-logsize — Set the maximum size for a log in MB
dsconf logging security set rotation-interval — Set the interval for when a log is rotated.This works with the interval unit ⏰ (yes the missing space is canon, I don't make the rules)
dsconf logging security set rotation-interval-unit — Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" 🕰️
dsconf logging security set rotation-tod-enabled — Enable "time of day" rotation for expired logs 🌅
dsconf logging security set rotation-tod-disabled — Disable "time of day" rotation for expired logs
dsconf logging security set rotation-tod-hour — Set the hour when an expired log should be rotated 🕐
dsconf logging security set rotation-tod-minute — Set the minute when an expired log should be rotated ⏱️
dsconf logging security set deletion-interval — Set the interval a rotated log should be deleted. This works with the deletion internal unit setting 🗑️
dsconf logging security set deletion-interval-unit — Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month"
dsconf logging security set max-disk-space — Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. 💾
dsconf logging security set free-disk-space — The server deletes the oldest rotated log file when the available disk space in MB is less than this amount. 🧹

🌈 COMMAND `'dsconf logging security set logging-enabled'` 🌈

usage: dsconf [-v] [-j] instance logging security set logging-enabled
[-h]

No values, no nothing. You just say the word and it's on. ✨

🦋 COMMAND `'dsconf logging security set logging-disabled'` 🦋

usage: dsconf [-v] [-j] instance logging security set logging-disabled
[-h]

The opposite vibe check. Off it goes.

🎀 COMMAND `'dsconf logging security set mode'` 🎀

usage: dsconf [-v] [-j] instance logging security set mode [-h] values

values — File permissions. Default is 600 🔐

Default is 600, bestie. Remember that number, it's the whole personality of this option. 💅

📍 COMMAND `'dsconf logging security set location'` 📍

usage: dsconf [-v] [-j] instance logging security set location [-h]
values

values — Log name and location 🗺️

🗜️ COMMAND `'dsconf logging security set compress-enabled'` 🗜️

usage: dsconf [-v] [-j] instance logging security set compress-enabled
[-h]

Squish those rotated logs down to size. 🫸✨

COMMAND `'dsconf logging security set compress-disabled'`

usage: dsconf [-v] [-j] instance logging security set compress-disabled
[-h]

No squishing. Full size files, full size feelings.

🫧 COMMAND `'dsconf logging security set buffering-enabled'` 🫧

usage: dsconf [-v] [-j] instance logging security set buffering-enabled
[-h]

COMMAND `'dsconf logging security set buffering-disabled'`

usage: dsconf [-v] [-j] instance logging security set buffering-disabled
[-h]

🗂️ COMMAND `'dsconf logging security set max-logs'` 🗂️

usage: dsconf [-v] [-j] instance logging security set max-logs [-h]
values

values — Set the maximum number of rotated logs the server will maintain 📚

COMMAND `'dsconf logging security set max-logsize'`

usage: dsconf [-v] [-j] instance logging security set max-logsize [-h]
values

values — Set the maximum size for a log in MB 📏

⏰ COMMAND `'dsconf logging security set rotation-interval'` ⏰

usage: dsconf [-v] [-j] instance logging security set rotation-interval
       [-h] values

values — Set the interval for when a log is rotated.This works with the interval unit 🌀

🕰️ COMMAND `'dsconf logging security set rotation-interval-unit'` 🕰️

usage: dsconf [-v] [-j] instance logging security set
rotation-interval-unit
       [-h] values

values — Set the time unit for the rotation interval for whena log is rotated. Choose between: "minute", "hour", "day", "week", and "month" 📅

🌅 COMMAND `'dsconf logging security set rotation-tod-enabled'` 🌅

usage: dsconf [-v] [-j] instance logging security set
rotation-tod-enabled
       [-h]

COMMAND `'dsconf logging security set rotation-tod-disabled'`

usage: dsconf [-v] [-j] instance logging security set
rotation-tod-disabled
       [-h]

🕐 COMMAND `'dsconf logging security set rotation-tod-hour'` 🕐

usage: dsconf [-v] [-j] instance logging security set rotation-tod-hour
       [-h] values

values — Set the hour when an expired log should be rotated ⏳

⏱️ COMMAND `'dsconf logging security set rotation-tod-minute'` ⏱️

usage: dsconf [-v] [-j] instance logging security set
rotation-tod-minute
       [-h] values

values — Set the minute when an expired log should be rotated 🫶

🗑️ COMMAND `'dsconf logging security set deletion-interval'` 🗑️

usage: dsconf [-v] [-j] instance logging security set deletion-interval
       [-h] values

values — Set the interval a rotated log should be deleted. This works with the deletion internal unit setting ✂️

COMMAND `'dsconf logging security set deletion-interval-unit'`

usage: dsconf [-v] [-j] instance logging security set
deletion-interval-unit
       [-h] values

values — Set the interval unit a rotated log should be deleted. Choose from: "day", "week", or "month" 🗓️

💾 COMMAND `'dsconf logging security set max-disk-space'` 💾

usage: dsconf [-v] [-j] instance logging security set max-disk-space
       [-h] values

values — Set the maximum amount of disk space in MB rotated logs can consume before rotated logs are deleted. 🚨

🧹 COMMAND `'dsconf logging security set free-disk-space'` 🧹

usage: dsconf [-v] [-j] instance logging security set free-disk-space
       [-h] values

values — Set the minimum available disk space in MB that triggers the server to delete rotated log files. 🫧

👑 COMMAND `'dsconf monitor'` 👑

usage: dsconf [-v] [-j] instance monitor [-h]
                               {server,dbmon,ldbm,backend,snmp,chaining,disk,memberof}
...

The watch-it-all command. Eight ways to stare lovingly at your server and see what it's actually doing. 📊

✨ POSITIONAL ARGUMENTS `'dsconf monitor'` ✨

dsconf monitor server — Displays the server statistics, connections, and operations 🖥️
dsconf monitor dbmon — Monitor all database statistics in a single report 📋
dsconf monitor ldbm — Monitor the LDBM statistics, such as dbcache 🧠
dsconf monitor backend — Monitor the behavior of a backend database 🗄️
dsconf monitor snmp — Displays the SNMP statistics 📡
dsconf monitor chaining — Monitor database chaining statistics ⛓️
dsconf monitor disk — Displays the disk space statistics. All values are in bytes. 💽
dsconf monitor memberof — Displays deferred memberof plugin stats. 👯

🖥️ COMMAND `'dsconf monitor server'` 🖥️

usage: dsconf [-v] [-j] instance monitor server [-h] [-r]

OPTIONS `'dsconf monitor server'`

-r, --just-resources — Just display the server resources being consumed ⚡

📋 COMMAND `'dsconf monitor dbmon'` 📋

usage: dsconf [-v] [-j] instance monitor dbmon [-h] [-b BACKENDS] [-x]

OPTIONS `'dsconf monitor dbmon'`

-b BACKENDS, --backends BACKENDS — Specifies a list of space-separated backends to monitor. Default is all backends. 🎯
-x, --indexes — Shows index stats for each backend 🔍

🧠 COMMAND `'dsconf monitor ldbm'` 🧠

usage: dsconf [-v] [-j] instance monitor ldbm [-h]

🗄️ COMMAND `'dsconf monitor backend'` 🗄️

usage: dsconf [-v] [-j] instance monitor backend [-h] [backend]

backend — The optional name of the backend to monitor 👀

📡 COMMAND `'dsconf monitor snmp'` 📡

usage: dsconf [-v] [-j] instance monitor snmp [-h]

⛓️ COMMAND `'dsconf monitor chaining'` ⛓️

usage: dsconf [-v] [-j] instance monitor chaining [-h] [backend]

backend — The optional name of the chaining backend to monitor 🔗

💽 COMMAND `'dsconf monitor disk'` 💽

usage: dsconf [-v] [-j] instance monitor disk [-h]

Heads up bestie: for this one, all values are in bytes. 🫶

👯 COMMAND `'dsconf monitor memberof'` 👯

usage: dsconf [-v] [-j] instance monitor memberof [-h]

🌸 COMMAND `'dsconf plugin'` 🌸

usage: dsconf [-v] [-j] instance plugin [-h]
                              {memberof,automember,referential-integrity,root-dn,usn,account-policy,attr-uniq,dna,ldap-pass-through-auth,linked-attr,managed-entries,pam-pass-through-auth,retro-changelog,posix-winsync,contentsync,entryuuid,pwstorage-scheme,list,show,set}
...

Okay so this is the big one — eighteen plugin pipelines plus list, show, and set to round it out. A whole roster of little side-characters each with main character energy. 🎭 We're gonna get into all of them, don't you worry. 💜

📋 POSITIONAL ARGUMENTS `dsconf plugin`

Okay bestie, the plugin command has a whole roster of sub-commands and honestly each one is a little icon in its own right 💅 here's the full guest list:

dsconf plugin memberof — manage and configure the MemberOf plugin ✨
dsconf plugin automember — manage and configure the Automembership plugin 🎀
dsconf plugin referential-integrity — manage and configure the Referential Integrity Postoperation plugin
dsconf plugin root-dn — manage and configure the RootDN Access Control plugin 👑
dsconf plugin usn — manage and configure the USN plugin
dsconf plugin account-policy — manage and configure the Account Policy plugin
dsconf plugin attr-uniq — manage and configure the Attribute Uniqueness plugin
dsconf plugin dna — manage and configure the DNA plugin 🧬
dsconf plugin ldap-pass-through-auth — manage and configure LDAP Pass-Through Authentication Plugin
dsconf plugin linked-attr — manage and configure the Linked Attributes plugin
dsconf plugin managed-entries — manage and configure the Managed Entries Plugin
dsconf plugin pam-pass-through-auth — manage and configure Pass-Through Authentication plugins (LDAP URLs and PAM) 🔐
dsconf plugin retro-changelog — manage and configure the Retro Changelog plugin
dsconf plugin posix-winsync — manage and configure the Posix Winsync API plugin
dsconf plugin contentsync — manage and configure Content Sync Plugin (aka syncrepl) 🦋
dsconf plugin entryuuid — manage and configure EntryUUID plugin
dsconf plugin pwstorage-scheme — manage password storage scheme plugins
dsconf plugin list — list current configured (enabled and disabled) plugins 📝
dsconf plugin show — show the plugin data
dsconf plugin set — edit the plugin settings

🛠️ COMMAND `dsconf plugin memberof`

So you wanna vibe with the MemberOf plugin? Say less. Here's the shape of it:

usage: dsconf [-v] [-j] instance plugin memberof [-h]
                                                 {show,enable,disable,status,set,add-attr,del-attr,config-entry,fixup,fixup-status}
...

📋 POSITIONAL ARGUMENTS `dsconf plugin memberof`

All the little moves you can pull:

dsconf plugin memberof show — displays the plugin configuration 👀
dsconf plugin memberof enable — enables the plugin ✅
dsconf plugin memberof disable — disables the plugin 🚫
dsconf plugin memberof status — displays the plugin status 📊
dsconf plugin memberof set — edit the plugin settings
dsconf plugin memberof add-attr — add attributes to the plugin ➕
dsconf plugin memberof del-attr — delete attributes from the plugin ➖
dsconf plugin memberof config-entry — manage the config entry
dsconf plugin memberof fixup — run the fix-up task for memberOf plugin 🔧
dsconf plugin memberof fixup-status — check the status of a fix-up task

🛠️ COMMAND `dsconf plugin memberof show`

usage: dsconf [-v] [-j] instance plugin memberof show [-h]

🛠️ COMMAND `dsconf plugin memberof enable`

usage: dsconf [-v] [-j] instance plugin memberof enable [-h]

🛠️ COMMAND `dsconf plugin memberof disable`

usage: dsconf [-v] [-j] instance plugin memberof disable [-h]

🛠️ COMMAND `dsconf plugin memberof status`

usage: dsconf [-v] [-j] instance plugin memberof status [-h]

🛠️ COMMAND `dsconf plugin memberof set`

usage: dsconf [-v] [-j] instance plugin memberof set [-h] [--attr ATTR]
                                                     [--groupattr
GROUPATTR [GROUPATTR ...]]
                                                     [--allbackends
{on,off}]
                                                     [--skipnested
{on,off}]
                                                     [--scope SCOPE
[SCOPE ...]]
                                                     [--exclude EXCLUDE
[EXCLUDE ...]]
                                                     [--autoaddoc
AUTOADDOC]
                                                     [--deferredupdate
{on,off}]
                                                     [--launchfixup
{on,off}]
                                                     [--specific-group-oc
SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...]]
                                                     [--specific-group-filter
SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...]]
                                                     [--exclude-specific-group-filter
EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...]]
                                                     [--config-entry
CONFIG_ENTRY]

⚙️ OPTIONS `dsconf plugin memberof set`

The full menu of knobs, no gatekeeping 🌸:

--attr ATTR — says which attribute in the user entry the Directory Server should manage so it reflects group membership, aka the memberOfAttr ✨
--groupattr GROUPATTR [GROUPATTR ...] — says which attribute in the group entry is used to identify the DNs of group members, aka memberOfGroupAttr
--allbackends {on,off} — toggles whether to search the local suffix for user entries across all available suffixes, aka memberOfAllBackends
--skipnested {on,off} — toggles whether to skip nested groups or not, aka memberOfSkipNested 🪆
--scope SCOPE [SCOPE ...] — names the backends or multiple-nested suffixes the MemberOf plug-in should work on, aka memberOfEntryScope
--exclude EXCLUDE [EXCLUDE ...] — names the backends or multiple-nested suffixes the MemberOf plug-in should exclude, aka memberOfEntryScopeExcludeSubtree 🙅
--autoaddoc AUTOADDOC — if an entry doesn't have an object class that allows the memberOf attribute, the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter 🎀
--deferredupdate {on,off} — says the updates of the members happen after the update of the target group is done. On top of that, each update (group/members) uses its own transaction ⏳
--launchfixup {on,off} — says that if the server shuts down disorderly (crash, kill, ..) then on restart the memberof fixup task gets launched automatically 🔧
--specific-group-oc SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...] — sets objectclasses for the specific groups to include/exclude. Otherwise all other groups get excluded. Heads up: this replaces all existing values. If you just want to add a new value, use the add-attr command instead, aka memberOfSpecificGroupOC ⚠️
--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — gives a filter for groups to include. Otherwise all other groups get excluded, aka memberOfSpecificGroupFilter
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — gives a filter for groups to exclude. Otherwise all other groups get included, aka memberOfExcludeSpecificGroupFilter
--config-entry CONFIG_ENTRY — the value to set as nsslapd-pluginConfigArea 💅

🛠️ COMMAND `dsconf plugin memberof add-attr`

usage: dsconf [-v] [-j] instance plugin memberof add-attr [-h]
                                                          [--specific-group-filter
SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...]]
                                                          [--exclude-specific-group-filter
EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...]]

⚙️ OPTIONS `dsconf plugin memberof add-attr`

--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — gives a filter for groups to include. This adds to the existing values. Otherwise all other groups get excluded, aka memberOfSpecificGroupFilter ➕
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — gives a filter for groups to exclude. This adds to the existing values. Otherwise all other groups get included, aka memberOfExcludeSpecificGroupFilter ➕

🛠️ COMMAND `dsconf plugin memberof del-attr`

usage: dsconf [-v] [-j] instance plugin memberof del-attr [-h]
                                                          [--specific-group-filter
SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...]]
                                                          [--exclude-specific-group-filter
EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...]]

⚙️ OPTIONS `dsconf plugin memberof del-attr`

--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — removes a filter for groups to include. This removes the value from the existing values, aka memberOfSpecificGroupFilter ➖
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — removes a filter for groups to exclude. This removes the value from the existing values, aka memberOfExcludeSpecificGroupFilter ➖

🛠️ COMMAND `dsconf plugin memberof config-entry`

usage: dsconf [-v] [-j] instance plugin memberof config-entry
       [-h] {add,set,add-attr,del-attr,show,delete} ...

📋 POSITIONAL ARGUMENTS `dsconf plugin memberof config-entry`

dsconf plugin memberof config-entry add — add the config entry ➕
dsconf plugin memberof config-entry set — edit the config entry ✏️
dsconf plugin memberof config-entry add-attr — add attributes to the config entry
dsconf plugin memberof config-entry del-attr — delete attributes from the config entry
dsconf plugin memberof config-entry show — display the config entry 👀
dsconf plugin memberof config-entry delete — delete the config entry and remove the reference in the plugin 🗑️

🛠️ COMMAND `dsconf plugin memberof config-entry add`

usage: dsconf [-v] [-j] instance plugin memberof config-entry add
       [-h] [--attr ATTR] [--groupattr GROUPATTR [GROUPATTR ...]]
       [--allbackends {on,off}] [--skipnested {on,off}]
       [--scope SCOPE [SCOPE ...]] [--exclude EXCLUDE [EXCLUDE ...]]
       [--autoaddoc AUTOADDOC] [--deferredupdate {on,off}]
       [--launchfixup {on,off}]
       [--specific-group-oc SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...]]
       [--specific-group-filter SPECIFIC_GROUP_FILTER
[SPECIFIC_GROUP_FILTER ...]]
       [--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER
[EXCLUDE_SPECIFIC_GROUP_FILTER ...]]
       DN

DN — the config entry full DN 💖

OPTIONS of `dsconf plugin memberof config-entry add` 💅

okay bestie, these are the dials you can turn when you're creating a config entry. every single one, no skips:

--attr ATTR — the attribute in the user entry that the Directory Server is gonna keep updated so it shows off group membership. in DS speak this is memberOfAttr. 🎀
--groupattr GROUPATTR [GROUPATTR ...] — the attribute over in the group entry that holds the DNs of who's in the group. give it one or give it a whole list. its real name is memberOfGroupAttr. ✨
--allbackends {on,off} — flip this and the server will search the local suffix for user entries across all the suffixes that exist. maps to memberOfAllBackends. 🌸
--allbackends vibes but nested groups edition: --skipnested {on,off} — tells it whether to skip nested groups or not. it's memberOfSkipNested. 🦋
--scope SCOPE [SCOPE ...] — picks the backends or multiple-nested suffixes the MemberOf plug-in is allowed to work on. one value or a bunch. memberOfEntryScope. 💖
--exclude EXCLUDE [EXCLUDE ...] — same energy but the opposite direction: the backends / multiple-nested suffixes the MemberOf plug-in should not touch. this one is memberOfEntryScopeExcludeSubtree. 🙈
--autoaddoc AUTOADDOC — if an entry is missing an object class that would let the memberOf attribute exist, the plug-in just goes ahead and adds the object class you name here automatically. it lives in memberOfAutoAddOC. ✨
--deferredupdate {on,off} — the members get updated after the target group's update finishes. and btw each update (group / members) gets its own transaction. no sharing. 💀
--launchfixup {on,off} — if the server went out sad and disorderly (crash, kill, …) then on restart the memberof fixup task launches all by itself. main character energy. 🔥
--specific-group-oc SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...] — set object classes for the specific groups you want to include/exclude. otherwise every other group gets excluded. heads up: this replaces all existing values. to add a new one instead, use the "add-attr" command. memberOfSpecificGroupOC. 🎀
--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — a filter for the groups to include. otherwise, yep, all other groups get excluded. memberOfSpecificGroupFilter. 🌈
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — a filter for the groups to exclude. otherwise all other groups get included (opposite logic, same drama). memberOfExcludeSpecificGroupFilter. ⭐

COMMAND `dsconf plugin memberof config-entry set` ✏️

usage: dsconf [-v] [-j] instance plugin memberof config-entry set
       [-h] [--attr ATTR] [--groupattr GROUPATTR [GROUPATTR ...]]
       [--allbackends {on,off}] [--skipnested {on,off}]
       [--scope SCOPE [SCOPE ...]] [--exclude EXCLUDE [EXCLUDE ...]]
       [--autoaddoc AUTOADDOC] [--deferredupdate {on,off}]
       [--launchfixup {on,off}]
       [--specific-group-oc SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...]]
       [--specific-group-filter SPECIFIC_GROUP_FILTER
[SPECIFIC_GROUP_FILTER ...]]
       [--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER
[EXCLUDE_SPECIFIC_GROUP_FILTER ...]]
       DN

DN — the config entry full DN. 🫶

OPTIONS of `dsconf plugin memberof config-entry set` 💖

same flags, same meanings, so you already know the lore — but here they are again because we don't gatekeep:

--attr ATTR — the attribute in the user entry for the Directory Server to manage so it reflects group membership (memberOfAttr). ✨
--groupattr GROUPATTR [GROUPATTR ...] — the attribute in the group entry used to identify the DNs of group members (memberOfGroupAttr). 🎀
--allbackends {on,off} — whether to search the local suffix for user entries on all available suffixes (memberOfAllBackends). 🌸
--skipnested {on,off} — whether to skip nested groups or not (memberOfSkipNested). 🦋
--scope SCOPE [SCOPE ...] — backends or multiple-nested suffixes for the MemberOf plug-in to work on (memberOfEntryScope). 💅
--exclude EXCLUDE [EXCLUDE ...] — backends or multiple-nested suffixes for the MemberOf plug-in to exclude (memberOfEntryScopeExcludeSubtree). 🙈
--autoaddoc AUTOADDOC — if an entry doesn't have an object class that allows the memberOf attribute, the plug-in auto-adds the object class named in the memberOfAutoAddOC parameter. ⭐
--deferredupdate {on,off} — member updates happen after the target group's update completes, and each update (group / members) uses its own transaction. 💀
--launchfixup {on,off} — if the server had a disorderly shutdown (crash, kill, ..) then at restart the memberof fixup task launches automatically. 🔥
--specific-group-oc SPECIFIC_GROUP_OC [SPECIFIC_GROUP_OC ...] — object classes for the specific groups to include/exclude, otherwise all other groups get excluded. note: this replaces all existing values; to add a new value use the "add-attr" command. (memberOfSpecificGroupOC) 🎀
--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — a filter for groups to include; otherwise all other groups are excluded (memberOfSpecificGroupFilter). 🌈
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — a filter for groups to exclude; otherwise all other groups are included (memberOfExcludeSpecificGroupFilter). 💜

