refcard.tex

% Copyright 2017 ForgeRock AS.
\documentclass[10pt,landscape]{article}
\usepackage[usenames, dvipsnames]{color}
\usepackage[landscape]{geometry}
\usepackage{hyperref}
\usepackage{ifthen}
\usepackage{listings}
\usepackage{multicol}
\usepackage{textcomp}

% Bash code listings can wrap at white space, with \ for line continuation.
\lstset{
basicstyle=\footnotesize\ttfamily,
breakatwhitespace=true,
breaklines=true,
columns=flexible,
commentstyle=\color{Gray},
language=sh,
prebreak=\small\symbol{'134},
showstringspaces=false,
upquote=true
}

% No headers or footers.
\pagestyle{empty}

% No section numbers.
\setcounter{secnumdepth}{0}

% Use less white space.
\geometry{top=1cm,left=1cm,right=1cm,bottom=1cm}
\setlength{\parindent}{0pt}
\setlength{\parskip}{0pt plus 0.5ex}
\makeatletter
\renewcommand{\section}{\@startsection{section}{1}{0mm}%
                                {-1ex plus -.5ex minus -.2ex}%
                                {0.5ex plus .2ex}%x
                                {\normalfont\normalsize\bfseries}}
\renewcommand{\subsection}{\@startsection{subsection}{2}{0mm}%
                                {-1explus -.5ex minus -.2ex}%
                                {0.5ex plus .2ex}%
                                {\normalfont\small\bfseries}}
\renewcommand{\subsubsection}{\@startsection{subsubsection}{3}{0mm}%
                                {-1ex plus -.5ex minus -.2ex}%
                                {1ex plus .2ex}%
                                {\normalfont\footnotesize\bfseries}}
\makeatother


% -----------------------------------------------------------------------------

\begin{document}
\raggedright
\footnotesize
\begin{multicols}{3}

\section{ForgeRock DS/OpenDJ Refcard}

\textbf{1.0 for server 5.5/4.1}

This card demonstrates common administrative and user tasks.

Command examples run in Bash, using short options where available.
Use \verb!--help! for detailed usage.

Settings shown here are appropriate for evaluation on a single host system.
For production deployments, read the documentation at
\href{https://backstage.forgerock.com/docs/ds}{https://backstage.forgerock.com/docs/ds}.



\section{Getting the Software}

\subsection{Download ForgeRock DS}
\href{https://backstage.forgerock.com/downloads}{https://backstage.forgerock.com/downloads}

\subsection{Install Directory Server}
\begin{lstlisting}
cd /path/to ; unzip ~/Downloads/DS-5.5.zip
./opendj/setup directory-server -D "cn=Directory Manager" -w password -h ldap.example.com -p 1389 -Z 1636 --httpPort 8080 --httpsPort 8443 --adminConnectorPort 4444 -b dc=example,dc=com -l /path/to/Example.ldif --acceptLicense
\end{lstlisting}

\subsection{Install Directory Proxy}
\begin{lstlisting}
cd /path/to ; unzip ~/Downloads/DS-5.5.zip
# Proxy for OpenDJ/ForgeRock DS:
./opendj/setup proxy-server -D "cn=Directory Manager" -w password -h ldap.example.com -p 1389 -Z 1636 --adminConnectorPort 4444 --replicationServer rs.example.com:4444 --replicationBindDN "uid=admin,cn=Administrators,cn=admin data" --replicationBindPassword password --proxyUserBindDn cn=Proxy,ou=Apps,dc=example,dc=com --proxyUserBindPassword password --acceptLicense -X
# Proxy for generic LDAPv3:
./opendj/setup proxy-server -D "cn=Directory Manager" -w password -h ldap.example.com -p 1389 -Z 1636 --adminConnectorPort 4444 --staticPrimaryServer remote.example.com:1389 --baseDn dc=example,dc=com --proxyUserBindDn cn=Proxy,ou=Apps,dc=example,dc=com --proxyUserBindPassword password --acceptLicense
\end{lstlisting}

