DSIDM(8) Generated Python Manual DSIDM(8)

# [NAME](#NAME)

dsidm

# [SYNOPSIS](#SYNOPSIS)

**dsidm** \[-h] \[-v] \[-j] \[-b BASEDN] \[-D BINDDN] \[-w BINDPW] \[-W] \[-y PWDFILE] \[-Z] instance {account,group,initialise,init,organizationalunit,ou,posixgroup,user,client\_config,role,service,uniquegroup} ...

# [POSITIONAL ARGUMENTS](#POSITIONAL_ARGUMENTS)

[**dsidm** *account*](#dsidm)

Manage generic accounts, with tasks like modify, locking and unlocking. To create an account, see "user" subcommand instead.

[**dsidm** *group*](#dsidm~2)

Manage groups. The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups. Groups uses the objectclass "groupOfNames" and the grouping attribute "member"

[**dsidm** *initialise*](#dsidm~3)

Initialise a backend with domain information and sample entries

[**dsidm** *organizationalunit*](#dsidm~4)

Manage organizational units

[**dsidm** *posixgroup*](#dsidm~5)

Manage posix groups The organizationalUnit (by default ou=groups") needs to exist prior to managing posix groups.

[**dsidm** *user*](#dsidm~6)

Manage posix users. The organizationalUnit (by default "ou=people") needs to exist prior to managing users.

[**dsidm** *client\_config*](#dsidm~7)

Display and generate client example configs for this LDAP server

[**dsidm** *role*](#dsidm~8)

Manage roles.

[**dsidm** *service*](#dsidm~9)

Manage service accounts. The organizationalUnit (by default "ou=Services") needs to exist prior to managing service accounts.

[**dsidm** *uniquegroup*](#dsidm~10)

Manage groups. The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups. Unique groups uses the objectclass "groupOfUniqueNames" and the grouping attribute "uniquemember"

# COMMAND *'dsidm* *account'*

usage: dsidm instance account \[-h]  
{list,get-by-dn,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status,reset\_password,change\_password,bulk\_update} ...

# POSITIONAL ARGUMENTS *'dsidm account'*

[**dsidm account** *list*](#dsidm~11)

list accounts that could login to the directory (returns the full DN of the entry)

[**dsidm account** *get-by-dn*](#dsidm~12)

get-by-dn <dn>

[**dsidm account** *modify-by-dn*](#dsidm~13)

modify-by-dn <dn> <add|delete|replace>:<attribute>:<value> ...

[**dsidm account** *rename-by-dn*](#dsidm~14)

rename the object

[**dsidm account** *delete*](#dsidm~15)

deletes the account

[**dsidm account** *lock*](#dsidm~16)

lock

[**dsidm account** *unlock*](#dsidm~17)

unlock

[**dsidm account** *entry-status*](#dsidm~18)

status of a single entry

[**dsidm account** *subtree-status*](#dsidm~19)

status of a subtree

[**dsidm account** *reset\_password*](#dsidm~20)

Reset the password of an account. This should be performed by a directory admin.

[**dsidm account** *change\_password*](#dsidm~21)

Change the password of an account. This can be performed by any user (with correct rights)

[**dsidm account** *bulk\_update*](#dsidm~22)

Perform a common operation to a set of entries

# COMMAND *'dsidm* *account* *list'*

usage: dsidm \[-v] \[-j] instance account list \[-h]

# COMMAND *'dsidm* *account* *get-by-dn'*

usage: dsidm \[-v] \[-j] instance account get-by-dn \[-h] \[dn]

[**dn**](#dn)

The dn to get and display

# COMMAND *'dsidm* *account* *modify-by-dn'*

usage: dsidm \[-v] \[-j] instance account modify-by-dn \[-h] dn changes \[changes ...]

