---
name: "dsidm"
section: "8"
platform: "linux"
package: "389-ds-base"
version: "3.3.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/dsidm"
---

# dsidm(8)

## NAME

dsidm

## SYNOPSIS

**dsidm** \[-h\] \[-v\] \[-j\] \[-b BASEDN\] \[-D BINDDN\] \[-w BINDPW\] \[-W\] \[-y PWDFILE\] \[-Z\] instance {account,group,initialise,init,organizationalunit,ou,posixgroup,user,client\_config,role,service,uniquegroup} ...

## POSITIONAL ARGUMENTS

- **dsidm** *account*

  Manage generic accounts, with tasks like modify, locking and unlocking. To create an account, see "user" subcommand instead.

- **dsidm** *group*

  Manage groups.  The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups.  Groups uses the objectclass "groupOfNames" and the grouping attribute "member"

- **dsidm** *initialise*

  Initialise a backend with domain information and sample entries

- **dsidm** *organizationalunit*

  Manage organizational units

- **dsidm** *posixgroup*

  Manage posix groups  The organizationalUnit (by default ou=groups") needs to exist prior to managing posix groups.

- **dsidm** *user*

  Manage posix users.  The organizationalUnit (by default "ou=people") needs to exist prior to managing users.

- **dsidm** *client\_config*

  Display and generate client example configs for this LDAP server

- **dsidm** *role*

  Manage roles.

- **dsidm** *service*

  Manage service accounts. The organizationalUnit (by default "ou=Services") needs to exist prior to managing service accounts.

- **dsidm** *uniquegroup*

  Manage groups.  The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups.  Unique groups uses the objectclass "groupOfUniqueNames" and the grouping attribute "uniquemember"

## COMMAND *'dsidm account'*

usage: dsidm instance account \[-h\]\
                               {list,get-by-dn,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status,reset\_password,change\_password,bulk\_update} ...

## POSITIONAL ARGUMENTS *'dsidm account'*

- **dsidm account** *list*

  list accounts that could login to the directory (returns the full DN of the entry)

- **dsidm account** *get-by-dn*

  get-by-dn \<dn\>

- **dsidm account** *modify-by-dn*

  modify-by-dn \<dn\> \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm account** *rename-by-dn*

  rename the object

- **dsidm account** *delete*

  deletes the account

- **dsidm account** *lock*

  lock

- **dsidm account** *unlock*

  unlock

- **dsidm account** *entry-status*

  status of a single entry

- **dsidm account** *subtree-status*

  status of a subtree

- **dsidm account** *reset\_password*

  Reset the password of an account. This should be performed by a directory admin.

- **dsidm account** *change\_password*

  Change the password of an account. This can be performed by any user (with correct rights)

- **dsidm account** *bulk\_update*

  Perform a common operation to a set of entries

## COMMAND *'dsidm account list'*

usage: dsidm \[-v\] \[-j\] instance account list \[-h\]

## COMMAND *'dsidm account get-by-dn'*

usage: dsidm \[-v\] \[-j\] instance account get-by-dn \[-h\] \[dn\]

- **dn**

  The dn to get and display

## COMMAND *'dsidm account modify-by-dn'*

usage: dsidm \[-v\] \[-j\] instance account modify-by-dn \[-h\] dn changes \[changes ...\]

- **dn**

  The dn to get and display

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm account rename-by-dn'*

usage: dsidm \[-v\] \[-j\] instance account rename-by-dn \[-h\] \[--keep-old-rdn\] dn new\_dn

- **dn**

  The dn to rename

- **new\_dn**

  A new role dn

## OPTIONS *'dsidm account rename-by-dn'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_role') should be kept as an attribute of the entry or not

## COMMAND *'dsidm account delete'*

usage: dsidm \[-v\] \[-j\] instance account delete \[-h\] \[dn\]

- **dn**

  The dn of the account to delete

## COMMAND *'dsidm account lock'*

usage: dsidm \[-v\] \[-j\] instance account lock \[-h\] \[dn\]

