SDIDIAG

Verify That Your SDI Domain Key Servers Are Ready for Universal Password

TID-10086669 Using SDIDiag - Switches and Options ( 23SEP2005)

SECURITY DOMAIN SERVER MANAGEMENT

Name	Shortcut Command	Command
Add All Write Partition Servers	ADDPARTITIONSERVERS	AP
Add Domain Server	ADD	AS
List Domain Server	LISTSERVERS	LS
Remove Domain Server	REMOVE	RS
Sync Domain Server	SYNCDOMAIN	SD

SERVER MANAGEMENT

Name	Shortcut Command	Command
Find Servers in Container	FINDSERVERS	FS
List Server Keys	LISTKEYS	LK
Resync Keys for Container	RESYNC	RD
Sync Server Keys from Domain	SYNCSERVER	SS

DIAGNOSTIC

Name	Shortcut Command	Command
Check Key or Domain Problems	CHECK	CK

OTHER COMMANDS

Name	Shortcut Command	Command
Help on most used commands	HELP	HE
Exit SDIDiag	EXIT or QUIT	E or I

>	Redirected output to a file using the '>' redirection switch.
>>	Append output to an existing file.
-A	Access servers regardless of their eDirectory or NICI versions. By default SDIDiag Version 2.00 Thursday, May 22, 2003, references only servers running eDirectory version 8.7.1 or higher. NOTE: It is strongly recommended that all servers be running a minimum of NICI 2.4.2 or higher.
-F	Force operation. Depending on the command, the -F switch removes any Security Domain Servers that do not hold a writeable replica of the W0.KAP.Security object.
-G	Generate a new key. When used with the SD command, all Security Domain Servers will be synchronized to hold this new key.
-I file	Specify an input file of server names to access. This switch specifies a file that holds a list of serverDNs for the command to process. In most cases, the objects are fully qualified dot delimited distinguish names with one server per line. Normally the -O file switch creates this file.
-N containerDN	Specifies with a fully qualified dot delimited distinguished name of a container that the command will reference.
-O file	Create an output file of server names. This switch defines a file to hold output information that may be passed to a command via the -I file switch. Normally, the -O file switch will contain a fully qualified dot delimited distinguished name list of servers.
-R	Revoke all keys. The -R switch will implicitly perform a -G switch operation after revoking all the keys.
-S serverDN	Specifies with a fully qualified dot delimited distinguished name a server name. NOTE: serverDN includes the tree name, for example: -S SERVERA.NOVELL.TEST-TREE
-T	Two pass "Comprehensive" switch for the RD command.
-U file	Create a file of server with incompatible NICI SDI support. The -U switch creates a file that contains a fully qualified dot delimited distinguished name of servers on which NICI must be upgraded to fully support multiple SDI keys. Server names are not displayed when this switch is omitted.
-V	Verbose, display all messages to SDIDiag console.
-X	Limit the search for servers to the container specified with the -n containerDN switch.

EXAMPLES OF SDIDiag COMMANDS

SECURITY DOMAIN MANAGEMENT
AS [-A] [-V] [-S serverDN]  [> file | >> file]
Add server -S serverDN as a Security Domain Server.
Another way to do this is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and add an additional server as an attribute value to the "NDSPKI:SD Key Server DN" attribute.
LK [-A] [-V] [-S serverDN]  [> file | >> file]
List keys held by the Security Domain Servers.
All servers which are listed under the "NDSPKI:SD Key Server DN" attribute on the other tab of the W0 object will be displayed with their associated SD Keys.
LS [-A] [-V] [-S serverDN]  [> file | >> file]
List the current Security Domain Servers.
Another way to gather this information is to open Console One and go to the W0 object in the Security Container. Select the "Other" tab on the W0 object and view the values of the "NDSPKI:SD Key Server DN" attribute.
RS [-A] [-V] [-S serverDN]  [> file | >> file]
Remove server -S serverDN as a Security Domain Server.
This can also been done through Console One by going to the W0 object in the Security Container. Select the "Other" tab on ther W0 object and delete a server shown as an attribute balue to the "NDSPKI:SD Key Server DN" attribute.
AP [-A] [-V] [-F] [> file | >> file]
Add any server hosting a writeable replica of the .W0.KAP.Security.Tree-Name object as a Security Domain Server.
If the -F switch is given, additionally remove any servers that do not hold a writeable replica.
 SD [-A] [-V] [-R] [-G] [-S serverDN ] [> file | >> file]
Synchronize the Security Domain Servers. The optional -R switch revokes all existing keys and generates a new SD key for use within the tree. The optional -G switch generates a new SD key.

NOTE: If either the -R or -G switches are used, then the RD command may need to be used to resynchronize the new keys to the other servers in the tree.
Revoked keys are retained and used to access any existing items, however, they are not used to manage new keys.
SERVER MANAGEMENT
FS [-N containerDN] [-X] [-O file] [-U file]
Find all servers starting with the -N containerDN and all sub-containers unless the -X switch is given, in which case, limit the search to the -N containerDN only. Output all eDirectory 8.7.1 servers or higher to a file using the -O file while all other server that are listed are outputed to the -U file. The -O file  may be used as an input to any commands that the support the -I file switch.
LK [-A] [-V] [-S serverDN ] [> file | >> file]
List keys held by -s serverDN.
Example of using LK is:
SDIDIAG> LK -A -S .servername.org.tree_name
RD [-A] [-V] [-T] [-N containerDN] [> file | >> file]
Resynchronize the Security Domain Servers with other servers in the tree.
If the -T switch is given, RD or RESYNC, performs a two pass operation by first ensuring that the Security Domain Servers have a copy of all keys on all referenced servers.
Secondly, RD resynchronizes all servers with the updated Security Domain Servers.
If the -N switch is omitted, RD attempts to resync all servers within the tree; whereas when the -N containerDN switch is provided, RD only resynchronizes the Security Domain with all servers holding writeable replicas of the specified containerDN partition. It 1460 persist, then a full RESYNC may be attempted which may take a considerable time as every server will need to be contacted.
Examples of using RD are:
SDIDIAG> RD -T -n .orgUnit.org.tree_name.
SS [-A] [-V] [-R] [-S serverDN] [-I file] [-N containerDN]
Synchronize all keys on the specified -S serverDN, severs in listed in the -I file, or server hosting a writeable replica of the -N containerDN with the Security Domain Servers. The -R switch may optionally be given to revoke all the existing keys on the server before synchronizing with the Security Domain Servers.
Example of using SS is:
SDIDIAG> SS -A -R -S .servername.org.tree_name
DIAGNOSTIC
CK [-A] [-V] [-N containerDN] [> file | >> file]
Check and display possible problems and display recommendations for the Security Domain Servers. If the -N containerDN is provided, also check the servers hosting a writeable replica of the -N containerDN object for possible problems and provide recommendations.
Examples of using CK are:

SDIDIAG> CK
SDIDIAG> CK -N .orgUnit.org.tree-name
SDIDIAG> CK -A -N .orgUnit.org.tree-name >> SYS:\TEMP\OUTPUT.TXT