[**dn**](#dn~2)

The dn to get and display

[**changes**](#changes)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *account* *rename-by-dn'*

usage: dsidm \[-v] \[-j] instance account rename-by-dn \[-h] \[--keep-old-rdn] dn new\_dn

[**dn**](#dn~3)

The dn to rename

[**new\_dn**](#new_dn)

A new role dn

# OPTIONS *'dsidm* *account* *rename-by-dn'*

[**--keep-old-rdn**](#keep)

Specify whether the old RDN (i.e. 'cn: old\_role') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *account* *delete'*

usage: dsidm \[-v] \[-j] instance account delete \[-h] \[dn]

[**dn**](#dn~4)

The dn of the account to delete

# COMMAND *'dsidm* *account* *lock'*

usage: dsidm \[-v] \[-j] instance account lock \[-h] \[dn]

[**dn**](#dn~5)

The dn to lock

# COMMAND *'dsidm* *account* *unlock'*

usage: dsidm \[-v] \[-j] instance account unlock \[-h] \[dn]

[**dn**](#dn~6)

The dn to unlock

# COMMAND *'dsidm* *account* *entry-status'*

usage: dsidm \[-v] \[-j] instance account entry-status \[-h] \[-V] \[dn]

[**dn**](#dn~7)

The single entry dn to check

# OPTIONS *'dsidm* *account* *entry-status'*

[**-V**, **--details**](#V)

Print more account policy details about the entry

# COMMAND *'dsidm* *account* *subtree-status'*

usage: dsidm \[-v] \[-j] instance account subtree-status \[-h] \[-V] \[-f FILTER]  
\[-s {one,sub}] \[-i]  
\[-o BECOME\_INACTIVE\_ON]  
basedn

[**basedn**](#basedn)

Search base for finding entries

# OPTIONS *'dsidm* *account* *subtree-status'*

[**-V**, **--details**](#V~2)

Print more account policy details about the entries

[**-f** *FILTER*, **--filter** *FILTER*](#f)

Search filter for finding entries

[**-s** *{one,sub}*, **--scope** *{one,sub}*](#s)

Search scope (one, sub - default is sub

[**-i**, **--inactive-only**](#i)

Only display inactivated entries

[**-o** *BECOME\_INACTIVE\_ON*, **--become-inactive-on** *BECOME\_INACTIVE\_ON*](#o)

Only display entries that will become inactive before specified date (in a format 2007-04-25T14:30)

# COMMAND *'dsidm* *account* *reset\_password'*

usage: dsidm \[-v] \[-j] instance account reset\_password \[-h] \[dn] \[new\_password]

[**dn**](#dn~8)

The dn to reset the password for

[**new\_password**](#new_password)

The new password to set

# COMMAND *'dsidm* *account* *change\_password'*

usage: dsidm \[-v] \[-j] instance account change\_password \[-h]  
\[dn] \[new\_password]  
\[current\_password]

[**dn**](#dn~9)

The dn to change the password for

[**new\_password**](#new_password~2)

The new password to set

[**current\_password**](#current_password)

The accounts current password

# COMMAND *'dsidm* *account* *bulk\_update'*

usage: dsidm \[-v] \[-j] instance account bulk\_update \[-h] \[-f FILTER] \[-s {one,sub}] \[-x]  
basedn changes \[changes ...]

[**basedn**](#basedn~2)

Search base for finding entries, only the children of this DN are processed

[**changes**](#changes~2)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# OPTIONS *'dsidm* *account* *bulk\_update'*

[**-f** *FILTER*, **--filter** *FILTER*](#f~2)

Search filter for finding entries, default is '(objectclass=\*)'

[**-s** *{one,sub}*, **--scope** *{one,sub}*](#s~2)

Search scope (one, sub - default is sub

[**-x**, **--stop**](#x)

Stop processing updates when an error occurs. Default is False

# COMMAND *'dsidm* *group'*

usage: dsidm instance group \[-h]  
{list,get,get\_dn,create,delete,modify,rename,members,add\_member,remove\_member} ...

# POSITIONAL ARGUMENTS *'dsidm group'*

[**dsidm group** *list*](#dsidm~23)

list

[**dsidm group** *get*](#dsidm~24)

get

[**dsidm group** *get\_dn*](#dsidm~25)

get\_dn

[**dsidm group** *create*](#dsidm~26)

create

[**dsidm group** *delete*](#dsidm~27)

deletes the object

[**dsidm group** *modify*](#dsidm~28)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm group** *rename*](#dsidm~29)

rename the object

[**dsidm group** *members*](#dsidm~30)

List member dns of a group

[**dsidm group** *add\_member*](#dsidm~31)

Add a member to a group

[**dsidm group** *remove\_member*](#dsidm~32)

