OTPME-REALM(1)

NAME
otpme-realm - manage OTPme realms

SYNOPSIS
otpme-realm command [options] [realm]

DESCRIPTION
otpme-realm manages realms in the OTPme system. A realm is the top-level organizational unit that contains all objects (users, tokens, hosts, nodes, groups, etc.). The realm is initialized with a CA hierarchy and a master site.

COMMANDS

  Realm Initialization

init [options] realm site fqdn [address]
    Initialize a new realm. Creates the realm with a master site, CA hierarchy, and initial node. This is the first command run when setting up a new OTPme installation.

  Display

show [realm]
    Display realm information. Without arguments, shows all realms.

list [regex]
    List realms, optionally filtered by regex pattern.

  Authentication and Synchronization

enable_auth realm
    Enable authentication with a trusted realm.

disable_auth realm
    Disable authentication with a trusted realm.

enable_sync realm
    Enable synchronization with a trusted realm.

disable_sync realm
    Disable synchronization with a trusted realm.

  CA Data

dump_ca_data realm
    Dump realm CA data (certificates and CRLs) to stdout.

update_ca_data realm
    Update realm CA data (certificates and CRLs).

  Policy Management

add_policy realm policy
    Attach a policy to the realm.

remove_policy realm policy
    Remove a policy from the realm.

list_policies realm
    List policies attached to the realm.

  ACL Management

add_acl realm owner_type owner acl
    Add an access control entry.

del_acl realm acl
    Remove an access control entry.

show_acls realm
    Display all ACLs for the realm.

  Extension and Attribute Management

add_extension realm extension
    Add an extension to the realm.

remove_extension realm extension
    Remove an extension from the realm.

add_attribute realm attribute=value
    Add an LDAP attribute to the realm.

modify_attribute realm attribute old_value new_value
    Modify an LDAP attribute of the realm.

del_attribute realm attribute=value
    Remove an LDAP attribute from the realm.

add_object_class realm class
    Add an LDAP object class to the realm.

del_object_class realm class
    Remove an LDAP object class from the realm.

show_ldif [-a attributes] realm
    Show LDIF representation of the realm. Use -a to show only specific attributes.

  Configuration and Attributes

description realm [description]
    Set realm description.

info realm [info]
    Set free-form info text. If info is omitted, the current info text is opened in the editor specified by the EDITOR environment variable.

dump_info realm
    Dump the info text to stdout.

touch realm
    Re-index the object to fix potential index problems.

  Import/Export

export [--password PASS] realm
    Export realm configuration.

remove_orphans realm
    Remove orphaned object references.

INIT OPTIONS
These options are used with the init command:

  CA Certificate Options

--ca-valid DAYS
    CA certificate validity in days.

--ca-key-len BITS
    Key length for CA certificates in bits.

--country COUNTRY
    Set CA certificate country field.

--state STATE
    Set CA certificate state field.

--locality LOCALITY
    Set CA certificate locality field.

--organization ORG
    Set CA certificate organization field.

--ou OU
    Set CA certificate organizational unit field.

--email EMAIL
    Set CA certificate email field.

  Site and Node Certificate Options

--site-valid DAYS
    Master site certificate validity in days.

--site-key-len BITS
    Key length for master site certificate in bits.

--node-valid DAYS
    Master node certificate validity in days.

--node-key-len BITS
    Key length for master node certificate in bits.

  Dictionary and ID Range Options

--no-dicts
    Do not add any word dictionaries for password strength checking.

--dicts dict1,dict2
    Add the given word dictionaries for password strength checking.

--id-ranges range1,range2
    ID ranges to add during initialization.

OPTIONS

  Display Options

-a  Show all realms.

-z SIZE
    Limit output size.

--fields FIELD1,FIELD2
    Display only specified fields.

--policy-limit N
    Limit number of policies shown.

--sort-by FIELD
    Sort output by field.

--reverse
    Reverse sort order.

--raw
    Output without headers/borders.

--csv
    Output as CSV.

--csv-sep SEP
    CSV separator character.

--attribute ATTR
    Display specific attribute in list command.

  General Options

--password PASS
    Password for encrypting exports.

Global options are available for all commands. See otpme(1) for details.

EXAMPLES

  Initializing a Realm

otpme-realm init myrealm master node1.example.com 10.0.0.1
    Initialize a new realm with master site and node

otpme-realm init --ca-key-len 4096 myrealm master node1.example.com
    Initialize with 4096-bit CA keys

  CA Data

otpme-realm dump_ca_data myrealm
    Export CA certificates and CRLs

FILES

/var/lib/otpme/
    OTPme data directory

SEE ALSO
otpme(1), otpme(7), otpme-site(1), otpme-ca(1), otpme-node(1), otpme-policy(1)

AUTHOR
the2nd <the2nd@otpme.org>

NOTE
This manual page was created with AI assistance.

COPYRIGHT
Copyright © 2014-2025 the2nd. License: GPLv3