Using exec tasks

The absolute path to the command to execute must be listed in the <server-root>/config/exec-command-whitelist.txt file.

The global configuration must be updated to allow the exec task. The server does not permit it by default. The following command enables this.

$ bin/dsconfig set-global-configuration-prop \
  --add allowed-task:com.unboundid.directory.server.tasks.ExecTask

The user scheduling the task must have the exec-task privilege. The server does not grant permission to run this task to any user by default, including root users.

To grant the exec-task privilege to a single root user, run the following.

$ bin/dsconfig set-root-dn-user-prop --user-name "<username>" \
  --add privilege:exec-task

To grant the exec-task privilege to all root users, run the following.

$ bin/dsconfig set-root-dn-prop \
  --add default-root-privilege-name:exec-task

To grant the exec-task privilege to a single non-root user, run the following.

dn:  <userdn>
changetype: modify
add: ds-privilege-name
ds-privilege-name: exec-task

Use the schedule-exec-task tool to create an exec task from the command line.

Example:

$ bin/schedule-exec-task --hostname directory.example.com \
  --port 389 \
  --bindDN uid=admin,dc=example,dc=com \
  --promptForBindPassword \
  --waitForCompletion \
  --logCommandOutput \
  /ds/bin/verify-index --baseDN dc=example,dc=com --index cn