COMMAND `dsconf plugin memberof config-entry add-attr` ➕

usage: dsconf [-v] [-j] instance plugin memberof config-entry add-attr
       [-h]
       [--specific-group-filter SPECIFIC_GROUP_FILTER
[SPECIFIC_GROUP_FILTER ...]]
       [--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER
[EXCLUDE_SPECIFIC_GROUP_FILTER ...]]
       DN

DN — the config entry full DN. 🫶

OPTIONS of `dsconf plugin memberof config-entry add-attr` 🎀

--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — a filter for groups to include. this one adds to the existing values (it doesn't nuke them, bestie 🫶). otherwise all other groups get excluded (memberOfSpecificGroupFilter). ✨
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — a filter for groups to exclude, and again it adds to the existing values. otherwise all other groups get included (memberOfExcludeSpecificGroupFilter). 🌸

COMMAND `dsconf plugin memberof config-entry del-attr` ➖

usage: dsconf [-v] [-j] instance plugin memberof config-entry del-attr
       [-h]
       [--specific-group-filter SPECIFIC_GROUP_FILTER
[SPECIFIC_GROUP_FILTER ...]]
       [--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER
[EXCLUDE_SPECIFIC_GROUP_FILTER ...]]
       DN

DN — the config entry full DN. 💖

OPTIONS of `dsconf plugin memberof config-entry del-attr` 🦋

--specific-group-filter SPECIFIC_GROUP_FILTER [SPECIFIC_GROUP_FILTER ...] — removes a filter for groups to include. it takes the value out of the existing values (memberOfSpecificGroupFilter). 🔥
--exclude-specific-group-filter EXCLUDE_SPECIFIC_GROUP_FILTER [EXCLUDE_SPECIFIC_GROUP_FILTER ...] — removes a filter for groups to exclude, also pulling the value out of the existing values (memberOfExcludeSpecificGroupFilter). 💀

COMMAND `dsconf plugin memberof config-entry show` 👀

usage: dsconf [-v] [-j] instance plugin memberof config-entry show [-h]
DN

DN — the config entry full DN. 🌈

COMMAND `dsconf plugin memberof config-entry delete` 🗑️

usage: dsconf [-v] [-j] instance plugin memberof config-entry delete
[-h] DN

DN — the config entry full DN. ⭐

COMMAND `dsconf plugin memberof fixup` 🛠️

usage: dsconf [-v] [-j] instance plugin memberof fixup [-h] [-f FILTER]
                                                       [--wait]
                                                       [--timeout
TIMEOUT]
                                                       DN

DN — Base DN that contains entries to fix up. 🫶

OPTIONS of `dsconf plugin memberof fixup` 💅

-f FILTER, --filter FILTER — a filter for the entries to fix up. if you omit it, then all entries with objectclass inetuser/inetadmin/nsmemberof under the base you specified get their memberOf attribute regenerated. all of them. 😭
--wait — wait for the task to finish. heads up: this could take a long time. 🕐
--timeout TIMEOUT — sets the task timeout. default is 0 (no timeout). ✨

COMMAND `dsconf plugin memberof fixup-status` 📊

usage: dsconf [-v] [-j] instance plugin memberof fixup-status
       [-h] [--dn DN] [--show-log] [--watch]

OPTIONS of `dsconf plugin memberof fixup-status` 🔍

--dn DN — the task entry's DN. 🎀
--show-log — display the task log. 📜
--watch — watch the task's status and wait for it to finish. 👑

COMMAND `dsconf plugin automember` 🌟

usage: dsconf [-v] [-j] instance plugin automember [-h]
                                                       {show,enable,disable,status,list,definition,fixup,fixup-status,abort-fixup}
       ...

POSITIONAL ARGUMENTS of `dsconf plugin automember` 🧚

dsconf plugin automember show — displays the plugin configuration. ✨
dsconf plugin automember enable — enables the plugin. 🔥
dsconf plugin automember disable — disables the plugin. 💤
dsconf plugin automember status — displays the plugin status. 📈
dsconf plugin automember list — list Automembership definitions or regex rules. 🌸
dsconf plugin automember definition — manage Automembership definition. 🎀
dsconf plugin automember fixup — run a rebuild membership task. 🛠️
dsconf plugin automember fixup-status — check the status of a fix-up task. 📊
dsconf plugin automember abort-fixup — abort the rebuild membership task. 🛑 not me aborting but okay!

COMMAND `dsconf plugin automember show` 👀

usage: dsconf [-v] [-j] instance plugin automember show [-h]

COMMAND `dsconf plugin automember enable` 🔥

usage: dsconf [-v] [-j] instance plugin automember enable [-h]

COMMAND `dsconf plugin automember disable` 💤

usage: dsconf [-v] [-j] instance plugin automember disable [-h]

COMMAND `dsconf plugin automember status` 📈

usage: dsconf [-v] [-j] instance plugin automember status [-h]

COMMAND `dsconf plugin automember list` 📋

usage: dsconf [-v] [-j] instance plugin automember list [-h]
                                                          {definitions,regexes}
       ...

POSITIONAL ARGUMENTS of `dsconf plugin automember list` 🦋

dsconf plugin automember list definitions — lists Automembership definitions. 💖
dsconf plugin automember list regexes — list Automembership regex rules. 🌈

COMMAND `dsconf plugin automember list definitions` 📝

usage: dsconf [-v] [-j] instance plugin automember list definitions [-h]

COMMAND `dsconf plugin automember list regexes` 🧵

usage: dsconf [-v] [-j] instance plugin automember list regexes [-h]
DEFNAME

DEFNAME — the definition entry CN. 🎀

it's giving very precise, and honestly? obsessed. 💜

🦋 COMMAND 'dsconf plugin automember definition'

usage: dsconf [-v] [-j] instance plugin automember definition
       [-h] DEFNAME {add,set,delete,show,regex} ...

Okay bestie, this is the definition layer of automember — the part where you actually tell the plugin the rules of the game. 💖

POSITIONAL ARGUMENTS 'dsconf plugin automember definition'

dsconf plugin automember definition add — Creates Automembership definition. ✨
dsconf plugin automember definition set — Edits Automembership definition. 🎀
dsconf plugin automember definition delete — Removes Automembership definition. 💀
dsconf plugin automember definition show — Displays Automembership definition. 👀
dsconf plugin automember definition regex — Manage Automembership regex rules. 🧚

🌸 COMMAND 'dsconf plugin automember definition add'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       add
              [-h] --grouping-attr GROUPING_ATTR [--default-group
       DEFAULT_GROUP]
              --scope SCOPE --filter FILTER

OPTIONS 'dsconf plugin automember definition add'

--grouping-attr GROUPING_ATTR — Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group_member_attr:entry_attr (autoMemberGroupingAttr). so like, the two halves of the handshake fr fr 🫶
--default-group DEFAULT_GROUP — Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup). the backup plan bestie 💅
--scope SCOPE — Sets the subtree DN to search for entries (autoMemberScope). 🔍
--filter FILTER — Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter). ✨

🎀 COMMAND 'dsconf plugin automember definition set'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       set
              [-h] --grouping-attr GROUPING_ATTR [--default-group
       DEFAULT_GROUP]
              --scope SCOPE --filter FILTER

OPTIONS 'dsconf plugin automember definition set'

--grouping-attr GROUPING_ATTR — Specifies the name of the member attribute in the group entry and the attribute in the object entry that supplies the member attribute value, in the format group_member_attr:entry_attr (autoMemberGroupingAttr). 🫶
--default-group DEFAULT_GROUP — Sets default or fallback group to add the entry to as a member attribute in group entry (autoMemberDefaultGroup). 💅
--scope SCOPE — Sets the subtree DN to search for entries (autoMemberScope). 🔍
--filter FILTER — Sets a standard LDAP search filter to use to search for matching entries (autoMemberFilter). ✨

💀 COMMAND 'dsconf plugin automember definition delete'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       delete
              [-h]

no options, it just yeets the definition into the void. say bye 👋

👀 COMMAND 'dsconf plugin automember definition show'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       show
              [-h]

just shows you what the definition is. no options. peek at your own handiwork, main character energy. 🌈

🧚 COMMAND 'dsconf plugin automember definition regex'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       regex
              [-h] REGEXNAME {add,set,delete,show} ...

this is where the regex sorcery lives, bestie. 🪄

POSITIONAL ARGUMENTS 'dsconf plugin automember definition regex'

dsconf plugin automember definition regex add — Creates Automembership regex. ✨
dsconf plugin automember definition regex set — Edits Automembership regex. 🎀
dsconf plugin automember definition regex delete — Removes Automembership regex. 💀
dsconf plugin automember definition regex show — Displays Automembership regex. 👀

✨ COMMAND 'dsconf plugin automember definition regex add'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       regex REGEXNAME add
              [-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
              [--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group
       TARGET_GROUP

OPTIONS 'dsconf plugin automember definition regex add'

--exclusive EXCLUSIVE [EXCLUSIVE ...] — Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex). not you, not you, absolutely not you 🙈
--inclusive INCLUSIVE [INCLUSIVE ...] — Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex). come in bestie, you're on the list 💖
--target-group TARGET_GROUP — Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup). the destination, periodt 🎯

🎀 COMMAND 'dsconf plugin automember definition regex set'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       regex REGEXNAME set
              [-h] [--exclusive EXCLUSIVE [EXCLUSIVE ...]]
              [--inclusive INCLUSIVE [INCLUSIVE ...]] --target-group
       TARGET_GROUP

OPTIONS 'dsconf plugin automember definition regex set'

--exclusive EXCLUSIVE [EXCLUSIVE ...] — Sets a single regular expression to use to identify entries to exclude (autoMemberExclusiveRegex). 🙈
--inclusive INCLUSIVE [INCLUSIVE ...] — Sets a single regular expression to use to identify entries to include (autoMemberInclusiveRegex). 💖
--target-group TARGET_GROUP — Sets which group to add the entry to as a member, if it meets the regular expression conditions (autoMemberTargetGroup). 🎯

💀 COMMAND 'dsconf plugin automember definition regex delete'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       regex REGEXNAME delete
              [-h]

no options. gone. reduced to atoms. ✨

👀 COMMAND 'dsconf plugin automember definition regex show'

usage: dsconf [-v] [-j] instance plugin automember definition DEFNAME
       regex REGEXNAME show
              [-h]

no options, just vibes and output. 🦋

🔥 COMMAND 'dsconf plugin automember fixup'

usage: dsconf [-v] [-j] instance plugin automember fixup [-h] -f FILTER
                                                                -s
       {sub,base,one}
                                                                [--cleanup]
       [--wait]
                                                                [--timeout
       TIMEOUT]
                                                                DN

       DN     Base DN that contains entries to fix up

DN — Base DN that contains entries to fix up 🫶

OPTIONS 'dsconf plugin automember fixup'

-f FILTER, --filter FILTER — Sets the LDAP filter for entries to fix up. 🔍
-s {sub,base,one}, --scope {sub,base,one} — Sets the LDAP search scope for entries to fix up. 📍
--cleanup — Clean up previous group memberships before rebuilding. 🧹
--wait — Wait for the task to finish, this could take a long time. ⏳ (fr fr, be patient bestie)
--timeout TIMEOUT — Set a timeout to wait for the fixup task. Default is 0 (no timeout). ⌛

🦋 COMMAND 'dsconf plugin automember fixup-status'

usage: dsconf [-v] [-j] instance plugin automember fixup-status
       [-h] [--dn DN] [--show-log] [--watch]

OPTIONS 'dsconf plugin automember fixup-status'

--dn DN — The task entry's DN. 📌
--show-log — Display the task log. 📜
--watch — Watch the task's status and wait for it to finish. 👀

😭 COMMAND 'dsconf plugin automember abort-fixup'

usage: dsconf [-v] [-j] instance plugin automember abort-fixup
       [-h] [--timeout TIMEOUT]

OPTIONS 'dsconf plugin automember abort-fixup'

--timeout TIMEOUT — Set a timeout to wait for the abort task. Default is 0 (no timeout). ⌛

💜 COMMAND 'dsconf plugin referential-integrity'

usage: dsconf instance [-v] [-j] plugin referential-integrity
       [-h] {show,enable,disable,status,set,config-entry} ...

Referential integrity, aka the plugin that keeps your groups from ghosting deleted users. iconic behaviour, honestly. 👑

POSITIONAL ARGUMENTS 'dsconf plugin referential-integrity'

dsconf plugin referential-integrity show — Displays the plugin configuration. 👀
dsconf plugin referential-integrity enable — Enables the plugin. ✅
dsconf plugin referential-integrity disable — Disables the plugin. 🚫
dsconf plugin referential-integrity status — Displays the plugin status. 📊
dsconf plugin referential-integrity set — Edit the plugin settings. ✏️
dsconf plugin referential-integrity config-entry — Manage the config entry. 🗂️

👀 COMMAND 'dsconf plugin referential-integrity show'

usage: dsconf [-v] [-j] instance plugin referential-integrity show [-h]

no options. just look at it. 💅

✅ COMMAND 'dsconf plugin referential-integrity enable'

usage: dsconf [-v] [-j] instance plugin referential-integrity enable
       [-h]

no options, just turn it on. slay. ✨

🚫 COMMAND 'dsconf plugin referential-integrity disable'

usage: dsconf [-v] [-j] instance plugin referential-integrity disable
       [-h]

no options, turn it off. 😴

📊 COMMAND 'dsconf plugin referential-integrity status'

usage: dsconf [-v] [-j] instance plugin referential-integrity status
       [-h]

no options, pure status check energy. 🔍

✏️ COMMAND 'dsconf plugin referential-integrity set'

usage: dsconf [-v] [-j] instance plugin referential-integrity set
       [-h] [--update-delay UPDATE_DELAY]
       [--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
       [--entry-scope ENTRY_SCOPE] [--exclude-entry-scope
       EXCLUDE_ENTRY_SCOPE]
       [--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
       [--config-entry CONFIG_ENTRY]

OPTIONS 'dsconf plugin referential-integrity set'

--update-delay UPDATE_DELAY — Sets the update interval. Special values: 0 — The check is performed immediately, -1 — No check is performed (referint-update-delay). ⏰ two very different vibes, pick wisely
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...] — Specifies attributes to check for and update (referint-membership-attr). 🫶
--entry-scope ENTRY_SCOPE — Defines the subtree in which the plug-in looks for the delete or rename operations of a user entry (nsslapd-pluginEntryScope). 📍
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE — Defines the subtree in which the plug-in ignores any operations for deleting or renaming a user (nsslapd-pluginExcludeEntryScope). 🙈
--container-scope CONTAINER_SCOPE — Specifies which branch the plug-in searches for the groups to which the user belongs. It only updates groups that are under the specified container branch, and leaves all other groups not updated (nsslapd-pluginContainerScope). 🗂️
--log-file LOG_FILE — Specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint 📜
--config-entry CONFIG_ENTRY — The value to set as nsslapd-pluginConfigArea. 🎀

🗂️ COMMAND 'dsconf plugin referential-integrity config-entry'

usage: dsconf [-v] [-j] instance plugin referential-integrity
       config-entry
       [-h] {add,set,show,delete} ...

POSITIONAL ARGUMENTS 'dsconf plugin referential-integrity config-entry'

dsconf plugin referential-integrity config-entry add — Add the config entry. ✨
dsconf plugin referential-integrity config-entry set — Edit the config entry. ✏️
dsconf plugin referential-integrity config-entry show — Display the config entry. 👀
dsconf plugin referential-integrity config-entry delete — Delete the config entry and remove the reference in the plugin entry. 💀

🎀 COMMAND 'dsconf plugin referential-integrity config-entry add'

okay bestie, this one creates a fresh referential-integrity config entry and you get to dial in all the little knobs while you do it. here's the shape of it:

usage: dsconf [-v] [-j] instance plugin referential-integrity
config-entry add
       [-h] [--update-delay UPDATE_DELAY]
       [--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
       [--entry-scope ENTRY_SCOPE] [--exclude-entry-scope
EXCLUDE_ENTRY_SCOPE]
       [--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
       DN

POSITIONAL ARGUMENTS 'dsconf plugin referential-integrity config-entry add'

DN — the config entry's full DN, bestie. that's it, that's the whole job. 💅

OPTIONS 'dsconf plugin referential-integrity config-entry add'

--update-delay UPDATE_DELAY — sets how often the check runs. ✨ special little values: 0 means the check happens immediately, and -1 means no check at all. (this maps to referint-update-delay)
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...] — tells it which attrs to check and update. you can list more than one, go off. (this is referint-membership-attr)
--entry-scope ENTRY_SCOPE — defines the subtree where the plug-in goes looking for delete or rename operations on a user entry. (that's nsslapd-pluginEntryScope)
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE — defines the subtree where the plug-in straight up ignores any delete-or-rename operations on a user. it's giving boundaries. (that's nsslapd-pluginExcludeEntryScope)
--container-scope CONTAINER_SCOPE — says which branch the plug-in should search for the groups the user belongs to. it will only update groups under that container branch and leaves every other group untouched, no cap. (that's nsslapd-pluginContainerScope)
--log-file LOG_FILE — gives you a path for the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint 🫶

🦋 COMMAND 'dsconf plugin referential-integrity config-entry set'

same energy, but this one edits the config entry you already have. it's the glow-up command:

usage: dsconf [-v] [-j] instance plugin referential-integrity
config-entry set
       [-h] [--update-delay UPDATE_DELAY]
       [--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...]]
       [--entry-scope ENTRY_SCOPE] [--exclude-entry-scope
EXCLUDE_ENTRY_SCOPE]
       [--container-scope CONTAINER_SCOPE] [--log-file LOG_FILE]
       DN

POSITIONAL ARGUMENTS 'dsconf plugin referential-integrity config-entry set'

DN — the config entry's full DN. you're pointing at the one you wanna change. ✨

OPTIONS 'dsconf plugin referential-integrity config-entry set'

--update-delay UPDATE_DELAY — sets the update interval. the special values again, bestie: 0 = the check is performed immediately, -1 = no check is performed. (this is referint-update-delay)
--membership-attr MEMBERSHIP_ATTR [MEMBERSHIP_ATTR ...] — specifies which attributes to check for and update. (this is referint-membership-attr)
--entry-scope ENTRY_SCOPE — defines the subtree where the plug-in looks for delete or rename operations of a user entry. (that's nsslapd-pluginEntryScope)
--exclude-entry-scope EXCLUDE_ENTRY_SCOPE — defines the subtree where the plug-in ignores any operations for deleting or renaming a user. not today, delete operation. 🙈 (that's nsslapd-pluginExcludeEntryScope)
--container-scope CONTAINER_SCOPE — specifies which branch the plug-in searches for the groups the user belongs to. it only updates groups that are under the specified container branch, and leaves all other groups not updated. (that's nsslapd-pluginContainerScope)
--log-file LOG_FILE — specifies a path to the Referential integrity logfile.For example: /var/log/dirsrv/slapd-YOUR_INSTANCE/referint 🌸

⭐ COMMAND 'dsconf plugin referential-integrity config-entry show'

just look at it. that's the vibe. 💖

usage: dsconf [-v] [-j] instance plugin referential-integrity
config-entry show
       [-h] DN

DN — the config entry's full DN. ✨

💀 COMMAND 'dsconf plugin referential-integrity config-entry delete'

and this one removes it. bye bestie, no notes. 🫶

usage: dsconf [-v] [-j] instance plugin referential-integrity
config-entry delete
       [-h] DN

DN — the config entry's full DN. ✨

👑 COMMAND 'dsconf plugin root-dn'

the root-dn plug-in, aka the bouncer at the club door deciding who gets root access. it's got a whole lil family of subcommands:

usage: dsconf [-v] [-j] instance plugin root-dn [-h]
                                                    {show,enable,disable,status,set}
       ...

