The compare-ldap-schemas Command-Line Tool

This tool can be used to compare the schemas of two LDAP servers to identify schema elements that may be present in one but not the other, or elements that may be present in both servers but have differences between them.

Usage

compare-ldap-schemas {arguments}

First Connection and Authentication Arguments

• --firstHostname {host} — The IP address or resolvable name to use to connect to the directory server. If this is not provided, then a default value of 'localhost' will be used.
  
  
• --firstPort {port} — The port to use to connect to the directory server. If this is not provided, then a default value of 389 will be used.
  The specified value must not be less than 1 or greater than 65,535.
  
  
• --firstBindDN {dn} — The DN to use to bind to the directory server when performing simple authentication.
  A provided value must be able to be parsed as an LDAP distinguished name as described in RFC 4514.
  
  
• --firstBindPassword {password} — The password to use to bind to the directory server when performing simple authentication or a password-based SASL mechanism.
  
  
• --firstBindPasswordFile {path} — The path to the file containing the password to use to bind to the directory server when performing simple authentication or a password-based SASL mechanism.
  The specified path must refer to a file that exists.
  
  
• --firstUseSSL — Use SSL when communicating with the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --firstUseStartTLS — Use StartTLS when communicating with the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --firstDefaultTrust — Use the JVM's default trust store, and optionally an additional trust store specified using the --trustStorePath argument, to non-interactively determine whether to trust any certificate chain presented during TLS negotiation. If the chain cannot be trusted based on any of those sources, then negotiation will fail without prompting about whether to trust it.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --firstTrustAll — Trust any certificate presented by the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --firstKeyStorePath {path} — The path to the file to use as the key store for obtaining client certificates when communicating securely with the directory server.
  
  
• --firstKeyStorePassword {password} — The password to use to access the key store contents.
  
  
• --firstKeyStorePasswordFile {path} — The path to the file containing the password to use to access the key store contents.
  The specified path must refer to a file that exists.
  
  
• --firstKeyStoreFormat {format} — The format (e.g., JKS, PKCS12, PKCS11, BCFKS, etc.) for the key store file.
  
  
• --firstTrustStorePath {path} — The path to the file to use as trust store when determining whether to trust a certificate presented by the directory server.
  
  
• --firstTrustStorePassword {password} — The password to use to access the trust store contents.
  
  
• --firstTrustStorePasswordFile {path} — The path to the file containing the password to use to access the trust store contents.
  The specified path must refer to a file that exists.
  
  
• --firstTrustStoreFormat {format} — The format (e.g., JKS, PKCS12, PKCS11, BCFKS, etc.) for the trust store file.
  
  
• --firstCertNickname {nickname} — The nickname (alias) of the client certificate in the key store to present to the directory server for SSL client authentication.
  
  
• --firstSASLOption {name=value} — A name-value pair providing information to use when performing SASL authentication.
  
  

Second Connection and Authentication Arguments

• --secondHostname {host} — The IP address or resolvable name to use to connect to the directory server. If this is not provided, then a default value of 'localhost' will be used.
  
  
• --secondPort {port} — The port to use to connect to the directory server. If this is not provided, then a default value of 389 will be used.
  The specified value must not be less than 1 or greater than 65,535.
  
  
• --secondBindDN {dn} — The DN to use to bind to the directory server when performing simple authentication.
  A provided value must be able to be parsed as an LDAP distinguished name as described in RFC 4514.
  
  
• --secondBindPassword {password} — The password to use to bind to the directory server when performing simple authentication or a password-based SASL mechanism.
  
  
• --secondBindPasswordFile {path} — The path to the file containing the password to use to bind to the directory server when performing simple authentication or a password-based SASL mechanism.
  The specified path must refer to a file that exists.
  
  
• --secondUseSSL — Use SSL when communicating with the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --secondUseStartTLS — Use StartTLS when communicating with the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --secondDefaultTrust — Use the JVM's default trust store, and optionally an additional trust store specified using the --trustStorePath argument, to non-interactively determine whether to trust any certificate chain presented during TLS negotiation. If the chain cannot be trusted based on any of those sources, then negotiation will fail without prompting about whether to trust it.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --secondTrustAll — Trust any certificate presented by the directory server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --secondKeyStorePath {path} — The path to the file to use as the key store for obtaining client certificates when communicating securely with the directory server.
  