Remove a member from a group

# COMMAND *'dsidm* *group* *list'*

usage: dsidm \[-v] \[-j] instance group list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *group* *list'*

[**--full-dn**](#full)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *group* *get'*

usage: dsidm \[-v] \[-j] instance group get \[-h] \[selector]

[**selector**](#selector)

The term to search for

# COMMAND *'dsidm* *group* *get\_dn'*

usage: dsidm \[-v] \[-j] instance group get\_dn \[-h] \[dn]

[**dn**](#dn~10)

The dn to get

# COMMAND *'dsidm* *group* *create'*

usage: dsidm \[-v] \[-j] instance group create \[-h] \[--cn \[CN]]  
\[--description \[DESCRIPTION]]

# OPTIONS *'dsidm* *group* *create'*

[**--cn** *\[CN\]*](#cn)

Value of cn

[**--description** *\[DESCRIPTION\]*](#description)

Value of description

# COMMAND *'dsidm* *group* *delete'*

usage: dsidm \[-v] \[-j] instance group delete \[-h] \[dn]

[**dn**](#dn~11)

The dn to delete

# COMMAND *'dsidm* *group* *modify'*

usage: dsidm \[-v] \[-j] instance group modify \[-h] selector changes \[changes ...]

[**selector**](#selector~2)

The cn to modify

[**changes**](#changes~3)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *group* *rename'*

usage: dsidm \[-v] \[-j] instance group rename \[-h] \[--keep-old-rdn] selector new\_name

[**selector**](#selector~3)

The cn to rename

[**new\_name**](#new_name)

A new group name

# OPTIONS *'dsidm* *group* *rename'*

[**--keep-old-rdn**](#keep~2)

Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *group* *members'*

usage: dsidm \[-v] \[-j] instance group members \[-h] \[cn]

[**cn**](#cn~2)

cn of group to list members of

# COMMAND *'dsidm* *group* *add\_member'*

usage: dsidm \[-v] \[-j] instance group add\_member \[-h] \[cn] \[dn]

[**cn**](#cn~3)

cn of group to add member to

[**dn**](#dn~12)

dn of object to add to group as member

# COMMAND *'dsidm* *group* *remove\_member'*

usage: dsidm \[-v] \[-j] instance group remove\_member \[-h] \[cn] \[dn]

[**cn**](#cn~4)

cn of group to remove member from

[**dn**](#dn~13)

dn of object to remove from group as member

# COMMAND *'dsidm* *initialise'*

usage: dsidm \[-v] \[-j] instance initialise \[-h] \[--version VERSION]

# OPTIONS *'dsidm* *initialise'*

[**--version** *VERSION*](#version)

The version of entries to create.

# COMMAND *'dsidm* *organizationalunit'*

usage: dsidm \[-v] \[-j] instance organizationalunit \[-h]  
{list,get,get\_dn,create,delete,modify,rename} ...

# POSITIONAL ARGUMENTS *'dsidm organizationalunit'*

[**dsidm organizationalunit** *list*](#dsidm~33)

list

[**dsidm organizationalunit** *get*](#dsidm~34)

get

[**dsidm organizationalunit** *get\_dn*](#dsidm~35)

get\_dn

[**dsidm organizationalunit** *create*](#dsidm~36)

create

[**dsidm organizationalunit** *delete*](#dsidm~37)

deletes the object

[**dsidm organizationalunit** *modify*](#dsidm~38)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm organizationalunit** *rename*](#dsidm~39)

rename the object

# COMMAND *'dsidm* *organizationalunit* *list'*

usage: dsidm \[-v] \[-j] instance organizationalunit list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *organizationalunit* *list'*

[**--full-dn**](#full~2)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *organizationalunit* *get'*

usage: dsidm \[-v] \[-j] instance organizationalunit get \[-h] \[selector]

[**selector**](#selector~4)

The term to search for

# COMMAND *'dsidm* *organizationalunit* *get\_dn'*

usage: dsidm \[-v] \[-j] instance organizationalunit get\_dn \[-h] \[dn]

[**dn**](#dn~14)

The dn to get

# COMMAND *'dsidm* *organizationalunit* *create'*

usage: dsidm \[-v] \[-j] instance organizationalunit create \[-h] \[--ou \[OU]]

# OPTIONS *'dsidm* *organizationalunit* *create'*

[**--ou** *\[OU\]*](#ou)

Value of ou

# COMMAND *'dsidm* *organizationalunit* *delete'*

usage: dsidm \[-v] \[-j] instance organizationalunit delete \[-h] \[dn]

[**dn**](#dn~15)

The dn to delete

# COMMAND *'dsidm* *organizationalunit* *modify'*

usage: dsidm \[-v] \[-j] instance organizationalunit modify \[-h]  
selector  
changes \[changes ...]