POSITIONAL ARGUMENTS 'dsconf plugin root-dn'

dsconf plugin root-dn show — displays the plugin configuration
dsconf plugin root-dn enable — enables the plugin
dsconf plugin root-dn disable — disables the plugin
dsconf plugin root-dn status — displays the plugin status
dsconf plugin root-dn set — edit the plugin settings

COMMAND 'dsconf plugin root-dn show'

usage: dsconf [-v] [-j] instance plugin root-dn show [-h]

COMMAND 'dsconf plugin root-dn enable'

usage: dsconf [-v] [-j] instance plugin root-dn enable [-h]

COMMAND 'dsconf plugin root-dn disable'

usage: dsconf [-v] [-j] instance plugin root-dn disable [-h]

COMMAND 'dsconf plugin root-dn status'

usage: dsconf [-v] [-j] instance plugin root-dn status [-h]

🔥 COMMAND 'dsconf plugin root-dn set'

this is the big one where you actually write the guest list. so many options, so much power, main character energy fr fr:

usage: dsconf [-v] [-j] instance plugin root-dn set [-h]
                                                    [--allow-host
ALLOW_HOST [ALLOW_HOST ...]]
                                                    [--deny-host
DENY_HOST [DENY_HOST ...]]
                                                    [--allow-ip ALLOW_IP
[ALLOW_IP ...]]
                                                    [--deny-ip DENY_IP
[DENY_IP ...]]
                                                    [--open-time
OPEN_TIME]
                                                    [--close-time
CLOSE_TIME]
                                                    [--days-allowed
DAYS_ALLOWED]

OPTIONS 'dsconf plugin root-dn set'

--allow-host ALLOW_HOST [ALLOW_HOST ...] — sets which hosts, by fully-qualified domain name, the root user is allowed to use to access Directory Server. any hosts not listed are implicitly denied. 💅 (that's rootdn-allow-host)
--deny-host DENY_HOST [DENY_HOST ...] — sets which hosts, by fully-qualified domain name, the root user is not allowed to use to access Directory Server. any hosts not listed are implicitly allowed. (that's rootdn-deny-host) ⚠️ and listen: if a host address shows up in both rootdn-allow-host and rootdn-deny-host, it gets denied access. deny wins, periodt.
--allow-ip ALLOW_IP [ALLOW_IP ...] — sets which IP addresses, either IPv4 or IPv6, for machines the root user is allowed to use to access Directory Server. any IP addresses not listed are implicitly denied. (that's rootdn-allow-ip)
--deny-ip DENY_IP [DENY_IP ...] — sets which IP addresses, either IPv4 or IPv6, for machines the root user is not allowed to use to access Directory Server. any IP addresses not listed are implicitly allowed. (that's rootdn-deny-ip) ⚠️ same rule as the host one: if an IP address is listed in both rootdn-allow-ip and rootdn-deny-ip, it is denied access.
--open-time OPEN_TIME — sets part of a time period or range when the root user is allowed to access Directory Server. this one sets when the time-based access begins. (that's rootdn-open- time)
--close-time CLOSE_TIME — sets part of a time period or range when the root user is allowed to access Directory Server. this one sets when the time-based access ends. (that's rootdn-close- time)
--days-allowed DAYS_ALLOWED — sets a comma-separated list of what days the root user is allowed to use to access Directory Server. any days listed are implicitly denied. (that's rootdn-days- allowed)

🌈 COMMAND 'dsconf plugin usn'

the USN plug-in! unique sequence numbers, living their best life. here's the whole roster:

usage: dsconf [-v] [-j] instance plugin usn [-h]
                                            {show,enable,disable,status,global,cleanup}
       ...

POSITIONAL ARGUMENTS 'dsconf plugin usn'

dsconf plugin usn show — displays the plugin configuration
dsconf plugin usn enable — enables the plugin
dsconf plugin usn disable — disables the plugin
dsconf plugin usn status — displays the plugin status
dsconf plugin usn global — get or manage global USN mode (nsslapd-entryusn-global)
dsconf plugin usn cleanup — runs the USN tombstone cleanup task

COMMAND 'dsconf plugin usn show'

usage: dsconf [-v] [-j] instance plugin usn show [-h]

COMMAND 'dsconf plugin usn enable'

usage: dsconf [-v] [-j] instance plugin usn enable [-h]

COMMAND 'dsconf plugin usn disable'

usage: dsconf [-v] [-j] instance plugin usn disable [-h]

COMMAND 'dsconf plugin usn status'

usage: dsconf [-v] [-j] instance plugin usn status [-h]

🧚 COMMAND 'dsconf plugin usn global'

global mode moment. it's on or it's off, no in-between:

usage: dsconf [-v] [-j] instance plugin usn global [-h] {on,off} ...

POSITIONAL ARGUMENTS 'dsconf plugin usn global'

dsconf plugin usn global on — enables USN global mode
dsconf plugin usn global off — disables USN global mode

COMMAND 'dsconf plugin usn global on'

usage: dsconf [-v] [-j] instance plugin usn global on [-h]

COMMAND 'dsconf plugin usn global off'

usage: dsconf [-v] [-j] instance plugin usn global off [-h]

💜 COMMAND 'dsconf plugin usn cleanup'

sweeping up those tombstones 🪦✨ — and bestie, heads up, you must give it either a suffix or a backend:

usage: dsconf [-v] [-j] instance plugin usn cleanup [-h] (-s SUFFIX |
                                                    -n BACKEND) [-m
MAX_USN]
                                                    [--timeout TIMEOUT]

OPTIONS 'dsconf plugin usn cleanup'

-s SUFFIX, --suffix SUFFIX — sets the suffix or subtree in Directory Server to run the cleanup operation against. if the suffix is not specified, then the back end must be specified. (that's suffix)
-n BACKEND, --backend BACKEND — sets the Directory Server instance back end, or database, to run the cleanup operation against. if the back end is not specified, then the suffix must be specified. Backend instance in which USN tombstone entries (that's backend)
-m MAX_USN, --max-usn MAX_USN — sets the highest USN value to delete when removing tombstone entries. (that's max_usn_to_delete)
--timeout TIMEOUT — sets the cleanup task timeout. Default is 120 seconds,

🍓 COMMAND 'dsconf plugin account-policy'

account policy time! rules for accounts, the responsible icon behavior. look at this subcommand lineup:

usage: dsconf [-v] [-j] instance plugin account-policy [-h]
                                                           {show,enable,disable,status,set,config-entry}
       ...

POSITIONAL ARGUMENTS 'dsconf plugin account-policy'

dsconf plugin account-policy show — displays the plugin configuration
dsconf plugin account-policy enable — enables the plugin
dsconf plugin account-policy disable — disables the plugin
dsconf plugin account-policy status — displays the plugin status
dsconf plugin account-policy set — edit the plugin settings
dsconf plugin account-policy config-entry — manage the config entry

COMMAND 'dsconf plugin account-policy show'

usage: dsconf [-v] [-j] instance plugin account-policy show [-h]

COMMAND 'dsconf plugin account-policy enable'

usage: dsconf [-v] [-j] instance plugin account-policy enable [-h]

COMMAND 'dsconf plugin account-policy disable'

usage: dsconf [-v] [-j] instance plugin account-policy disable [-h]

and that's where we pause, bestie — there's more coming, don't you dare close the tab 💖

✨ COMMAND 'dsconf plugin account-policy status' ✨

okay bestie, vibe check on the account policy plugin — is it alive, is it dead, what's the tea? This one just peeks at it. 🫶

usage: dsconf [-v] [-j] instance plugin account-policy status [-h]

🌸 COMMAND 'dsconf plugin account-policy set' 🌸

Customizing the plugin's setup. It takes exactly one knob, and that knob is about which entry holds the config. 🎀

usage: dsconf [-v] [-j] instance plugin account-policy set [-h]
                                                           [--config-entry
       CONFIG_ENTRY]

⭐ OPTIONS 'dsconf plugin account-policy set' ⭐

--config-entry CONFIG_ENTRY — sets the nsslapd-pluginarg0 attribute. That's the one. That's the whole job. 💅

🦋 COMMAND 'dsconf plugin account-policy config-entry' 🦋

The big one — this is where you actually manage the config entry itself, and it's got a whole little command family under it: {add,set,show,delete}. Main character energy fr fr. 👑

usage: dsconf [-v] [-j] instance plugin account-policy config-entry
       [-h] {add,set,show,delete} ...

🌈 POSITIONAL ARGUMENTS 'dsconf plugin account-policy config-entry' 🌈

dsconf plugin account-policy config-entry add — add the config entry ✨
dsconf plugin account-policy config-entry set — edit the config entry ✏️
dsconf plugin account-policy config-entry show — display the config entry 👀
dsconf plugin account-policy config-entry delete — delete the config entry and remove the reference in the plugin entry. So it cleans up after itself, we love a tidy icon. 🧹

💜 COMMAND 'dsconf plugin account-policy config-entry add' 💜

Brand new config entry, freshly made, no cap. You give it a DN and it takes a whole pile of settings. 🍓

usage: dsconf [-v] [-j] instance plugin account-policy config-entry add
       [-h] [--always-record-login {yes,no}] [--alt-state-attr
       ALT_STATE_ATTR]
       [--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
       [--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
       [--state-attr STATE_ATTR] [--login-history-size
       LOGIN_HISTORY_SIZE]
       [--check-all-state-attrs {yes,no}]
       DN

DN — the full DN of the config entry. Literally what it says, the whole thing, not a vibe, an actual DN. 💖

✨ OPTIONS 'dsconf plugin account-policy config-entry add' ✨

--always-record-login {yes,no} — sets that every entry records its last login time (alwaysRecordLogin). Yes = everybody's timestamped, no = we move mysterious. 🙈
--alt-state-attr ALT_STATE_ATTR — provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName). Backup plan, always prepared. 🫶
--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR — specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr). That's where the login time gets written, iykyk. ⭐
--limit-attr LIMIT_ATTR — specifies the attribute within the policy to use for the account inactivation limit (limitAttrName). When the account gets the little sleep, this is the att r that says so. 😭
--spec-attr SPEC_ATTR — specifies the attribute to identify which entries are account policy configuration entries (specAttrName). It's the "I'm a config entry" name tag. 🏷️
--state-attr STATE_ATTR — specifies the primary time attribute used to evaluate an account policy (stateAttrName). The main clock, the one that matters. 🔥
--login-history-size LOGIN_HISTORY_SIZE — specifies the number of login timestamps to store (lastLoginHistorySize). How deep the receipts go. 💀
--check-all-state-attrs {yes,no} — check both state and alternate state attributes for account state. Two attrs, one check. 💅

🎀 COMMAND 'dsconf plugin account-policy config-entry set' 🎀

Same energy as add, but you're editing something that already exists. Glow up for your config entry. 🌸

usage: dsconf [-v] [-j] instance plugin account-policy config-entry set
       [-h] [--always-record-login {yes,no}] [--alt-state-attr
       ALT_STATE_ATTR]
       [--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR]
       [--limit-attr LIMIT_ATTR] [--spec-attr SPEC_ATTR]
       [--state-attr STATE_ATTR] [--login-history-size
       LOGIN_HISTORY_SIZE]
       [--check-all-state-attrs {yes,no}]
       DN

DN — the full DN of the config entry. Yes, again. It's the address, bestie. 📍

💖 OPTIONS 'dsconf plugin account-policy config-entry set' 💖

--always-record-login {yes,no} — sets that every entry records its last login time (alwaysRecordLogin). ⏰
--alt-state-attr ALT_STATE_ATTR — provides a backup attribute for the server to reference to evaluate the expiration time (altStateAttrName). 🛟
--always-record-login-attr ALWAYS_RECORD_LOGIN_ATTR — specifies the attribute to store the time of the last successful login in this attribute in the users directory entry (alwaysRecordLoginAttr). ✍️
--limit-attr LIMIT_ATTR — specifies the attribute within the policy to use for the account inactivation limit (limitAttrName). ⛔
--spec-attr SPEC_ATTR — specifies the attribute to identify which entries are account policy configuration entries (specAttrName). 🏷️
--state-attr STATE_ATTR — specifies the primary time attribute used to evaluate an account policy (stateAttrName). 🕰️
--login-history-size LOGIN_HISTORY_SIZE — specifies the number of login timestamps to store (lastLoginHistorySize). 📚
--check-all-state-attrs {yes,no} — check both state and alternate state attributes for account state. ✅

🔍 COMMAND 'dsconf plugin account-policy config-entry show' 🔍

Just show me the config entry. That's it. That's the whole command. She's lowkey simple and we respect her for it. 💜

usage: dsconf [-v] [-j] instance plugin account-policy config-entry show
       [-h] DN

DN — the full DN of the config entry. 💫

🗑️ COMMAND 'dsconf plugin account-policy config-entry delete' 🗑️

Gone. Deleted. Not coming back. And remember, this one also yanks out the reference in the plugin entry, so nothing's left dangling. Clean exit, iconic behavior. 🔥

usage: dsconf [-v] [-j] instance plugin account-policy config-entry
       delete
       [-h] DN

DN — the full DN of the config entry. 💀

🦄 COMMAND 'dsconf plugin attr-uniq' 🦄

attribute uniqueness time!! This plugin's whole deal is making sure a value shows up exactly once and nowhere else. It's got a whole command tree so you can poke at individual configs. 🌈

usage: dsconf [-v] [-j] instance plugin attr-uniq [-h]
                                                         {list,add,set,show,delete,enable,disable,status}
       ...

🌟 POSITIONAL ARGUMENTS 'dsconf plugin attr-uniq' 🌟

dsconf plugin attr-uniq list — lists available plugin configs 📋
dsconf plugin attr-uniq add — add the config entry ➕
dsconf plugin attr-uniq set — edit the config entry ✏️
dsconf plugin attr-uniq show — display the config entry 👀
dsconf plugin attr-uniq delete — delete the config entry 🗑️
dsconf plugin attr-uniq enable — enable plugin 🟢
dsconf plugin attr-uniq disable — disable plugin 🔴
dsconf plugin attr-uniq status — display plugin status 📊

💅 COMMAND 'dsconf plugin attr-uniq list' 💅

Shows you all the available plugin configs. No arguments, no drama, just a list. 🎀

usage: dsconf [-v] [-j] instance plugin attr-uniq list [-h]

🍓 COMMAND 'dsconf plugin attr-uniq add' 🍓

Making a fresh uniqueness config. It's got so many options and honestly every single one of them is doing something real. 🫶

usage: dsconf [-v] [-j] instance plugin attr-uniq add [-h]
                                                             [--enabled
       {on,off}]
                                                             [--attr-name
       ATTR_NAME [ATTR_NAME ...]]
                                                             [--subtree SUBTREE
       [SUBTREE ...]]
                                                             [--exclude-subtree
       EXCLUDE_SUBTREE [EXCLUDE_SUBTREE ...]]
                                                             [--across-all-subtrees
       {on,off}]
                                                             [--top-entry-oc
       TOP_ENTRY_OC]
                                                             [--subtree-entries-oc
       SUBTREE_ENTRIES_OC]
                                                             NAME

NAME — the name of the plug-in configuration record. (cn) You can use any string, but "attribute_name Attribute Uniqueness" is recommended. Like, literally any string works, but that format is the moment. ⭐

✨ OPTIONS 'dsconf plugin attr-uniq add' ✨

--enabled {on,off} — identifies whether or not the config is enabled. 🟢
--attr-name ATTR_NAME [ATTR_NAME ...] — sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name) — and yes, it's multi-valued, so you can stack them. 📚
--subtree SUBTREE [SUBTREE ...] — sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees). Multi-valued again, we love options. 🌳
--exclude-subtree EXCLUDE_SUBTREE [EXCLUDE_SUBTREE ...] — sets subtrees that should be excluded from attribute uniqueness checks. This attribute is multi-valued (uniqueness-exclude-subtrees). The "not these ones" list. 🚫
--across-all-subtrees {on,off} — if enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees). So: one big check, or one small check. Big difference. 🔍
--top-entry-oc TOP_ENTRY_OC — verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc). 🎯
--subtree-entries-oc SUBTREE_ENTRIES_OC — verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc). Conditional uniqueness, fancy. 💅

🌸 COMMAND 'dsconf plugin attr-uniq set' 🌸

Editing an existing uniqueness config instead of making a new one. Same option set, same energy, just applied to something that already exists. 🦋

usage: dsconf [-v] [-j] instance plugin attr-uniq set [-h]
                                                             [--enabled
       {on,off}]
                                                             [--attr-name
       ATTR_NAME [ATTR_NAME ...]]
                                                             [--subtree SUBTREE
       [SUBTREE ...]]
                                                             [--exclude-subtree
       EXCLUDE_SUBTREE [EXCLUDE_SUBTREE ...]]
                                                             [--across-all-subtrees
       {on,off}]
                                                             [--top-entry-oc
       TOP_ENTRY_OC]
                                                             [--subtree-entries-oc
       SUBTREE_ENTRIES_OC]
                                                             NAME

NAME — the name of the plug-in configuration record. (cn) You can use any string, but "attribute_name Attribute Uniqueness" is recommended. 🎀

💖 OPTIONS 'dsconf plugin attr-uniq set' 💖

--enabled {on,off} — identifies whether or not the config is enabled. ⚡
--attr-name ATTR_NAME [ATTR_NAME ...] — sets the name of the attribute whose values must be unique. This attribute is multi-valued. (uniqueness-attribute-name) 🌟
--subtree SUBTREE [SUBTREE ...] — sets the DN under which the plug-in checks for uniqueness of the attributes value. This attribute is multi-valued (uniqueness-subtrees). 🌲
--exclude-subtree EXCLUDE_SUBTREE [EXCLUDE_SUBTREE ...] — sets subtrees that should be excluded from attribute uniqueness checks. This attribute is multi-valued (uniqueness-exclude-subtrees). 🙅
--across-all-subtrees {on,off} — if enabled (on), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off, uniqueness is only enforced within the subtree of the updated entry (uniqueness-across-all-subtrees). 🎪
--top-entry-oc TOP_ENTRY_OC — verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree (uniqueness-top-entry-oc). 📌
--subtree-entries-oc SUBTREE_ENTRIES_OC — verifies if an attribute is unique, if the entry contains the object class set in this parameter (uniqueness-subtree-entries-oc). 🧚

👀 COMMAND 'dsconf plugin attr-uniq show' 👀

Pulls up one config record so you can look at it. Just the name, nothing else. 💜

usage: dsconf [-v] [-j] instance plugin attr-uniq show [-h] NAME

NAME — the name of the plug-in configuration record. 🏷️

💀 COMMAND 'dsconf plugin attr-uniq delete' 💀

Deleting a plug-in configuration record. Give it the name, it's out. Periodt. 🔥

usage: dsconf [-v] [-j] instance plugin attr-uniq delete [-h] NAME

NAME — the name of the plug-in configuration record. ✨

COMMAND `dsconf plugin attr-uniq enable`

usage: dsconf [-v] [-j] instance plugin attr-uniq enable [-h] NAME

NAME — the name of the plug-in configuration record 💖

COMMAND `dsconf plugin attr-uniq disable`

usage: dsconf [-v] [-j] instance plugin attr-uniq disable [-h] NAME

NAME — the name of the plug-in configuration record 🎀

COMMAND `dsconf plugin attr-uniq status`

usage: dsconf [-v] [-j] instance plugin attr-uniq status [-h] NAME

NAME — the name of the plug-in configuration record ✨

COMMAND `dsconf plugin dna`

okay bestie, and now we get to the DNA plugin — yes, distributed numeric assignment, the plug-in that hands out numbers so no two servers ever fight over the same one. 🧬💅

usage: dsconf [-v] [-j] instance plugin dna [-h]
                                            {show,enable,disable,status,list,config}
...

POSITIONAL ARGUMENTS `dsconf plugin dna`

dsconf plugin dna show — displays the plugin configuration 👀
dsconf plugin dna enable — enables the plugin 🔥
dsconf plugin dna disable — disables the plugin 💀
dsconf plugin dna status — displays the plugin status 🌡️
dsconf plugin dna list — list available plugin configs 📋
dsconf plugin dna config — manage plugin configs ⚙️

COMMAND `dsconf plugin dna show`

usage: dsconf [-v] [-j] instance plugin dna show [-h]

COMMAND `dsconf plugin dna enable`

usage: dsconf [-v] [-j] instance plugin dna enable [-h]

COMMAND `dsconf plugin dna disable`

usage: dsconf [-v] [-j] instance plugin dna disable [-h]

COMMAND `dsconf plugin dna status`

usage: dsconf [-v] [-j] instance plugin dna status [-h]

COMMAND `dsconf plugin dna list`

usage: dsconf [-v] [-j] instance plugin dna list [-h]
                                                 {configs,shared-configs}
...

POSITIONAL ARGUMENTS `dsconf plugin dna list`

dsconf plugin dna list configs — list main DNA plugin config entries 🗂️
dsconf plugin dna list shared-configs — list DNA plugin shared config entries 🤝

COMMAND `dsconf plugin dna list configs`

usage: dsconf [-v] [-j] instance plugin dna list configs [-h]

COMMAND `dsconf plugin dna list shared-configs`

usage: dsconf [-v] [-j] instance plugin dna list shared-configs [-h]
BASEDN

BASEDN — the search DN 🔎

COMMAND `dsconf plugin dna config`

usage: dsconf [-v] [-j] instance plugin dna config [-h]
                                                     NAME
                                                     {add,set,show,delete,shared-config-entry}
...

