Environment
Novell NetWare 6.5
Novell Open Enterprise Server
Novell eDirectory
Situation
Error -1423
Error -1411
Using SDIDiag - Switches and Options
Error -1411
Using SDIDiag - Switches and Options
Resolution
SECURITY DOMAIN SERVER MANAGEMENT
SERVER MANAGEMENT
DIAGNOSTIC
OTHER COMMANDS
EXAMPLES OF SDIDiag COMMANDS SECURITY DOMAIN MANAGEMENT
All servers which are listed under the "NDSPKI:SD Key Server DN" attribute on the other tab of the W0 object will be displayed with their associated SD Keys. LS [-A] [-V] [-S serverDN] [> file |>> file] List the current Security Domain Servers.
Another way to gather this information is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and view the values of the "NDSPKI:SD Key Server DN" attribute. RS [-A] [-V] [-S serverDN] [> file |>> file] Remove server -S serverDN as a Security Domain Server.
This can also been done through Console One by going to the W0 object in the Security Container. Select the "Other" tab on ther W0 object and delete a server shown as an attribute balue to the"NDSPKI:SD Key Server DN" attribute. AP [-A] [-V] [-F] [> file |>> file] Add any server hosting a writeable replica of the .W0.KAP.Security.Tree-Name object as a Security Domain Server.
If the -F switch is given, additionally remove any servers that do not hold a writeable replica. SD [-A] [-V] [-R] [-G] [-S serverDN ] [> file | >> file] Synchronize the Security Domain Servers. The optional -R switch revokes all existing keys and generates a new SD key for use within the tree. The optional -G switch generates a new SD key.
NOTE: If either the -R or -G switches are used, then the RD command may need to be used to resynchronize the new keys to the other servers in the tree.
Revoked keys are retained and used to access any existing items, however, they are not used to manage new keys. SERVER MANAGEMENT
FS [-N containerDN] [-X] [-O file] [-U file] Find all servers starting with the -N containerDN and all sub-containers unless the -X switch is given, in which case, limit the search to the -N containerDN only. Output all eDirectory 8.7.1 servers or higher to a file using the -O file while all other server that are listed are outputed to the -U file. The -O file may be used as an input to any commands that the support the -I file switch. LK [-A] [-V] [-S serverDN ] [> file | >> file] List keys held by -s serverDN.
Example of using LK is:
SDIDIAG> LK -A -S .servername.org.tree_name
RD [-A] [-V] [-T] [-N containerDN] [> file | >> file] Resynchronize the Security Domain Servers with other servers in the tree. If the -T switch is given, RD or RESYNC, performs a two pass operation by first ensuring that the Security Domain Servers have a copy of all keys on all referenced servers.
Secondly, RD resynchronizes all servers with the updated Security Domain Servers.
If the -N switch is omitted, RD attempts to resync all servers within the tree; whereas when the -N containerDN switch is provided, RD only resynchronizes the Security Domain with all servers holding writeable replicas of the specified containerDN partition. It 1460 persist, then a full RESYNC may be attempted which may take a considerable time as every server will need to be contacted.
Examples of using RD are:
SDIDIAG> RD -T -n .orgUnit.org.tree_name. SS [-A] [-V] [-R] [-S serverDN] [-I file] [-N containerDN] Synchronize all keys on the specified -S serverDN, severs in listed in the -I file, or server hosting a writeable replica of the -N containerDN with the Security Domain Servers. The -R switch may optionally be given to revoke all the existing keys on the server before synchronizing with the Security Domain Servers.
Example of using SS is:
SDIDIAG> SS -A -R -S .servername.org.tree_name DIAGNOSTIC CK [-A] [-V] [-N containerDN] [> file | >> file] Check and display possible problems and display recommendations for the Security Domain Servers. If the -N containerDN is provided, also check the servers hosting a writeable replica of the -N containerDN object for possible problems and provide recommendations.
Examples of using CK are:
SDIDIAG> CK
SDIDIAG> CK -N .orgUnit.org.tree-name
SDIDIAG> CK -A -N .orgUnit.org.tree-name >> SYS:\TEMP\OUTPUT.TXT .
Name | Shortcut Command | Command |
Add All Write Partition Servers | ADDPARTITIONSERVERS | AP |
Add Domain Server | ADD | AS |
List Domain Server | LISTSERVERS | LS |
Remove Domain Server | REMOVE | RS |
Sync Domain Server | SYNCDOMAIN | SD |
Name | Shortcut Command | Command |
Find Servers in Container | FINDSERVERS | FS |
List Server Keys | LISTKEYS | LK |
Resync Keys for Container | RESYNC | RD |
Sync Server Keys from Domain | SYNCSERVER | SS |
Name | Shortcut Command | Command |
Check Key or Domain Problems | CHECK | CK |
Name | Shortcut Command | Command |
Help on most used commands | HELP | HE |
Exit SDIDiag | EXIT or QUIT | E or I |
> | Redirected output to a file using the '>' redirection switch. |
>> | Append output to an existing file. |
-A | Access servers regardless of their eDirectory or NICI versions.
