IGEL UMS Administrator Command-Line Interface

List all configured data sources

db

list

Shows the ID of the data source, which is required by other commands.

The lowest ID is 1.

IDs may change upon the creation and deletion of data sources.

It is strongly recommended to always extract the ID before using it in other commands with --id

The ID is calculated like this: highest existing ID + 1

Show all details of a database

db

show

-i

--id

integer

The ID of the database to show

Run umsadmin-cli db list to get a list of current data sources and select the ID of a data source.

Run umsadmin-cli db show --id <ID>  with that ID.

Create a new database connection

db

create

-t

--type

string

The database type.
For a list of the possible values, type umsadmin-cli db create

Type, user, and port are required.

Other options may or may not be required depending on the DB type

db create will activate the database by default; this can be prevented by using -A or --no-activate. A password option cannot be used then.

If activation fails, the data source entry will still be present and is not active (same behavior as in the graphical UMS Administrator).

'rmdb' is a reserved name for the embedded database type and cannot be used for other types.

-H

--host

string

The database host

-d

--domain

string

The database domain

-p

--port

integer

The database port

-u

--user

string

The database username

-S

--schema

string

The database schema

-n

--name

string

The database name.

Free text, except 'rmdb'; this name is reserved for the embedded database.

-I

--instance

string

The name of the database instance

-A

--no-activate

The database will not be activated.

--password:file

string

The password is read from a file (plain text) whose path is provided after this option.

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Edit a data source

db

edit

-t

--type

string

The database type.
For a list of the possible values, type umsadmin-cli db create

Embedded databases cannot be edited (as in the graphical UMS Administrator).

All options are optional, except --id

-H

--host

string

The database host

-d

--domain

string

The database domain

-i

--id

integer

The identifier of the database to be edited

-I

--instance

string

The name of the database instance

--jdbc-params

string

Additional JDBC parameter. 

For details on the JDBC parameters, see How to Set Up a Data Source in the IGEL UMS Administrator.

Examples:

• rmadmin\umsadmin-cli.exe db create --type=mssql --name=rmdb12_00 --host=122.30.229.1 --port=1433 --user=rmdb --password:in --jdbc-params sendStringParametersAsUnicode=false;

• rmadmin/umsadmin-cli.bin db edit -i 1 --jdbc-params sendStringParametersAsUnicode=false;

-n

--name

string

The database name.

Free text, except 'rmdb'; this name is reserved for the embedded database.

-p

--port

integer

The database port

-S

--schema

string

The database schema

-u

--user

string

The database username

Activate a database connection

db

activate

--password:file

string

The password is read from a file (plain text) whose path is provided after this option. 

Example: umsadmin-cli db activate --password:file /home/ike/password.txt

--password:in

string

The password is read from stdin; an interactive prompt is shown.

-i

--id

integer

The identifier of the database to be activated

Deactivate the active database connection

db

deactivate

-i

--id

integer

The identifier of the database to be deactivated

Test the active database connection

db

test

--password:file

string

The password is read from a file (plain text) whose path is provided after this option. 

Example: umsadmin-cli db test --password:file /home/ike/password.txt

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Optimize the active database

db 

optimize

This command can only be applied to an embedded database or a Derby database.

Create a copy of the current database

db

copy

-t

--target

integer

The ID of the target database

To get the database ID, enter umsadmin-cli db list

--password:file

string

The password is read from a file (plain text) whose path is provided after this option. 

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Delete a database connection

db

delete

-i

--id

integer

The ID of the database connection that is to be deleted

Create a backup of the current embedded database

db

backup

-o

--outfile

Path to the target file. The file suffix .pbak is automatically added. 

Existing backup files are not overwritten.

-f

--full

Full backup. Database, server configurations, and transfer files are included.

-p

--parent

All directories for the specified path will be created if they are not already existing.

Restore a backup into the embedded database

db

restore

-f

--file

Path to the backup file

List all ports and SSL flag

ports

list

Set new port numbers or SSL-only flag

ports

set

-d

--dev-comm

integer

Device communication port. For details, see Devices Contacting UMS.