- **dn**

  The dn to lock

## COMMAND *'dsidm account unlock'*

usage: dsidm \[-v\] \[-j\] instance account unlock \[-h\] \[dn\]

- **dn**

  The dn to unlock

## COMMAND *'dsidm account entry-status'*

usage: dsidm \[-v\] \[-j\] instance account entry-status \[-h\] \[-V\] \[dn\]

- **dn**

  The single entry dn to check

## OPTIONS *'dsidm account entry-status'*

- **-V**, **--details**

  Print more account policy details about the entry

## COMMAND *'dsidm account subtree-status'*

usage: dsidm \[-v\] \[-j\] instance account subtree-status \[-h\] \[-V\] \[-f FILTER\]\
                                              \[-s {one,sub}\] \[-i\]\
                                              \[-o BECOME\_INACTIVE\_ON\]\
                                              basedn

- **basedn**

  Search base for finding entries

## OPTIONS *'dsidm account subtree-status'*

- **-V**, **--details**

  Print more account policy details about the entries

- **-f** *FILTER*, **--filter** *FILTER*

  Search filter for finding entries

- **-s** *{one,sub}*, **--scope** *{one,sub}*

  Search scope (one, sub - default is sub

- **-i**, **--inactive-only**

  Only display inactivated entries

- **-o** *BECOME\_INACTIVE\_ON*, **--become-inactive-on** *BECOME\_INACTIVE\_ON*

  Only display entries that will become inactive before specified date (in a format 2007-04-25T14:30)

## COMMAND *'dsidm account reset\_password'*

usage: dsidm \[-v\] \[-j\] instance account reset\_password \[-h\] \[dn\] \[new\_password\]

- **dn**

  The dn to reset the password for

- **new\_password**

  The new password to set

## COMMAND *'dsidm account change\_password'*

usage: dsidm \[-v\] \[-j\] instance account change\_password \[-h\]\
                                               \[dn\] \[new\_password\]\
                                               \[current\_password\]

- **dn**

  The dn to change the password for

- **new\_password**

  The new password to set

- **current\_password**

  The accounts current password

## COMMAND *'dsidm account bulk\_update'*

usage: dsidm \[-v\] \[-j\] instance account bulk\_update \[-h\] \[-f FILTER\] \[-s {one,sub}\] \[-x\]\
                                           basedn changes \[changes ...\]

- **basedn**

  Search base for finding entries, only the children of this DN are processed

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## OPTIONS *'dsidm account bulk\_update'*

- **-f** *FILTER*, **--filter** *FILTER*

  Search filter for finding entries, default is '(objectclass=\*)'

- **-s** *{one,sub}*, **--scope** *{one,sub}*

  Search scope (one, sub - default is sub

- **-x**, **--stop**

  Stop processing updates when an error occurs. Default is False

## COMMAND *'dsidm group'*

usage: dsidm instance group \[-h\]\
                             {list,get,get\_dn,create,delete,modify,rename,members,add\_member,remove\_member} ...

## POSITIONAL ARGUMENTS *'dsidm group'*

- **dsidm group** *list*

  list

- **dsidm group** *get*

  get

- **dsidm group** *get\_dn*

  get\_dn

- **dsidm group** *create*

  create

- **dsidm group** *delete*

  deletes the object

- **dsidm group** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm group** *rename*

  rename the object

- **dsidm group** *members*

  List member dns of a group

- **dsidm group** *add\_member*

  Add a member to a group

- **dsidm group** *remove\_member*

  Remove a member from a group

## COMMAND *'dsidm group list'*

usage: dsidm \[-v\] \[-j\] instance group list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm group list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm group get'*

usage: dsidm \[-v\] \[-j\] instance group get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm group get\_dn'*

usage: dsidm \[-v\] \[-j\] instance group get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm group create'*

usage: dsidm \[-v\] \[-j\] instance group create \[-h\] \[--cn \[CN\]\]\
                                    \[--description \[DESCRIPTION\]\]