By default SDIDiag Version 2.00 Thursday, May 22, 2003, references
only servers running eDirectory version 8.7.1 or higher. |
-F | Force operation. Depending on the command, the -F switch removes any Security Domain Servers that do not hold a writeable replica of the W0.KAP.Security object. |
-G | Generate a new key. When used with the SD command, all Security Domain Servers will be synchronized to hold this new key. |
-I file | Specify an input file of server names to access. This switch specifies a file that holds a list of serverDNs for the command to process. In most cases, the objects are fully qualified dot delimited distinguish names with one server per line. Normally the -O file switch creates this file. |
-N containerDN | Specifies with a fully qualified dot delimited distinguished name of a container that the command will reference. |
-O file | Create an output file of server names. This switch defines afileto hold output information that may be passed to a command via the -I file switch. Normally, the -Ofileswitch will contain a fully qualified dot delimited distinguished name list of servers. |
-R | Revoke all keys. The -R switch will implicitly perform a -G switch operation after revoking all the keys. |
-S serverDN | Specifies with a fully qualified dot delimited distinguished
name a server name. |
-T | Two pass "Comprehensive" switch for the RD command. |
-U file | Create a file of server with incompatible NICI SDI support. The -U switch creates a file that contains a fully qualified dot delimited distinguished name of servers on which NICI must be upgraded to fully support multiple SDI keys. Server names are not displayed when this switch is omitted. |
-V | Verbose, display all messages to SDIDiag console. |
-X | Limit the search for servers to the container specified with the -n containerDN switch. |
EXAMPLES OF SDIDiag COMMANDS SECURITY DOMAIN MANAGEMENT
AS [-A] [-V] [-S serverDN] [> file | >> file]
Add server -S serverDN as a Security Domain Server.
Another way to do this is to open Console One and go to the W0
object in the Security Container. Select the "Other" tab on the W0
object and add an additional server as an attribute value to the"NDSPKI:SD Key Server DN" attribute.
All servers which are listed under the "NDSPKI:SD Key Server DN" attribute on the other tab of the W0 object will be displayed with their associated SD Keys. LS [-A] [-V] [-S serverDN] [> file |>> file] List the current Security Domain Servers.
Another way to gather this information is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and view the values of the "NDSPKI:SD Key Server DN" attribute. RS [-A] [-V] [-S serverDN] [> file |>> file] Remove server -S serverDN as a Security Domain Server.
This can also been done through Console One by going to the W0 object in the Security Container. Select the "Other" tab on ther W0 object and delete a server shown as an attribute balue to the"NDSPKI:SD Key Server DN" attribute. AP [-A] [-V] [-F] [> file |>> file] Add any server hosting a writeable replica of the .W0.KAP.Security.Tree-Name object as a Security Domain Server.
If the -F switch is given, additionally remove any servers that do not hold a writeable replica. SD [-A] [-V] [-R] [-G] [-S serverDN ] [> file | >> file] Synchronize the Security Domain Servers. The optional -R switch revokes all existing keys and generates a new SD key for use within the tree. The optional -G switch generates a new SD key.
NOTE: If either the -R or -G switches are used, then the RD command may need to be used to resynchronize the new keys to the other servers in the tree.
Revoked keys are retained and used to access any existing items, however, they are not used to manage new keys. SERVER MANAGEMENT
FS [-N containerDN] [-X] [-O file] [-U file] Find all servers starting with the -N containerDN and all sub-containers unless the -X switch is given, in which case, limit the search to the -N containerDN only. Output all eDirectory 8.7.1 servers or higher to a file using the -O file while all other server that are listed are outputed to the -U file. The -O file may be used as an input to any commands that the support the -I file switch. LK [-A] [-V] [-S serverDN ] [> file | >> file] List keys held by -s serverDN.
Example of using LK is:
SDIDIAG> LK -A -S .servername.org.tree_name
RD [-A] [-V] [-T] [-N containerDN] [> file | >> file] Resynchronize the Security Domain Servers with other servers in the tree. If the -T switch is given, RD or RESYNC, performs a two pass operation by first ensuring that the Security Domain Servers have a copy of all keys on all referenced servers.
Secondly, RD resynchronizes all servers with the updated Security Domain Servers.
If the -N switch is omitted, RD attempts to resync all servers within the tree; whereas when the -N containerDN switch is provided, RD only resynchronizes the Security Domain with all servers holding writeable replicas of the specified containerDN partition. It 1460 persist, then a full RESYNC may be attempted which may take a considerable time as every server will need to be contacted.
Examples of using RD are:
SDIDIAG> RD -T -n .orgUnit.org.tree_name. SS [-A] [-V] [-R] [-S serverDN] [-I file] [-N containerDN] Synchronize all keys on the specified -S serverDN, severs in listed in the -I file, or server hosting a writeable replica of the -N containerDN with the Security Domain Servers. The -R switch may optionally be given to revoke all the existing keys on the server before synchronizing with the Security Domain Servers.
Example of using SS is:
SDIDIAG> SS -A -R -S .servername.org.tree_name DIAGNOSTIC CK [-A] [-V] [-N containerDN] [> file | >> file] Check and display possible problems and display recommendations for the Security Domain Servers. If the -N containerDN is provided, also check the servers hosting a writeable replica of the -N containerDN object for possible problems and provide recommendations.
Examples of using CK are:
SDIDIAG> CK
SDIDIAG> CK -N .orgUnit.org.tree-name
SDIDIAG> CK -A -N .orgUnit.org.tree-name >> SYS:\TEMP\OUTPUT.TXT .
Additional Information
Formerly known as TID# 10086669