Click here for Reference Manual which shows how the Command Line Interpreter drives the Fortress APIs from a command prompt.
group function options
admin auser -u hounddog42 -p myNewP@$$w0rd -o developmentIn this example the group is 'admin', the function is 'auser' or add user, and the options are -u for userid, -p for password and -o that points to a valid USERS OrgUnit node. Despite being called an 'option', so named parameters may or may not be required for a given function. Option names are always preceded by a dash ('-') when entered. Option values must be enclosed within single quotes '' or double quotes "" if value contains multiple Strings separated by whitespace. For example the user description value can be entered like this: -d "This description contains more than one word" or this: -d 'This description also contains more than one word'.
[echo] Run the Fortress Command Line Interpreter [java] 2011-12-03 21:10:02,431 (INFO ) CLI Options include admin, review, system, dadmin [java] 2011-12-03 21:10:02,431 (INFO ) Enter one from above or 'q' to quit admin auser -u hounddog42 -p myNewP@$$w0rd -o development [java] 2011-12-03 21:41:37,614 (INFO ) arg:admin [java] 2011-12-03 21:41:37,614 (INFO ) arg:auser [java] 2011-12-03 21:41:37,615 (INFO ) arg:-u [java] 2011-12-03 21:41:37,615 (INFO ) arg:hounddog42 [java] 2011-12-03 21:41:37,615 (INFO ) arg:-p [java] 2011-12-03 21:41:37,616 (INFO ) arg:-o [java] 2011-12-03 21:41:37,616 (INFO ) arg:development [java] 2011-12-03 21:41:37,617 (INFO ) auser [java] 2011-12-03 21:41:37,750 (INFO ) command:auser was successful [java] 2011-12-03 21:41:37,750 (INFO ) CLI Options include admin, review, system, dadmin [java] 2011-12-03 21:41:37,751 (INFO ) Enter one from above or 'q' to quit
This remainder of document is a command reference document to show how the Fortress CLI works.
This command creates a new RBAC user. The command is valid only if the new user is not already a member of the USERS data set. The USER data set is updated. The new user does not own any session at the time of its creation.
This method performs an update on User entity in directory. Prior to making this call the entity must exist in directory.
This command deletes an existing user from the RBAC database. The command is valid if and only if the user to be deleted is a member of the USERS data set. The USERS and UA data sets and the assigned_users function are updated. This method performs a "hard" delete. It completely removes all data associated with this user from the directory. User entity must exist in directory prior to making this call else exception will be thrown.
Password policies will be enforced if in effect at the time of this function call.
Used by administrator to change a user's password when they have forgotten old password or if the password is expired. When policies are in effect this will force User to change their password the next time authenticate.
Used to lock a user's account in LDAP
Used to unlock a user's account in so they may sign on again to LDAP. Note this will not fix an expired password (which needs to be changed by user or reset by admin)
This command creates a new role. The command is valid if and only if the new role is not already a member of the ROLES data set. The ROLES data set is updated. Initially, no user or permission is assigned to the new role.
Method will update a Role entity in the directory. The role must exist in role container prior to this call.
This command deletes an existing role from the RBAC database. The command is valid if and only if the role to be deleted is a member of the ROLES data set. If role assignments to USERS or PERMISSIONS exist this command will delete those as well.
This command assigns a user to a role.
Successful completion of this op, the following occurs:
ftUserAttrs
aux object
class based on:
This command deletes the assignment of the User from the Role entities. The command is valid if and only if the user is a member of the USERS data set, the role is a member of the ROLES data set, and the user is assigned to the role. Any sessions that currently have this role activated will not be effected.
This commands establishes a new immediate inheritance relationship parentRole <<-- childRole between existing roles parentRole, childRole.
The command is valid if and only if:
command is valid if and only if:
The command is valid if and only if:
This command deletes a SSD role set completely. The command is valid if and only if the SSD role set exists.
This command creates a named DSD set of roles and sets an associated cardinality n. The DSD constraint stipulates that the DSD role set cannot contain n or more roles simultaneously active in the same session.
The command is valid if and only if:
This command deletes a DSD role set completely. The command is valid if and only if the DSD role set exists.
This method will add permission object to perms container in directory. The perm object must not exist before making this call. A PermObj instance exists in a hierarchical, one-many relationship between itself and children as stored in ldap tree: PermObj*->Permission.
This method will update permission object in perms container in directory. The perm object must exist before making this call. A PermObj instance exists in a hierarchical, one-many relationship between itself and children as stored in ldap tree: PermObj*->Permission.
This method will remove permission object to perms container in directory. This method will also remove in associated permission objects that are attached to this object.
This method will add permission operation to an existing permission object which resides under ou=Permissions,ou=RBAC,dc=yourHostName,dc=com container in directory information tree. The perm operation entity may have Role or User associations. The target Permission must not exist prior to calling. A Fortress Permission instance exists in a hierarchical, one-many relationship between its parent and itself as stored in ldap tree: PermObj*->Permission.
This method will update permission operation pre-existing in target directory under ou=Permissions,ou=RBAC,dc=yourHostName,dc=com container in directory information tree. The perm operation entity may also contain Role or User associations to add or remove using this function. The perm operation must exist before making this call. Only non-null attributes will be updated.
This method will remove permission operation entity from permission object. A Fortress permission is PermObj*->Permission. The perm operation must exist before making this call.
This command grants a role the permission to perform an operation on an object to a role. The command is implemented by granting permission by setting the access control list of the object involved. The command is valid if and only if the pair (operation, object) represents a permission, and the role is a member of the ROLES data set.