\subsection{Uninstall Server}
\begin{lstlisting}
# First unconfigure replication, if configured.
/path/to/opendj/bin/dsreplication unconfigure -h ldap.example.com -p 4444 -D "cn=Directory Manager" -w password --unconfigureAll -X -n
/path/to/opendj/bin/stop-ds ; rm -rf /path/to/opendj
\end{lstlisting}


\section{Managing Servers}

\verb!export PATH=/path/to/opendj/bin:$PATH!

\begin{tabular}{@{}ll@{}}
Start GUI       & \verb!control-panel &! \\
Start server    & \verb!start-ds! \\
Stop server     & \verb!stop-ds! \\
Restart server  & \verb!stop-ds -R!
\end{tabular}

\subsection{Data}

\subsubsection{Enable Referential Integrity}
\begin{lstlisting}
dsconfig set-plugin-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --plugin-name "Referential Integrity" --set enabled:true -X -n
\end{lstlisting}

\subsubsection{Create Backend}
\begin{lstlisting}
dsconfig create-backend -h localhost -p 4444 -D "cn=Directory Manager" -w password --backend-name userRoot -t je --set enabled:true --set base-dn:dc=example,dc=com --set db-cache-percent:50 -X -n
\end{lstlisting}

\subsubsection{Generate LDIF}
\begin{lstlisting}
makeldif -o /path/to/generated.ldif /path/to/opendj/config/MakeLDIF/example.template
\end{lstlisting}

\subsubsection{Import LDIF}
\begin{lstlisting}
import-ldif -h localhost -p 4444 -D "cn=Directory Manager" -w password -l /path/to/generated.ldif -n userRoot -t 0 -X
\end{lstlisting}

\subsubsection{Backup All Data}
\begin{lstlisting}
backup -h localhost -p 4444 -D "cn=Directory Manager" -w password -a -d /path/to/opendj/bak -t 0 -X
\end{lstlisting}

\subsubsection{Export LDIF}
\begin{lstlisting}
export-ldif -h localhost -p 4444 -D "cn=Directory Manager" -w password -l /path/to/export.ldif -n userRoot -t 0 -X
\end{lstlisting}

\subsubsection{Restore All Backends}
\begin{lstlisting}
restore -h localhost -p 4444 -D "cn=Directory Manager" -w password -d /path/to/opendj/bak -t 0 -X
\end{lstlisting}

\subsubsection{Delete Backend}
\begin{lstlisting}
dsconfig delete-backend -h localhost -p 4444 -D "cn=Directory Manager" -w password --backend-name userRoot -X -n
\end{lstlisting}

\subsection{Indexes}

\subsubsection{Create Standard Index}
\begin{lstlisting}
dsconfig create-backend-index -h localhost -p 4444 -D "cn=Directory Manager" -w password --backend-name userRoot --index-name description --set index-type:equality -X -n
\end{lstlisting}

\subsubsection{Rebuild an Index}
\begin{lstlisting}
rebuild-index -h localhost -p 4444 -D "cn=Directory Manager" -w password -b dc=example,dc=com --index description -t 0 -X
\end{lstlisting}

\subsubsection{Rebuild All Indexes}
\begin{lstlisting}
rebuild-index -h localhost -p 4444 -D "cn=Directory Manager" -w password -b dc=example,dc=com --rebuildAll -t 0 -X
\end{lstlisting}

\subsubsection{Verify Indexes}
\begin{lstlisting}
stop-ds -Q ; verify-index -b dc=example,dc=com --countErrors
\end{lstlisting}

\subsection{Passwords}

\subsubsection{Read User's Password Policy}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password -b dc=example,dc=com "(uid=bjensen)" pwdPolicySubentry
\end{lstlisting}

\subsubsection{Assign Password Admin Privilege}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: uid=kvaughan,ou=People,dc=example,dc=com
changetype: modify
add: ds-privilege-name
ds-privilege-name: password-reset
\end{lstlisting}

\subsubsection{Reset Password}
\begin{lstlisting}
ldappasswordmodify -h localhost -p 1389 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery -a dn:uid=scarter,ou=People,dc=example,dc=com -n changeit
\end{lstlisting}