  
• --secondKeyStorePassword {password} — The password to use to access the key store contents.
  
  
• --secondKeyStorePasswordFile {path} — The path to the file containing the password to use to access the key store contents.
  The specified path must refer to a file that exists.
  
  
• --secondKeyStoreFormat {format} — The format (e.g., JKS, PKCS12, PKCS11, BCFKS, etc.) for the key store file.
  
  
• --secondTrustStorePath {path} — The path to the file to use as trust store when determining whether to trust a certificate presented by the directory server.
  
  
• --secondTrustStorePassword {password} — The password to use to access the trust store contents.
  
  
• --secondTrustStorePasswordFile {path} — The path to the file containing the password to use to access the trust store contents.
  The specified path must refer to a file that exists.
  
  
• --secondTrustStoreFormat {format} — The format (e.g., JKS, PKCS12, PKCS11, BCFKS, etc.) for the trust store file.
  
  
• --secondCertNickname {nickname} — The nickname (alias) of the client certificate in the key store to present to the directory server for SSL client authentication.
  
  
• --secondSASLOption {name=value} — A name-value pair providing information to use when performing SASL authentication.
  
  

Additional Arguments

• --firstSchemaEntryDN {dn} — The DN of the subschema subentry in the first server that contains the definitions to examine. If this is not specified, then the entry referenced by the subschemaSubentry attribute in the server's root DSE will be used.
  A provided value must be able to be parsed as an LDAP distinguished name as described in RFC 4514.
  
  
• --secondSchemaEntryDN {dn} — The DN of the subschema subentry in the second server that contains the definitions to examine. If this is not specified, then the entry referenced by the subschemaSubentry attribute in the server's root DSE will be used.
  A provided value must be able to be parsed as an LDAP distinguished name as described in RFC 4514.
  
  
• --schemaElementType {elementType} — The types of schema elements to examine. Allowed values include attribute-syntaxes, matching-rules, attribute-types, object-classes, dit-content-rules, dit-structure-rules, name-forms, and matching-rule-uses. This may be provided multiple times to include multiple specific schema element types. If this argument is not provided, then all schema element types will be considered.
  
  
• --getExtendedSchemaInfo — Use the extended schema info request control, which may be used to retrieve additional information about schema element definitions from a Ping Identity Directory Server.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --ignoreDescriptions — Indicates that the tool should ignore differences in descriptions when comparing schema elements.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --ignoreExtensions — Indicates that the tool should ignore differences in extensions when comparing schema elements.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --includeElementsWithNameMatchingPrefix {prefix} — Indicates that the tool should only examine schema elements with names that match the specified prefix. This argument may be provided multiple times to specify multiple include prefixes. If no include or exclude prefixes are specified, then names will not be used when considering which elements to examine.
  
  
• --excludeElementsWithNameMatchingPrefix {prefix} — Indicates that the tool should not examine schema elements with names that match the specified prefix. This argument may be provided multiple times to specify multiple exclude prefixes. If no include or exclude prefixes are specified, then names will not be used when considering which elements to examine.
  
  
• --includeElementsWithExtensionValue {name=value} — Indicates that the tool should only examine schema elements with an extension that has the specified name and value. This argument may be provided multiple times to specify multiple include extension values. If no include or exclude extension values are specified, then extensions will not be used when considering which elements to examine.
  
  
• --excludeElementsWithExtensionValue {name=value} — Indicates that the tool should no examine schema elements with an extension that has the specified name and value. This argument may be provided multiple times to specify multiple exclude extension values. If no include or exclude extension values are specified, then extensions will not be used when considering which elements to examine.
  
  
• --interactive — Launch the tool in interactive mode.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --outputFile {path} — Write all standard output and standard error messages to the specified file instead of to the console.
  The specified path must refer to a file which may or may not exist, but whose parent directory must exist.
  