[**selector**](#selector~5)

The ou to modify

[**changes**](#changes~4)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *organizationalunit* *rename'*

usage: dsidm \[-v] \[-j] instance organizationalunit rename \[-h]  
\[--keep-old-rdn]  
selector new\_name

[**selector**](#selector~6)

The ou to rename

[**new\_name**](#new_name~2)

A new organizational unit name

# OPTIONS *'dsidm* *organizationalunit* *rename'*

[**--keep-old-rdn**](#keep~3)

Specify whether the old RDN (i.e. 'ou: old\_ou') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *posixgroup'*

usage: dsidm instance posixgroup \[-h]  
{list,get,get\_dn,create,delete,modify,rename} ...

# POSITIONAL ARGUMENTS *'dsidm posixgroup'*

[**dsidm posixgroup** *list*](#dsidm~40)

list

[**dsidm posixgroup** *get*](#dsidm~41)

get

[**dsidm posixgroup** *get\_dn*](#dsidm~42)

get\_dn

[**dsidm posixgroup** *create*](#dsidm~43)

create

[**dsidm posixgroup** *delete*](#dsidm~44)

deletes the object

[**dsidm posixgroup** *modify*](#dsidm~45)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm posixgroup** *rename*](#dsidm~46)

rename the object

# COMMAND *'dsidm* *posixgroup* *list'*

usage: dsidm \[-v] \[-j] instance posixgroup list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *posixgroup* *list'*

[**--full-dn**](#full~3)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *posixgroup* *get'*

usage: dsidm \[-v] \[-j] instance posixgroup get \[-h] \[selector]

[**selector**](#selector~7)

The term to search for

# COMMAND *'dsidm* *posixgroup* *get\_dn'*

usage: dsidm \[-v] \[-j] instance posixgroup get\_dn \[-h] \[dn]

[**dn**](#dn~16)

The dn to get

# COMMAND *'dsidm* *posixgroup* *create'*

usage: dsidm \[-v] \[-j] instance posixgroup create \[-h] \[--cn \[CN]]  
\[--gidNumber \[GIDNUMBER]]

# OPTIONS *'dsidm* *posixgroup* *create'*

[**--cn** *\[CN\]*](#cn~5)

Value of cn

[**--gidNumber** *\[GIDNUMBER\]*](#gidNumber)

Value of gidNumber

# COMMAND *'dsidm* *posixgroup* *delete'*

usage: dsidm \[-v] \[-j] instance posixgroup delete \[-h] \[dn]

[**dn**](#dn~17)

The dn to delete

# COMMAND *'dsidm* *posixgroup* *modify'*

usage: dsidm \[-v] \[-j] instance posixgroup modify \[-h] selector changes \[changes ...]

[**selector**](#selector~8)

The cn to modify

[**changes**](#changes~5)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *posixgroup* *rename'*

usage: dsidm \[-v] \[-j] instance posixgroup rename \[-h] \[--keep-old-rdn]  
selector new\_name

[**selector**](#selector~9)

The cn to rename

[**new\_name**](#new_name~3)

A new posix group name

# OPTIONS *'dsidm* *posixgroup* *rename'*

[**--keep-old-rdn**](#keep~4)

Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *user'*

usage: dsidm instance user \[-h]  
\[--user-type {basic,posix,service,traditional}]  
{list,get,get-pwp,get\_dn,create,modify,rename,delete} ...