-j

--java-webstart

integer

Java Web Start port

-w

--web-server

integer

UMS server port. For details, see UMS with Internal Database and UMS with External Database.

-e

--embedded

integer

Embedded database port

--ssl-only

boolean

Allow SSL connections only

List all ciphers, optionally filtered

cipher

list

List all ciphers

-e

--enabled

List only enabled ciphers

-d

--disabled

List only disabled ciphers

Enable ciphers

cipher

enable

Enable ciphers. The ciphers are separated by whitespaces.

Example: umsadmin-cli cipher enable CIPHER1 CIPHER 2 CIPHER3 

--all

Apply for all; individual cipher names are ignored.

Disable ciphers

cipher

disable

Disable ciphers. The ciphers are separated by whitespaces.

Example: umsadmin-cli cipher disable CIPHER1 CIPHER 2 CIPHER3

--all

Apply for all; individual cipher names are ignored.

Reset web certificates

reset-certs

-y

--yes

The reset is only executed after confirmation

Assign certificate to current or all servers

web-certs

assign-cert

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

-s

--server

Server to which the certificate is assigned. Possible values:

• ALL_SERVER

• CURRENT_SERVER (default)

Create a root certificate

web-certs

create-root-cert

-a

--algorithm

Key pair algorithm; rsa or ec (default: rsa)

-c

--country

Country code (two letters)

-d

--expiration-date

Expiration date (YYYY-MM-DD)

(Current date plus 20 years if not specified.)

--key-size

Key size (4096, 8192, ... bits). Valid values :

• 4k (default)

• 8k

• 12k

• 16k 

-l

--locality

Locality

(If not specified, the hash code of a random uuid is used.)

-n

--name

Certificate name
(default: Root certificate)

--named-curve

Named curve.
Valid values:

• nist-p-384 (default)

• nist-p-256

• nist-p-521 

-o

--organization

Organization

(Mandatory option)

Create signed certificate

web-certs

create-signed-cert

-f

--fingerprint-sha1

SHA1 fingerprint of parent CA certificate

The parent CA certificate is specified by the SHA1 fingerprint. It doesn’t matter whether you use no delimiter, ‘-’ or ‘:’ as the delimiter for the fingerprint.

-n

--name

Certificate name
(default: Certificate)

--cn

Common name

-c

--country

Country code (two letters)

-o

--organization

Organization

-l

--locality

Locality

(If not specified, the hash code of a random uuid is used.)

-d

--expiration-date

Expiration date (YYYY-MM-DD)

(Current date plus 1 year if not specified.)

--ca

Certificate type:

• true = CA certificate

• false = End entity (default)

-h

--hostname

Hostname (hostname or one of these values:

• ALL_SERVER

• CURRENT_SERVER (default)

You can specify a list of hostnames for the subject alternative names (SAN) or you can specify, whether the current server (CURRENT_SERVER) or all servers (ALL_SERVER) should be listed in the SAN list.

Delete a certificate

web-certs

delete

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

Export certificate

web-certs

export-cert

-c

--cert-file

Path to which the certificate should be exported
(Name cert.cert is used when only a directory is specified.)

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

Export certificate chain to keystore (JKS)

web-certs

export-cert-chain

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

-k

--keystore-file

Path to keystore to which certificate chain should be exported

--password:file

Path to a file containing the password

--password:in

Shows an interactive prompt to enter the password

Import certificate chain from keystore

web-certs

import-cert-chain

-k

--keystore-file

The keystore file

--password:file

Path to a file containing the password

--password:in

Shows an interactive prompt to enter the password

Import decrypted private key

web-certs

import-private-key

-f

--fingerprint-sha1

SHA1 fingerprint of parent CA certificate

-p

--private-key-file

The file containing the private key

Import root certificate

web-certs

import-root-cert

-c

--cert-file

The root certificate (CERT, CER, CRT, PEM)

Import signed certificate

web-certs

import-signed-cert

-c

--cert-file

The root certificate (CERT, CER, CRT, PEM)

A certificate can only be imported when no other certificate with the same fingerprint already exists; otherwise, you will get an error message.