\subsubsection{Reset Forgotten Root DN Password}
\begin{lstlisting}
stop-ds
encode-password -s PBKDF2 -i
Please enter the password :
Please renter the password:
Encoded Password:  "{PBKDF2}10000:***"
# On cn=Directory Manager,cn=Root DNs,cn=config,
# set userPassword: {PBKDF2}10000:***
vi /path/to/opendj/config/config.ldif
start-ds
\end{lstlisting}

\subsubsection{Reset Global Admin Password}
\begin{lstlisting}
ldappasswordmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password -a "dn:cn=admin,cn=Administrators,cn=admin data" -n changeit
\end{lstlisting}

\subsection{Accounts}

\subsubsection{Assign Account Admin Rights}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: ou=People,dc=example,dc=com
changetype: modify
add: aci
aci: (target="ldap:///ou=People,dc=example,dc=com")
 (targetattr ="*||+")(version 3.0;
  acl "Allow access to change all attributes";
  allow(all) userdn =
  "ldap:///uid=kvaughan,ou=People,dc=example,dc=com";)
\end{lstlisting}

\subsubsection{Lock Account}
\begin{lstlisting}
manage-account set-account-is-disabled -h localhost -p 4444 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery -X -b uid=scarter,ou=People,dc=example,dc=com -O true
\end{lstlisting}

\subsubsection{Unlock Account}
\begin{lstlisting}
manage-account set-account-is-disabled -h localhost -p 4444 -D uid=kvaughan,ou=people,dc=example,dc=com -w bribery -X -b uid=scarter,ou=People,dc=example,dc=com -O false
\end{lstlisting}

\subsubsection{Enable Email Account Notifications}
\begin{lstlisting}
dsconfig set-global-configuration-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --set smtp-server:smtp.example.com -X -n
dsconfig set-account-status-notification-handler-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --handler-name "SMTP Handler" --set enabled:true --set email-address-attribute-type:mail -X -n
dsconfig set-password-policy-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --policy-name "Default Password Policy" --set account-status-notification-handler:"SMTP Handler" -X -n
\end{lstlisting}

\subsection{Replication}

\subsubsection{Basic Two-Server Setup}
\begin{lstlisting}
cd /path/to ; unzip ~/Downloads/DS-5.5.zip ; cp -R opendj replica
./opendj/setup directory-server -D "cn=Directory Manager" -w password -h ldap.example.com -p 1389 -Z 1636 --adminConnectorPort 4444 -b dc=example,dc=com -l /path/to/Example.ldif --acceptLicense
./replica/setup directory-server -D "cn=Directory Manager" -w password -h ldap.example.com -p 2389 -Z 3636 --adminConnectorPort 5444 -b dc=example,dc=com -a --acceptLicense
\end{lstlisting}

\subsubsection{Configure Replication}
\begin{lstlisting}
dsreplication configure --adminUID admin --adminPassword password --baseDn dc=example,dc=com --host1 ldap.example.com --port1 4444 --bindDN1 "cn=Directory Manager" --bindPassword1 password --replicationPort1 8989 --host2 ldap.example.com --port2 5444 --bindDN2 "cn=Directory Manager" --bindPassword2 password --replicationPort2 9989 -X -n
\end{lstlisting}

\subsubsection{Initialize Replication}
\begin{lstlisting}
dsreplication initialize-all -h ldap.example.com -p 4444 -I admin -w password -b dc=example,dc=com -X -n
\end{lstlisting}

\subsubsection{Check Replication Status}
\begin{lstlisting}
dsreplication status -h ldap.example.com -p 4444 -I admin -w password -X -n
\end{lstlisting}

\subsubsection{Restore Replica From Backup}
\begin{lstlisting}
dsreplication pre-external-initialization -h ldap.example.com -p 4444 -I admin -w password -b dc=example,dc=com -X -n
restore -h localhost -p 4444 -D "cn=Directory Manager" -w password -d /path/to/opendj/bak -t 0 -X
dsreplication post-external-initialization -h ldap.example.com -p 4444 -I admin -w password -b dc=example,dc=com -X -n
\end{lstlisting}