# POSITIONAL ARGUMENTS *'dsidm user'*

[**dsidm user** *list*](#dsidm~47)

list

[**dsidm user** *get*](#dsidm~48)

get

[**dsidm user** *get-pwp*](#dsidm~49)

Show the effective password policy for a user

[**dsidm user** *get\_dn*](#dsidm~50)

get\_dn

[**dsidm user** *create*](#dsidm~51)

create

[**dsidm user** *modify*](#dsidm~52)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm user** *rename*](#dsidm~53)

rename the object

[**dsidm user** *delete*](#dsidm~54)

deletes the object

# COMMAND *'dsidm* *user* *list'*

usage: dsidm \[-v] \[-j] instance user list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *user* *list'*

[**--full-dn**](#full~4)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *user* *get'*

usage: dsidm \[-v] \[-j] instance user get \[-h] \[selector]

[**selector**](#selector~10)

The term to search for

# COMMAND *'dsidm* *user* *get-pwp'*

usage: dsidm \[-v] \[-j] instance user get-pwp \[-h] \[--parent-dn PARENT\_DN] \[selector]

Resolve and display the password policy (global, user local, or subtree local) that applies to the user, including all effective settings.

[**selector**](#selector~11)

The user identifier to look up (same as user get, typically uid)

# OPTIONS *'dsidm* *user* *get-pwp'*

[**--parent-dn** *PARENT\_DN*](#parent)

A base DN to use for user lookups. Default is "ou=people,$SUFFIX" for users, or "ou=services,$SUFFIX" for service accounts

# COMMAND *'dsidm* *user* *get\_dn'*

usage: dsidm \[-v] \[-j] instance user get\_dn \[-h] \[dn]

[**dn**](#dn~18)

The dn to get

# COMMAND *'dsidm* *user* *create'*

usage: dsidm \[-v] \[-j] instance user create \[-h] \[--uid \[UID]] \[--cn \[CN]]  
\[--displayName \[DISPLAYNAME]]  
\[--uidNumber \[UIDNUMBER]]  
\[--gidNumber \[GIDNUMBER]]  
\[--homeDirectory \[HOMEDIRECTORY]]

# OPTIONS *'dsidm* *user* *create'*

[**--uid** *\[UID\]*](#uid)

Value of uid

[**--cn** *\[CN\]*](#cn~6)

Value of cn

[**--displayName** *\[DISPLAYNAME\]*](#displayName)

Value of displayName

[**--uidNumber** *\[UIDNUMBER\]*](#uidNumber)

Value of uidNumber

[**--gidNumber** *\[GIDNUMBER\]*](#gidNumber~2)

Value of gidNumber

[**--homeDirectory** *\[HOMEDIRECTORY\]*](#homeDirectory)

Value of homeDirectory

# COMMAND *'dsidm* *user* *modify'*

usage: dsidm \[-v] \[-j] instance user modify \[-h] selector changes \[changes ...]

[**selector**](#selector~12)

The uid to modify

[**changes**](#changes~6)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *user* *rename'*

usage: dsidm \[-v] \[-j] instance user rename \[-h] \[--keep-old-rdn] selector new\_name

[**selector**](#selector~13)

The uid to modify

[**new\_name**](#new_name~4)

A new user name

# OPTIONS *'dsidm* *user* *rename'*

[**--keep-old-rdn**](#keep~5)

Specify whether the old RDN (i.e. 'cn: old\_user') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *user* *delete'*

usage: dsidm \[-v] \[-j] instance user delete \[-h] \[dn]

[**dn**](#dn~19)

The dn to delete

# OPTIONS *'dsidm* *user'*

[**--user-type** *{basic,posix,service,traditional}*](#user)

The type of user to manage. "basic" is an entry based off of objectclasses: nsPerson, nsAccount, and nsOrgPerson. "posix" is based off of objectclasses: nsPerson, nsAccount, nsOrgPerson, and posixAccount. "service" is based off of objectclasses: nsAccount and applicationProcess. "traditional", aka legacy, is based off of objectclasses: person, organizationalPerson, and inetOrgPerson. The default user type is "posix"

# COMMAND *'dsidm* *client\_config'*

usage: dsidm instance client\_config \[-h] {sssd.conf,ldap.conf,display} ...