## OPTIONS *'dsidm group create'*

- **--cn** *\[CN\]*

  Value of cn

- **--description** *\[DESCRIPTION\]*

  Value of description

## COMMAND *'dsidm group delete'*

usage: dsidm \[-v\] \[-j\] instance group delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## COMMAND *'dsidm group modify'*

usage: dsidm \[-v\] \[-j\] instance group modify \[-h\] selector changes \[changes ...\]

- **selector**

  The cn to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm group rename'*

usage: dsidm \[-v\] \[-j\] instance group rename \[-h\] \[--keep-old-rdn\] selector new\_name

- **selector**

  The cn to rename

- **new\_name**

  A new group name

## OPTIONS *'dsidm group rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

## COMMAND *'dsidm group members'*

usage: dsidm \[-v\] \[-j\] instance group members \[-h\] \[cn\]

- **cn**

  cn of group to list members of

## COMMAND *'dsidm group add\_member'*

usage: dsidm \[-v\] \[-j\] instance group add\_member \[-h\] \[cn\] \[dn\]

- **cn**

  cn of group to add member to

- **dn**

  dn of object to add to group as member

## COMMAND *'dsidm group remove\_member'*

usage: dsidm \[-v\] \[-j\] instance group remove\_member \[-h\] \[cn\] \[dn\]

- **cn**

  cn of group to remove member from

- **dn**

  dn of object to remove from group as member

## COMMAND *'dsidm initialise'*

usage: dsidm \[-v\] \[-j\] instance initialise \[-h\] \[--version VERSION\]

## OPTIONS *'dsidm initialise'*

- **--version** *VERSION*

  The version of entries to create.

## COMMAND *'dsidm organizationalunit'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit \[-h\]\
                                          {list,get,get\_dn,create,delete,modify,rename} ...

## POSITIONAL ARGUMENTS *'dsidm organizationalunit'*

- **dsidm organizationalunit** *list*

  list

- **dsidm organizationalunit** *get*

  get

- **dsidm organizationalunit** *get\_dn*

  get\_dn

- **dsidm organizationalunit** *create*

  create

- **dsidm organizationalunit** *delete*

  deletes the object

- **dsidm organizationalunit** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm organizationalunit** *rename*

  rename the object

## COMMAND *'dsidm organizationalunit list'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm organizationalunit list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm organizationalunit get'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm organizationalunit get\_dn'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm organizationalunit create'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit create \[-h\] \[--ou \[OU\]\]

## OPTIONS *'dsidm organizationalunit create'*

- **--ou** *\[OU\]*

  Value of ou

## COMMAND *'dsidm organizationalunit delete'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## COMMAND *'dsidm organizationalunit modify'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit modify \[-h\]\
                                                           selector\
                                                           changes \[changes ...\]

- **selector**

  The ou to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm organizationalunit rename'*

usage: dsidm \[-v\] \[-j\] instance organizationalunit rename \[-h\]\
                                                           \[--keep-old-rdn\]\
                                                           selector new\_name

- **selector**

  The ou to rename

- **new\_name**

  A new organizational unit name

## OPTIONS *'dsidm organizationalunit rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'ou: old\_ou') should be kept as an attribute of the entry or not

## COMMAND *'dsidm posixgroup'*

usage: dsidm instance posixgroup \[-h\]\
                                  {list,get,get\_dn,create,delete,modify,rename} ...