POSITIONAL ARGUMENTS `dsconf plugin dna config`

dsconf plugin dna config add — add the config entry ➕
dsconf plugin dna config set — edit the config entry 📝
dsconf plugin dna config show — display the config entry 👀
dsconf plugin dna config delete — delete the config entry 🗑️
dsconf plugin dna config shared-config-entry — manage the shared config entry 🤝

COMMAND `dsconf plugin dna config add`

usage: dsconf [-v] [-j] instance plugin dna config NAME add
       [-h] [--type TYPE [TYPE ...]] [--prefix PREFIX]
       [--next-value NEXT_VALUE] [--max-value MAX_VALUE] [--interval
INTERVAL]
       [--magic-regen MAGIC_REGEN] [--filter FILTER] [--scope SCOPE]
       [--remote-bind-dn REMOTE_BIND_DN] [--remote-bind-cred
REMOTE_BIND_CRED]
       [--shared-config-entry SHARED_CONFIG_ENTRY] [--threshold
THRESHOLD]
       [--next-range NEXT_RANGE]
       [--range-request-timeout RANGE_REQUEST_TIMEOUT]

OPTIONS `dsconf plugin dna config add`

--type TYPE [TYPE ...] — sets which attributes have unique numbers being generated for them (dnaType) 🔢
--prefix PREFIX — defines a prefix that can be prepended to the generated number values for the attribute (dnaPrefix) 🏷️
--next-value NEXT_VALUE — sets the next available number which can be assigned (dnaNextValue) ⏭️
--max-value MAX_VALUE — sets the maximum value that can be assigned for the range (dnaMaxValue) 🔝
--interval INTERVAL — sets an interval to use to increment through numbers in a range (dnaInterval) 📈
--magic-regen MAGIC_REGEN — sets a user-defined value that instructs the plug-in to assign a new value for the entry (dnaMagicRegen) 🪄
--filter FILTER — sets an LDAP filter to use to search for and identify the entries to which to apply the distributed numeric assignment range (dnaFilter) 🔍
--scope SCOPE — sets the base DN to search for entries to which to apply the distributed numeric assignment (dnaScope) 🌳
--remote-bind-dn REMOTE_BIND_DN — specifies the Replication Manager DN (dnaRemoteBindDN) 🔑
--remote-bind-cred REMOTE_BIND_CRED — specifies the Replication Manager's password (dnaRemoteBindCred) 🤫
--shared-config-entry SHARED_CONFIG_ENTRY — defines a shared identity that the servers can use to transfer ranges to one another (dnaSharedCfgDN) 🤝
--threshold THRESHOLD — sets a threshold of remaining available numbers in the range. When the server hits the threshold, it sends a request for a new range (dnaThreshold) 🚨
--next-range NEXT_RANGE — defines the next range to use when the current range is exhausted (dnaNextRange) ⏭️
--range-request-timeout RANGE_REQUEST_TIMEOUT — sets a timeout period, in seconds, for range requests so that the server does not stall waiting on a new range from one server and can request a range from a new server (dnaRangeRequestTimeout) ⏱️

COMMAND `dsconf plugin dna config set`

usage: dsconf [-v] [-j] instance plugin dna config NAME set
       [-h] [--type TYPE [TYPE ...]] [--prefix PREFIX]
       [--next-value NEXT_VALUE] [--max-value MAX_VALUE] [--interval
INTERVAL]
       [--magic-regen MAGIC_REGEN] [--filter FILTER] [--scope SCOPE]
       [--remote-bind-dn REMOTE_BIND_DN] [--remote-bind-cred
REMOTE_BIND_CRED]
       [--shared-config-entry SHARED_CONFIG_ENTRY] [--threshold
THRESHOLD]
       [--next-range NEXT_RANGE]
       [--range-request-timeout RANGE_REQUEST_TIMEOUT]

OPTIONS `dsconf plugin dna config set`

same flags, same energy, but now you're editing instead of creating:

--type TYPE [TYPE ...] — sets which attributes have unique numbers being generated for them (dnaType) 🔢
--prefix PREFIX — defines a prefix that can be prepended to the generated number values for the attribute (dnaPrefix) 🏷️
--next-value NEXT_VALUE — sets the next available number which can be assigned (dnaNextValue) ⏭️
--max-value MAX_VALUE — sets the maximum value that can be assigned for the range (dnaMaxValue) 🔝
--interval INTERVAL — sets an interval to use to increment through numbers in a range (dnaInterval) 📈
--magic-regen MAGIC_REGEN — sets a user-defined value that instructs the plug-in to assign a new value for the entry (dnaMagicRegen) 🪄
--filter FILTER — sets an LDAP filter to use to search for and identify the entries to which to apply the distributed numeric assignment range (dnaFilter) 🔍
--scope SCOPE — sets the base DN to search for entries to which to apply the distributed numeric assignment (dnaScope) 🌳
--remote-bind-dn REMOTE_BIND_DN — specifies the Replication Manager DN (dnaRemoteBindDN) 🔑
--remote-bind-cred REMOTE_BIND_CRED — specifies the Replication Manager's password (dnaRemoteBindCred) 🤫
--shared-config-entry SHARED_CONFIG_ENTRY — defines a shared identity that the servers can use to transfer ranges to one another (dnaSharedCfgDN) 🤝
--threshold THRESHOLD — sets a threshold of remaining available numbers in the range. When the server hits the threshold, it sends a request for a new range (dnaThreshold) 🚨
--next-range NEXT_RANGE — defines the next range to use when the current range is exhausted (dnaNextRange) ⏭️
--range-request-timeout RANGE_REQUEST_TIMEOUT — sets a timeout period, in seconds, for range requests so that the server does not stall waiting on a new range from one server and can request a range from a new server (dnaRangeRequestTimeout) ⏱️

COMMAND `dsconf plugin dna config show`

usage: dsconf [-v] [-j] instance plugin dna config NAME show [-h]

COMMAND `dsconf plugin dna config delete`

usage: dsconf [-v] [-j] instance plugin dna config NAME delete [-h]

COMMAND `dsconf plugin dna config shared-config-entry`

usage: dsconf [-v] [-j] instance plugin dna config NAME
shared-config-entry
       [-h] SHARED_CFG {set,show,delete} ...

POSITIONAL ARGUMENTS `dsconf plugin dna config shared-config-entry`

dsconf plugin dna config shared-config-entry set — edit the shared config entry 📝
dsconf plugin dna config shared-config-entry show — display the shared config entry 👀
dsconf plugin dna config shared-config-entry delete — delete the shared config entry 🗑️

COMMAND `dsconf plugin dna config shared-config-entry set`

usage: dsconf [-v] [-j] instance plugin dna config NAME
shared-config-entry SHARED_CFG set
       [-h] [--remote-bind-method REMOTE_BIND_METHOD]
       [--remote-conn-protocol REMOTE_CONN_PROTOCOL]

OPTIONS `dsconf plugin dna config shared-config-entry set`

--remote-bind-method REMOTE_BIND_METHOD — specifies the remote bind method "SIMPLE", "SSL" (for SSL client auth), "SASL/GSSAPI", or "SASL/DIGEST-MD5" (dnaRemoteBindMethod) 🔐
--remote-conn-protocol REMOTE_CONN_PROTOCOL — specifies the remote connection protocol "LDAP", or "TLS" (dnaRemoteConnProtocol) 🌐

COMMAND `dsconf plugin dna config shared-config-entry show`

usage: dsconf [-v] [-j] instance plugin dna config NAME
shared-config-entry SHARED_CFG show
       [-h]

COMMAND `dsconf plugin dna config shared-config-entry delete`

usage: dsconf [-v] [-j] instance plugin dna config NAME
shared-config-entry SHARED_CFG delete
       [-h]

COMMAND `dsconf plugin ldap-pass-through-auth`

next up, bestie, it's the LDAP pass-through auth plug-in — the one that lets your directory go "hmm, not my credentials, let me go ask someone else" 😭✨

usage: dsconf instance [-v] [-j] plugin ldap-pass-through-auth
       [-h] {show,enable,disable,status,list,add,modify,delete} ...

POSITIONAL ARGUMENTS `dsconf plugin ldap-pass-through-auth`

dsconf plugin ldap-pass-through-auth show — displays the plugin configuration 👀
dsconf plugin ldap-pass-through-auth enable — enables the plugin 🔥
dsconf plugin ldap-pass-through-auth disable — disables the plugin 💀
dsconf plugin ldap-pass-through-auth status — displays the plugin status 🌡️
dsconf plugin ldap-pass-through-auth list — lists LDAP URLs 📋
dsconf plugin ldap-pass-through-auth add — add an LDAP url to the config entry ➕
dsconf plugin ldap-pass-through-auth modify — edit the LDAP pass through config entry ✏️
dsconf plugin ldap-pass-through-auth delete — delete a URL from the config entry 🗑️

COMMAND `dsconf plugin ldap-pass-through-auth show`

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth show [-h]

COMMAND 'dsconf plugin ldap-pass-through-auth enable'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth enable
[-h]

COMMAND 'dsconf plugin ldap-pass-through-auth disable'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth disable
[-h]

COMMAND 'dsconf plugin ldap-pass-through-auth status'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth status
[-h]

COMMAND 'dsconf plugin ldap-pass-through-auth list'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth list [-h]

COMMAND 'dsconf plugin ldap-pass-through-auth add'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth add [-h]
URL

URL — bestie this is the full LDAP URL, and the format is LOCKED IN: "ldap|ldaps://authDS/subtree maxconns,maxops,timeout,ldver,connlifetime,startTLS". And listen 💀 if you specify even ONE of those optional parameters, you have to specify the rest too. All or nothing, no in-between. Periodt.

COMMAND 'dsconf plugin ldap-pass-through-auth modify'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth modify
       [-h] OLD_URL NEW_URL

OLD_URL — the full LDAP URL you grab from the "list" command 👑
NEW_URL — sets the full LDAP URL in the format "ldap|ldaps://authDS/subtree maxconns,maxops,timeout,ldver,connlifetime,startTLS". And yeah, same rule as before: if one optional parameter is specified the rest should be specified too 🫶

COMMAND 'dsconf plugin ldap-pass-through-auth delete'

usage: dsconf [-v] [-j] instance plugin ldap-pass-through-auth delete
[-h] URL

URL — the full LDAP URL you get from the "list" command, bestie.

COMMAND 'dsconf plugin linked-attr'

usage: dsconf [-v] [-j] instance plugin linked-attr [-h]
                                                    {show,enable,disable,status,fixup,fixup-status,list,config}
...

POSITIONAL ARGUMENTS 'dsconf plugin linked-attr'

dsconf plugin linked-attr show — shows you the plugin config, the whole vibe ✨
dsconf plugin linked-attr enable — turns the plugin ON 💅
dsconf plugin linked-attr disable — turns the plugin OFF 🙈
dsconf plugin linked-attr status — tells you the plugin's status, the vibe check 🌸
dsconf plugin linked-attr fixup — runs the fix-up task for the linked attributes plugin 🔥
dsconf plugin linked-attr fixup-status — checks how that fix-up task is doing
dsconf plugin linked-attr list — lists the available plugin configs
dsconf plugin linked-attr config — manages the plugin configs, main character energy

COMMAND 'dsconf plugin linked-attr show'

usage: dsconf [-v] [-j] instance plugin linked-attr show [-h]

COMMAND 'dsconf plugin linked-attr enable'

usage: dsconf [-v] [-j] instance plugin linked-attr enable [-h]

COMMAND 'dsconf plugin linked-attr disable'

usage: dsconf [-v] [-j] instance plugin linked-attr disable [-h]

COMMAND 'dsconf plugin linked-attr status'

usage: dsconf [-v] [-j] instance plugin linked-attr status [-h]

COMMAND 'dsconf plugin linked-attr fixup'

usage: dsconf [-v] [-j] instance plugin linked-attr fixup [-h] [-l
LINKDN]
                                                          [--wait]

OPTIONS 'dsconf plugin linked-attr fixup'

-l LINKDN, --linkdn LINKDN — sets the base DN that contains entries to fix up 🎀
--wait — waits for the task to finish. ngl this could take a long time, so maybe go get a snack first 🍓

COMMAND 'dsconf plugin linked-attr fixup-status'

usage: dsconf [-v] [-j] instance plugin linked-attr fixup-status
       [-h] [--dn DN] [--show-log] [--watch]

OPTIONS 'dsconf plugin linked-attr fixup-status'

--dn DN — the task entry's DN
--show-log — displays the task log, receipts and all 🧚
--watch — watches the task's status and waits for it to finish, like you're refreshing the group chat 👀

COMMAND 'dsconf plugin linked-attr list'

usage: dsconf [-v] [-j] instance plugin linked-attr list [-h]

COMMAND 'dsconf plugin linked-attr config'

usage: dsconf [-v] [-j] instance plugin linked-attr config [-h]
                                                           NAME
                                                           {add,set,show,delete}
...

POSITIONAL ARGUMENTS 'dsconf plugin linked-attr config'

dsconf plugin linked-attr config add — adds the config entry 💖
dsconf plugin linked-attr config set — edits the config entry
dsconf plugin linked-attr config show — displays the config entry
dsconf plugin linked-attr config delete — deletes the config entry, bye bestie 👋

COMMAND 'dsconf plugin linked-attr config add'

usage: dsconf [-v] [-j] instance plugin linked-attr config NAME add
       [-h] [--link-type LINK_TYPE] [--managed-type MANAGED_TYPE]
       [--link-scope LINK_SCOPE]

OPTIONS 'dsconf plugin linked-attr config add'

--link-type LINK_TYPE — sets the attribute that is managed manually by administrators (linkType)
--managed-type MANAGED_TYPE — sets the attribute that is created dynamically by the plugin (managedType) ✨
--link-scope LINK_SCOPE — sets the scope that restricts the plugin to a specific part of the directory tree (linkScope)

COMMAND 'dsconf plugin linked-attr config set'

usage: dsconf [-v] [-j] instance plugin linked-attr config NAME set
       [-h] [--link-type LINK_TYPE] [--managed-type MANAGED_TYPE]
       [--link-scope LINK_SCOPE]

OPTIONS 'dsconf plugin linked-attr config set'

--link-type LINK_TYPE — sets the attribute that is managed manually by administrators (linkType)
--managed-type MANAGED_TYPE — sets the attribute that is created dynamically by the plugin (managedType) ✨
--link-scope LINK_SCOPE — sets the scope that restricts the plugin to a specific part of the directory tree (linkScope)

COMMAND 'dsconf plugin linked-attr config show'

usage: dsconf [-v] [-j] instance plugin linked-attr config NAME show
[-h]

COMMAND 'dsconf plugin linked-attr config delete'

usage: dsconf [-v] [-j] instance plugin linked-attr config NAME delete
[-h]

COMMAND 'dsconf plugin managed-entries'

usage: dsconf [-v] [-j] instance plugin managed-entries [-h]
                                                            {show,enable,disable,status,set,list,config,template}
...

POSITIONAL ARGUMENTS 'dsconf plugin managed-entries'

dsconf plugin managed-entries show — displays the plugin configuration 💜
dsconf plugin managed-entries enable — enables the plugin
dsconf plugin managed-entries disable — disables the plugin
dsconf plugin managed-entries status — displays the plugin status
dsconf plugin managed-entries set — edits the plugin settings
dsconf plugin managed-entries list — lists Managed Entries Plugin configs and templates
dsconf plugin managed-entries config — handles Managed Entries Plugin configs
dsconf plugin managed-entries template — handles Managed Entries Plugin templates 🌈

COMMAND 'dsconf plugin managed-entries show'

usage: dsconf [-v] [-j] instance plugin managed-entries show [-h]

COMMAND 'dsconf plugin managed-entries enable'

usage: dsconf [-v] [-j] instance plugin managed-entries enable [-h]

COMMAND 'dsconf plugin managed-entries disable'

usage: dsconf [-v] [-j] instance plugin managed-entries disable [-h]

COMMAND 'dsconf plugin managed-entries status'

usage: dsconf [-v] [-j] instance plugin managed-entries status [-h]

COMMAND 'dsconf plugin managed-entries set'

usage: dsconf [-v] [-j] instance plugin managed-entries set
       [-h] [--config-area CONFIG_AREA]

OPTIONS 'dsconf plugin managed-entries set'

--config-area CONFIG_AREA — sets the value of the nsslapd-pluginConfigArea attribute 🎀

COMMAND 'dsconf plugin managed-entries list'

usage: dsconf [-v] [-j] instance plugin managed-entries list
       [-h] {configs,templates} ...

POSITIONAL ARGUMENTS 'dsconf plugin managed-entries list'

dsconf plugin managed-entries list configs — lists Managed Entries Plugin configs (list config-area if specified in the main plugin entry)
dsconf plugin managed-entries list templates — lists Managed Entries Plugin templates in the directory 💅

COMMAND 'dsconf plugin managed-entries list configs'

usage: dsconf instance [-v] [-j] plugin managed-entries list configs
[-h]

COMMAND 'dsconf plugin managed-entries list templates'

usage: dsconf instance [-v] [-j] plugin managed-entries list templates
       [-h] [BASEDN]

BASEDN — the base DN where to search the templates 🔍

COMMAND 'dsconf plugin managed-entries config'

usage: dsconf [-v] [-j] instance plugin managed-entries config
       [-h] NAME {add,set,show,delete} ...

POSITIONAL ARGUMENTS 'dsconf plugin managed-entries config'

dsconf plugin managed-entries config add — adds the config entry 💖
dsconf plugin managed-entries config set — edits the config entry
dsconf plugin managed-entries config show — displays the config entry
dsconf plugin managed-entries config delete — deletes the config entry 🦋

COMMAND 'dsconf plugin managed-entries config add'

usage: dsconf [-v] [-j] instance plugin managed-entries config NAME add
       [-h] [--scope SCOPE] [--filter FILTER] [--managed-base
MANAGED_BASE]
       [--managed-template MANAGED_TEMPLATE]

OPTIONS 'dsconf plugin managed-entries config add'

--scope SCOPE — sets the scope of the search to use to see which entries the plug-in monitors (originScope)
--filter FILTER — sets the search filter to use to search for and identify the entries within the subtree which require a managed entry (originFilter)
--managed-base MANAGED_BASE — sets the subtree under which to create the managed entries (managedBase)
--managed-template MANAGED_TEMPLATE — identifies the template entry to use to create the managed entry (managedTemplate) ✨

COMMAND 'dsconf plugin managed-entries config set'

usage: dsconf [-v] [-j] instance plugin managed-entries config NAME set
       [-h] [--scope SCOPE] [--filter FILTER] [--managed-base
MANAGED_BASE]
       [--managed-template MANAGED_TEMPLATE]

OPTIONS 'dsconf plugin managed-entries config set'

--scope SCOPE — sets the scope of the search to use to see which entries the plug-in monitors (originScope)
--filter FILTER — sets the search filter to use to search for and identify the entries within the subtree which require a managed entry (originFilter)
--managed-base MANAGED_BASE — sets the subtree under which to create the managed entries (managedBase)
--managed-template MANAGED_TEMPLATE — identifies the template entry to use to create the managed entry (managedTemplate) ✨

COMMAND 'dsconf plugin managed-entries config show'

usage: dsconf [-v] [-j] instance plugin managed-entries config NAME show
[-h]

COMMAND 'dsconf plugin managed-entries config delete'

usage: dsconf [-v] [-j] instance plugin managed-entries config NAME
delete
       [-h]

✨ COMMAND 'dsconf plugin managed-entries template' ✨

okay bestie, we're in template town now 💅 this is the command that lets you poke at the managed-entries plugin's template entry — the blueprint the server copies from when it auto-generates new managed entries. here's the shape of it:

usage: dsconf [-v] [-j] instance plugin managed-entries template
       [-h] DN {add,set,show,delete} ...

🌸 POSITIONAL ARGUMENTS 'dsconf plugin managed-entries template' 🌸

dsconf plugin managed-entries template add — Add the template entry ✨
dsconf plugin managed-entries template set — Edit the template entry ✏️
dsconf plugin managed-entries template show — Display the template entry 👀
dsconf plugin managed-entries template delete — Delete the template entry 🗑️

💖 COMMAND 'dsconf plugin managed-entries template add' 💖

so you wanna build a brand new template entry from scratch? iconic. here's the invocation:

usage: dsconf [-v] [-j] instance plugin managed-entries template DN add
       [-h] [--rdn-attr RDN_ATTR]
       [--static-attr STATIC_ATTR [STATIC_ATTR ...]]
       [--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...]]

🎀 OPTIONS 'dsconf plugin managed-entries template add' 🎀

--rdn-attr RDN_ATTR — Sets which attribute to use as the naming attribute in the automatically- generated entry (mepRDNAttr) 💫
--static-attr STATIC_ATTR [STATIC_ATTR ...] — Sets an attribute with a defined value that must be added to the automatically-generated entry (mepStaticAttr) 🔒
--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...] — Sets attributes in the Managed Entries template entry which must exist in the generated entry (mepMappedAttr) 🗺️

🌈 COMMAND 'dsconf plugin managed-entries template set' 🌈

already got a template and just need to tweak it? say less. same flags, different verb:

usage: dsconf [-v] [-j] instance plugin managed-entries template DN set
       [-h] [--rdn-attr RDN_ATTR]
       [--static-attr STATIC_ATTR [STATIC_ATTR ...]]
       [--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...]]

🦋 OPTIONS 'dsconf plugin managed-entries template set' 🦋

--rdn-attr RDN_ATTR — Sets which attribute to use as the naming attribute in the automatically- generated entry (mepRDNAttr) 💫
--static-attr STATIC_ATTR [STATIC_ATTR ...] — Sets an attribute with a defined value that must be added to the automatically-generated entry (mepStaticAttr) 🔒
--mapped-attr MAPPED_ATTR [MAPPED_ATTR ...] — Sets attributes in the Managed Entries template entry which must exist in the generated entry (mepMappedAttr) 🗺️

👀 COMMAND 'dsconf plugin managed-entries template show' 👀

peek at your template, no notes, just vibes:

usage: dsconf [-v] [-j] instance plugin managed-entries template DN show
[-h]

🗑️ COMMAND 'dsconf plugin managed-entries template delete' 🗑️

yeet the template. it's giving gone girl:

usage: dsconf [-v] [-j] instance plugin managed-entries template DN
delete
       [-h]

🔥 COMMAND 'dsconf plugin pam-pass-through-auth' 🔥

okay new plugin era — PAM pass-through auth, aka letting PAM handle the auth moment while LDAP stays the directory ✨ here's the top-level shape:

usage: dsconf instance [-v] [-j] plugin pam-pass-through-auth
       [-h] {show,enable,disable,status,list,config} ...

