diff --git a/servers/slapd/Makefile.in b/servers/slapd/Makefile.in
index 1bfb523796df06a8c6007336526c72fba498be54..644de6603b0e39ba47c6d369012efe44c4a93d15 100644
--- a/servers/slapd/Makefile.in
+++ b/servers/slapd/Makefile.in
@@ -13,11 +13,12 @@
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
 
-PROGRAMS=slapd
+SLAPTOOLS=slapadd slapcat slapindex slapppasswd
+PROGRAMS=slapd $(SLAPTOOLS)
 XPROGRAMS=sslapd libbackends.a .backend liboverlays.a
 XSRCS=version.c
 
-SUBDIRS=back-* shell-backends slapi overlays tools
+SUBDIRS=back-* shell-backends slapi overlays
 
 NT_SRCS = nt_svc.c
 NT_OBJS = nt_svc.o ../../libraries/liblutil/slapdmsg.res
@@ -34,6 +35,7 @@ SRCS	= main.c globals.c config.c daemon.c \
 		oidm.c starttls.c index.c sets.c referral.c root_dse.c \
 		sasl.c module.c mra.c mods.c sl_malloc.c limits.c \
 		backglue.c operational.c matchedValues.c cancel.c syncrepl.c \
+		slapadd.c slapcat.c slapcommon.c slapindex.c slappasswd.c \
 		backover.c ctxcsn.c ldapsync.c sessionlog.c $(@PLAT@_SRCS)
 
 OBJS	= main.o globals.o config.o daemon.o \
@@ -48,6 +50,7 @@ OBJS	= main.o globals.o config.o daemon.o \
 		oidm.o starttls.o index.o sets.o referral.o root_dse.o \
 		sasl.o module.o mra.o mods.o sl_malloc.o limits.o \
 		backglue.o operational.o matchedValues.o cancel.o syncrepl.o \
+		slapadd.o slapcat.o slapcommon.o slapindex.o slappasswd.o \
 		backover.o ctxcsn.o ldapsync.o sessionlog.o $(@PLAT@_OBJS)
 
 LDAP_INCDIR= ../../include -I$(srcdir)/slapi
@@ -250,13 +253,14 @@ libslapi.a: slapi/.libs/libslapi.a
 slapd: $(SLAPD_DEPENDS) @LIBSLAPI@
 	$(LTLINK) -o $@ $(SLAPD_OBJECTS) $(LIBS) \
 		$(WRAP_LIBS)
+	rm -f $(SLAPTOOLS)
+	for i in $(SLAPTOOLS); do \
+		$(LN_S) slapd $$i; done
+
 
 sslapd: version.o
 	$(LTLINK) -static -o $@ $(OBJS) version.o $(LIBS) $(WRAP_LIBS)
 
-tools $(SLAPD_DYNAMIC_BACKENDS): slapd
-	cd $@; $(MAKE) $(MFLAGS) all
-	@touch $@
 
 #
 # In Windows, dynamic backends have to be built after slapd. For this
@@ -354,7 +358,7 @@ install-slapd: FORCE
 	    fi; \
 	done
 
-all-cffiles: slapd $(SLAPD_DYNAMIC_BACKENDS) tools
+all-cffiles: slapd $(SLAPD_DYNAMIC_BACKENDS)
 	@if test $(PLAT) = NT; then \
 	    sysconfdir=`cygpath -w $(sysconfdir) | \
 		$(SED) -e 's/\\\\/\\\\\\\\\\\\\\\\/g'`; \
@@ -406,6 +410,8 @@ install-conf: FORCE
 	fi
 
 install-tools: FORCE
-	@-$(MKDIR) $(DESTDIR)$(sbindir)
-	(cd tools; $(MAKE) $(MFLAGS) install)
+	-$(MKDIR) $(DESTDIR)$(sbindir)
+	cd $(DESTDIR)$(sbindir); rm -f $(SLAPTOOLS); \
+	for i in $(SLAPTOOLS); do \
+		$(LN_S) $(DESTDIR)$(libexecdir)/slapd $$i; done
 
diff --git a/servers/slapd/main.c b/servers/slapd/main.c
index 04e0c981f1d9f68223826f6471ff6e3f91788f1a..497d40868161bcc3f2b7b8cf6e82aa1e442d6c65 100644
--- a/servers/slapd/main.c
+++ b/servers/slapd/main.c
@@ -64,6 +64,20 @@ static struct sockaddr_in	bind_addr;
 #define MAIN_RETURN(x) return(x)
 #endif
 