## POSITIONAL ARGUMENTS *'dsidm posixgroup'*

- **dsidm posixgroup** *list*

  list

- **dsidm posixgroup** *get*

  get

- **dsidm posixgroup** *get\_dn*

  get\_dn

- **dsidm posixgroup** *create*

  create

- **dsidm posixgroup** *delete*

  deletes the object

- **dsidm posixgroup** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm posixgroup** *rename*

  rename the object

## COMMAND *'dsidm posixgroup list'*

usage: dsidm \[-v\] \[-j\] instance posixgroup list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm posixgroup list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm posixgroup get'*

usage: dsidm \[-v\] \[-j\] instance posixgroup get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm posixgroup get\_dn'*

usage: dsidm \[-v\] \[-j\] instance posixgroup get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm posixgroup create'*

usage: dsidm \[-v\] \[-j\] instance posixgroup create \[-h\] \[--cn \[CN\]\]\
                                         \[--gidNumber \[GIDNUMBER\]\]

## OPTIONS *'dsidm posixgroup create'*

- **--cn** *\[CN\]*

  Value of cn

- **--gidNumber** *\[GIDNUMBER\]*

  Value of gidNumber

## COMMAND *'dsidm posixgroup delete'*

usage: dsidm \[-v\] \[-j\] instance posixgroup delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## COMMAND *'dsidm posixgroup modify'*

usage: dsidm \[-v\] \[-j\] instance posixgroup modify \[-h\] selector changes \[changes ...\]

- **selector**

  The cn to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm posixgroup rename'*

usage: dsidm \[-v\] \[-j\] instance posixgroup rename \[-h\] \[--keep-old-rdn\]\
                                         selector new\_name

- **selector**

  The cn to rename

- **new\_name**

  A new posix group name

## OPTIONS *'dsidm posixgroup rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

## COMMAND *'dsidm user'*

usage: dsidm instance user \[-h\]\
                            \[--user-type {basic,posix,service,traditional}\]\
                            {list,get,get-pwp,get\_dn,create,modify,rename,delete} ...

## POSITIONAL ARGUMENTS *'dsidm user'*

- **dsidm user** *list*

  list

- **dsidm user** *get*

  get

- **dsidm user** *get-pwp*

  Show the effective password policy for a user

- **dsidm user** *get\_dn*

  get\_dn

- **dsidm user** *create*

  create

- **dsidm user** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm user** *rename*

  rename the object

- **dsidm user** *delete*

  deletes the object

## COMMAND *'dsidm user list'*

usage: dsidm \[-v\] \[-j\] instance user list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm user list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm user get'*

usage: dsidm \[-v\] \[-j\] instance user get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm user get-pwp'*

usage: dsidm \[-v\] \[-j\] instance user get-pwp \[-h\] \[--parent-dn PARENT\_DN\] \[selector\]

Resolve and display the password policy (global, user local, or subtree local) that applies to the user, including all effective settings.

- **selector**

  The user identifier to look up (same as user get, typically uid)

## OPTIONS *'dsidm user get-pwp'*

- **--parent-dn** *PARENT\_DN*

  A base DN to use for user lookups. Default is "ou=people,$SUFFIX" for users, or "ou=services,$SUFFIX" for service accounts

## COMMAND *'dsidm user get\_dn'*

usage: dsidm \[-v\] \[-j\] instance user get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm user create'*

usage: dsidm \[-v\] \[-j\] instance user create \[-h\] \[--uid \[UID\]\] \[--cn \[CN\]\]\
                                   \[--displayName \[DISPLAYNAME\]\]\
                                   \[--uidNumber \[UIDNUMBER\]\]\
                                   \[--gidNumber \[GIDNUMBER\]\]\
                                   \[--homeDirectory \[HOMEDIRECTORY\]\]

## OPTIONS *'dsidm user create'*

- **--uid** *\[UID\]*

  Value of uid

- **--cn** *\[CN\]*

  Value of cn

- **--displayName** *\[DISPLAYNAME\]*

  Value of displayName

- **--uidNumber** *\[UIDNUMBER\]*

  Value of uidNumber

- **--gidNumber** *\[GIDNUMBER\]*

  Value of gidNumber

- **--homeDirectory** *\[HOMEDIRECTORY\]*

  Value of homeDirectory

## COMMAND *'dsidm user modify'*

usage: dsidm \[-v\] \[-j\] instance user modify \[-h\] selector changes \[changes ...\]