💜 POSITIONAL ARGUMENTS 'dsconf plugin pam-pass-through-auth' 💜

dsconf plugin pam-pass-through-auth show — Displays the plugin configuration 👀
dsconf plugin pam-pass-through-auth enable — Enables the plugin ✅
dsconf plugin pam-pass-through-auth disable — Disables the plugin 🚫
dsconf plugin pam-pass-through-auth status — Displays the plugin status 📊
dsconf plugin pam-pass-through-auth list — Lists PAM configurations 📝
dsconf plugin pam-pass-through-auth config — Manage PAM PTA configurations. 🛠️

👑 COMMAND 'dsconf plugin pam-pass-through-auth show' 👑

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth show [-h]

✅ COMMAND 'dsconf plugin pam-pass-through-auth enable' ✅

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth enable
[-h]

🚫 COMMAND 'dsconf plugin pam-pass-through-auth disable' 🚫

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth disable
[-h]

📊 COMMAND 'dsconf plugin pam-pass-through-auth status' 📊

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth status
[-h]

📝 COMMAND 'dsconf plugin pam-pass-through-auth list' 📝

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth list [-h]

🛠️ COMMAND 'dsconf plugin pam-pass-through-auth config' 🛠️

this is where the actual per-config settings live, bestie. you give it a NAME and then pick a verb:

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
       [-h] NAME {add,set,show,delete} ...

🧚 POSITIONAL ARGUMENTS 'dsconf plugin pam-pass-through-auth config' 🧚

dsconf plugin pam-pass-through-auth config add — Add the config entry ✨
dsconf plugin pam-pass-through-auth config set — Edit the config entry ✏️
dsconf plugin pam-pass-through-auth config show — Display the config entry 👀
dsconf plugin pam-pass-through-auth config delete — Delete the config entry 🗑️

💫 COMMAND 'dsconf plugin pam-pass-through-auth config add' 💫

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
NAME add
       [-h] [--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...]]
       [--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...]]
       [--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] [--filter FILTER]
       [--id-attr ID_ATTR] [--id_map_method ID_MAP_METHOD]
       [--fallback {TRUE,FALSE}] [--secure {TRUE,FALSE}] [--service
SERVICE]

🍓 OPTIONS 'dsconf plugin pam-pass-through-auth config add' 🍓

--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...] — Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix) 🚫
--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...] — Sets a suffix to include for PAM authentication (pamIncludeSuffix) ✅
--missing-suffix {ERROR,ALLOW,IGNORE,delete,} — Identifies how to handle missing include or exclude suffixes (pamMissingSuffix) 🤔
--filter FILTER — Sets an LDAP filter to use to identify specific entries within the included suffixes for which to use PAM pass-through authentication (pamFilter) 🔍
--id-attr ID_ATTR — Contains the attribute name which is used to hold the PAM user ID (pamIDAttr) 🆔
--id_map_method ID_MAP_METHOD — Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod) 🗺️
--fallback {TRUE,FALSE} — Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback) ↩️
--secure {TRUE,FALSE} — Requires secure TLS connection for PAM authentication (pamSecure) 🔐
--service SERVICE — Contains the service name to pass to PAM (pamService) 🛎️

✏️ COMMAND 'dsconf plugin pam-pass-through-auth config set' ✏️

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
NAME set
       [-h] [--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...]]
       [--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...]]
       [--missing-suffix {ERROR,ALLOW,IGNORE,delete,}] [--filter FILTER]
       [--id-attr ID_ATTR] [--id_map_method ID_MAP_METHOD]
       [--fallback {TRUE,FALSE}] [--secure {TRUE,FALSE}] [--service
SERVICE]

🌟 OPTIONS 'dsconf plugin pam-pass-through-auth config set' 🌟

--exclude-suffix EXCLUDE_SUFFIX [EXCLUDE_SUFFIX ...] — Specifies a suffix to exclude from PAM authentication (pamExcludeSuffix) 🚫
--include-suffix INCLUDE_SUFFIX [INCLUDE_SUFFIX ...] — Sets a suffix to include for PAM authentication (pamIncludeSuffix) ✅
--missing-suffix {ERROR,ALLOW,IGNORE,delete,} — Identifies how to handle missing include or exclude suffixes (pamMissingSuffix) 🤔
--filter FILTER — Sets an LDAP filter to use to identify specific entries within the included suffixes for which to use PAM pass-through authentication (pamFilter) 🔍
--id-attr ID_ATTR — Contains the attribute name which is used to hold the PAM user ID (pamIDAttr) 🆔
--id_map_method ID_MAP_METHOD — Sets the method to use to map the LDAP bind DN to a PAM identity (pamIDMapMethod) 🗺️
--fallback {TRUE,FALSE} — Sets whether to fallback to regular LDAP authentication if PAM authentication fails (pamFallback) ↩️
--secure {TRUE,FALSE} — Requires secure TLS connection for PAM authentication (pamSecure) 🔐
--service SERVICE — Contains the service name to pass to PAM (pamService) 🛎️

👀 COMMAND 'dsconf plugin pam-pass-through-auth config show' 👀

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
NAME show
       [-h]

🗑️ COMMAND 'dsconf plugin pam-pass-through-auth config delete' 🗑️

usage: dsconf [-v] [-j] instance plugin pam-pass-through-auth config
NAME delete
       [-h]

⭐ COMMAND 'dsconf plugin retro-changelog' ⭐

and now for the retro changelog plugin — the one that keeps a little historical record of changes, no cap. here's the layout:

usage: dsconf [-v] [-j] instance plugin retro-changelog [-h]
                                                            {show,enable,disable,status,set,add,del}
...

💫 POSITIONAL ARGUMENTS 'dsconf plugin retro-changelog' 💫

dsconf plugin retro-changelog show — Displays the plugin configuration 👀
dsconf plugin retro-changelog enable — Enables the plugin ✅
dsconf plugin retro-changelog disable — Disables the plugin 🚫
dsconf plugin retro-changelog status — Displays the plugin status 📊
dsconf plugin retro-changelog set — Edit the plugin ✏️
dsconf plugin retro-changelog add — Add attributes to the plugin ➕
dsconf plugin retro-changelog del — Delete an attribute from plugin scope ➖

👀 COMMAND 'dsconf plugin retro-changelog show' 👀

usage: dsconf [-v] [-j] instance plugin retro-changelog show [-h]

✅ COMMAND 'dsconf plugin retro-changelog enable' ✅

usage: dsconf [-v] [-j] instance plugin retro-changelog enable [-h]

🚫 COMMAND 'dsconf plugin retro-changelog disable' 🚫

usage: dsconf [-v] [-j] instance plugin retro-changelog disable [-h]

📊 COMMAND 'dsconf plugin retro-changelog status' 📊

usage: dsconf [-v] [-j] instance plugin retro-changelog status [-h]

✏️ COMMAND 'dsconf plugin retro-changelog set' ✏️

usage: dsconf [-v] [-j] instance plugin retro-changelog set
       [-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
       [--directory DIRECTORY] [--max-age MAX_AGE]
       [--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX
...]]
       [--exclude-attrs [EXCLUDE_ATTRS ...]]

💖 OPTIONS 'dsconf plugin retro-changelog set' 💖

--is-replicated {TRUE,FALSE} — Sets a flag to indicate on a change in the changelog whether the change is newly made on that server or whether it was replicated over from another server (isReplicated) 🔁
--attribute ATTRIBUTE — Specifies another Directory Server attribute which must be included in the retro changelog entries (nsslapd-attribute) 📌
--directory DIRECTORY — Specifies the name of the directory in which the changelog database is created the first time the plug-in is run 📁
--max-age MAX_AGE — Specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit [sSmMhHdDwW]. Used to trim the changelog (nsslapd-changelogmaxage) ⏳
--trim-interval TRIM_INTERVAL — (the original page gives this flag no description text at all, bestie — it's just sitting there being mysterious 🫥)
--exclude-suffix [EXCLUDE_SUFFIX ...] — Specifies the suffix which will be excluded from the scope of the plugin (nsslapd-exclude-suffix) 🚫
--exclude-attrs [EXCLUDE_ATTRS ...] — Specifies the attributes which will be excluded from the scope of the plugin (nsslapd-exclude-attrs) 🚫

heads up: --missing-suffix takes the literal choices {ERROR,ALLOW,IGNORE,delete,} — yes, with that trailing comma, exactly like the original wrote it. don't come for me, i'm just the messenger 💀 and --id_map_method is spelled with the underscores, --id_map_method ID_MAP_METHOD, not --id-map-method. copy it exactly, iykyk 🫶

COMMAND `dsconf plugin retro-changelog add` 💖

usage: dsconf [-v] [-j] instance plugin retro-changelog add
       [-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
       [--directory DIRECTORY] [--max-age MAX_AGE]
       [--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX ...]]
       [--exclude-attrs [EXCLUDE_ATTRS ...]]

OPTIONS `dsconf plugin retro-changelog add`

--is-replicated {TRUE,FALSE} — flips the flag that tells the changelog whether a change was freshly made right here on this server or whether it got replicated over from another one ✨ (aka isReplicated, iconic)
--attribute ATTRIBUTE — names another Directory Server attribute that absolutely must be in the retro changelog entries, no skipping (that's nsslapd-attribute bestie)
--directory DIRECTORY — the name of the directory where the changelog database gets created the very first time the plug-in runs 🎀
--max-age MAX_AGE — the max age of any entry chillin' in the changelog. Value has to be a number followed by a duration unit [sSmMhHdDwW] ⏳ and yeah it's what trims the changelog (nsslapd-changelogmaxage)
--trim-interval TRIM_INTERVAL — no description given in the original, she's mysterious 🙈 literally just sitting there with no explanation (the manpage says nothing, so I say nothing — we don't invent)
--exclude-suffix [EXCLUDE_SUFFIX ...] — the suffix (or suffixes) being excluded from the plugin's scope (nsslapd-exclude-suffix)
--exclude-attrs [EXCLUDE_ATTRS ...] — the attributes getting excluded from the plugin's scope (nsslapd-exclude-attrs)

COMMAND `dsconf plugin retro-changelog del` 🦋

usage: dsconf [-v] [-j] instance plugin retro-changelog del
       [-h] [--is-replicated {TRUE,FALSE}] [--attribute ATTRIBUTE]
       [--directory DIRECTORY] [--max-age MAX_AGE]
       [--trim-interval TRIM_INTERVAL] [--exclude-suffix [EXCLUDE_SUFFIX ...]]
       [--exclude-attrs [EXCLUDE_ATTRS ...]]

OPTIONS `dsconf plugin retro-changelog del`

--is-replicated {TRUE,FALSE} — sets the flag saying whether a change in the changelog is brand-new on this server or got replicated in from somewhere else (isReplicated) 💫
--attribute ATTRIBUTE — specifies another Directory Server attribute that has to be included in the retro changelog entries (nsslapd-attribute)
--directory DIRECTORY — the name of the directory where the changelog database is created the first time the plug-in runs 🍓
--max-age MAX_AGE — max age of any changelog entry; it's a number plus a duration unit [sSmMhHdDwW], and it's the thing that trims the changelog (nsslapd-changelogmaxage)
--trim-interval TRIM_INTERVAL — again, no description in the source, we simply do not know, and we do not make things up 🙈
--exclude-suffix [EXCLUDE_SUFFIX ...] — the suffix excluded from the plugin's scope (nsslapd-exclude-suffix)
--exclude-attrs [EXCLUDE_ATTRS ...] — the attributes excluded from the plugin's scope (nsslapd-exclude-attrs)

🌈 COMMAND `dsconf plugin posix-winsync` 🌈

usage: dsconf [-v] [-j] instance plugin posix-winsync [-h]
                                                      {show,enable,disable,status,set,fixup}
       ...

POSITIONAL ARGUMENTS `dsconf plugin posix-winsync`

dsconf plugin posix-winsync show — shows you the plugin configuration, the whole vibe check 💅
dsconf plugin posix-winsync enable — turns the plugin ON, we love to see it ✨
dsconf plugin posix-winsync disable — turns it OFF, rip 🫶
dsconf plugin posix-winsync status — tells you the plugin status, like are we up or are we not
dsconf plugin posix-winsync set — edits the plugin settings, the makeover command 💖
dsconf plugin posix-winsync fixup — runs the memberOf fix-up task to correct mismatched member and uniquemember values for synced users — it's giving cleanup era 🧹

COMMAND `dsconf plugin posix-winsync show`

usage: dsconf [-v] [-j] instance plugin posix-winsync show [-h]

COMMAND `dsconf plugin posix-winsync enable`

usage: dsconf [-v] [-j] instance plugin posix-winsync enable [-h]

COMMAND `dsconf plugin posix-winsync disable`

usage: dsconf [-v] [-j] instance plugin posix-winsync disable [-h]

COMMAND `dsconf plugin posix-winsync status`

usage: dsconf [-v] [-j] instance plugin posix-winsync status [-h]

COMMAND `dsconf plugin posix-winsync set` 🎀

usage: dsconf [-v] [-j] instance plugin posix-winsync set [-h]
                                                          [--create-memberof-task {true,false}]
                                                          [--lower-case-uid {true,false}]
                                                          [--map-member-uid {true,false}]
                                                          [--map-nested-grouping {true,false}]
                                                          [--ms-sfu-schema {true,false}]

OPTIONS `dsconf plugin posix-winsync set`

--create-memberof-task {true,false} — decides whether to run the memberUID fix-up task, like, immediately after a sync run, so that group memberships for synced users get updated (posixWinsyncCreateMemberOfTask) 🔥
--lower-case-uid {true,false} — whether to store (and, if needed, convert) the UID value in the memberUID attribute in lower case, periodt (posixWinsyncLowerCaseUID) 💅
--map-member-uid {true,false} — whether to map the memberUID attribute in an Active Directory group over to the uniqueMember attribute in a Directory Server group (posixWinsyncMapMemberUID) 🔁
--map-nested-grouping {true,false} — manages whether nested groups get updated when memberUID attributes in an Active Directory POSIX group change, the whole ripple effect (posixWinsyncMapNestedGrouping) 🪆
--ms-sfu-schema {true,false} — sets whether to use the older Microsoft System Services for Unix 3.0 (msSFU30) schema when syncing Posix attributes from Active Directory (posixWinsyncMsSFUSchema) — vintage Microsoft, ngl 🫠

COMMAND `dsconf plugin posix-winsync fixup` 🧚

usage: dsconf [-v] [-j] instance plugin posix-winsync fixup
       [-h] [-f FILTER] [--timeout TIMEOUT] DN

DN — set the base DN that contains entries to fix up, that's the target zone bestie 🎯

OPTIONS `dsconf plugin posix-winsync fixup`

-f FILTER, --filter FILTER — the filter for which entries to fix up. If you just… don't give one, then all entries with objectclass inetuser/inetadmin/nsmemberof under the specified base get their memberOf attribute regenerated. No filter, no problem 💫
--timeout TIMEOUT — set a timeout for waiting on the fixup task. Default is 120 seconds ⏱️

🌸 COMMAND `dsconf plugin contentsync` 🌸

usage: dsconf [-v] [-j] instance plugin contentsync [-h]
                                                      {show,enable,disable,status,set,add}
       ...

POSITIONAL ARGUMENTS `dsconf plugin contentsync`

dsconf plugin contentsync show — displays the plugin configuration ✨
dsconf plugin contentsync enable — enables the plugin 👑
dsconf plugin contentsync disable — disables the plugin 😭
dsconf plugin contentsync status — displays the plugin status 🦋
dsconf plugin contentsync set — edit the plugin settings 💅
dsconf plugin contentsync add — add attributes to the plugin, like adding sprinkles 🍓

COMMAND `dsconf plugin contentsync show`

usage: dsconf [-v] [-j] instance plugin contentsync show [-h]

COMMAND `dsconf plugin contentsync enable`

usage: dsconf [-v] [-j] instance plugin contentsync enable [-h]

COMMAND `dsconf plugin contentsync disable`

usage: dsconf [-v] [-j] instance plugin contentsync disable [-h]

COMMAND `dsconf plugin contentsync status`

usage: dsconf [-v] [-j] instance plugin contentsync status [-h]

COMMAND `dsconf plugin contentsync set` 💖

usage: dsconf [-v] [-j] instance plugin contentsync set [-h]
                                                         [--allow-openldap {on,off}]
                                                         [--queue-max-size QUEUE_MAX_SIZE]
                                                         [--max-concurrent MAX_CONCURRENT]

OPTIONS `dsconf plugin contentsync set`

--allow-openldap {on,off} — lets openldap servers act as read-only consumers of this server via syncrepl, sharing is caring 🫶
--queue-max-size QUEUE_MAX_SIZE — limits how many entries are still sitting there not-yet-processed (range [100, 100000]) 📦
--max-concurrent MAX_CONCURRENT — limits how many persistent searches can be running at the same time, we're capping the chaos 🔥

COMMAND `dsconf plugin contentsync add` 🎀

usage: dsconf [-v] [-j] instance plugin contentsync add [-h]
                                                         [--allow-openldap {on,off}]
                                                         [--queue-max-size QUEUE_MAX_SIZE]
                                                         [--max-concurrent MAX_CONCURRENT]

OPTIONS `dsconf plugin contentsync add`

--allow-openldap {on,off} — allows openldap servers to act as read-only consumers of this server via syncrepl ✨
--queue-max-size QUEUE_MAX_SIZE — limits the number of entries not yet processed (range [100, 100000]) 🌈
--max-concurrent MAX_CONCURRENT — limits the number of persistent searches running at the same time ⭐

💜 COMMAND `dsconf plugin entryuuid` 💜

usage: dsconf [-v] [-j] instance plugin entryuuid [-h]
                                                      {show,enable,disable,status,fixup,fixup-status}
       ...

POSITIONAL ARGUMENTS `dsconf plugin entryuuid`

dsconf plugin entryuuid show — displays the plugin configuration 💅
dsconf plugin entryuuid enable — enables the plugin ✨
dsconf plugin entryuuid disable — disables the plugin 🙈
dsconf plugin entryuuid status — displays the plugin status
dsconf plugin entryuuid fixup — run the fix-up task for the EntryUUID plugin 🛠️
dsconf plugin entryuuid fixup-status — check the status of a fix-up task, like stalking your own progress 👀

COMMAND `dsconf plugin entryuuid show`

usage: dsconf [-v] [-j] instance plugin entryuuid show [-h]

COMMAND `dsconf plugin entryuuid enable`

usage: dsconf [-v] [-j] instance plugin entryuuid enable [-h]

COMMAND `dsconf plugin entryuuid disable`

usage: dsconf [-v] [-j] instance plugin entryuuid disable [-h]

COMMAND `dsconf plugin entryuuid status`

usage: dsconf [-v] [-j] instance plugin entryuuid status [-h]

COMMAND `dsconf plugin entryuuid fixup` 🔥

usage: dsconf [-v] [-j] instance plugin entryuuid fixup [-h] [-f FILTER]
                                                         [--wait]
                                                         [--timeout TIMEOUT]
                                                         DN

DN — base DN that contains entries to fix up, the home base of the whole operation 🎯

✨ OPTIONS 'dsconf plugin entryuuid fixup' ✨

-f FILTER, --filter FILTER — this is your filter for which entries get the ✨glow up✨. Skip it and every single entry under the base DN gets its EntryUUID attribute regenerated if it isn't already there. no filter = the whole roster, bestie 💖
--wait — wait for the task to actually finish before you go anywhere. fair warning: this could take a long time 😭 like, go make a snack, text your group chat, come back kind of long.
--timeout TIMEOUT — sets the task timeout. Default is 0, and 0 means no timeout. iconic, honestly 🫶

🦋 COMMAND 'dsconf plugin entryuuid fixup-status' 🦋

usage: dsconf [-v] [-j] instance plugin entryuuid fixup-status
       [-h] [--dn DN] [--show-log] [--watch]

OPTIONS 'dsconf plugin entryuuid fixup-status'

--dn DN — the DN of the task entry. that's the one you're asking about 💅
--show-log — display the task log 📜 spill it.
--watch — watch the task's status and just… wait for it to finish. main character energy, sitting there watching the progress bar 🍓

🌸 COMMAND 'dsconf plugin pwstorage-scheme' 🌸

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme [-h]
                                                                {pbkdf2,pbkdf2-sha1,pbkdf2-sha256,pbkdf2-sha256-legacy,pbkdf2-sha512}
       ...

so basically: this is your password storage scheme corner of the shop, and you've got five flavors to pick from. pick wisely 💜

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme'

dsconf plugin pwstorage-scheme pbkdf2 — manage the legacy PBKDF2 scheme ({PBKDF2}). heads up: its settings are independent of pbkdf2-sha1, even though both of them use SHA-1. don't mix them up fr fr.
dsconf plugin pwstorage-scheme pbkdf2-sha1 — manage the PBKDF2-SHA1 scheme ({PBKDF2-SHA1}). same deal but from the other direction: its settings are independent of the legacy pbkdf2, even though both use SHA-1. yes it's confusing, no it's not my fault 😭
dsconf plugin pwstorage-scheme pbkdf2-sha256 — manage the PBKDF2-SHA256 scheme. the classic, the reliable, the queen 👑
dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy — manage the PBKDF2-SHA256-LEGACY scheme. vintage, but in a museum way 🎀
dsconf plugin pwstorage-scheme pbkdf2-sha512 — manage the PBKDF2-SHA512 scheme. bigger hash, bigger vibes 🌈

🎀 COMMAND 'dsconf plugin pwstorage-scheme pbkdf2' 🎀

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
       [-h]
       {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations}
       ...

steady, bestie, this is the legacy PBKDF2 one specifically 💅

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme pbkdf2'

dsconf plugin pwstorage-scheme pbkdf2 get-num-iterations — get the number of iterations 🔢
dsconf plugin pwstorage-scheme pbkdf2 set-num-iterations — set the number of iterations ✨
dsconf plugin pwstorage-scheme pbkdf2 get-accept-max-iterations — get the maximum iterations accepted from stored hashes on bind 🔍
dsconf plugin pwstorage-scheme pbkdf2 set-accept-max-iterations — set the maximum iterations accepted from stored hashes on bind 🛠️
dsconf plugin pwstorage-scheme pbkdf2 delete-accept-max-iterations — remove the accept max iterations override and revert back to the default 🧹

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2 get-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
get-num-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2 set-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
set-num-iterations
       [-h] iterations

iterations — number of iterations, and the range is (10,000-10,000,000). keep it in the lines, babes 🫶

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2 get-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
get-accept-max-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2 set-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
set-accept-max-iterations
       [-h] iterations

iterations — maximum iterations accepted on bind, range (10,000-10,000,000) 💖

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2 delete-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2
delete-accept-max-iterations
       [-h]

🦋 COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1' 🦋

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
       [-h]
       {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations}
       ...

okay so this one is the non-legacy SHA-1 one. remember: independent settings from legacy pbkdf2. told you. 💜

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme pbkdf2-sha1'

dsconf plugin pwstorage-scheme pbkdf2-sha1 get-num-iterations — get number of iterations 🔢
dsconf plugin pwstorage-scheme pbkdf2-sha1 set-num-iterations — set number of iterations ✨
dsconf plugin pwstorage-scheme pbkdf2-sha1 get-accept-max-iterations — get the maximum iterations accepted from stored hashes on bind 🔍
dsconf plugin pwstorage-scheme pbkdf2-sha1 set-accept-max-iterations — set the maximum iterations accepted from stored hashes on bind 🛠️
dsconf plugin pwstorage-scheme pbkdf2-sha1 delete-accept-max-iterations — remove the accept max iterations override, revert to default 🧹

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1 get-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
get-num-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1 set-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
set-num-iterations
       [-h] iterations

iterations — number of iterations (10,000-10,000,000) 🍓

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1 get-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
get-accept-max-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1 set-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
set-accept-max-iterations
       [-h] iterations

iterations — maximum iterations accepted on bind (10,000-10,000,000) 🌸

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha1 delete-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha1
delete-accept-max-iterations
       [-h]

💜 COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256' 💜

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
       [-h]
       {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations}
       ...