+typedef int (MainFunc) LDAP_P(( int argc, char *argv[] ));
+extern MainFunc slapadd, slapcat, slapindex, slappasswd;
+
+static struct {
+	char *name;
+	MainFunc *func;
+} tools[] = {
+	{"slapadd", slapadd},
+	{"slapcat", slapcat},
+	{"slapindex", slapindex},
+	{"slappasswd", slappasswd},
+	{NULL, NULL}
+};
+
 /*
  * when more than one slapd is running on one machine, each one might have
  * it's own LOCAL for syslogging and must have its own pid/args files
@@ -113,6 +127,7 @@ usage( char *name )
 	fprintf( stderr,
 		"\t-4\t\tIPv4 only\n"
 		"\t-6\t\tIPv6 only\n"
+		"\t-T (a|c|i|p)\tRun in Tool mode\n"
 		"\t-c cookie\tSync cookie of consumer\n"
 		"\t-d level\tDebug level" "\n"
 		"\t-f filename\tConfiguration file\n"
@@ -164,7 +179,7 @@ int main( int argc, char **argv )
 #else
 	char		*configfile = SLAPD_DEFAULT_CONFIGFILE;
 #endif
-	char	    *serverName = NULL;
+	char	    *serverName;
 	int	    serverMode = SLAP_SERVER_MODE;
 
 	struct berval cookie = { 0, NULL };
@@ -180,6 +195,17 @@ int main( int argc, char **argv )
 
 	sl_mem_init();
 
+	serverName = lutil_progname( "slapd", argc, argv );
+
+	if ( strcmp( serverName, "slapd" ) ) {
+		for (i=0; tools[i].name; i++) {
+			if ( !strcmp( serverName, tools[i].name ) ) {
+				rc = tools[i].func(argc, argv);
+				MAIN_RETURN(rc);
+			}
+		}
+	}
+
 #ifdef HAVE_NT_SERVICE_MANAGER
 	{
 		int *i;
@@ -188,7 +214,6 @@ int main( int argc, char **argv )
 		char *regService = NULL;
 
 		if ( is_NT_Service ) {
-			serverName = argv[0];
 			lutil_CommenceStartupProcessing( serverName, slap_sig_shutdown );
 			if ( strcmp(serverName, SERVICE_NAME) )
 			    regService = serverName;
@@ -241,7 +266,7 @@ int main( int argc, char **argv )
 #endif
 
 	while ( (i = getopt( argc, argv,
-			     "c:d:f:h:s:n:t:V"
+			     "c:d:f:h:s:n:t:T:V"
 #if LDAP_PF_INET6
 				"46"
 #endif
@@ -341,7 +366,6 @@ int main( int argc, char **argv )
 #endif /* SETUID && GETUID */
 
 		case 'n':  /* NT service name */
-			if( serverName != NULL ) free( serverName );
 			serverName = ch_strdup( optarg );
 			break;
 
@@ -352,6 +376,14 @@ int main( int argc, char **argv )
 			version++;
 			break;
 
+		case 'T':
+			for (i=0; tools[i].name; i++) {
+				if ( optarg[0] == tools[i].name[4] ) {
+					rc = tools[i].func(argc, argv);
+					MAIN_RETURN(rc);
+				}
+			}
+			/* FALLTHRU */
 		default:
 			usage( argv[0] );
 			rc = 1;
@@ -374,14 +406,6 @@ int main( int argc, char **argv )
 		if ( version > 1 ) goto stop;
 	}
 