- **selector**

  The uid to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm user rename'*

usage: dsidm \[-v\] \[-j\] instance user rename \[-h\] \[--keep-old-rdn\] selector new\_name

- **selector**

  The uid to modify

- **new\_name**

  A new user name

## OPTIONS *'dsidm user rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_user') should be kept as an attribute of the entry or not

## COMMAND *'dsidm user delete'*

usage: dsidm \[-v\] \[-j\] instance user delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## OPTIONS *'dsidm user'*

- **--user-type** *{basic,posix,service,traditional}*

  The type of user to manage. "basic" is an entry based off of objectclasses: nsPerson, nsAccount, and nsOrgPerson. "posix" is based off of objectclasses: nsPerson, nsAccount, nsOrgPerson, and posixAccount. "service" is based off of objectclasses: nsAccount and applicationProcess. "traditional", aka legacy, is based off of objectclasses: person, organizationalPerson, and inetOrgPerson. The default user type is "posix"

## COMMAND *'dsidm client\_config'*

usage: dsidm instance client\_config \[-h\] {sssd.conf,ldap.conf,display} ...

## POSITIONAL ARGUMENTS *'dsidm client\_config'*

- **dsidm client\_config** *sssd.conf*

  Generate a SSSD configuration for this LDAP server

- **dsidm client\_config** *ldap.conf*

  Generate an OpenLDAP ldap.conf configuration for this LDAP server

- **dsidm client\_config** *display*

  Display generic application parameters for LDAP connection

## COMMAND *'dsidm client\_config sssd.conf'*

usage: dsidm instance client\_config sssd.conf \[-h\] \[allowed\_group\]

- **allowed\_group**

  The name of the group allowed access to this system

## COMMAND *'dsidm client\_config ldap.conf'*

usage: dsidm instance client\_config ldap.conf \[-h\]

## COMMAND *'dsidm client\_config display'*

usage: dsidm instance client\_config display \[-h\]

## COMMAND *'dsidm role'*

usage: dsidm \[-v\] \[-j\] instance role \[-h\]\
                            {list,get,get-by-dn,create-managed,create-filtered,create-nested,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status} ...

## POSITIONAL ARGUMENTS *'dsidm role'*

- **dsidm role** *list*

  list roles that could login to the directory

- **dsidm role** *get*

  get

- **dsidm role** *get-by-dn*

  get-by-dn \<dn\>

- **dsidm role** *create-managed*

  create

- **dsidm role** *create-filtered*

  create

- **dsidm role** *create-nested*

  create

- **dsidm role** *modify-by-dn*

  modify-by-dn \<dn\> \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm role** *rename-by-dn*

  rename the object

- **dsidm role** *delete*

  deletes the role

- **dsidm role** *lock*

  lock

- **dsidm role** *unlock*

  unlock

- **dsidm role** *entry-status*

  status of a single entry

- **dsidm role** *subtree-status*

  status of a subtree

## COMMAND *'dsidm role list'*

usage: dsidm \[-v\] \[-j\] instance role list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm role list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm role get'*

usage: dsidm \[-v\] \[-j\] instance role get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm role get-by-dn'*

usage: dsidm \[-v\] \[-j\] instance role get-by-dn \[-h\] \[dn\]

- **dn**

  The dn to get and display

## COMMAND *'dsidm role create-managed'*

usage: dsidm \[-v\] \[-j\] instance role create-managed \[-h\] \[--cn \[CN\]\]

## OPTIONS *'dsidm role create-managed'*

- **--cn** *\[CN\]*

  Value of cn

## COMMAND *'dsidm role create-filtered'*

usage: dsidm \[-v\] \[-j\] instance role create-filtered \[-h\] \[--cn \[CN\]\]

## OPTIONS *'dsidm role create-filtered'*

- **--cn** *\[CN\]*

  Value of cn

## COMMAND *'dsidm role create-nested'*

usage: dsidm \[-v\] \[-j\] instance role create-nested \[-h\] \[--cn \[CN\]\]\
                                                    \[--nsroledn \[NSROLEDN\]\]