# POSITIONAL ARGUMENTS *'dsidm client\_config'*

[**dsidm client\_config** *sssd.conf*](#dsidm~55)

Generate a SSSD configuration for this LDAP server

[**dsidm client\_config** *ldap.conf*](#dsidm~56)

Generate an OpenLDAP ldap.conf configuration for this LDAP server

[**dsidm client\_config** *display*](#dsidm~57)

Display generic application parameters for LDAP connection

# COMMAND *'dsidm* *client\_config* *sssd.conf'*

usage: dsidm instance client\_config sssd.conf \[-h] \[allowed\_group]

[**allowed\_group**](#allowed_group)

The name of the group allowed access to this system

# COMMAND *'dsidm* *client\_config* *ldap.conf'*

usage: dsidm instance client\_config ldap.conf \[-h]

# COMMAND *'dsidm* *client\_config* *display'*

usage: dsidm instance client\_config display \[-h]

# COMMAND *'dsidm* *role'*

usage: dsidm \[-v] \[-j] instance role \[-h]  
{list,get,get-by-dn,create-managed,create-filtered,create-nested,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status} ...

# POSITIONAL ARGUMENTS *'dsidm role'*

[**dsidm role** *list*](#dsidm~58)

list roles that could login to the directory

[**dsidm role** *get*](#dsidm~59)

get

[**dsidm role** *get-by-dn*](#dsidm~60)

get-by-dn <dn>

[**dsidm role** *create-managed*](#dsidm~61)

create

[**dsidm role** *create-filtered*](#dsidm~62)

create

[**dsidm role** *create-nested*](#dsidm~63)

create

[**dsidm role** *modify-by-dn*](#dsidm~64)

modify-by-dn <dn> <add|delete|replace>:<attribute>:<value> ...

[**dsidm role** *rename-by-dn*](#dsidm~65)

rename the object

[**dsidm role** *delete*](#dsidm~66)

deletes the role

[**dsidm role** *lock*](#dsidm~67)

lock

[**dsidm role** *unlock*](#dsidm~68)

unlock

[**dsidm role** *entry-status*](#dsidm~69)

status of a single entry

[**dsidm role** *subtree-status*](#dsidm~70)

status of a subtree

# COMMAND *'dsidm* *role* *list'*

usage: dsidm \[-v] \[-j] instance role list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *role* *list'*

[**--full-dn**](#full~5)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *role* *get'*

usage: dsidm \[-v] \[-j] instance role get \[-h] \[selector]

[**selector**](#selector~14)

The term to search for

# COMMAND *'dsidm* *role* *get-by-dn'*

usage: dsidm \[-v] \[-j] instance role get-by-dn \[-h] \[dn]

[**dn**](#dn~20)

The dn to get and display

# COMMAND *'dsidm* *role* *create-managed'*

usage: dsidm \[-v] \[-j] instance role create-managed \[-h] \[--cn \[CN]]

# OPTIONS *'dsidm* *role* *create-managed'*

[**--cn** *\[CN\]*](#cn~7)

Value of cn

# COMMAND *'dsidm* *role* *create-filtered'*

usage: dsidm \[-v] \[-j] instance role create-filtered \[-h] \[--cn \[CN]]

# OPTIONS *'dsidm* *role* *create-filtered'*

[**--cn** *\[CN\]*](#cn~8)

Value of cn

# COMMAND *'dsidm* *role* *create-nested'*

usage: dsidm \[-v] \[-j] instance role create-nested \[-h] \[--cn \[CN]]  
\[--nsroledn \[NSROLEDN]]

# OPTIONS *'dsidm* *role* *create-nested'*

[**--cn** *\[CN\]*](#cn~9)

Value of cn

[**--nsroledn** *\[NSROLEDN\]*](#nsroledn)

Value of nsroledn

# COMMAND *'dsidm* *role* *modify-by-dn'*

usage: dsidm \[-v] \[-j] instance role modify-by-dn \[-h]  
dn changes \[changes ...]

[**dn**](#dn~21)

The dn to modify

[**changes**](#changes~7)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *role* *rename-by-dn'*

usage: dsidm \[-v] \[-j] instance role rename-by-dn \[-h] \[--keep-old-rdn]  
dn new\_dn

[**dn**](#dn~22)

The dn to rename

[**new\_dn**](#new_dn~2)

A new account dn

# OPTIONS *'dsidm* *role* *rename-by-dn'*

[**--keep-old-rdn**](#keep~6)

Specify whether the old RDN (i.e. 'cn: old\_account') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *role* *delete'*

usage: dsidm \[-v] \[-j] instance role delete \[-h] \[dn]

[**dn**](#dn~23)