This command revokes the permission to perform an operation on an object from the set of permissions assigned to a role. The command is implemented by setting the access control list of the object involved. The command is valid if and only if the pair (operation, object) represents a permission, the role is a member of the ROLES data set, and the permission is assigned to that role.
This command creates a new admin role. The command is valid if and only if the new admin role is not already a member of the ADMIN ROLES data set. The ADMIN ROLES data set is updated. Initially, no user or permission is assigned to the new role.
Method will update a admin Role entity in the directory. The role must exist in admin role container prior to this call.
This command deletes an existing admin role from the ARBAC database. The command is valid if and only if the admin role to be deleted is a member of the ADMIN ROLES data set and has been deassigned from all users.
This command assigns a user to an admin role. Successful completion of this op, the following occurs:
ftUserAttrs
aux object
class based on:
This method removes assigned admin role from user entity. Both user and admin role entities must exist and have role relationship before calling this method. Successful completion: del Role to User assignment in User data set AND User to Role assignment in Admin Role data set.
The command is valid if and only if:
The command is valid if and only if:
Command adds a new USERS OrgUnit entity to OrgUnit dataset.
Command updates a USERS OrgUnit entity to OrgUnit dataset.
Command removes an existing USERS OrgUnit entity from the OrgUnit dataset.
The command is valid if and only if:
The command is valid if and only if:
Command adds a new PERMS OrgUnit entity to OrgUnit dataset.
Command updates a PERMS OrgUnit entity to OrgUnit dataset.
Command removes an existing PERMS OrgUnit entity from the OrgUnit dataset.
The command is valid if and only if:
The command is valid if and only if:
This method will add administrative permission object to perms container in directory. The perm object must not exist before making this call. A PermObj instance exists in a hierarchical, one-many relationship between itself and children as stored in ldap tree: PermObj*->Permission.
This method will update an administrative permission object in perms container in directory. The perm object must exist before making this call. A PermObj instance exists in a hierarchical, one-many relationship between itself and children as stored in ldap tree: PermObj*->Permission.
This method will remove an administrative permission object to perms container in directory. This method will also remove in associated permission objects that are attached to this object.
This method will add an administrative permission operation to an existing permission object which resides under ou=AdminPermis,ou=ARBAC,dc=yourHostName,dc=com container in directory information tree. The perm operation entity may have AdminRole or User associations. The target Permission must not exist prior to calling. A Fortress Administrative Permission instance exists in a hierarchical, one-many relationship between its parent and itself as stored in ldap tree: PermObj*->Permission.
This method will update an administrative permission operation pre-existing in target directory under ou=AdminPermis,ou=ARBAC,dc=yourHostName,dc=com container in directory information tree. The perm operation entity may also contain AdminRole or User associations to add or remove using this function. The perm operation must exist before making this call. Only non-null attributes will be updated.
This method will remove an administrative permission operation entity from permission object. A Fortress administrative permission is PermObj*->Permission. The perm operation must exist before making this call.
This command grants an adminRole the administrative permission to perform an operation on an object to a role. The command is implemented by granting permission by setting the access control list of the object involved. The command is valid if and only if the pair (operation, object) represents a permission, and the role is a member of the ADMIN_ROLES data set.
This command revokes the permission to perform an operation on an object from the set of permissions assigned to an adminRole. The command is implemented by setting the access control list of the object involved. The command is valid if and only if the pair (operation, object) represents a permission, the role is a member of the ADMIN_ROLES data set, and the permission is assigned to that role.
This function reads a User object from the directory. The userId is not case sensitive.
String filter = "(&(objectclass=" + objectClassImpl + ")(" + GlobalIds.UID + "=" + searchVal + "*))";which will return all Users that match the leading characters of the search field which is case insensitive. This logs the results using log4j to allow output to be logged to console or file.
This function returns all Users who are assigned a particular Role.
This function reads a Role object from the directory. The Role name is not case sensitive.
This function searches for matching Roles on the name field. It will return all Roles that match the leading characters of the search field which is case insensitive. This logs the results using log4j to allow output to be logged to console or file.
This function reads a Permission Object from the directory. The object name is not case sensitive.
This function searches for matching Permission Objects on the name field. It will return all PermObjs that match the leading characters of the search field which is case insensitive. This logs the results using log4j to allow output to be logged to console or file.
This function reads a Permission Operation from the directory. The permission object and operation names are not case sensitive.
This function searches for matching Permission Operations on the name fields of the Permission Object and Operation attributes. It will return all Permissions that match the leading characters of the search fields which are not case insensitive. This logs the results using log4j to allow output to be logged to console or file.
This function adds a new LDAP group to the directory.
Modify existing group node. The name is required. Does not update members or properties. Use ASSIGN_GROUP, DEASSIGN_GROUP, ADD_GROUP_PROP or DEL_GROUP_PROP for multivalued attributes.
This function removes an LDAP group from the directory.
This function adds a user as a member to an existing LDAP group in the directory.
This function removes a user as a member from an existing LDAP group in the directory.
This function adds one or more properties to an existing LDAP group.
This function removes one or more properties from an existing LDAP group.
This function reads and displays to console an existing LDAP group. The Group name is not case sensitive.
This function searches and displays to console existing LDAP groups found as target of search. The Group name is not case sensitive.
The org.apache.directory.fortress.cli.CommandLineInterpreter drives the Fortress APIs. For more info on how the Fortress APIs work, check out Fortress SDK Javadoc.