\subsubsection{Read Changelog}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password -b cn=changelog -J "1.3.6.1.4.1.26027.1.5.4:false" "(&)" changes changeLogCookie targetDN
\end{lstlisting}

\subsubsection{Suspend/Resume Replication}
\begin{lstlisting}
dsreplication suspend -h ldap.example.com -p 4444 -I admin -w password -X -n
dsreplication resume -h ldap.example.com -p 4444 -I admin -w password -X -n
\end{lstlisting}

\subsubsection{Unconfigure Replication}
\begin{lstlisting}
dsreplication unconfigure -h ldap.example.com -p 4444 -D "cn=Directory Manager" -w password --unconfigureAll -X -n
dsreplication unconfigure -h ldap.example.com -p 5444 -D "cn=Directory Manager" -w password --unconfigureAll -X -n
\end{lstlisting}

\subsection{Default Logs}

\begin{tabular}{@{}ll@{}}
\verb!logs/errors!                  & Server errors and info \\
\verb!logs/http-access.audit.json!  & Common HTTP access \\
\verb!logs/ldap-access.audit.json!  & Common LDAP access \\
\verb!logs/replication!             & Replication repair \\
\verb!logs/server.out!              & Server events since startup \\
\verb!logs/server.pid!              & Server process ID
\end{tabular}

\subsection{Monitoring}

\subsubsection{Read Monitor Info}
\begin{lstlisting}
# LDAP
ldapsearch -p 1389 -D "cn=Directory Manager" -w password -b cn=monitor "(&)" \* +
# REST
curl --user kvaughan:bribery \
 http://localhost:8080/admin/monitor
\end{lstlisting}

\subsubsection{Check Server Status}
\begin{lstlisting}
status -D "cn=Directory Manager" -w password -X
\end{lstlisting}

\subsubsection{Enable Email Alerts}
\begin{lstlisting}
dsconfig set-global-configuration-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --set smtp-server:smtp.example.com -X -n
dsconfig create-alert-handler -h localhost -p 4444 -D "cn=Directory Manager" -w password --handler-name "SMTP Alert Handler" -t smtp --set enabled:true --set message-subject:"Directory Server Alert, Type: %%alert-type%%, ID: %%alert-id%%" --set message-body:"%%alert-message%%" --set recipient-address:admin@example.com --set sender-address:opendj@example.com -X -n
\end{lstlisting}

\subsection{Security}

\subsubsection{Import Trusted Cert}
\begin{lstlisting}
keytool -import -alias ca-cert -file ca.crt -trustcacerts -keystore /path/to/opendj/config/keystore -storepass:file /path/to/opendj/config/keystore.pin -storetype PKCS12 -noprompt
\end{lstlisting}

\subsubsection{Change Key Pair/Cert Alias}
\begin{lstlisting}
keytool -genkeypair -alias new-cert -ext "san=dns:ldap.example.com" -dname "CN=ldap.example.com,O=Example Corp,C=FR" -keystore /path/to/opendj/config/keystore -storetype PKCS12 -storepass:file /path/to/opendj/config/keystore.pin -keypass:file /path/to/opendj/config/keystore.pin
dsconfig set-connection-handler-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --handler-name "LDAPS Connection Handler" --set ssl-cert-nickname:new-cert -X -n
dsconfig set-connection-handler-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --handler-name "LDAPS Connection Handler" --set enabled:false -X -n
dsconfig set-connection-handler-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --handler-name "LDAPS Connection Handler" --set enabled:true -X -n
\end{lstlisting}

\subsection{Troubleshooting}

\subsubsection{Cancel Task}
\begin{lstlisting}
# Display task IDs
manage-tasks -h localhost -p 4444 -D "cn=Directory Manager" -w password -s -X
# Cancel by ID
manage-tasks -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -c <taskID>
\end{lstlisting}