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme pbkdf2-sha256'

dsconf plugin pwstorage-scheme pbkdf2-sha256 get-num-iterations — get number of iterations 🔢
dsconf plugin pwstorage-scheme pbkdf2-sha256 set-num-iterations — set number of iterations ✨
dsconf plugin pwstorage-scheme pbkdf2-sha256 get-accept-max-iterations — get the maximum iterations accepted from stored hashes on bind 🔍
dsconf plugin pwstorage-scheme pbkdf2-sha256 set-accept-max-iterations — set the maximum iterations accepted from stored hashes on bind 🛠️
dsconf plugin pwstorage-scheme pbkdf2-sha256 delete-accept-max-iterations — remove the accept max iterations override, revert to default 🧹

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256 get-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
get-num-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256 set-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
set-num-iterations
       [-h] iterations

iterations — number of iterations (10,000-10,000,000) 💅

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256 get-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
get-accept-max-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256 set-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
set-accept-max-iterations
       [-h] iterations

iterations — maximum iterations accepted on bind (10,000-10,000,000) 🌈

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256 delete-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha256
delete-accept-max-iterations
       [-h]

🧚 COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy' 🧚

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme
pbkdf2-sha256-legacy
       [-h] {get-accept-max-iterations,set-accept-max-iterations} ...

not me noticing this one only has two sub-commands instead of five… the legacy scheme keeps it simple, periodt 💅

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy'

dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy get-accept-max-iterations — get maximum accepted iterations 🔍
dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy set-accept-max-iterations — set maximum accepted iterations 🛠️

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy get-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme
pbkdf2-sha256-legacy get-accept-max-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha256-legacy set-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme
pbkdf2-sha256-legacy set-accept-max-iterations
       [-h] iterations

iterations — maximum accepted iterations, and look at this range bestie: (2,048-2,147,483,647). that's a big range. no cap 😭

⭐ COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512' ⭐

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
       [-h]
       {get-num-iterations,set-num-iterations,get-accept-max-iterations,set-accept-max-iterations,delete-accept-max-iterations}
       ...

last scheme, and she's the big one 🫶

POSITIONAL ARGUMENTS 'dsconf plugin pwstorage-scheme pbkdf2-sha512'

dsconf plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations — get number of iterations 🔢
dsconf plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations — set number of iterations ✨
dsconf plugin pwstorage-scheme pbkdf2-sha512 get-accept-max-iterations — get the maximum iterations accepted from stored hashes on bind 🔍
dsconf plugin pwstorage-scheme pbkdf2-sha512 set-accept-max-iterations — set the maximum iterations accepted from stored hashes on bind 🛠️
dsconf plugin pwstorage-scheme pbkdf2-sha512 delete-accept-max-iterations — remove the accept max iterations override, revert to default 🧹

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
get-num-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
set-num-iterations
       [-h] iterations

iterations — number of iterations (10,000-10,000,000) 💖

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512 get-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
get-accept-max-iterations
       [-h]

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512 set-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
set-accept-max-iterations
       [-h] iterations

iterations — maximum iterations accepted on bind (10,000-10,000,000) 🌸

COMMAND 'dsconf plugin pwstorage-scheme pbkdf2-sha512 delete-accept-max-iterations'

usage: dsconf [-v] [-j] instance plugin pwstorage-scheme pbkdf2-sha512
delete-accept-max-iterations
       [-h]

👑 COMMAND 'dsconf plugin list' 👑

usage: dsconf [-v] [-j] instance plugin list [-h]

and there she is — the "just show me everything" command 🌈 no options, no drama, just the list of plugins. we love a low-maintenance icon 👑

COMMAND 'dsconf plugin show' 🔍💖

Okay bestie, this one is lowkey a “where my plugin at?” vibe check. It searches for a plugin, periodt.

usage: dsconf [-v] [-j] instance plugin show [-h] [selector]

selector — the plugin you're searching for, no cap 🦋

COMMAND 'dsconf plugin set' ✨💅

This command edits a plugin, so it's giving main character energy. Peep the usage:

usage: dsconf [-v] [-j] instance plugin set [-h] [--type TYPE]
                                            [--enabled {on,off}] [--path
       PATH]
                                            [--initfunc INITFUNC] [--id
       ID]
                                            [--vendor VENDOR]
                                            [--version VERSION]
                                            [--description DESCRIPTION]
                                            [--depends-on-type
       DEPENDS_ON_TYPE]
                                            [--depends-on-named
       DEPENDS_ON_NAMED]
                                            [--precedence PRECEDENCE]
                                            [selector]

selector — the plugin you're editing, bestie 🎀

OPTIONS 'dsconf plugin set' 💅

--type TYPE — the type of plugin.
--enabled {on,off} — identifies whether or not the plugin is enabled.
--path PATH — the plugin library name, without the library suffix.
--initfunc INITFUNC — an initialization function of the plugin.
--id ID — the plugin ID.
--vendor VENDOR — the vendor of the plugin.
--version VERSION — the version of the plugin.
--description DESCRIPTION — the description of the plugin.
--depends-on-type DEPENDS_ON_TYPE — all plug-ins with a type value that matches one of the values in the following valid range will be started by the server prior to this plug-in.
--depends-on-named DEPENDS_ON_NAMED — the plug-in name matching one of the following values will be started by the server prior to this plug-in.
--precedence PRECEDENCE — the priority it has in the execution order of plug-ins.

COMMAND 'dsconf pwpolicy' 🎀🌈

Password policy central, bestie. The vibe is very “get, set, list, fix up,” iykyk.

usage: dsconf [-v] [-j] instance pwpolicy [-h]
       {get,set,list-schemes,fixup-shadow} ...

POSITIONAL ARGUMENTS 'dsconf pwpolicy' 🫶

dsconf pwpolicy get — get the global password policy entry.
dsconf pwpolicy set — set an attribute in a global password policy.
dsconf pwpolicy list-schemes — get a list of the current password storage schemes.
dsconf pwpolicy fixup-shadow — create a task to set shadowLastChange on ShadowAccount entries.

COMMAND 'dsconf pwpolicy get' 💖

Simple, iconic, no notes. It just gets the global password policy entry.

usage: dsconf [-v] [-j] instance pwpolicy get [-h]

COMMAND 'dsconf pwpolicy set' ✨👑

This usage is a whole mood — every flag is here, so don't skip a single one:

usage: dsconf instance [-v] [-j] pwpolicy set [-h] [--pwdscheme
       PWDSCHEME]
                                                     [--pwdchange PWDCHANGE]
                                                     [--pwdmustchange
       PWDMUSTCHANGE]
                                                     [--pwdhistory PWDHISTORY]
                                                     [--pwdhistorycount
       PWDHISTORYCOUNT]
                                                     [--pwdadmin PWDADMIN]
                                                     [--pwdadminskipupdates
       PWDADMINSKIPUPDATES]
                                                     [--pwdtrack PWDTRACK]
                                                     [--pwdwarning PWDWARNING]
                                                     [--pwdexpire PWDEXPIRE]
                                                     [--pwdmaxage PWDMAXAGE]
                                                     [--pwdminage PWDMINAGE]
                                                     [--pwdgracelimit
       PWDGRACELIMIT]
                                                     [--pwdsendexpiring
       PWDSENDEXPIRING]
                                                     [--pwdlockout PWDLOCKOUT]
                                                     [--pwdunlock PWDUNLOCK]
                                                     [--pwdlockoutduration
       PWDLOCKOUTDURATION]
                                                     [--pwdmaxfailures
       PWDMAXFAILURES]
                                                     [--pwdresetfailcount
       PWDRESETFAILCOUNT]
                                                     [--pwdchecksyntax
       PWDCHECKSYNTAX]
                                                     [--pwdminlen PWDMINLEN]
                                                     [--pwdmindigits
       PWDMINDIGITS]
                                                     [--pwdminalphas
       PWDMINALPHAS]
                                                     [--pwdminuppers
       PWDMINUPPERS]
                                                     [--pwdminlowers
       PWDMINLOWERS]
                                                     [--pwdminspecials
       PWDMINSPECIALS]
                                                     [--pwdmin8bits
       PWDMIN8BITS]
                                                     [--pwdmaxrepeats
       PWDMAXREPEATS]
                                                     [--pwdpalindrome
       PWDPALINDROME]
                                                     [--pwdmaxseq PWDMAXSEQ]
                                                     [--pwdmaxseqsets
       PWDMAXSEQSETS]
                                                     [--pwdmaxclasschars
       PWDMAXCLASSCHARS]
                                                     [--pwdmincatagories
       PWDMINCATAGORIES]
                                                     [--pwdmintokenlen
       PWDMINTOKENLEN]
                                                     [--pwdbadwords
       PWDBADWORDS]
                                                     [--pwduserattrs
       PWDUSERATTRS]
                                                     [--pwddictcheck
       PWDDICTCHECK]
                                                     [--pwddictpath
       PWDDICTPATH]
                                                     [--pwptprmaxuse
       PWPTPRMAXUSE]
                                                     [--pwptprdelayexpireat
       PWPTPRDELAYEXPIREAT]
                                                     [--pwptprdelayvalidfrom
       PWPTPRDELAYVALIDFROM]
                                                     [--pwdlocal PWDLOCAL]
                                                     [--pwdisglobal
       PWDISGLOBAL]
                                                     [--pwdallowhash
       PWDALLOWHASH]
                                                     [--pwpinheritglobal
       PWPINHERITGLOBAL]

✨ OPTIONS for `dsconf pwpolicy set` ✨

Okay bestie, buckle up, this is the big one — every knob you can twist on a password policy, all in one place. Nothing scary, just a LOT of them. 🎀

--pwdscheme PWDSCHEME — the password storage scheme, aka how your password gets scrambled before it hits the disk. 🔐
--pwdchange PWDCHANGE — lets users change their own passwords. Yes, this is a permission. Yes, it matters.
--pwdmustchange PWDMUSTCHANGE — the classic: after an admin resets your password, you gotta change it before you do anything else. No skipping. 💅
--pwdhistory PWDHISTORY — turn password history on, or off. That's the whole vibe.
--pwdhistorycount PWDHISTORYCOUNT — how many old passwords get kept in the history stash. 🗂️
--pwdadmin PWDADMIN — the DN of an entry (or a whole group of accounts) that gets to bypass password policy constraints. Big power, handle with care. 👑
--pwdadminskipupdates PWDADMINSKIPUPDATES — set this to on if the Password Admin's own password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc). So their reset stays quiet.
--pwdtrack PWDTRACK — set to on to actually track the time the password was last changed. ⏰
--pwdwarning PWDWARNING — sends an expiring warning if the password expires within this window (the value is in seconds).
--pwdexpire PWDEXPIRE — set to on to enable password expiration at all.
--pwdmaxage PWDMAXAGE — the password expiration time, in seconds. ⏳
--pwdminage PWDMINAGE — how many seconds must pass before a user is even allowed to change their password again. Anti-chaos measure fr.
--pwdgracelimit PWDGRACELIMIT — how many logins you still get after your password has already expired. Grace period, iconic behavior.
--pwdsendexpiring PWDSENDEXPIRING — set to on to always send the expiring control, no matter what the warning period says.
--pwdlockout PWDLOCKOUT — set to on to enable account lockout. 🔒
--pwdunlock PWDUNLOCK — set to on and an account can become unlocked again after the lockout duration runs out. Self-healing era.
--pwdlockoutduration PWDLOCKOUTDURATION — the number of seconds an account stays locked out. Sit in time-out bestie. 😭
--pwdmaxfailures PWDMAXFAILURES — the max number of failed password attempts allowed before the account gets locked.
--pwdresetfailcount PWDRESETFAILCOUNT — how many seconds to wait before reducing the failed login count on an account.
--pwdchecksyntax PWDCHECKSYNTAX — set to on to enable password syntax checking. This is the quality control era. ✨
--pwdminlen PWDMINLEN — minimum number of characters required in a password.
--pwdmindigits PWDMINDIGITS — minimum number of digit/number characters in a password.
--pwdminalphas PWDMINALPHAS — minimum number of alpha characters required in a password.
--pwdminuppers PWDMINUPPERS — minimum number of uppercase characters required in a password.
--pwdminlowers PWDMINLOWERS — minimum number of lowercase characters required in a password.
--pwdminspecials PWDMINSPECIALS — minimum number of special characters required in a password. !@#$%^&* stans rise up. 🎉
--pwdmin8bits PWDMIN8BITS — minimum number of 8-bit characters required in a password.
--pwdmaxrepeats PWDMAXREPEATS — the max number of times the same character can appear sequentially in the password. aaa? Not on her watch.
--pwdpalindrome PWDPALINDROME — set to on to reject passwords that are palindromes. Sorry to racecar. 🏎️
--pwdmaxseq PWDMAXSEQ — the max number of allowed monotonic character sequences in a password (abc, 123, that whole situation).
--pwdmaxseqsets PWDMAXSEQSETS — the max number of allowed monotonic character sequences that can be duplicated in a password.
--pwdmaxclasschars PWDMAXCLASSCHARS — the max number of sequential characters from the same character class allowed in a password.
--pwdmincatagories PWDMINCATAGORIES — the minimum number of syntax category checks. (Yes, the spelling is catagories, we keep it exactly as-is, no cap. 🙈)
--pwdmintokenlen PWDMINTOKENLEN — sets the smallest attribute value length used for trivial/user-words checking. This also impacts --pwduserattrs.
--pwdbadwords PWDBADWORDS — a space-separated list of words that can not be in a password. 💀
--pwduserattrs PWDUSERATTRS — a space-separated list of attributes whose values can not appear in the password (peep --pwdmintokenlen).
--pwddictcheck PWDDICTCHECK — set to on to enforce CrackLib dictionary checking.
--pwddictpath PWDDICTPATH — filesystem path to specific/custom CrackLib dictionary files.
--pwptprmaxuse PWPTPRMAXUSE — number of times a reset password can be used for authentication.
--pwptprdelayexpireat PWPTPRDELAYEXPIREAT — number of seconds after which a reset password expires.
--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM — number of seconds to wait before using a reset password to authenticate.
--pwdlocal PWDLOCAL — set to on to enable fine-grained (subtree/user-level) password policies.
--pwdisglobal PWDISGLOBAL — set to on to enable password policy state attributes to be replicated.
--pwdallowhash PWDALLOWHASH — set to on to allow adding prehashed passwords.
--pwpinheritglobal PWPINHERITGLOBAL — set to on to let local policies inherit the global policy. Generational wealth but for password rules. 🫶

🌈 COMMAND `dsconf pwpolicy list-schemes` 🌈

Just wants to show you all the schemes available. Low effort, high reward.

usage: dsconf [-v] [-j] instance pwpolicy list-schemes [-h]

🔥 COMMAND `dsconf pwpolicy fixup-shadow` 🔥

The "hey, go back and sync up all those shadow accounts" command.

usage: dsconf [-v] [-j] instance pwpolicy fixup-shadow [-h] [--force]
                                                              [--watch]
                                                              suffix

suffix — the LDAP suffix to search (subtree) for objectClass ShadowAccount.

🧚 OPTIONS for `dsconf pwpolicy fixup-shadow` 🧚

--force — updates all users under the suffix regardless of whether shadowLastChange is set. No skipping anyone. 💅
--watch — watches the task's status and waits for it to finish. Patience era. ⏳

💖 COMMAND `dsconf localpwp` 💖

Local password policies!! The fine-grained era. Here's the shape of it:

usage: dsconf [-v] [-j] instance localpwp [-h]
                                       {list,get,set,remove,adduser,addsubtree}
       ...

🎀 POSITIONAL ARGUMENTS for `dsconf localpwp` 🎀

dsconf localpwp list — list all the local password policies. Shopping-cart energy. 🛒
dsconf localpwp get — get one local password policy entry.
dsconf localpwp set — set an attribute in a local password policy.
dsconf localpwp remove — remove a local password policy. Bye bestie. 👋
dsconf localpwp adduser — add a new user password policy.
dsconf localpwp addsubtree — add a new subtree password policy.

🦋 COMMAND `dsconf localpwp list` 🦋

usage: dsconf [-v] [-j] instance localpwp list [-h] [DN]

DN — the suffix to search for local password policies.

🌸 COMMAND `dsconf localpwp get` 🌸

usage: dsconf [-v] [-j] instance localpwp get [-h] DN

DN — get the local policy for this entry DN.

💜 COMMAND `dsconf localpwp set` 💜

Okay so this one takes the ENTIRE option list from dsconf pwpolicy set and points it at a specific DN. Same flags, local scope. Here's the usage in all its glory:

usage: dsconf [-v] [-j] instance localpwp set [-h] [--pwdscheme
PWDSCHEME]
                                                     [--pwdchange PWDCHANGE]
                                                     [--pwdmustchange
PWDMUSTCHANGE]
                                                     [--pwdhistory PWDHISTORY]
                                                     [--pwdhistorycount
PWDHISTORYCOUNT]
                                                     [--pwdadmin PWDADMIN]
                                                     [--pwdadminskipupdates
PWDADMINSKIPUPDATES]
                                                     [--pwdtrack PWDTRACK]
                                                     [--pwdwarning PWDWARNING]
                                                     [--pwdexpire PWDEXPIRE]
                                                     [--pwdmaxage PWDMAXAGE]
                                                     [--pwdminage PWDMINAGE]
                                                     [--pwdgracelimit
PWDGRACELIMIT]
                                                     [--pwdsendexpiring
PWDSENDEXPIRING]
                                                     [--pwdlockout PWDLOCKOUT]
                                                     [--pwdunlock PWDUNLOCK]
                                                     [--pwdlockoutduration
PWDLOCKOUTDURATION]
                                                     [--pwdmaxfailures
PWDMAXFAILURES]
                                                     [--pwdresetfailcount
PWDRESETFAILCOUNT]
                                                     [--pwdchecksyntax
PWDCHECKSYNTAX]
                                                     [--pwdminlen PWDMINLEN]
                                                     [--pwdmindigits
PWDMINDIGITS]
                                                     [--pwdminalphas
PWDMINALPHAS]
                                                     [--pwdminuppers
PWDMINUPPERS]
                                                     [--pwdminlowers
PWDMINLOWERS]
                                                     [--pwdminspecials
PWDMINSPECIALS]
                                                     [--pwdmin8bits
PWDMIN8BITS]
                                                     [--pwdmaxrepeats
PWDMAXREPEATS]
                                                     [--pwdpalindrome
PWDPALINDROME]
                                                     [--pwdmaxseq PWDMAXSEQ]
                                                     [--pwdmaxseqsets
PWDMAXSEQSETS]
                                                     [--pwdmaxclasschars
PWDMAXCLASSCHARS]
                                                     [--pwdmincatagories
PWDMINCATAGORIES]
                                                     [--pwdmintokenlen
PWDMINTOKENLEN]
                                                     [--pwdbadwords
PWDBADWORDS]
                                                     [--pwduserattrs
PWDUSERATTRS]
                                                     [--pwddictcheck
PWDDICTCHECK]
                                                     [--pwddictpath
PWDDICTPATH]
                                                     [--pwptprmaxuse
PWPTPRMAXUSE]
                                                     [--pwptprdelayexpireat
PWPTPRDELAYEXPIREAT]
                                                     [--pwptprdelayvalidfrom
PWPTPRDELAYVALIDFROM]
                                                     DN

DN — set the local policy for this entry DN.