-f

--fingerprint-sha1

SHA1 fingerprint of parent CA certificate

List the assigned server of a certificate

web-certs

list-assigned-server

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

List all web certificates or details of a certificate

web-certs

list

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

When you specify a fingerprint, the details of the certificate with that fingerprint are shown.

Renew certificate

web-certs

renew-cert

-f

--fingerprint-sha1

SHA1 fingerprint of certificate

You only have to specify the fingerprint of the certificate that should be renewed. If the other parameters are not specified, the values from the old certificate are used (with a new expiration date).

-n

--name

Certificate name 

--cn

Common name

-c

--country

Country code (two letters)

-o

--organization

Organization

-l

--locality

Locality

-d

--expiration-date

Expiration date (YYYY-MM-DD)
(Current date plus 1 year if not specified)

-h

--hostname

Hostname (hostname or one of these values:

• ALL_SERVER

• CURRENT_SERVER

Enable the acceptance of expired client certificates

accept-expired-client-certs

enable

Enables the use of a custom TrustManager that accepts expired client certificates. As a result, the UMS can communicate with IGEL OS 12 devices that have expired client certificates.

Disables the acceptance of expired client certificates

accept-expired-client-certs

disable

Disables the use of a custom TrustManager that accepts expired client certificates. As a result, the UMS cannot communicate with IGEL OS 12 devices that have expired client certificates.

Show state of the option

accept-expired-client-certs

state

Shows if the custom TrustManager is enabled or disabled.

Show UMS superuser

su

list

Change UMS superuser

su

change

-u

--user

string

New superuser

-p

--password:file

string

The password is read from a file (plain text) whose path is provided after this option.

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Show the current UMS IDs

licensing

list

Create a new UMS ID

licensing

create

Backup the UMS ID

licensing

backup

-o

--outfile

string

Path to the target file (file suffix: .ksbak)

-p

--parent

All directories for the specified path will be created if they are not already existing.

--password:file

string

The password is read from a file (plain text) whose path is provided after this option.

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Restore a UMS ID from a backup

licensing

restore

-f

--file

string

Path to the backup file

--password:file

string

The password is read from a file (plain text) whose path is provided after this option.

--password:in

string

The password is read from stdin; an interactive prompt is shown.

Register a license to the UMS

ums-license

register

-f

--filename

path to .lic file

Path to the UMS license file.

During registration several errors could occur, e.g. the path doesn’t exist, the file is invalid, the license already exists, the UMS ID doesn’t match. When such an error occurs a corresponding error code is returned. See error codes under Error Numbers.

Returns current UMS License information

ums-license

state

Delete all licenses previously imported with the command register

ums-license

deleteall

Install a network token for the UMS Server or a broker (UMS HA)

token

-f

--token-file

string

Path to token file

This command is also available as a standalone command named umstokeninstall-cli in broker-only installations. It is equivalent to umsadmin-cli token.

--server

boolean

Install token for UMS Server

--broker

boolean

Install token for broker

Show the current UMS cluster FQDN

ums-cluster

list

Set a new UMS cluster FQDN

ums-cluster

create

-n

--name

Name for the new UMS cluster FQDN

Delete the current UMS cluster FQDN

ums-cluster

remove

Start the local UMS Server

server

start

Stop the local UMS Server

server

stop

Restart the local UMS Server

server

restart

End the update mode of the local UMS Server

server

end-update-mode

Set the distributed mode of the UMS installation

server

distributed

-e

--enable

Enable Distributed UMS

-d

--disable

Disable Distributed UMS

Encrypt text

enc

encrypt

-p

--plain-text

Example:

enc encrypt -p “testExample“

Encode file

enc

encode

-f

--plain-file

Example:

enc encode -f "/home/IGEL/test.user/Downloads/test/test.ksbak"