\subsubsection{Enter Lockdown Mode}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: ds-task-id=Enter Lockdown Mode,cn=Scheduled Tasks,cn=tasks
objectClass: top
objectClass: ds-task
ds-task-id: Enter Lockdown Mode
ds-task-class-name: org.opends.server.tasks.EnterLockdownModeTask
\end{lstlisting}

\subsubsection{Leave Lockdown Mode}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: ds-task-id=Leave Lockdown Mode,cn=Scheduled Tasks,cn=tasks
objectClass: top
objectClass: ds-task
ds-task-id: Leave Lockdown Mode
ds-task-class-name: org.opends.server.tasks.LeaveLockdownModeTask
\end{lstlisting}

\subsubsection{Enable Debug Logging}
\begin{lstlisting}
dsconfig set-log-publisher-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --publisher-name "File-Based Debug Logger" --set enabled:true -X -n
dsconfig create-debug-target -h localhost -p 4444 -D "cn=Directory Manager" -w password --publisher-name "File-Based Debug Logger" -t generic --target-name org.opends.server.api --set enabled:true -X -n
tail -f /path/to/opendj/logs/debug
\end{lstlisting}

\subsubsection{Log TLS/SSL Debug Info}
\begin{lstlisting}
OPENDJ_JAVA_ARGS="-Djavax.net.debug=all" stop-ds -R
\end{lstlisting}


\section{Using Client Applications}

\verb!export PATH=/path/to/opendj/bin:$PATH!

\subsection{LDAP}

\subsubsection{Simple Search Filter}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)"
\end{lstlisting}

\subsubsection{Complex Search Filter}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(&(sn=Jensen)(l=San Francisco))"
\end{lstlisting}

\subsubsection{Search Attribute Lists}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)" mail
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)" +
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)" @person
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)" 1.1
\end{lstlisting}

\subsubsection{Search Filter Operators}
\begin{tabular}{@{}ll@{}}
\verb!=!             & Equality, as in \verb!(sn=Jensen)! \\
\verb!<=!            & Less than or equal to, alphanumeric \\
\verb!>=!            & Greater than or equal to, alphanumeric \\
\verb!=*!            & Presence, e.g. all entries with \verb!userPassword! \\
                     & match \verb!(userPassword=*)!. \\
\verb!~=!            & Approximate, "sounds like" \\
\verb![:dn][:oid]:=! & Extensible match, e.g. \verb!(ou:dn:=people)! \\
                     & matches all entries with \verb!ou=people! \\
                     & in the DN or in the entry. \\
                     & E.g. \verb!(lastLoginTime:! \\
                     & \verb!1.3.6.1.4.1.26027.1.4.5:=-13w)! \\
                     & matches entries with last login \\
                     & in last 13 weeks. \\
                     & Add digits to OID: \\
                     & 1. (\verb!<!), .2 (\verb!<=!), \\
                     & .3 (\verb!=!, default), .4 (\verb!>=!), \\
                     & .5 (\verb!>!), .6 (substring). \\
\verb$!$             & NOT, as in \verb$!(objectclass=person)$ \\
\verb!&!             & AND, as in \verb!(&(sn=Jensen)! \\
                     & \verb!(l=San Francisco))! \\
\verb!|!             & OR, as in \verb!(|(sn=Jensen)(sn=Johnson))!
\end{tabular}

\subsubsection{Search Filter Escape Characters}
\begin{tabular}{@{}ll@{}}
Replace           & With \\
\verb!*!          & \verb!\2a! \\
\verb!(!          & \verb!\28! \\
\verb!)!          & \verb!\29! \\
\verb!\!          & \verb!\5c! \\
\verb!NUL (0x00)! & \verb!\00!
\end{tabular}

\subsubsection{Add Entry}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=Arsene Lupin,ou=Special Users,dc=example,dc=com
objectClass: person
objectClass: top
cn: Arsene Lupin
telephoneNumber: +33 1 23 45 67 89
sn: Lupin
\end{lstlisting}

\subsubsection{Add Attribute Value}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=Arsene Lupin,ou=Special Users,dc=example,dc=com
changetype: modify
add: description
description: Gentleman thief and master of disguise
\end{lstlisting}