## OPTIONS *'dsidm role create-nested'*

- **--cn** *\[CN\]*

  Value of cn

- **--nsroledn** *\[NSROLEDN\]*

  Value of nsroledn

## COMMAND *'dsidm role modify-by-dn'*

usage: dsidm \[-v\] \[-j\] instance role modify-by-dn \[-h\]\
                                                   dn changes \[changes ...\]

- **dn**

  The dn to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm role rename-by-dn'*

usage: dsidm \[-v\] \[-j\] instance role rename-by-dn \[-h\] \[--keep-old-rdn\]\
                                                   dn new\_dn

- **dn**

  The dn to rename

- **new\_dn**

  A new account dn

## OPTIONS *'dsidm role rename-by-dn'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_account') should be kept as an attribute of the entry or not

## COMMAND *'dsidm role delete'*

usage: dsidm \[-v\] \[-j\] instance role delete \[-h\] \[dn\]

- **dn**

  The dn of the role to delete

## COMMAND *'dsidm role lock'*

usage: dsidm \[-v\] \[-j\] instance role lock \[-h\] \[dn\]

- **dn**

  The dn to lock

## COMMAND *'dsidm role unlock'*

usage: dsidm \[-v\] \[-j\] instance role unlock \[-h\] \[dn\]

- **dn**

  The dn to unlock

## COMMAND *'dsidm role entry-status'*

usage: dsidm \[-v\] \[-j\] instance role entry-status \[-h\] \[dn\]

- **dn**

  The single entry dn to check

## COMMAND *'dsidm role subtree-status'*

usage: dsidm \[-v\] \[-j\] instance role subtree-status \[-h\] \[-f FILTER\]\
                                                     \[-s {base,one,sub}\]\
                                                     basedn

- **basedn**

  Search base for finding entries

## OPTIONS *'dsidm role subtree-status'*

- **-f** *FILTER*, **--filter** *FILTER*

  Search filter for finding entries

- **-s** *{base,one,sub}*, **--scope** *{base,one,sub}*

  Search scope (base, one, sub - default is sub

## COMMAND *'dsidm service'*

usage: dsidm \[-v\] \[-j\] instance service \[-h\]\
                               {list,get,get\_dn,create,modify,rename,delete} ...

## POSITIONAL ARGUMENTS *'dsidm service'*

- **dsidm service** *list*

  list

- **dsidm service** *get*

  get

- **dsidm service** *get\_dn*

  get\_dn

- **dsidm service** *create*

  create

- **dsidm service** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm service** *rename*

  rename the object

- **dsidm service** *delete*

  deletes the object

## COMMAND *'dsidm service list'*

usage: dsidm \[-v\] \[-j\] instance service list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm service list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm service get'*

usage: dsidm \[-v\] \[-j\] instance service get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm service get\_dn'*

usage: dsidm \[-v\] \[-j\] instance service get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm service create'*

usage: dsidm \[-v\] \[-j\] instance service create \[-h\] \[--cn \[CN\]\]\
                                                \[--description \[DESCRIPTION\]\]

## OPTIONS *'dsidm service create'*

- **--cn** *\[CN\]*

  Value of cn

- **--description** *\[DESCRIPTION\]*

  Value of description

## COMMAND *'dsidm service modify'*

usage: dsidm \[-v\] \[-j\] instance service modify \[-h\]\
                                                selector changes \[changes ...\]

- **selector**

  The cn to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm service rename'*

usage: dsidm \[-v\] \[-j\] instance service rename \[-h\] \[--keep-old-rdn\]\
                                                selector new\_name

- **selector**

  The cn to modify

- **new\_name**

  A new service name

## OPTIONS *'dsidm service rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_service') should be kept as an attribute of the entry or not

## COMMAND *'dsidm service delete'*

usage: dsidm \[-v\] \[-j\] instance service delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## COMMAND *'dsidm uniquegroup'*

usage: dsidm instance uniquegroup \[-h\]\
                                   {list,get,get\_dn,create,delete,modify,rename,members,add\_member,remove\_member} ...