Yeah, it's a wall of text. That's just what happens when your password policy has ✨range✨. Every single flag above means exactly what it means in dsconf pwpolicy set, only applied right here at this DN instead of globally. 💅

OPTIONS for `dsconf localpwp set` 💅

okay bestie, this is the big one — literally every knob for the local password policy. same flags as the main pwpolicy fam, but scoped to one lil entry. let's go 🫶

--pwdscheme PWDSCHEME — the password storage scheme, aka how the password actually gets scrambled before it's stored 🔐
--pwdchange PWDCHANGE — lets users change their own passwords, yes ma'am 💅
--pwdmustchange PWDMUSTCHANGE — forces users to change their password after an admin resets it. no sneaky reuse of the temp one 💀
--pwdhistory PWDHISTORY — to turn password history on, set this to "on", otherwise "off". that's it, that's the whole vibe ✨
--pwdhistorycount PWDHISTORYCOUNT — how many old passwords get kept in the history. the more the merrier (and the safer) 🎀
--pwdadmin PWDADMIN — the DN of an entry or a group of accounts that can bypass password policy constraints. main character exemption energy 👑
--pwdadminskipupdates PWDADMINSKIPUPDATES — set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc.). lowkey a big deal, don't skip past this one 🙈
--pwdtrack PWDTRACK — set to "on" to track the time the password was last changed ⏰
--pwdwarning PWDWARNING — send an expiring warning if the password expires within this time (in seconds). a lil heads up before disaster 🚨
--pwdexpire PWDeXPIRE — wait no, it's --pwdexpire PWDeXPIRE — set to "on" to enable password expiration. yes, passwords die eventually, it's giving mortality 😭
--pwdmaxage PWDMAXAGE — the password expiration time, in seconds ⏳
--pwdminage PWDMINAGE — how many seconds must pass before a user can change their password again. no rapid-fire swapping, bestie 🚫
--pwdgracelimit PWDGRACELIMIT — the number of allowed logins after the password has already expired. a lil grace period, we love a forgiving queen 🌸
--pwdsendexpiring PWDSENDEXPIRING — set to "on" to always send the expiring control regardless of the warning period 📬
--pwdlockout PWDLOCKOUT — set to "on" to enable account lockout 🔒
--pwdunlock PWDUNLOCK — set to "on" to allow an account to become unlocked after the lockout duration. the comeback arc ✨
--pwdlockoutduration PWDLOCKOUTDURATION — the number of seconds an account stays locked out ⏱️
--pwdmaxfailures PWDMAXFAILURES — the max number of allowed failed password attempts before the account gets locked. try again... and again... and boom, locked 💀
--pwdresetfailcount PWDRESETFAILCOUNT — the number of seconds to wait before reducing the failed login count on an account 🧮
--pwdchecksyntax PWDCHECKSYNTAX — set to "on" to enable password syntax checking. the grammar police but for your password 🕵️
--pwdminlen PWDMINLEN — the minimum number of characters required in a password 📏
--pwdmindigits PWDMINDIGITS — the minimum number of digit/number characters in a password. 1234 girlies, your time is now 🔢
--pwdminalphas PWDMINALPHAS — the minimum number of alpha characters required in a password 🔤
--pwdminuppers PWDMINUPPERS — the minimum number of uppercase characters required in a password. SCREAM IT 📣
--pwdminlowers PWDMINLOWERS — the minimum number of lowercase characters required in a password. soft launch, quiet luxury 🌙
--pwdminspecials PWDMINSPECIALS — the minimum number of special characters required in a password. !@#$% icons only 💅
--pwdmin8bits PWDMIN8BITS — the minimum number of 8-bit characters required in a password 🌐
--pwdmaxrepeats PWDMAXREPEATS — the maximum number of times the same character can appear sequentially in the password. aaaaa bestie, no 🔁
--pwdpalindrome PWDPALINDROME — set to "on" to reject passwords that are palindromes. sorry racecar, you're out 🏎️
--pwdmaxseq PWDMAXSEQ — the maximum number of allowed monotonic character sequences in a password (you know, like abcd or 4321) 📉
--pwdmaxseqsets PWDMAXSEQSETS — the maximum number of allowed monotonic character sequences that can be duplicated in a password 🔂
--pwdmaxclasschars PWDMAXCLASSCHARS — the maximum number of sequential characters from the same character class that is allowed in a password 🧩
--pwdmincatagories PWDMINCATAGORIES — the minimum number of syntax category checks ✅
--pwdmintokenlen PWDMINTOKENLEN — sets the smallest attribute value length used for trivial/user word checking. this also impacts "--pwduserattrs" ⚠️
--pwdbadwords PWDBADWORDS — a space-separated list of words that can not be in a password. the banned list, no cap 🚫
--pwduserattrs PWDUSERATTRS — a space-separated list of attributes whose values can not appear in the password (see "--pwdmintokenlen") 🧬
--pwddictcheck PWDDICTCHECK — set to "on" to enforce CrackLib dictionary checking 📖
--pwddictpath PWDDICTPATH — filesystem path to specific/custom CrackLib dictionary files 📂
--pwptprmaxuse PWPTPRMAXUSE — the number of times a reset password can be used for authentication 🔄
--pwptprdelayexpireat PWPTPRDELAYEXPIREAT — number of seconds after which a reset password expires 🕐
--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM — number of seconds to wait before using a reset password to authenticate. patience, bestie 🧘

COMMAND `dsconf localpwp remove` 🗑️

usage:

dsconf [-v] [-j] instance localpwp remove [-h] DN

DN — remove the local policy for this entry DN. bye bye, policy 🫶

COMMAND `dsconf localpwp adduser` 👤

usage:

dsconf [-v] [-j] instance localpwp adduser [-h] [--pwdscheme PWDSCHEME]
                                                  [--pwdchange PWDCHANGE]
                                                  [--pwdmustchange PWDMUSTCHANGE]
                                                  [--pwdhistory PWDHISTORY]
                                                  [--pwdhistorycount PWDHISTORYCOUNT]
                                                  [--pwdadmin PWDADMIN]
                                                  [--pwdadminskipupdates PWDADMINSKIPUPDATES]
                                                  [--pwdtrack PWDTRACK]
                                                  [--pwdwarning PWDWARNING]
                                                  [--pwdexpire PWDEXPIRE]
                                                  [--pwdmaxage PWDMAXAGE]
                                                  [--pwdminage PWDMINAGE]
                                                  [--pwdgracelimit PWDGRACELIMIT]
                                                  [--pwdsendexpiring PWDSENDEXPIRING]
                                                  [--pwdlockout PWDLOCKOUT]
                                                  [--pwdunlock PWDUNLOCK]
                                                  [--pwdlockoutduration PWDLOCKOUTDURATION]
                                                  [--pwdmaxfailures PWDMAXFAILURES]
                                                  [--pwdresetfailcount PWDRESETFAILCOUNT]
                                                  [--pwdchecksyntax PWDCHECKSYNTAX]
                                                  [--pwdminlen PWDMINLEN]
                                                  [--pwdmindigits PWDMINDIGITS]
                                                  [--pwdminalphas PWDMINALPHAS]
                                                  [--pwdminuppers PWDMINUPPERS]
                                                  [--pwdminlowers PWDMINLOWERS]
                                                  [--pwdminspecials PWDMINSPECIALS]
                                                  [--pwdmin8bits PWDMIN8BITS]
                                                  [--pwdmaxrepeats PWDMAXREPEATS]
                                                  [--pwdpalindrome PWDPALINDROME]
                                                  [--pwdmaxseq PWDMAXSEQ]
                                                  [--pwdmaxseqsets PWDMAXSEQSETS]
                                                  [--pwdmaxclasschars PWDMAXCLASSCHARS]
                                                  [--pwdmincatagories PWDMINCATAGORIES]
                                                  [--pwdmintokenlen PWDMINTOKENLEN]
                                                  [--pwdbadwords PWDBADWORDS]
                                                  [--pwduserattrs PWDUSERATTRS]
                                                  [--pwddictcheck PWDDICTCHECK]
                                                  [--pwddictpath PWDDICTPATH]
                                                  [--pwptprmaxuse PWPTPRMAXUSE]
                                                  [--pwptprdelayexpireat PWPTPRDELAYEXPIREAT]
                                                  [--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM]
                                                  DN

DN — add/replace the local password policy for this entry DN. new policy, who dis 💖

OPTIONS `dsconf localpwp adduser` 💅

okay so this is a LOT of knobs, bestie, but every single one of them is here, no skips, no shortcuts. this is you building a whole password policy from scratch, so buckle up 🎀

--pwdscheme PWDSCHEME — the password storage scheme, aka how the password gets hashed and kept.
--pwdchange PWDCHANGE — lets users change their own passwords. cute, democratic, slay.
--pwdmustchange PWDMUSTCHANGE — users HAVE to change their password after an admin resets it. no lurking with the temp one.
--pwdhistory PWDHISTORY — turns password history on or off. set it to "on" to enable, otherwise "off".
--pwdhistorycount PWDHISTORYCOUNT — how many old passwords get kept in the history.
--pwdadmin PWDADMIN — the DN of an entry or a group of accounts that gets to bypass password policy constraints. main character privileges fr.
--pwdadminskipupdates PWDADMINSKIPUPDATES — set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc).
--pwdtrack PWDTRACK — set to "on" to track the time the password was last changed.
--pwdwarning PWDWARNING — send an expiring warning if the password expires within this time, in seconds.
--pwdexpire PWDEXPIRE — set to "on" to enable password expiration. the clock starts ticking bestie.
--pwdmaxage PWDMAXAGE — the password expiration time, in seconds.
--pwdminage PWDMINAGE — how many seconds have to pass before a user is even allowed to change their password again.
--pwdgracelimit PWDGRACELIMIT — how many logins you get after the password has already expired. the grace era 🌸
--pwdsendexpiring PWDSENDEXPIRING — set to "on" to always send the expiring control, no matter what the warning period says.
--pwdlockout PWDLOCKOUT — set to "on" to enable account lockout.
--pwdunlock PWDUNLOCK — set to "on" to allow an account to become unlocked again once the lockout duration is up.
--pwdlockoutduration PWDLOCKOUTDURATION — the number of seconds an account stays locked out.
--pwdmaxfailures PWDMAXFAILURES — the max number of failed password attempts allowed before the account gets locked 💀
--pwdresetfailcount PWDRESETFAILCOUNT — the number of seconds to wait before reducing the failed login count on an account.
--pwdchecksyntax PWDCHECKSYNTAX — set to "on" to enable password syntax checking.
--pwdminlen PWDMINLEN — the minimum number of characters required in a password.
--pwdmindigits PWDMINDIGITS — the minimum number of digit/number characters in a password.
--pwdminalphas PWDMINALPHAS — the minimum number of alpha characters required in a password.
--pwdminuppers PWDMINUPPERS — the minimum number of uppercase characters required in a password.
--pwdminlowers PWDMINLOWERS — the minimum number of lowercase characters required in a password.
--pwdminspecials PWDMINSPECIALS — the minimum number of special characters required in a password.
--pwdmin8bits PWDMIN8BITS — the minimum number of 8-bit characters required in a password.
--pwdmaxrepeats PWDMAXREPEATS — the maximum number of times the same character can appear sequentially in the password. aaaaa is not the vibe 🙈
--pwdpalindrome PWDPALINDROME — set to "on" to reject passwords that are palindromes.
--pwdmaxseq PWDMAXSEQ — the maximum number of allowed monotonic character sequences in a password.
--pwdmaxseqsets PWDMAXSEQSETS — the maximum number of allowed monotonic character sequences that can be duplicated in a password.
--pwdmaxclasschars PWDMAXCLASSCHARS — the maximum number of sequential characters from the same character class that is allowed in a password.
--pwdmincatagories PWDMINCATAGORIES — the minimum number of syntax category checks. (yes, that's how it's spelled in the flag, we keep it exactly ✨)
--pwdmintokenlen PWDMINTOKENLEN — sets the smallest attribute value length that is used for trivial/user words checking. this also impacts "--pwduserattrs".
--pwdbadwords PWDBADWORDS — a space-separated list of words that can not be in a password. villain-word blocklist 🚫
--pwduserattrs PWDUSERATTRS — a space-separated list of attributes whose values can not appear in the password. (See "--pwdmintokenlen".)
--pwddictcheck PWDDICTCHECK — set to "on" to enforce CrackLib dictionary checking.
--pwddictpath PWDDICTPATH — filesystem path to specific/custom CrackLib dictionary files.
--pwptprmaxuse PWPTPRMAXUSE — number of times a reset password can be used for authentication.
--pwptprdelayexpireat PWPTPRDELAYEXPIREAT — number of seconds after which a reset password expires.
--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM — number of seconds to wait before using a reset password to authenticated.

COMMAND `dsconf localpwp addsubtree` 🌈

okay so same energy as adduser, but this one is scoped to a whole subtree instead of a single user. the flag list is identical, so everything you just read above still applies 💖

usage: dsconf [-v] [-j] instance localpwp addsubtree [-h]
                                                     [--pwdscheme
       PWDSCHEME]
                                                     [--pwdchange
       PWDCHANGE]
                                                     [--pwdmustchange
       PWDMUSTCHANGE]
                                                     [--pwdhistory
       PWDHISTORY]
                                                     [--pwdhistorycount
       PWDHISTORYCOUNT]
                                                     [--pwdadmin
       PWDADMIN]
                                                     [--pwdadminskipupdates
       PWDADMINSKIPUPDATES]
                                                     [--pwdtrack
       PWDTRACK]
                                                     [--pwdwarning
       PWDWARNING]
                                                     [--pwdexpire
       PWDEXPIRE]
                                                     [--pwdmaxage
       PWDMAXAGE]
                                                     [--pwdminage
       PWDMINAGE]
                                                     [--pwdgracelimit
       PWDGRACELIMIT]
                                                     [--pwdsendexpiring
       PWDSENDEXPIRING]
                                                     [--pwdlockout
       PWDLOCKOUT]
                                                     [--pwdunlock
       PWDUNLOCK]
                                                     [--pwdlockoutduration
       PWDLOCKOUTDURATION]
                                                     [--pwdmaxfailures
       PWDMAXFAILURES]
                                                     [--pwdresetfailcount
       PWDRESETFAILCOUNT]
                                                     [--pwdchecksyntax
       PWDCHECKSYNTAX]
                                                     [--pwdminlen
       PWDMINLEN]
                                                     [--pwdmindigits
       PWDMINDIGITS]
                                                     [--pwdminalphas
       PWDMINALPHAS]
                                                     [--pwdminuppers
       PWDMINUPPERS]
                                                     [--pwdminlowers
       PWDMINLOWERS]
                                                     [--pwdminspecials
       PWDMINSPECIALS]
                                                     [--pwdmin8bits
       PWDMIN8BITS]
                                                     [--pwdmaxrepeats
       PWDMAXREPEATS]
                                                     [--pwdpalindrome
       PWDPALINDROME]
                                                     [--pwdmaxseq
       PWDMAXSEQ]
                                                     [--pwdmaxseqsets
       PWDMAXSEQSETS]
                                                     [--pwdmaxclasschars
       PWDMAXCLASSCHARS]
                                                     [--pwdmincatagories
       PWDMINCATAGORIES]
                                                     [--pwdmintokenlen
       PWDMINTOKENLEN]
                                                     [--pwdbadwords
       PWDBADWORDS]
                                                     [--pwduserattrs
       PWDUSERATTRS]
                                                     [--pwddictcheck
       PWDDICTCHECK]
                                                     [--pwddictpath
       PWDDICTPATH]
                                                     [--pwptprmaxuse
       PWPTPRMAXUSE]
                                                     [--pwptprdelayexpireat
       PWPTPRDELAYEXPIREAT]
                                                     [--pwptprdelayvalidfrom
       PWPTPRDELAYVALIDFROM]
                                                     DN

DN — add/replace the subtree policy for this entry DN. drop it in and the whole subtree is covered, periodt 👑

✨ OPTIONS 'dsconf localpwp addsubtree' ✨

--pwdscheme PWDSCHEME — bestie, this sets the password storage scheme 💅
--pwdchange PWDCHANGE — lets users change their own passwords 🎀
--pwdmustchange PWDMUSTCHANGE — users gotta change their password after an administrator resets it 🔐
--pwdhistory PWDHISTORY — to enable password history, set this to "on", otherwise "off" ✨
--pwdhistorycount PWDHISTORYCOUNT — the number of passwords to keep in history 🧚
--pwdadmin PWDADMIN — the DN of an entry or a group of accounts that can bypass password policy constraints 👑
--pwdadminskipupdates PWDADMINSKIPUPDATES — set to "on" if the Password Admin's password update should not trigger updates to the password state attributes (passwordExpirationtime, passwordHistory, etc.) 💀
--pwdtrack PWDTRACK — set to "on" to track the time the password was last changed ⏰
--pwdwarning PWDWARNING — send an expiring warning if password expires within this time (in seconds) ⚠️
--pwdexpire PWDEXPIRE — set to "on" to enable password expiration 📅
--pwdmaxage PWDMAXAGE — the password expiration time in seconds ⏳
--pwdminage PWDMINAGE — the number of seconds that must pass before a user can change their password 🕰️
--pwdgracelimit PWDGRACELIMIT — the number of allowed logins after the password has expired 🚪
--pwdsendexpiring PWDSENDEXPIRING — set to "on" to always send the expiring control regardless of the warning period 📨
--pwdlockout PWDLOCKOUT — set to "on" to enable account lockout 🔒
--pwdunlock PWDUNLOCK — set to "on" to allow an account to become unlocked after the lockout duration 🔓
--pwdlockoutduration PWDLOCKOUTDURATION — the number of seconds an account stays locked out ⏲️
--pwdmaxfailures PWDMAXFAILURES — the maximum number of allowed failed password attempts before the account gets locked 💥
--pwdresetfailcount PWDRESETFAILCOUNT — the number of seconds to wait before reducing the failed login count on an account ♻️
--pwdchecksyntax PWDCHECKSYNTAX — set to "on" to enable password syntax checking ✅
--pwdminlen PWDMINLEN — the minimum number of characters required in a password 🔡
--pwdmindigits PWDMINDIGITS — the minimum number of digit/number characters in a password 🔢
--pwdminalphas PWDMINALPHAS — the minimum number of alpha characters required in a password 🔤
--pwdminuppers PWDMINUPPERS — the minimum number of uppercase characters required in a password 🔠
--pwdminlowers PWDMINLOWERS — the minimum number of lowercase characters required in a password 🔡
--pwdminspecials PWDMINSPECIALS — the minimum number of special characters required in a password ✨
--pwdmin8bits PWDMIN8BITS — the minimum number of 8-bit characters required in a password 🌈
--pwdmaxrepeats PWDMAXREPEATS — the maximum number of times the same character can appear sequentially in the password 🔁
--pwdpalindrome PWDPALINDROME — set to "on" to reject passwords that are palindromes 🙃
--pwdmaxseq PWDMAXSEQ — the maximum number of allowed monotonic character sequences in a password 📈
--pwdmaxseqsets PWDMAXSEQSETS — the maximum number of allowed monotonic character sequences that can be duplicated in a password 📊
--pwdmaxclasschars PWDMAXCLASSCHARS — the maximum number of sequential characters from the same character class that is allowed in a password 🎯
--pwdmincatagories PWDMINCATAGORIES — the minimum number of syntax category checks 🗂️
--pwdmintokenlen PWDMINTOKENLEN — sets the smallest attribute value length that is used for trivial/user words checking. This also impacts "--pwduserattrs" 📏
--pwdbadwords PWDBADWORDS — a space-separated list of words that can not be in a password 🚫
--pwduserattrs PWDUSERATTRS — a space-separated list of attributes whose values can not appear in the password (see "--pwdmintokenlen") 🧐
--pwddictcheck PWDDICTCHECK — set to "on" to enforce CrackLib dictionary checking 📖
--pwddictpath PWDDICTPATH — filesystem path to specific/custom CrackLib dictionary files 📁
--pwptprmaxuse PWPTPRMAXUSE — number of times a reset password can be used for authentication 🔁
--pwptprdelayexpireat PWPTPRDELAYEXPIREAT — number of seconds after which a reset password expires ⌛
--pwptprdelayvalidfrom PWPTPRDELAYVALIDFROM — number of seconds to wait before using a reset password to authenticated 🙈

💜 COMMAND 'dsconf replication' 💜

usage: dsconf [-v] [-j] instance replication [-h]
                                          {enable,disable,get-ruv,list,status,winsync-status,promote,create-manager,delete-manager,demote,get,set-changelog,get-changelog,export-changelog,import-changelog,set,monitor,lag-report}
       ...