\subsubsection{Replace Attribute Value}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=Arsene Lupin,ou=Special Users,dc=example,dc=com
changetype: modify
replace: description
description: Fictional character
\end{lstlisting}

\subsubsection{Delete Attribute}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=Arsene Lupin,ou=Special Users,dc=example,dc=com
changetype: modify
delete: description
\end{lstlisting}

\subsubsection{Delete Single Attribute Value}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: uid=bjensen,ou=People,dc=example,dc=com
changetype: modify
delete: cn
cn: Babs Jensen
\end{lstlisting}

\subsubsection{Move Entry}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=Arsene Lupin,ou=Special Users,dc=example,dc=com
changetype: moddn
newrdn: cn=Arsene Lupin
deleteoldrdn: 0
newsuperior: ou=People,dc=example,dc=com
\end{lstlisting}

\subsubsection{Rename Entry}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: uid=scarter,ou=people,dc=example,dc=com
changetype: modrdn
newrdn: uid=sjensen
deleteoldrdn: 1

dn: uid=sjensen,ou=people,dc=example,dc=com
changetype: modify
replace: cn
cn: Sam Jensen
-
replace: sn
sn: Jensen
-
replace: homeDirectory
homeDirectory: /home/sjensen
-
replace: mail
mail: sjensen@example.com
\end{lstlisting}

\subsubsection{Delete Entry}
\begin{lstlisting}
ldapdelete -h localhost -p 1389 -D "cn=Directory Manager" -w password "cn=Arsene Lupin,ou=People,dc=example,dc=com"
\end{lstlisting}

\subsubsection{Change Own Password}
\begin{lstlisting}
ldappasswordmodify -h localhost -p 1389 -a dn:uid=bjensen,ou=people,dc=example,dc=com -c hifalutin -n changeit
\end{lstlisting}

\subsubsection{Read Schema}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b cn=schema -s base "(&)" +
\end{lstlisting}

\subsubsection{Read Server Capabilities}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b "" -s base "(&)" +
\end{lstlisting}

\subsubsection{Create Static Group}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=My Static Group,ou=Groups,dc=example,dc=com
cn: My Static Group
objectClass: groupOfNames
objectClass: top
ou: Groups
member: uid=ahunter,ou=People,dc=example,dc=com
member: uid=bjensen,ou=People,dc=example,dc=com
member: uid=tmorris,ou=People,dc=example,dc=com
\end{lstlisting}

\subsubsection{Create Dynamic Group}
\begin{lstlisting}
ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password
dn: cn=My Dynamic Group,ou=Groups,dc=example,dc=com
cn: My Dynamic Group
objectClass: top
objectClass: groupOfURLs
ou: Groups
memberURL: ldap:///ou=People,dc=example,dc=com??sub?l=San Francisco
\end{lstlisting}

\subsubsection{Read Group Membership}
\begin{lstlisting}
ldapsearch -h localhost -p 1389 -b dc=example,dc=com "(uid=bjensen)" isMemberOf
\end{lstlisting}

\subsection{REST}

\subsubsection{Enable \texttt{/api}}
\begin{lstlisting}
dsconfig set-http-endpoint-prop -h localhost -p 4444 -D "cn=Directory Manager" -w password --endpoint-name /api --set authorization-mechanism:"HTTP Basic" --set config-directory:config/rest2ldap/endpoints/api --set enabled:true -X -n
\end{lstlisting}

\subsubsection{Create}
\begin{lstlisting}
curl --request PUT --user kvaughan:bribery --header "Content-Type: application/json" --header "If-None-Match: *" --data '{"_id":"newuser", "_schema":"frapi:opendj:rest2ldap:user:1.0", "contactInformation": {"telephoneNumber":"+1 408 555 1212", "emailAddress":"newuser@example.com"}, "name": {"familyName":"New", "givenName":"User"}, "displayName":["New User"], "manager": {"_id":"kvaughan", "displayName":"Kirsten Vaughan"}}' \
 http://localhost:8080/api/users/newuser
\end{lstlisting}