-	if( serverName == NULL ) {
-		if ( (serverName = strrchr( argv[0], *LDAP_DIRSEP )) == NULL ) {
-			serverName = argv[0];
-		} else {
-			serverName = serverName + 1;
-		}
-	}
-
 	{
 		char *logName;
 #ifdef HAVE_EBCDIC
diff --git a/servers/slapd/slapadd.c b/servers/slapd/slapadd.c
new file mode 100644
index 0000000000000000000000000000000000000000..eaa3b9cb54385ba09a1d102313d949f55bf97d80
--- /dev/null
+++ b/servers/slapd/slapadd.c
@@ -0,0 +1,690 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1998-2003 Kurt D. Zeilenga.
+ * Portions Copyright 2003 IBM Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Kurt Zeilenga for inclusion
+ * in OpenLDAP Software.  Additional signficant contributors include
+ *    Jong Hyuk Choi
+ *    Pierangelo Masarati
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+
+#include <ac/ctype.h>
+#include <ac/string.h>
+#include <ac/socket.h>
+#include <ac/unistd.h>
+
+#include <lber.h>
+#include <ldif.h>
+#include <lutil.h>
+
+#include "slapcommon.h"
+
+static char csnbuf[ LDAP_LUTIL_CSNSTR_BUFSIZE ];
+static const struct berval slap_syncrepl_bvc = BER_BVC("syncreplxxx");
+static const struct berval slap_syncrepl_cn_bvc = BER_BVC("cn=syncreplxxx");
+static struct berval slap_syncrepl_bv = BER_BVNULL;
+static struct berval slap_syncrepl_cn_bv = BER_BVNULL;
+
+struct subentryinfo {
+	struct berval cn;
+	struct berval ndn;
+	struct berval rdn;
+	struct berval cookie;
+	LDAP_SLIST_ENTRY( subentryinfo ) sei_next;
+};
+
+int
+slapadd( int argc, char **argv )
+{
+	char		*buf = NULL;
+	int         lineno;
+	int         lmax;
+	int			rc = EXIT_SUCCESS;
+
+	const char *text;
+	char textbuf[SLAP_TEXT_BUFLEN] = { '\0' };
+	size_t textlen = sizeof textbuf;
+	const char *progname = "slapadd";
+
+	struct berval csn;
+	struct berval maxcsn = { 0, NULL };
+	struct berval ldifcsn = { 0, NULL };
+	int match;
+	int	provider_subentry = 0;
+	struct subentryinfo *sei;
+	LDAP_SLIST_HEAD( consumer_subentry_slist, subentryinfo ) consumer_subentry;
+	Attribute *attr;
+	Entry *ctxcsn_e;
+	ID	ctxcsn_id;
+	struct berval	ctxcsn_ndn = { 0, NULL };
+	int ret;
+	struct berval bvtext;
+	int i;
+#ifdef NEW_LOGGING
+	lutil_log_initialize(argc, argv );
+#endif
+	slap_tool_init( progname, SLAPADD, argc, argv );
+
+	LDAP_SLIST_INIT( &consumer_subentry );
+
+	if( !be->be_entry_open ||
+		!be->be_entry_close ||
+		!be->be_entry_put )
+	{
+		fprintf( stderr, "%s: database doesn't support necessary operations.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	lmax = 0;
+	lineno = 0;
+
+	if( be->be_entry_open( be, 1 ) != 0 ) {
+		fprintf( stderr, "%s: could not open database.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	while( ldif_read_record( ldiffp, &lineno, &buf, &lmax ) ) {
+		Entry *e = str2entry( buf );
+
+		/*
+		 * Initialize text buffer
+		 */
+		bvtext.bv_len = textlen;
+		bvtext.bv_val = textbuf;
+		bvtext.bv_val[0] = '\0';
+
+		if( e == NULL ) {
+			fprintf( stderr, "%s: could not parse entry (line=%d)\n",
+				progname, lineno );
+			rc = EXIT_FAILURE;
+			if( continuemode ) continue;
+			break;
+		}
+
+		/* make sure the DN is not empty */
+		if( !e->e_nname.bv_len ) {
+			fprintf( stderr, "%s: empty dn=\"%s\" (line=%d)\n",
+				progname, e->e_dn, lineno );
+			rc = EXIT_FAILURE;
+			entry_free( e );
+			if( continuemode ) continue;
+			break;
+		}
+
+		/* check backend */
+		if( select_backend( &e->e_nname, is_entry_referral(e), nosubordinates )