## POSITIONAL ARGUMENTS *'dsidm uniquegroup'*

- **dsidm uniquegroup** *list*

  list

- **dsidm uniquegroup** *get*

  get

- **dsidm uniquegroup** *get\_dn*

  get\_dn

- **dsidm uniquegroup** *create*

  create

- **dsidm uniquegroup** *delete*

  deletes the object

- **dsidm uniquegroup** *modify*

  modify \<add\|delete\|replace\>:\<attribute\>:\<value\> ...

- **dsidm uniquegroup** *rename*

  rename the object

- **dsidm uniquegroup** *members*

  List member dns of a group

- **dsidm uniquegroup** *add\_member*

  Add a member to a group

- **dsidm uniquegroup** *remove\_member*

  Remove a member from a group

## COMMAND *'dsidm uniquegroup list'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup list \[-h\] \[--full-dn\]

## OPTIONS *'dsidm uniquegroup list'*

- **--full-dn**

  Return the full DN of the entry instead of the RDN value

## COMMAND *'dsidm uniquegroup get'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup get \[-h\] \[selector\]

- **selector**

  The term to search for

## COMMAND *'dsidm uniquegroup get\_dn'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup get\_dn \[-h\] \[dn\]

- **dn**

  The dn to get

## COMMAND *'dsidm uniquegroup create'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup create \[-h\] \[--cn \[CN\]\]

## OPTIONS *'dsidm uniquegroup create'*

- **--cn** *\[CN\]*

  Value of cn

## COMMAND *'dsidm uniquegroup delete'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup delete \[-h\] \[dn\]

- **dn**

  The dn to delete

## COMMAND *'dsidm uniquegroup modify'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup modify \[-h\] selector changes \[changes ...\]

- **selector**

  The cn to modify

- **changes**

  A list of changes to apply in format: \<add\|delete\|replace\>:\<attribute\>:\<value\>

## COMMAND *'dsidm uniquegroup rename'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup rename \[-h\] \[--keep-old-rdn\]\
                                          selector new\_name

- **selector**

  The cn to rename

- **new\_name**

  A new group name

## OPTIONS *'dsidm uniquegroup rename'*

- **--keep-old-rdn**

  Specify whether the old RDN (i.e. 'cn: old\_group') should be kept as an attribute of the entry or not

## COMMAND *'dsidm uniquegroup members'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup members \[-h\] \[cn\]

- **cn**

  cn of group to list members of

## COMMAND *'dsidm uniquegroup add\_member'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup add\_member \[-h\] \[cn\] \[dn\]

- **cn**

  cn of group to add member to

- **dn**

  dn of object to add to group as member

## COMMAND *'dsidm uniquegroup remove\_member'*

usage: dsidm \[-v\] \[-j\] instance uniquegroup remove\_member \[-h\] \[cn\] \[dn\]

- **cn**

  cn of group to remove member from

- **dn**

  dn of object to remove from group as member

## OPTIONS

- **-v**, **--verbose**

  Display verbose operation tracing during command execution

- **-j**, **--json**

  Return result in JSON object

- **-b** *BASEDN*, **--basedn** *BASEDN*

  Base DN (root naming context) of the instance to manage

- **-D** *BINDDN*, **--binddn** *BINDDN*

  The account to bind as for executing operations

- **-w** *BINDPW*, **--bindpw** *BINDPW*

  Password for the bind DN

- **-W**, **--prompt**

  Prompt for password of the bind DN

- **-y** *PWDFILE*, **--pwdfile** *PWDFILE*

  Specifies a file containing the password of the bind DN

- **-Z**, **--starttls**

  Connect with StartTLS

## AUTHOR

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```