  
• --appendToOutputFile — Indicates that the tool should append to the file specified by the --outputFile argument if it already exists. If this argument is not provided and the output file already exists, it will be overwritten.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --teeOutput — Write all standard output and standard error messages to the console as well as to the specified output file. The --outputFile argument must also be provided.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• -H / --help — Display usage information for this program.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --help-debug — Display usage information for debug logging.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --enable-debug-logging — Enables debug logging for the tool.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --debug-log-level {level} — The debug log level to use for the tool. Allowed values include 'off', 'severe', 'warning', 'info', 'fine', 'finer', and 'finest'. If this is not specified, a default level of 'severe' will be used.
  
  
• --debug-log-category {category} — The message categories to include in the debug log output. Allowed values include 'asn1', 'connect', 'exception', 'ldap', 'connectionpool', 'ldif', 'monitor', 'codingerror', and 'other'. This argument may be provided multiple times to indicate that multiple categories should be included. If this is not specified, then all categories will be included.
  
  
• --include-debug-stack-traces — Indicates that debug log messages should include a stack trace with the code location from which each debug message originated.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --use-multi-line-debug-messages — Indicates that debug log messages (which will be JSON objects) should be written as multi-line strings rather than single-line strings.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --debug-log-file {path} — The path to the debug log file to be written. If this is not specified, a default path of 'compare-ldap-schemas.debug' will be used.
  The specified path must refer to a file which may or may not exist, but whose parent directory must exist.
  
  
• -V / --version — Display version information for this program.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --propertiesFilePath {path} — The path to a properties file used to specify default values for arguments not supplied on the command line.
  The specified path must refer to a file that exists.
  
  
• --generatePropertiesFile {path} — Write an empty properties file that may be used to specify default values for arguments.
  The specified path must refer to a file which may or may not exist, but whose parent directory must exist.
  
  
• --noPropertiesFile — Do not obtain any argument values from a properties file.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  
• --suppressPropertiesFileComment — Suppress output listing the arguments obtained from a properties file.
  This argument is not allowed to have a value. If this argument is included in a set of arguments, then it will be assumed to have a value of 'true'. If it is absent from a set of arguments, then it will be assumed to have a value of 'false'.
  
  

Dependent Argument Sets

• If the --firstBindDN argument is provided, then at least one of the following arguments must also be provided: --firstBindPassword, --firstBindPasswordFile
• If the --secondBindDN argument is provided, then at least one of the following arguments must also be provided: --secondBindPassword, --secondBindPasswordFile
• If the --appendToOutputFile argument is provided, then the --outputFile argument must also be provided.
• If the --teeOutput argument is provided, then the --outputFile argument must also be provided.

Exclusive Argument Sets

• The following arguments cannot be used together: --firstUseSSL, --firstUseStartTLS
• The following arguments cannot be used together: --firstBindPassword, --firstBindPasswordFile
• The following arguments cannot be used together: --firstKeyStorePassword, --firstKeyStorePasswordFile
• The following arguments cannot be used together: --firstTrustStorePassword, --firstTrustStorePasswordFile
• The following arguments cannot be used together: --firstTrustAll, --firstTrustStorePath
• The following arguments cannot be used together: --firstTrustAll, --firstDefaultTrust
• The following arguments cannot be used together: --secondUseSSL, --secondUseStartTLS
• The following arguments cannot be used together: --secondBindPassword, --secondBindPasswordFile
• The following arguments cannot be used together: --secondKeyStorePassword, --secondKeyStorePasswordFile
• The following arguments cannot be used together: --secondTrustStorePassword, --secondTrustStorePasswordFile
• The following arguments cannot be used together: --secondTrustAll, --secondTrustStorePath
• The following arguments cannot be used together: --secondTrustAll, --secondDefaultTrust
• The following arguments cannot be used together: --propertiesFilePath, --noPropertiesFile

Examples

• Compares the LDAP schemas for the two directory servers using the default settings, which will identify any differences between the schemas.

    compare-ldap-schemas --firstHostname ds1.example.com --firstPort 636 \
         --firstUseSSL --firstBindDN "cn=Directory Manager" \
         --firstBindPasswordFile /path/to/password.txt \
         --secondHostname ds2.example.com --secondPort 636 --secondUseSSL \
         --secondBindDN "cn=Directory Manager" \
         --secondBindPasswordFile /path/to/password.txt