+			!= be )
+		{
+			fprintf( stderr, "%s: line %d: "
+				"database (%s) not configured to hold \"%s\"\n",
+				progname, lineno,
+				be ? be->be_suffix[0].bv_val : "<none>",
+				e->e_dn );
+			fprintf( stderr, "%s: line %d: "
+				"database (%s) not configured to hold \"%s\"\n",
+				progname, lineno,
+				be ? be->be_nsuffix[0].bv_val : "<none>",
+				e->e_ndn );
+			rc = EXIT_FAILURE;
+			entry_free( e );
+			if( continuemode ) continue;
+			break;
+		}
+
+		if( global_schemacheck ) {
+			Attribute *sc = attr_find( e->e_attrs,
+				slap_schema.si_ad_structuralObjectClass );
+			Attribute *oc = attr_find( e->e_attrs,
+				slap_schema.si_ad_objectClass );
+
+			if( oc == NULL ) {
+				fprintf( stderr, "%s: dn=\"%s\" (line=%d): %s\n",
+					progname, e->e_dn, lineno,
+					"no objectClass attribute");
+				rc = EXIT_FAILURE;
+				entry_free( e );
+				if( continuemode ) continue;
+				break;
+			}
+
+			if( sc == NULL ) {
+				struct berval vals[2];
+
+				rc = structural_class( oc->a_vals, vals,
+					NULL, &text, textbuf, textlen );
+
+				if( rc != LDAP_SUCCESS ) {
+					fprintf( stderr, "%s: dn=\"%s\" (line=%d): (%d) %s\n",
+						progname, e->e_dn, lineno, rc, text );
+					rc = EXIT_FAILURE;
+					entry_free( e );
+					if( continuemode ) continue;
+					break;
+				}
+
+				vals[1].bv_len = 0;
+				vals[1].bv_val = NULL;
+
+				attr_merge( e, slap_schema.si_ad_structuralObjectClass,
+					vals, NULL /* FIXME */ );
+			}
+
+			/* check schema */
+			rc = entry_schema_check( be, e, NULL, &text, textbuf, textlen );
+
+			if( rc != LDAP_SUCCESS ) {
+				fprintf( stderr, "%s: dn=\"%s\" (line=%d): (%d) %s\n",
+					progname, e->e_dn, lineno, rc, text );
+				rc = EXIT_FAILURE;
+				entry_free( e );
+				if( continuemode ) continue;
+				break;
+			}
+		}
+
+		if ( SLAP_LASTMOD(be) ) {
+			struct tm *ltm;
+			time_t now = slap_get_time();
+			char uuidbuf[ LDAP_LUTIL_UUIDSTR_BUFSIZE ];
+			struct berval vals[ 2 ];
+
+			struct berval name, timestamp;
+
+			struct berval nvals[ 2 ];
+			struct berval nname;
+			char timebuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
+
+			vals[1].bv_len = 0;
+			vals[1].bv_val = NULL;
+
+			nvals[1].bv_len = 0;
+			nvals[1].bv_val = NULL;
+
+			ltm = gmtime(&now);
+			lutil_gentime( timebuf, sizeof(timebuf), ltm );
+
+			csn.bv_len = lutil_csnstr( csnbuf, sizeof( csnbuf ), 0, 0 );
+			csn.bv_val = csnbuf;
+
+			timestamp.bv_val = timebuf;
+			timestamp.bv_len = strlen(timebuf);
+
+			if ( be->be_rootndn.bv_len == 0 ) {
+				name.bv_val = SLAPD_ANONYMOUS;
+				name.bv_len = sizeof(SLAPD_ANONYMOUS) - 1;
+				nname.bv_val = SLAPD_ANONYMOUS;
+				nname.bv_len = sizeof(SLAPD_ANONYMOUS) - 1;
+			} else {
+				name = be->be_rootdn;
+				nname = be->be_rootndn;
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_entryUUID )
+				== NULL )
+			{
+				vals[0].bv_len = lutil_uuidstr( uuidbuf, sizeof( uuidbuf ) );
+				vals[0].bv_val = uuidbuf;
+				attr_merge_normalize_one( e,
+							slap_schema.si_ad_entryUUID, vals, NULL );
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_creatorsName )
+				== NULL )
+			{
+				vals[0] = name;
+				nvals[0] = nname;
+				attr_merge( e, slap_schema.si_ad_creatorsName, vals, nvals );
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_modifiersName )
+				== NULL )
+			{
+				vals[0] = name;
+				nvals[0] = nname;