The dn of the role to delete

# COMMAND *'dsidm* *role* *lock'*

usage: dsidm \[-v] \[-j] instance role lock \[-h] \[dn]

[**dn**](#dn~24)

The dn to lock

# COMMAND *'dsidm* *role* *unlock'*

usage: dsidm \[-v] \[-j] instance role unlock \[-h] \[dn]

[**dn**](#dn~25)

The dn to unlock

# COMMAND *'dsidm* *role* *entry-status'*

usage: dsidm \[-v] \[-j] instance role entry-status \[-h] \[dn]

[**dn**](#dn~26)

The single entry dn to check

# COMMAND *'dsidm* *role* *subtree-status'*

usage: dsidm \[-v] \[-j] instance role subtree-status \[-h] \[-f FILTER]  
\[-s {base,one,sub}]  
basedn

[**basedn**](#basedn~3)

Search base for finding entries

# OPTIONS *'dsidm* *role* *subtree-status'*

[**-f** *FILTER*, **--filter** *FILTER*](#f~3)

Search filter for finding entries

[**-s** *{base,one,sub}*, **--scope** *{base,one,sub}*](#s~3)

Search scope (base, one, sub - default is sub

# COMMAND *'dsidm* *service'*

usage: dsidm \[-v] \[-j] instance service \[-h]  
{list,get,get\_dn,create,modify,rename,delete} ...

# POSITIONAL ARGUMENTS *'dsidm service'*

[**dsidm service** *list*](#dsidm~71)

list

[**dsidm service** *get*](#dsidm~72)

get

[**dsidm service** *get\_dn*](#dsidm~73)

get\_dn

[**dsidm service** *create*](#dsidm~74)

create

[**dsidm service** *modify*](#dsidm~75)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm service** *rename*](#dsidm~76)

rename the object

[**dsidm service** *delete*](#dsidm~77)

deletes the object

# COMMAND *'dsidm* *service* *list'*

usage: dsidm \[-v] \[-j] instance service list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *service* *list'*

[**--full-dn**](#full~6)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *service* *get'*

usage: dsidm \[-v] \[-j] instance service get \[-h] \[selector]

[**selector**](#selector~15)

The term to search for

# COMMAND *'dsidm* *service* *get\_dn'*

usage: dsidm \[-v] \[-j] instance service get\_dn \[-h] \[dn]

[**dn**](#dn~27)

The dn to get

# COMMAND *'dsidm* *service* *create'*

usage: dsidm \[-v] \[-j] instance service create \[-h] \[--cn \[CN]]  
\[--description \[DESCRIPTION]]

# OPTIONS *'dsidm* *service* *create'*

[**--cn** *\[CN\]*](#cn~10)

Value of cn

[**--description** *\[DESCRIPTION\]*](#description~2)

Value of description

# COMMAND *'dsidm* *service* *modify'*

usage: dsidm \[-v] \[-j] instance service modify \[-h]  
selector changes \[changes ...]

[**selector**](#selector~16)

The cn to modify

[**changes**](#changes~8)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *service* *rename'*

usage: dsidm \[-v] \[-j] instance service rename \[-h] \[--keep-old-rdn]  
selector new\_name

[**selector**](#selector~17)

The cn to modify

[**new\_name**](#new_name~5)

A new service name

# OPTIONS *'dsidm* *service* *rename'*

[**--keep-old-rdn**](#keep~7)

Specify whether the old RDN (i.e. 'cn: old\_service') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *service* *delete'*

usage: dsidm \[-v] \[-j] instance service delete \[-h] \[dn]

[**dn**](#dn~28)

The dn to delete

# COMMAND *'dsidm* *uniquegroup'*

usage: dsidm instance uniquegroup \[-h]  
{list,get,get\_dn,create,delete,modify,rename,members,add\_member,remove\_member} ...

# POSITIONAL ARGUMENTS *'dsidm uniquegroup'*

[**dsidm uniquegroup** *list*](#dsidm~78)

list

[**dsidm uniquegroup** *get*](#dsidm~79)

get

[**dsidm uniquegroup** *get\_dn*](#dsidm~80)

get\_dn

[**dsidm uniquegroup** *create*](#dsidm~81)

create

[**dsidm uniquegroup** *delete*](#dsidm~82)

deletes the object

[**dsidm uniquegroup** *modify*](#dsidm~83)

modify <add|delete|replace>:<attribute>:<value> ...

