Home/ Questions/Q 6101405
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T13:29:47+00:00

OpenDS provides command-line access to many necessary account functions via its manage-account utility. For

  • 0

OpenDS provides command-line access to many necessary account functions via its manage-account utility. For example, to disable an account:

manage-account set-account-is-disabled --operationValue true 
--baseDN uid=someuser,ou=People,dc=example,dc=com" --hostname hostname --port 389
--bindDN "cn=Directory Manager" --bindPassword password

This is fine and dandy is you have a sysadmin to administer your ldap server but in a scenario where you have 1000s of users all over the globe this becomes a problem (imagine a user locked out of their account in Japan while the sysadmin is asleep in the US). We’d like to be able to programmatically tie into some of these manage-account functions so we can provide local admins/managers the ability to manage their own users.

Can anybody provide any insight on if this is possible and if so how? We are writing this in C# and I can’t find any examples on it. Looking at the .NET API docs I thought System.DirectoryServices.Protocols.ExtendedRequest looked promising but cannot figure out how to use it.

Any help would be greatly appreciated, thanks!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The Manage-Account tool uses an LDAP extended operation, which code is in opends/src/server/org/opends/server/extensions/PasswordPolicyStateExtendedOperation.java.

    Alternately, you can check the OpenDJ LDAP SDK, which has support for the extended operation, and will allow you to quickly write a client application.
    OpenDJ LDAP SDK is documented at http://opendj.forgerock.org/opendj-ldap-sdk/ (and the doc is in the developer’s guide : http://opendj.forgerock.org/doc/dev-guide/OpenDJ-Dev-Guide.html).

    Regards,

    Ludovic

    • 0