+				attr_merge( e, slap_schema.si_ad_modifiersName, vals, nvals );
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_createTimestamp )
+				== NULL )
+			{
+				vals[0] = timestamp;
+				attr_merge( e, slap_schema.si_ad_createTimestamp, vals, NULL );
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_modifyTimestamp )
+				== NULL )
+			{
+				vals[0] = timestamp;
+				attr_merge( e, slap_schema.si_ad_modifyTimestamp, vals, NULL );
+			}
+
+			if( attr_find( e->e_attrs, slap_schema.si_ad_entryCSN )
+				== NULL )
+			{
+				vals[0] = csn;
+				attr_merge( e, slap_schema.si_ad_entryCSN, vals, NULL );
+			}
+
+			if ( !is_entry_syncProviderSubentry( e ) &&
+				 !is_entry_syncConsumerSubentry( e ) &&
+				 update_ctxcsn != SLAP_TOOL_CTXCSN_KEEP ) {
+				attr = attr_find( e->e_attrs, slap_schema.si_ad_entryCSN );
+				if ( maxcsn.bv_len != 0 ) {
+					value_match( &match, slap_schema.si_ad_entryCSN,
+						slap_schema.si_ad_entryCSN->ad_type->sat_ordering,
+						SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
+						&maxcsn, &attr->a_nvals[0], &text );
+				} else {
+					match = -1;
+				}
+				if ( match < 0 ) {
+					if ( maxcsn.bv_val )
+						ch_free( maxcsn.bv_val );
+					ber_dupbv( &maxcsn, &attr->a_nvals[0] );
+				}
+			}
+		}
+
+		if ( update_ctxcsn == SLAP_TOOL_CTXCSN_KEEP ) {
+			if ( is_entry_syncProviderSubentry( e )) { 
+				if ( !LDAP_SLIST_EMPTY( &consumer_subentry )) {
+					fprintf( stderr, "%s: consumer and provider subentries "
+									 "are both present\n", progname );
+					rc = EXIT_FAILURE;
+					entry_free( e );
+					sei = LDAP_SLIST_FIRST( &consumer_subentry );
+					while ( sei ) {
+						ch_free( sei->cn.bv_val );
+						ch_free( sei->ndn.bv_val );
+						ch_free( sei->rdn.bv_val );
+						ch_free( sei->cookie.bv_val );
+						LDAP_SLIST_REMOVE_HEAD( &consumer_subentry, sei_next );
+						ch_free( sei );
+						sei = LDAP_SLIST_FIRST( &consumer_subentry );
+					}
+					break;
+				}
+				if ( provider_subentry ) {
+					fprintf( stderr, "%s: multiple provider subentries are "
+							"present : add -w flag to refresh\n", progname );
+					rc = EXIT_FAILURE;
+					entry_free( e );
+					break;
+				}
+				attr = attr_find( e->e_attrs, slap_schema.si_ad_contextCSN );
+				if ( attr == NULL ) {
+					entry_free( e );
+					continue;
+				}
+				provider_subentry = 1;
+				ber_dupbv( &maxcsn, &attr->a_nvals[0] );
+			} else if ( is_entry_syncConsumerSubentry( e )) {
+				if ( provider_subentry ) {
+					fprintf( stderr, "%s: consumer and provider subentries "
+									 "are both present\n", progname );
+					rc = EXIT_FAILURE;
+					entry_free( e );
+					break;
+				}
+
+				attr = attr_find( e->e_attrs, slap_schema.si_ad_cn );
+
+				if ( attr == NULL ) {
+					entry_free( e );
+					continue;
+				}
+
+				if ( !LDAP_SLIST_EMPTY( &consumer_subentry )) {
+					LDAP_SLIST_FOREACH( sei, &consumer_subentry, sei_next ) {
+						value_match( &match, slap_schema.si_ad_cn,
+							slap_schema.si_ad_cn->ad_type->sat_equality,
+							SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
+							&sei->cn, &attr->a_nvals[0], &text );
+					}
+					if ( !match ) {
+						fprintf( stderr, "%s: multiple consumer subentries "
+								"have the same id : add -w flag to refresh\n",
+								progname );
+						rc = EXIT_FAILURE;
+						entry_free( e );
+						sei = LDAP_SLIST_FIRST( &consumer_subentry );
+						while ( sei ) {