\subsubsection{Read}
\begin{lstlisting}
curl --user kvaughan:bribery \
http://localhost:8080/api/users/newuser
\end{lstlisting}

\subsubsection{Update}
\begin{lstlisting}
curl --request PUT --user kvaughan:bribery --header "Content-Type: application/json" --header "If-Match: *" --data '{"contactInformation": {"telephoneNumber":"+1 408 555 4798", "emailAddress":"scarter@example.com"}, "name": {"familyName":"Carter", "givenName":"Sam"}, "userName":"scarter@example.com", "displayName": ["Sam Carter", "Samantha Carter"], "groups": [{"_id":"Accounting Managers"}], "manager": {"_id":"trigden", "displayName":"Torrey Rigden"}, "uidNumber":1002, "gidNumber":1000, "homeDirectory":"/home/scarter"}' \
 http://localhost:8080/api/users/scarter
\end{lstlisting}

\subsubsection{Delete}
\begin{lstlisting}
curl --request DELETE --user kvaughan:bribery \
http://localhost:8080/api/users/newuser
\end{lstlisting}

\subsubsection{Patch}
\begin{lstlisting}
curl --user kvaughan:bribery --request PATCH --header "Content-Type: application/json" --data '[{ "operation": "replace", "field": "/contactInformation/emailAddress", "value": "babs@example.com" }]' \
 http://localhost:8080/api/users/bjensen
\end{lstlisting}

\subsubsection{Action: Change Own Password}
\begin{lstlisting}
curl --request POST --user bjensen:hifalutin --header "Content-Type: application/json" --insecure \
 --data '{ "oldPassword": "hifalutin", "newPassword": "changeme"}' \
 https://localhost:8443/api/users/bjensen\
?_action=modifyPassword
\end{lstlisting}

\subsubsection{Query}
\begin{lstlisting}
curl --user kvaughan:bribery \
 http://localhost:8080/api/users?\
_queryFilter=userName+eq+'babs@example.com'
\end{lstlisting}

\subsection{LDAP Search Filters vs. REST Query Filters}
\begin{tabular}{@{}ll@{}}
LDAP Search Filter                 & REST Query Filter \\
\verb!(&)!                         & \lstinline!_queryFilter=true! \\
\verb!(uid=*)!                     & \lstinline!_queryFilter=_id+pr! \\
\verb!(uid=bjensen)!               & \lstinline!_queryFilter=! \\
                                   & \lstinline!_id+eq+'bjensen'! \\
\verb!(uid=*jensen*)!              & \lstinline!_queryFilter=! \\
                                   & \lstinline!_id+co+'jensen'! \\
\verb!(uid=jensen*)!               & \lstinline!_queryFilter=! \\
                                   & \lstinline!_id+sw+'jensen'! \\
\verb!(&(uid=*jensen*)(cn=babs*))! & \lstinline!_queryFilter=! \\
                                   & \lstinline!(_id+co+'jensen'! \\
                                   & \lstinline!+and! \\
                                   & \lstinline!+displayName+sw+'babs')! \\
\verb!(|(uid=*jensen*)(cn=sam*))!  & \lstinline!_queryFilter=(! \\
                                   & \lstinline!_id+co+'jensen'! \\
                                   & \lstinline!+or! \\
                                   & \lstinline!+displayName+sw+'sam')! \\
\verb$(!(uid=*jensen*))$           & \lstinline!_queryFilter=! \\
                                   & \lstinline$!(_id+co+'jensen')$ \\
\verb!(uid<=jensen)!               & \lstinline!_queryFilter=! \\
                                   & \lstinline!_id+le+'jensen'! \\
\verb!(uid>=jensen)!               & \lstinline!_queryFilter=! \\
                                   & \lstinline!_id+ge+'jensen'!
\end{tabular}

\rule{0.3\linewidth}{0.25pt}
\scriptsize

Copyright \copyright\ 2017 ForgeRock AS.

\href{https://github.com/markcraig/opendj-refcard}{https://github.com/markcraig/opendj-refcard}

\end{multicols}
\end{document}