[**dsidm uniquegroup** *rename*](#dsidm~84)

rename the object

[**dsidm uniquegroup** *members*](#dsidm~85)

List member dns of a group

[**dsidm uniquegroup** *add\_member*](#dsidm~86)

Add a member to a group

[**dsidm uniquegroup** *remove\_member*](#dsidm~87)

Remove a member from a group

# COMMAND *'dsidm* *uniquegroup* *list'*

usage: dsidm \[-v] \[-j] instance uniquegroup list \[-h] \[--full-dn]

# OPTIONS *'dsidm* *uniquegroup* *list'*

[**--full-dn**](#full~7)

Return the full DN of the entry instead of the RDN value

# COMMAND *'dsidm* *uniquegroup* *get'*

usage: dsidm \[-v] \[-j] instance uniquegroup get \[-h] \[selector]

[**selector**](#selector~18)

The term to search for

# COMMAND *'dsidm* *uniquegroup* *get\_dn'*

usage: dsidm \[-v] \[-j] instance uniquegroup get\_dn \[-h] \[dn]

[**dn**](#dn~29)

The dn to get

# COMMAND *'dsidm* *uniquegroup* *create'*

usage: dsidm \[-v] \[-j] instance uniquegroup create \[-h] \[--cn \[CN]]

# OPTIONS *'dsidm* *uniquegroup* *create'*

[**--cn** *\[CN\]*](#cn~11)

Value of cn

# COMMAND *'dsidm* *uniquegroup* *delete'*

usage: dsidm \[-v] \[-j] instance uniquegroup delete \[-h] \[dn]

[**dn**](#dn~30)

The dn to delete

# COMMAND *'dsidm* *uniquegroup* *modify'*

usage: dsidm \[-v] \[-j] instance uniquegroup modify \[-h] selector changes \[changes ...]

[**selector**](#selector~19)

The cn to modify

[**changes**](#changes~9)

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

# COMMAND *'dsidm* *uniquegroup* *rename'*

usage: dsidm \[-v] \[-j] instance uniquegroup rename \[-h] \[--keep-old-rdn]  
selector new\_name

[**selector**](#selector~20)

The cn to rename

[**new\_name**](#new_name~6)

A new group name

# OPTIONS *'dsidm* *uniquegroup* *rename'*

[**--keep-old-rdn**](#keep~8)

Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

# COMMAND *'dsidm* *uniquegroup* *members'*

usage: dsidm \[-v] \[-j] instance uniquegroup members \[-h] \[cn]

[**cn**](#cn~12)

cn of group to list members of

# COMMAND *'dsidm* *uniquegroup* *add\_member'*

usage: dsidm \[-v] \[-j] instance uniquegroup add\_member \[-h] \[cn] \[dn]

[**cn**](#cn~13)

cn of group to add member to

[**dn**](#dn~31)

dn of object to add to group as member

# COMMAND *'dsidm* *uniquegroup* *remove\_member'*

usage: dsidm \[-v] \[-j] instance uniquegroup remove\_member \[-h] \[cn] \[dn]

[**cn**](#cn~14)

cn of group to remove member from

[**dn**](#dn~32)

dn of object to remove from group as member

# [OPTIONS](#OPTIONS)

[**-v**, **--verbose**](#v)

Display verbose operation tracing during command execution

[**-j**, **--json**](#j)

Return result in JSON object

[**-b** *BASEDN*, **--basedn** *BASEDN*](#b)

Base DN (root naming context) of the instance to manage

[**-D** *BINDDN*, **--binddn** *BINDDN*](#D)

The account to bind as for executing operations

[**-w** *BINDPW*, **--bindpw** *BINDPW*](#w)

Password for the bind DN

[**-W**, **--prompt**](#W)

Prompt for password of the bind DN

[**-y** *PWDFILE*, **--pwdfile** *PWDFILE*](#y)

Specifies a file containing the password of the bind DN

[**-Z**, **--starttls**](#Z)

Connect with StartTLS

# [AUTHOR](#AUTHOR)

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```

1980-01-01 lib389 3.3.1

---

Document: dsidm(8) from py3.13-lib389 3.3.1-r7 (Chainguard OS)
Source: https://github.com/389ds/389-ds-base.git