+							ch_free( sei->cn.bv_val );
+							ch_free( sei->ndn.bv_val );
+							ch_free( sei->rdn.bv_val );
+							ch_free( sei->cookie.bv_val );
+							LDAP_SLIST_REMOVE_HEAD( &consumer_subentry, sei_next );
+							ch_free( sei );
+							sei = LDAP_SLIST_FIRST( &consumer_subentry );
+						}
+						break;
+					}
+				}
+				sei = ch_calloc( 1, sizeof( struct subentryinfo ));
+				ber_dupbv( &sei->cn, &attr->a_nvals[0] );
+				ber_dupbv( &sei->ndn, &e->e_nname );
+				dnExtractRdn( &sei->ndn, &sei->rdn, NULL );
+				attr = attr_find( e->e_attrs, slap_schema.si_ad_syncreplCookie );
+				if ( attr == NULL ) {
+					ch_free( sei->cn.bv_val );
+					ch_free( sei->ndn.bv_val );
+					ch_free( sei->rdn.bv_val );
+					ch_free( sei->cookie.bv_val );
+					ch_free( sei );
+					entry_free( e );
+					continue;
+				}
+				ber_dupbv( &sei->cookie, &attr->a_nvals[0] );
+				LDAP_SLIST_INSERT_HEAD( &consumer_subentry, sei, sei_next );
+			}
+		}
+
+		if ( !is_entry_syncProviderSubentry( e ) &&
+			 !is_entry_syncConsumerSubentry( e )) {
+			if (!dryrun) {
+				ID id = be->be_entry_put( be, e, &bvtext );
+				if( id == NOID ) {
+					fprintf( stderr, "%s: could not add entry dn=\"%s\" "
+									 "(line=%d): %s\n", progname, e->e_dn,
+									 lineno, bvtext.bv_val );
+					rc = EXIT_FAILURE;
+					entry_free( e );
+					if( continuemode ) continue;
+					break;
+				}
+	
+				if ( verbose ) {
+					fprintf( stderr, "added: \"%s\" (%08lx)\n",
+						e->e_dn, (long) id );
+				}
+			} else {
+				if ( verbose ) {
+					fprintf( stderr, "(dry) added: \"%s\"\n", e->e_dn );
+				}
+			}
+		}
+
+		entry_free( e );
+	}
+
+	bvtext.bv_len = textlen;
+	bvtext.bv_val = textbuf;
+	bvtext.bv_val[0] = '\0';
+
+	if ( !LDAP_SLIST_EMPTY( &consumer_subentry )) {
+		maxcsn.bv_len = 0;
+		maxcsn.bv_val = NULL;
+		LDAP_SLIST_FOREACH( sei, &consumer_subentry, sei_next ) {
+			if ( maxcsn.bv_len != 0 ) {
+				value_match( &match, slap_schema.si_ad_syncreplCookie,
+					slap_schema.si_ad_syncreplCookie->ad_type->sat_ordering,
+					SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
+					&maxcsn, &sei->cookie, &text );
+			} else {
+				match = -1;
+			}
+			if ( match < 0 ) {
+				if ( maxcsn.bv_val )
+					ch_free( maxcsn.bv_val );
+				ber_dupbv( &maxcsn, &sei->cookie );
+			}
+		}
+	}
+
+	if ( SLAP_LASTMOD(be) && replica_promotion ) {
+		if ( provider_subentry || update_ctxcsn == SLAP_TOOL_CTXCSN_BATCH ||
+			 !LDAP_SLIST_EMPTY( &consumer_subentry )) {
+			build_new_dn( &ctxcsn_ndn, &be->be_nsuffix[0],
+						  (struct berval *)&slap_ldapsync_cn_bv, NULL );
+			ctxcsn_id = be->be_dn2id_get( be, &ctxcsn_ndn );
+		
+			if ( ctxcsn_id == NOID ) {
+				ctxcsn_e = slap_create_context_csn_entry( be, &maxcsn );
+				if ( !dryrun ) {
+					ctxcsn_id = be->be_entry_put( be, ctxcsn_e, &bvtext );
+					if( ctxcsn_id == NOID ) {
+						fprintf( stderr, "%s: could not add ctxcsn subentry\n",
+										 progname);
+						rc = EXIT_FAILURE;
+					}
+					if ( verbose ) {
+						fprintf( stderr, "added: \"%s\" (%08lx)\n",
+										 ctxcsn_e->e_dn, (long) ctxcsn_id );
+					}
+				} else {
+					if ( verbose ) {
+						fprintf( stderr, "(dry) added: \"%s\"\n", ctxcsn_e->e_dn );
+					}
+				}
+				entry_free( ctxcsn_e );
+			} else {
+				ret = be->be_id2entry_get( be, ctxcsn_id, &ctxcsn_e );
+				if ( ret == LDAP_SUCCESS ) {
+					attr = attr_find( ctxcsn_e->e_attrs,