🌸 POSITIONAL ARGUMENTS 'dsconf replication' 🌸

dsconf replication enable — enable replication for a suffix 💖
dsconf replication disable — disable replication for a suffix 🚫
dsconf replication get-ruv — display the database RUV entry for a suffix 🔍
dsconf replication list — lists all the replicated suffixes 📝
dsconf replication status — display the current status of all the replication agreements 📊
dsconf replication winsync-status — display the current status of all the replication agreements 🪟
dsconf replication promote — promote a replica to a hub or supplier 👑
dsconf replication create-manager — create a replication manager entry 🛠️
dsconf replication delete-manager — delete a replication manager entry 🗑️
dsconf replication demote — demote replica to a hub or consumer 📉
dsconf replication get — display the replication configuration ⚙️
dsconf replication set-changelog — set replication changelog attributes 📝
dsconf replication get-changelog — display replication changelog attributes 👀
dsconf replication export-changelog — export the Directory Server replication changelog to an LDIF file 📤
dsconf replication import-changelog — restore/import Directory Server replication change log from an LDIF file. This is typically used when managing changelog encryption 📥
dsconf replication set — set an attribute in the replication configuration 🎛️
dsconf replication monitor — display the full replication topology report 🗺️
dsconf replication lag-report — generate detailed replication lag monitoring report ⏱️

✨ COMMAND 'dsconf replication enable' ✨

usage: dsconf [-v] [-j] instance replication enable [-h] --suffix SUFFIX
                                                           --role ROLE
                                                           [--replica-id
       REPLICA_ID]
                                                           [--bind-group-dn
       BIND_GROUP_DN]
                                                           [--bind-dn BIND_DN]
                                                           [--bind-passwd
       BIND_PASSWD]
                                                           [--bind-passwd-file
       BIND_PASSWD_FILE]
                                                           [--bind-passwd-prompt]

🎀 OPTIONS 'dsconf replication enable' 🎀

--suffix SUFFIX — sets the DN of the suffix to be enabled for replication 🌟
--role ROLE — sets the replication role: "supplier", "hub", or "consumer" 👑
--replica-id REPLICA_ID — sets the replication identifier for a "supplier". Values range from 1 - 65534 🔢
--bind-group-dn BIND_GROUP_DN — sets a group entry DN containing members that are "bind/supplier" DNs 🫶
--bind-dn BIND_DN — sets the bind or supplier DN that can make replication updates 💌
--bind-passwd BIND_PASSWD — sets the password for replication manager (--bind-dn). This will create the manager entry if a value is set 🔑
--bind-passwd-file BIND_PASSWD_FILE — file containing the password 📁
--bind-passwd-prompt — prompt for password 🙈

💅 COMMAND 'dsconf replication disable' 💅

usage: dsconf [-v] [-j] instance replication disable [-h] --suffix
       SUFFIX

🌸 OPTIONS 'dsconf replication disable' 🌸

--suffix SUFFIX — sets the DN of the suffix to have replication disabled 🚫

🌈 COMMAND 'dsconf replication get-ruv' 🌈

usage: dsconf [-v] [-j] instance replication get-ruv [-h] --suffix
       SUFFIX

🦋 OPTIONS 'dsconf replication get-ruv' 🦋

--suffix SUFFIX — sets the DN of the replicated suffix 🔍

⭐ COMMAND 'dsconf replication list' ⭐

usage: dsconf [-v] [-j] instance replication list [-h]

🎀 COMMAND 'dsconf replication status' 🎀

usage: dsconf [-v] [-j] instance replication status [-h] --suffix SUFFIX
                                                           [--bind-dn BIND_DN]
                                                           [--bind-passwd
       BIND_PASSWD]
                                                           [--bind-passwd-file
       BIND_PASSWD_FILE]
                                                           [--bind-passwd-prompt]

✨ OPTIONS 'dsconf replication status' ✨

--suffix SUFFIX — sets the DN of the replication suffix 💖
--bind-dn BIND_DN — sets the DN to use to authenticate to the consumer. If not set, current instance's root DN will be used. It will be used for all agreements 🔐
--bind-passwd BIND_PASSWD — sets the password for the bind DN. It will be used for all agreements 🔑
--bind-passwd-file BIND_PASSWD_FILE — file containing the password. It will be used for all agreements 📁
--bind-passwd-prompt — prompt for passwords for each agreement's instance separately 🙈

🦋 COMMAND 'dsconf replication winsync-status' 🦋

usage: dsconf instance [-v] [-j] replication winsync-status
              [-h] --suffix SUFFIX [--bind-dn BIND_DN] [--bind-passwd
       BIND_PASSWD]
              [--bind-passwd-file BIND_PASSWD_FILE] [--bind-passwd-prompt]

💜 OPTIONS 'dsconf replication winsync-status' 💜

--suffix SUFFIX — sets the DN of the replication suffix 🌟
--bind-dn BIND_DN — sets the DN to use to authenticate to the consumer. Currectly not used 😭
--bind-passwd BIND_PASSWD — sets the password of the bind DN. Currectly not used 😭
--bind-passwd-file BIND_PASSWD_FILE — file containing the password. Currectly not used 😭
--bind-passwd-prompt — prompt for password. Currectly not used 😭

💖 COMMAND `'dsconf replication promote'` 💖

okay bestie, this one's for giving a replica a ✨glow up✨ — like, you're literally letting a consumer ascend to something with actual power. main character energy fr fr.

usage: dsconf [-v] [-j] instance replication promote [-h] --suffix SUFFIX
                                                     --newrole NEWROLE
                                                     [--replica-id REPLICA_ID]
                                                     [--bind-group-dn BIND_GROUP_DN]
                                                     [--bind-dn BIND_DN]

🌈 OPTIONS `'dsconf replication promote'` 🌈

--suffix SUFFIX — sets the DN of the replication suffix you wanna promote. like, which subtree is getting the promotion letter 💅
--newrole NEWROLE — sets the new replica role to "hub" or "supplier". that's it, that's the glow up.
--replica-id REPLICA_ID — sets the replication identifier for a "supplier". values range from 1 - 65534. no cap, that's the whole range 🫶
--bind-group-dn BIND_GROUP_DN — sets a group entry DN containing members that are "bind/supplier" DNs
--bind-dn BIND_DN — sets the bind or supplier DN that can make replication updates

🦋 COMMAND `'dsconf replication create-manager'` 🦋

new manager just dropped 🎀 this is how you spawn a fresh replication manager entry, and honestly? she's iconic.

usage: dsconf [-v] [-j] instance replication create-manager
       [-h] [--name NAME] [--passwd PASSWD] [--passwd-file PASSWD_FILE]
       [--bind-passwd-file BIND_PASSWD_FILE] [--suffix SUFFIX]

🌸 OPTIONS `'dsconf replication create-manager'` 🌸

--name NAME — sets the name of the new replication manager entry. For example, if the name is "replication manager" then the new manager entry's DN would be "cn=replication manager,cn=config". periodt.
--passwd PASSWD — sets the password for replication manager. If not provided, you will be prompted for the password. no stress, she'll ask 💅
--passwd-file PASSWD_FILE — file containing the password for back compatibility
--bind-passwd-file BIND_PASSWD_FILE — file containing the password
--suffix SUFFIX — the DN of the replication suffix whose replication configuration you want to add this new manager to (OPTIONAL)

💀 COMMAND `'dsconf replication delete-manager'` 💀

and now the opposite vibe — she's leaving the group chat 😭

usage: dsconf [-v] [-j] instance replication delete-manager
       [-h] [--name NAME] [--suffix SUFFIX]

🥀 OPTIONS `'dsconf replication delete-manager'` 🥀

--name NAME — sets the name of the replication manager entry under cn=config: "cn=NAME,cn=config"
--suffix SUFFIX — sets the DN of the replication suffix whose replication configuration you want to remove this manager from (OPTIONAL)

💜 COMMAND `'dsconf replication demote'` 💜

noooo not the demotion 😭 everyone has a downfall arc i guess. this drops a replica down a peg.

usage: dsconf [-v] [-j] instance replication demote [-h] --suffix SUFFIX
                                                     --newrole NEWROLE

✨ OPTIONS `'dsconf replication demote'` ✨

--suffix SUFFIX — sets the DN of the replication suffix
--newrole NEWROLE — sets the new replication role to "hub", or "consumer". yeah. she's a consumer now. humble era 🙈

🔥 COMMAND `'dsconf replication get'` 🔥

vibe check on your replication config — just show me everything, no filter.

usage: dsconf [-v] [-j] instance replication get [-h] --suffix SUFFIX

🍓 OPTIONS `'dsconf replication get'` 🍓

--suffix SUFFIX — sets the suffix DN for the replication configuration to display

🎀 COMMAND `'dsconf replication set-changelog'` 🎀

the changelog is like the group chat history of your replication — and here's where you set how much of it gets kept around, and whether it's locked down with encryption 🔐

usage: dsconf [-v] [-j] instance replication set-changelog [-h]
                                                          --suffix SUFFIX
                                                          [--max-entries MAX_ENTRIES]
                                                          [--max-age MAX_AGE]
                                                          [--trim-interval TRIM_INTERVAL]
                                                          [--encrypt]
                                                          [--disable-encrypt]

🧚 OPTIONS `'dsconf replication set-changelog'` 🧚

--suffix SUFFIX — sets the suffix that uses the changelog
--max-entries MAX_ENTRIES — sets the maximum number of entries to get in the replication changelog
--max-age MAX_AGE — specifies the maximum age of any entry in the changelog. The value must be a number followed by a duration unit [sSmMhHdDwW]. like 7d, bestie — number first, unit after, don't freestyle it 💅
--trim-interval TRIM_INTERVAL — sets the interval to check if the replication changelog can be trimmed
--encrypt — sets the replication changelog to use encryption. You must export and import the changelog after setting this. listen — must. not "should", not "maybe later". export + import or it's not happening 🫶
--disable-encrypt — sets the replication changelog to not use encryption. You must export and import the changelog after setting this. same deal, same rule ✨

🌈 COMMAND `'dsconf replication get-changelog'` 🌈

peek at the changelog settings, no editing, just looking respectfully 👀

usage: dsconf [-v] [-j] instance replication get-changelog [-h]
                                                          --suffix SUFFIX

💖 OPTIONS `'dsconf replication get-changelog'` 💖

--suffix SUFFIX — sets the suffix that uses the changelog

🦋 COMMAND `'dsconf replication export-changelog'` 🦋

time to get that changelog out of the building 🚪✨

usage: dsconf [-v] [-j] instance replication export-changelog
       [-h] {to-ldif,default} ...

🌸 POSITIONAL ARGUMENTS `'dsconf replication export-changelog'` 🌸

dsconf replication export-changelog to-ldif — sets the LDIF file name. This is typically used for setting up changelog encryption
dsconf replication export-changelog default — export the replication changelog to the server's default LDIF directory

💅 COMMAND `'dsconf replication export-changelog to-ldif'` 💅

the full-control version, with all the little switches 🎛️

usage: dsconf instance [-v] [-j] replication export-changelog to-ldif
       [-h] [-c] [-d] [-l] [-i CHANGELOG_LDIF] -o OUTPUT_FILE -r REPLICA_ROOT

🌟 OPTIONS `'dsconf replication export-changelog to-ldif'` 🌟

-c, --csn-only — enables to export and interpret CSN only. This option can be used with or without -i option. The LDIF file that is generated can not be imported and is only used for debugging purposes. so like, debug snack, not a meal 🍓
-d, --decode — decodes the base64 values in each changelog entry. The LDIF file that is generated can not be imported and is only used for debugging purposes. again: debug only, bestie 💀
-l, --preserve-ldif-done — preserves generated LDIF "files.done" files in changelog directory.
-i CHANGELOG_LDIF, --changelog-ldif CHANGELOG_LDIF — decodes changes in an LDIF file. Use this option if you already have a changelog LDIF file, but the changes in that file are encoded.
-o OUTPUT_FILE, --output-file OUTPUT_FILE — sets the path name for the final result
-r REPLICA_ROOT, --replica-root REPLICA_ROOT — specifies the replica root whose changelog you want to export

🎀 COMMAND `'dsconf replication export-changelog default'` 🎀

the low-effort version — she just does the thing to the default spot 🫶

usage: dsconf [-v] [-j] instance replication export-changelog default
       [-h] -r REPLICA_ROOT

✨ OPTIONS `'dsconf replication export-changelog default'` ✨

-r REPLICA_ROOT, --replica-root REPLICA_ROOT — specifies the replica root whose changelog you want to export

🌈 COMMAND `'dsconf replication import-changelog'` 🌈

and we're bringing it back in, reverse uno card 🔄

usage: dsconf instance [-v] [-j] replication import-changelog
       [-h] {from-ldif,default} ...

💜 POSITIONAL ARGUMENTS `'dsconf replication import-changelog'` 💜

dsconf replication import-changelog from-ldif — restore/import a specific single LDIF file
dsconf replication import-changelog default — import the default changelog LDIF file created by the server

🦋 COMMAND `'dsconf replication import-changelog from-ldif'` 🦋

one specific file, one specific mission 🎯

usage: dsconf [-v] [-j] instance replication import-changelog from-ldif
       [-h] -r REPLICA_ROOT LDIF_PATH

LDIF_PATH — the path of the changelog LDIF file

🌸 OPTIONS `'dsconf replication import-changelog from-ldif'` 🌸

-r REPLICA_ROOT, --replica-root REPLICA_ROOT — specifies the replica root whose changelog you want to import

💖 COMMAND `'dsconf replication import-changelog default'` 💖

the server already made you a default changelog LDIF, so let's just slurp that one back in 🍓

usage: dsconf instance [-v] [-j] replication import-changelog default
       [-h] -r REPLICA_ROOT

✨ OPTIONS `'dsconf replication import-changelog default'` ✨

-r REPLICA_ROOT, --replica-root REPLICA_ROOT — specifies the replica root whose changelog you want to import

👑 COMMAND `'dsconf replication set'` 👑

the big one — a whole buffet of replication settings, and she is serving 🍽️✨

usage: dsconf [-v] [-j] instance replication set [-h] --suffix SUFFIX
                                                 [--repl-add-bind-dn REPL_ADD_BIND_DN]
                                                 [--repl-del-bind-dn REPL_DEL_BIND_DN]
                                                 [--repl-add-ref REPL_ADD_REF]
                                                 [--repl-del-ref REPL_DEL_REF]
                                                 [--repl-purge-delay REPL_PURGE_DELAY]
                                                 [--repl-tombstone-purge-interval REPL_TOMBSTONE_PURGE_INTERVAL]
                                                 [--repl-fast-tombstone-purging REPL_FAST_TOMBSTONE_PURGING]
                                                 [--repl-bind-group REPL_BIND_GROUP]
                                                 [--repl-bind-group-interval REPL_BIND_GROUP_INTERVAL]
                                                 [--repl-protocol-timeout REPL_PROTOCOL_TIMEOUT]
                                                 [--repl-backoff-max REPL_BACKOFF_MAX]
                                                 [--repl-backoff-min REPL_BACKOFF_MIN]
                                                 [--repl-release-timeout REPL_RELEASE_TIMEOUT]
                                                 [--repl-keepalive-update-interval REPL_KEEPALIVE_UPDATE_INTERVAL]

✨ OPTIONS 'dsconf replication set' ✨

--suffix SUFFIX — sets the DN of the replication suffix, bestie. That's the whole vibe 🎀
--repl-add-bind-dn REPL_ADD_BIND_DN — adds a bind (supplier) DN 💖
--repl-del-bind-dn REPL_DEL_BIND_DN — takes a bind (supplier) DN away, bye bye 👋
--repl-add-ref REPL_ADD_REF — adds a replication referral, and heads up: this one is for consumers only 🧚
--repl-del-ref REPL_DEL_REF — removes a replication referral (also consumers only — the original page literally spells it "conusmers" and honestly, we respect the typo era 💀)
--repl-purge-delay REPL_PURGE_DELAY — sets the replication purge delay ⏳
--repl-tombstone-purge-interval REPL_TOMBSTONE_PURGE_INTERVAL — sets the interval, in seconds, to check for tombstones that can be purged 🪦
--repl-fast-tombstone-purging REPL_FAST_TOMBSTONE_PURGING — turns the tombstone-purging performance improvement on or off. Yes it's a toggle, slay 🔥
--repl-bind-group REPL_BIND_GROUP — sets a group entry DN containing members that are "bind/supplier" DNs 👑
--repl-bind-group-interval REPL_BIND_GROUP_INTERVAL — sets an interval in seconds to check if the bind group has been updated 🔄
--repl-protocol-timeout REPL_PROTOCOL_TIMEOUT — sets a timeout in seconds for how long to wait before stopping replication when the server is under load 😮‍💨
--repl-backoff-max REPL_BACKOFF_MAX — the max time in seconds a replication agreement should stay in a backoff state while waiting to acquire the consumer. Default is 300 seconds ✨
--repl-backoff-min REPL_BACKOFF_MIN — the starting time in seconds a replication agreement should stay in a backoff state while waiting to acquire the consumer. Default is 3 seconds 🌸
--repl-release-timeout REPL_RELEASE_TIMEOUT — a timeout in seconds a replication supplier should send updates before it yields its replication session 🫶
--repl-keepalive-update-interval REPL_KEEPALIVE_UPDATE_INTERVAL — interval in seconds for how often the server will apply an internal update to keep the RUV from getting stale. The default is 1 hour (3600 seconds) ⏰

👀 COMMAND 'dsconf replication monitor' 👀

usage: dsconf [-v] [-j] instance replication monitor [-h]
                                                     [-c [CONNECTIONS
...]]
                                                     [-a [ALIASES ...]]

✨ OPTIONS 'dsconf replication monitor' ✨

-c [CONNECTIONS ...], --connections [CONNECTIONS ...] — sets the connection values for monitoring other not-connected topologies. The format is 'host:port:binddn:bindpwd'. You can use regex for host and port 😌. You can set bindpwd to * and it'll be requested at runtime, or you can include the path to the password file in square brackets — like [~/pwd.txt] 🔐
-a [ALIASES ...], --aliases [ALIASES ...] — enables displaying an alias instead of host:port, if an alias is assigned to a host:port combination. The format: alias=host:port 💅

📊 COMMAND 'dsconf replication lag-report' 📊

usage: dsconf [-v] [-j] instance replication lag-report [-h]
                                                           --log-dirs
LOG_DIRS [LOG_DIRS ...]
                                                           --suffixes
SUFFIXES [SUFFIXES ...]
                                                           --output-dir
OUTPUT_DIR
                                                           [--output-format
OUTPUT_FORMAT [OUTPUT_FORMAT ...]]
                                                           [--json]
                                                           [--only-fully-replicated
 |
                                                           --only-not-replicated]
                                                           [--lag-time-lowest
LAG_TIME_LOWEST]
                                                           [--etime-lowest
ETIME_LOWEST]
                                                           [--start-time
START_TIME]
                                                           [--end-time
END_TIME]
                                                           [--utc-offset
UTC_OFFSET]
                                                           [--anonymous]
                                                           [--precision
{fast,balanced,full}]
                                                           [--max-chart-points
MAX_CHART_POINTS]

🧸 INPUT OPTIONS 'dsconf replication lag-report' 🧸

--log-dirs LOG_DIRS [LOG_DIRS ...] — list of log directories to analyze 📁
--suffixes SUFFIXES [SUFFIXES ...] — list of suffixes to analyze 🌈

🎀 OUTPUT OPTIONS 'dsconf replication lag-report' 🎀

--output-dir OUTPUT_DIR — directory to write analysis reports to 💖
--output-format OUTPUT_FORMAT [OUTPUT_FORMAT ...] — one or more output formats: html, json, png, csv. Default: html ✨
--json — output the result as JSON (for UI integration / programmatic use) 🤖

🦋 FILTERING OPTIONS 'dsconf replication lag-report' 🦋

--only-fully-replicated — show only fully replicated entries ✅
--only-not-replicated — show only entries that failed to replicate 😭
--lag-time-lowest LAG_TIME_LOWEST — filter entries with lag time above this threshold (seconds) ⏱️
--etime-lowest ETIME_LOWEST — filter entries with etime above this threshold (seconds) ⏳

🌸 TIME RANGE OPTIONS 'dsconf replication lag-report' 🌸

--start-time START_TIME — start time for analysis (YYYY-MM-DD HH:MM:SS) 🗓️
--end-time END_TIME — end time for analysis (YYYY-MM-DD HH:MM:SS) 🗓️

💜 ADDITIONAL OPTIONS 'dsconf replication lag-report' 💜

--utc-offset UTC_OFFSET — UTC offset in ±HHMM format (e.g., -0400, +0530) 🌍
--anonymous — anonymize server names in the report 🕵️

🔥 PERFORMANCE OPTIONS 'dsconf replication lag-report' 🔥

--precision {fast,balanced,full} — analysis precision vs speed: fast (more sampling), balanced (default), full (no sampling) 🏎️
--max-chart-points MAX_CHART_POINTS — maximum total data points to include across all chart series (sampling applied if exceeded). Default depends on --precision 📈

👑 COMMAND 'dsconf repl-agmt' 👑

usage: dsconf [-v] [-j] instance repl-agmt [-h]
                                        {list,enable,disable,init,init-status,poke,status,delete,create,set,get}
       ...

✨ POSITIONAL ARGUMENTS 'dsconf repl-agmt' ✨

dsconf repl-agmt list — list all replication agreements 📋
dsconf repl-agmt enable — enable replication agreement ✅
dsconf repl-agmt disable — disable replication agreement ⛔
dsconf repl-agmt init — initialize replication agreement 🚀
dsconf repl-agmt init-status — check the agreement initialization status 🔍
dsconf repl-agmt poke — trigger replication to send updates now 👉📨
dsconf repl-agmt status — displays the current status of the replication agreement 🩺
dsconf repl-agmt delete — delete replication agreement 🗑️
dsconf repl-agmt create — initialize replication agreement 🌱
dsconf repl-agmt set — set an attribute in the replication agreement 🛠️
dsconf repl-agmt get — get replication configuration 📖

📋 COMMAND 'dsconf repl-agmt list' 📋

usage: dsconf [-v] [-j] instance repl-agmt list [-h] --suffix SUFFIX
                                                       [--entry ENTRY]