-a old_password

-S new_password

-T new_password.txt

-t old_password.txt

-w mypassword

Specifies the distinguished name with which to authenticate to the server. This value must be a DN recognized by the Directory Server, and it must also have the authority to delete the entries. For example:

-D "uid=bjensen, dc=example,dc=com"

The -D option cannot be used with the -N option.

For more information on access control, see the "Managing Access Control" chapter in the Directory Server Administration Guide.

Specifies that the password policy request control not be sent with the bind request. By default, the new LDAP password policy request control is sent with bind requests.

The ldappasswd tool can parse and display information from the response control if it is returned by a server; that is, the tool will print an appropriate error or warning message when a server sends the password policy response control with the appropriate value.

The criticality of the request control is set to false to ensure that all LDAPv3 servers that do not understand the control can ignore it. To suppress sending of the request control with the bind request, include -g on the command-line.

-h cyclops

Specifies the path, including the filename, of the private key database of the client. This can be the absolute or relative (to the server root) path.

The -K option must be used when the key database is not called key3.db or when the key database is not in the same directory as the certificate database (that is, the cert8.db file, the path for which is specified with the -P option).

Specifies the certificate name to use for certificate-based client authentication. For example:

-N Server-Cert

If this option is specified, then the -Z and -W options are required.

If this option is specified, then the -D and -w options must not be specified, or certificate-based authentication will not occur, and the bind operation will use the authentication credentials specified by -D and -w.

Specifies the absolute path, including the filename, of the certificate database of the client. This option is used only with the -Z option.

When used on a machine where an SSL-enabled web browser is configured, the path specified on this option can be that of the certificate database for the browser. For example:

-P /security/cert.db

The client security files can also be stored on the Directory Server in the /etc/dirsrv/slapd-instance_name directory. In this case, the -P option would call out a path and filename similar to the following:

-P /etc/dirsrv/slapd-instance_name/client-cert.db

-W serverpassword

Specifies the password associated with the distinguished name that is specified in the -D option. For example:

-w diner892

The default is "", or anonymous.

If a password is not sent on the command line and the server requires one, the command prompts for one. It is more secure not to provide a password on the command-line so that it does not show up in clear text in a listing of commands.

-Z

Specifies that SSL is to be used for the search request.

-ZZ

Specifies the Start TLS request. Use this option to make a cleartext connection into a secure one. If the server does not support Start TLS, the command does not need to be aborted; it will continue in cleartext.

-ZZZ

Enforces the Start TLS request. The server must respond that the request was successful. If the server does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect, the command is aborted immediately.