Using SDIDiag - Switches and Options

  • 3840110
  • 29-Jan-2007
  • 26-Apr-2012

Environment

Novell NetWare 6.5
Novell Open Enterprise Server
Novell eDirectory

Situation

Error -1423
Error -1411
Using SDIDiag - Switches and Options

Resolution

SECURITY DOMAIN SERVER MANAGEMENT


Name

Shortcut CommandCommand
Add All Write Partition ServersADDPARTITIONSERVERSAP
Add Domain ServerADDAS
List Domain ServerLISTSERVERSLS
Remove Domain ServerREMOVERS
Sync Domain ServerSYNCDOMAINSD

SERVER MANAGEMENT
NameShortcut CommandCommand
Find Servers in ContainerFINDSERVERSFS
List Server KeysLISTKEYSLK
Resync Keys for ContainerRESYNCRD
Sync Server Keys from DomainSYNCSERVERSS

DIAGNOSTIC
NameShortcut CommandCommand
Check Key or Domain ProblemsCHECKCK

OTHER COMMANDS
NameShortcut CommandCommand
Help on most used commandsHELPHE
Exit SDIDiagEXIT or QUITE or I

>Redirected output to a file using the '>' redirection switch.
>>Append output to an existing file.
-AAccess servers regardless of their eDirectory or NICI versions. By default SDIDiag Version 2.00 Thursday, May 22, 2003, references only servers running eDirectory version 8.7.1 or higher.
NOTE: It is strongly recommended that all servers be running a minimum of NICI 2.4.2 or higher.
-FForce operation. Depending on the command, the -F switch removes any Security Domain Servers that do not hold a writeable replica of the W0.KAP.Security object.
-GGenerate a new key. When used with the SD command, all Security Domain Servers will be synchronized to hold this new key.
-I fileSpecify an input file of server names to access. This switch specifies a file that holds a list of serverDNs for the command to process. In most cases, the objects are fully qualified dot delimited distinguish names with one server per line. Normally the -O file switch creates this file.
-N containerDNSpecifies with a fully qualified dot delimited distinguished name of a container that the command will reference.
-O fileCreate an output file of server names. This switch defines afileto hold output information that may be passed to a command via the -I file switch. Normally, the -Ofileswitch will contain a fully qualified dot delimited distinguished name list of servers.
-RRevoke all keys. The -R switch will implicitly perform a -G switch operation after revoking all the keys.
-S serverDNSpecifies with a fully qualified dot delimited distinguished name a server name.
NOTE: serverDN includes the tree name, for example: -S SERVERA.NOVELL.TEST-TREE
-TTwo pass "Comprehensive" switch for the RD command.
-U fileCreate a file of server with incompatible NICI SDI support. The -U switch creates a file that contains a fully qualified dot delimited distinguished name of servers on which NICI must be upgraded to fully support multiple SDI keys. Server names are not displayed when this switch is omitted.
-VVerbose, display all messages to SDIDiag console.
-XLimit the search for servers to the container specified with the -n containerDN switch.

EXAMPLES OF SDIDiag COMMANDS SECURITY DOMAIN MANAGEMENT

AS [-A] [-V] [-S serverDN] [> file | >> file]

Add server -S serverDN as a Security Domain Server.
Another way to do this is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and add an additional server as an attribute value to the"NDSPKI:SD Key Server DN" attribute.

LK [-A] [-V] [-S serverDN] [> file | >> file] List keys held by the Security Domain Servers.
All servers which are listed under the "NDSPKI:SD Key Server DN" attribute on the other tab of the W0 object will be displayed with their associated SD Keys. LS [-A] [-V] [-S serverDN] [> file |>> file] List the current Security Domain Servers.
Another way to gather this information is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and view the values of the "NDSPKI:SD Key Server DN" attribute. RS [-A] [-V] [-S serverDN] [> file |>> file] Remove server -S serverDN as a Security Domain Server.
This can also been done through Console One by going to the W0 object in the Security Container. Select the "Other" tab on ther W0 object and delete a server shown as an attribute balue to the"NDSPKI:SD Key Server DN" attribute. AP [-A] [-V] [-F] [> file |>> file] Add any server hosting a writeable replica of the .W0.KAP.Security.Tree-Name object as a Security Domain Server.
If the -F switch is given, additionally remove any servers that do not hold a writeable replica. SD [-A] [-V] [-R] [-G] [-S serverDN ] [> file | >> file] Synchronize the Security Domain Servers. The optional -R switch revokes all existing keys and generates a new SD key for use within the tree. The optional -G switch generates a new SD key.

NOTE: If either the -R or -G switches are used, then the RD command may need to be used to resynchronize the new keys to the other servers in the tree.
Revoked keys are retained and used to access any existing items, however, they are not used to manage new keys. SERVER MANAGEMENT
FS [-N containerDN] [-X] [-O file] [-U file] Find all servers starting with the -N containerDN and all sub-containers unless the -X switch is given, in which case, limit the search to the -N containerDN only. Output all eDirectory 8.7.1 servers or higher to a file using the -O file while all other server that are listed are outputed to the -U file. The -O file may be used as an input to any commands that the support the -I file switch. LK [-A] [-V] [-S serverDN ] [> file | >> file] List keys held by -s serverDN.
Example of using LK is:
SDIDIAG> LK -A -S .servername.org.tree_name
RD [-A] [-V] [-T] [-N containerDN] [> file | >> file] Resynchronize the Security Domain Servers with other servers in the tree. If the -T switch is given, RD or RESYNC, performs a two pass operation by first ensuring that the Security Domain Servers have a copy of all keys on all referenced servers.
Secondly, RD resynchronizes all servers with the updated Security Domain Servers.
If the -N switch is omitted, RD attempts to resync all servers within the tree; whereas when the -N containerDN switch is provided, RD only resynchronizes the Security Domain with all servers holding writeable replicas of the specified containerDN partition. It 1460 persist, then a full RESYNC may be attempted which may take a considerable time as every server will need to be contacted.
Examples of using RD are:
SDIDIAG> RD -T -n .orgUnit.org.tree_name. SS [-A] [-V] [-R] [-S serverDN] [-I file] [-N containerDN] Synchronize all keys on the specified -S serverDN, severs in listed in the -I file, or server hosting a writeable replica of the -N containerDN with the Security Domain Servers. The -R switch may optionally be given to revoke all the existing keys on the server before synchronizing with the Security Domain Servers.
Example of using SS is:
SDIDIAG> SS -A -R -S .servername.org.tree_name DIAGNOSTIC CK [-A] [-V] [-N containerDN] [> file | >> file] Check and display possible problems and display recommendations for the Security Domain Servers. If the -N containerDN is provided, also check the servers hosting a writeable replica of the -N containerDN object for possible problems and provide recommendations.
Examples of using CK are:
SDIDIAG> CK
SDIDIAG> CK -N .orgUnit.org.tree-name
SDIDIAG> CK -A -N .orgUnit.org.tree-name >> SYS:\TEMP\OUTPUT.TXT .

Additional Information


Formerly known as TID# 10086669