+										slap_schema.si_ad_contextCSN );
+					AC_MEMCPY( attr->a_vals[0].bv_val, maxcsn.bv_val, maxcsn.bv_len );
+					attr->a_vals[0].bv_val[maxcsn.bv_len] = '\0';
+					attr->a_vals[0].bv_len = maxcsn.bv_len;
+					if ( !dryrun ) {
+						ctxcsn_id = be->be_entry_modify( be, ctxcsn_e, &bvtext );
+						if( ctxcsn_id == NOID ) {
+							fprintf( stderr, "%s: could not modify ctxcsn "
+											 "subentry\n", progname);
+							rc = EXIT_FAILURE;
+						}
+						if ( verbose ) {
+							fprintf( stderr, "modified: \"%s\" (%08lx)\n",
+											 ctxcsn_e->e_dn, (long) ctxcsn_id );
+						}
+					} else {
+						if ( verbose ) {
+							fprintf( stderr, "(dry) modified: \"%s\"\n",
+											 ctxcsn_e->e_dn );
+						}
+					}
+				} else {
+					fprintf( stderr, "%s: could not modify ctxcsn subentry\n",
+									 progname);
+					rc = EXIT_FAILURE;
+				}
+			}
+		} 
+	} else if ( SLAP_LASTMOD(be) && replica_demotion &&
+				( update_ctxcsn == SLAP_TOOL_CTXCSN_BATCH ||
+				provider_subentry )) {
+
+		ber_dupbv( &slap_syncrepl_bv, (struct berval *) &slap_syncrepl_bvc );
+		ber_dupbv( &slap_syncrepl_cn_bv,
+					(struct berval *) &slap_syncrepl_cn_bvc );
+
+		if ( replica_id_list == NULL ) {
+			replica_id_list = ch_calloc( 2, sizeof( int ));
+			replica_id_list[0] = 0;
+			replica_id_list[1] = -1;
+		}
+
+		for ( i = 0; replica_id_list[i] > -1 ; i++ ) {
+			slap_syncrepl_bv.bv_len = snprintf( slap_syncrepl_bv.bv_val,
+									slap_syncrepl_bvc.bv_len,
+									"syncrepl%d", replica_id_list[i] );
+			slap_syncrepl_cn_bv.bv_len = snprintf( slap_syncrepl_cn_bv.bv_val,
+										slap_syncrepl_cn_bvc.bv_len,
+										"cn=syncrepl%d", replica_id_list[i] );
+			build_new_dn( &ctxcsn_ndn, &be->be_nsuffix[0],
+						  (struct berval *)&slap_syncrepl_cn_bv, NULL );
+			ctxcsn_id = be->be_dn2id_get( be, &ctxcsn_ndn );
+
+			if ( ctxcsn_id == NOID ) {
+				ctxcsn_e = slap_create_syncrepl_entry( be, &maxcsn,
+												&slap_syncrepl_cn_bv,
+												&slap_syncrepl_bv );
+				if ( !dryrun ) {
+					ctxcsn_id = be->be_entry_put( be, ctxcsn_e, &bvtext );
+					if( ctxcsn_id == NOID ) {
+						fprintf( stderr, "%s: could not add ctxcsn subentry\n",
+										 progname);
+						rc = EXIT_FAILURE;
+					}
+					if ( verbose ) {
+						fprintf( stderr, "added: \"%s\" (%08lx)\n",
+										 ctxcsn_e->e_dn, (long) ctxcsn_id );
+					}
+				} else {
+					if ( verbose ) {
+						fprintf( stderr, "(dry) added: \"%s\"\n",
+											ctxcsn_e->e_dn );
+					}
+				}
+				entry_free( ctxcsn_e );
+			} else {
+				ret = be->be_id2entry_get( be, ctxcsn_id, &ctxcsn_e );
+				if ( ret == LDAP_SUCCESS ) {
+					attr = attr_find( ctxcsn_e->e_attrs,
+									  slap_schema.si_ad_syncreplCookie );
+					AC_MEMCPY( attr->a_vals[0].bv_val, maxcsn.bv_val, maxcsn.bv_len );
+					attr->a_vals[0].bv_val[maxcsn.bv_len] = '\0';
+					attr->a_vals[0].bv_len = maxcsn.bv_len;
+					if ( !dryrun ) {
+						ctxcsn_id = be->be_entry_modify( be,
+											ctxcsn_e, &bvtext );
+						if( ctxcsn_id == NOID ) {
+							fprintf( stderr, "%s: could not modify ctxcsn "
+											 "subentry\n", progname);
+							rc = EXIT_FAILURE;
+						}
+						if ( verbose ) {
+							fprintf( stderr, "modified: \"%s\" (%08lx)\n",
+											 ctxcsn_e->e_dn, (long) ctxcsn_id );
+						}
+					} else {
+						if ( verbose ) {
+							fprintf( stderr, "(dry) modified: \"%s\"\n",
+											 ctxcsn_e->e_dn );
+						}
+					}
+				} else {
+					fprintf( stderr, "%s: could not modify ctxcsn subentry\n",
+									 progname);
+					rc = EXIT_FAILURE;
+				}
+			}
+		}
+		
+		if ( slap_syncrepl_bv.bv_val ) {
+			ch_free( slap_syncrepl_bv.bv_val );
+		}
+		if ( slap_syncrepl_cn_bv.bv_val ) {
+			ch_free( slap_syncrepl_cn_bv.bv_val );
+		}
+	} else if ( SLAP_LASTMOD(be) && replica_demotion &&
+				!LDAP_SLIST_EMPTY( &consumer_subentry )) {
+
+		LDAP_SLIST_FOREACH( sei, &consumer_subentry, sei_next ) {
+			ctxcsn_id = be->be_dn2id_get( be, &sei->ndn );
+
+			if ( ctxcsn_id == NOID ) {
+				ctxcsn_e = slap_create_syncrepl_entry( be, &sei->cookie,
+												&sei->rdn, &sei->cn );
+				if ( !dryrun ) {
+					ctxcsn_id = be->be_entry_put( be, ctxcsn_e, &bvtext );
+					if( ctxcsn_id == NOID ) {
+						fprintf( stderr, "%s: could not add ctxcsn subentry\n",
+										 progname);
+						rc = EXIT_FAILURE;
+					}
+					if ( verbose ) {
+						fprintf( stderr, "added: \"%s\" (%08lx)\n",
+										 ctxcsn_e->e_dn, (long) ctxcsn_id );
+					}
+				} else {
+					if ( verbose ) {
+						fprintf( stderr, "(dry) added: \"%s\"\n",
+											ctxcsn_e->e_dn );
+					}
+				}
+				entry_free( ctxcsn_e );
+			} else {
+				ret = be->be_id2entry_get( be, ctxcsn_id, &ctxcsn_e );
+				if ( ret == LDAP_SUCCESS ) {
+					attr = attr_find( ctxcsn_e->e_attrs,
+									  slap_schema.si_ad_syncreplCookie );
+					AC_MEMCPY( attr->a_vals[0].bv_val, maxcsn.bv_val, maxcsn.bv_len );
+					attr->a_vals[0].bv_val[maxcsn.bv_len] = '\0';
+					attr->a_vals[0].bv_len = maxcsn.bv_len;
+					if ( !dryrun ) {
+						ctxcsn_id = be->be_entry_modify( be,
+											ctxcsn_e, &bvtext );
+						if( ctxcsn_id == NOID ) {
+							fprintf( stderr, "%s: could not modify ctxcsn "
+											 "subentry\n", progname);
+							rc = EXIT_FAILURE;
+						}
+						if ( verbose ) {
+							fprintf( stderr, "modified: \"%s\" (%08lx)\n",
+											 ctxcsn_e->e_dn, (long) ctxcsn_id );
+						}
+					} else {
+						if ( verbose ) {
+							fprintf( stderr, "(dry) modified: \"%s\"\n",
+											 ctxcsn_e->e_dn );
+						}
+					}
+				} else {
+					fprintf( stderr, "%s: could not modify ctxcsn subentry\n",
+									 progname);
+					rc = EXIT_FAILURE;
+				}
+			}
+		}
+		
+		if ( slap_syncrepl_bv.bv_val ) {
+			ch_free( slap_syncrepl_bv.bv_val );
+		}
+		if ( slap_syncrepl_cn_bv.bv_val ) {
+			ch_free( slap_syncrepl_cn_bv.bv_val );
+		}
+	}
+
+	sei = LDAP_SLIST_FIRST( &consumer_subentry );
+	while ( sei ) {
+		ch_free( sei->cn.bv_val );
+		ch_free( sei->ndn.bv_val );
+		ch_free( sei->rdn.bv_val );
+		ch_free( sei->cookie.bv_val );
+		LDAP_SLIST_REMOVE_HEAD( &consumer_subentry, sei_next );
+		ch_free( sei );
+		sei = LDAP_SLIST_FIRST( &consumer_subentry );
+	}
+
+	ch_free( buf );
+
+	if( be->be_entry_close( be )) rc = EXIT_FAILURE;
+
+	if( be->be_sync ) {
+		be->be_sync( be );
+	}
+
+	slap_tool_destroy();
+	return rc;
+}
diff --git a/servers/slapd/slapcat.c b/servers/slapd/slapcat.c
new file mode 100644
index 0000000000000000000000000000000000000000..665ee153886f1fde9d86837f16ed9bcf02367da4
--- /dev/null
+++ b/servers/slapd/slapcat.c
@@ -0,0 +1,118 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1998-2003 Kurt D. Zeilenga.
+ * Portions Copyright 2003 IBM Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Kurt Zeilenga for inclusion
+ * in OpenLDAP Software.  Additional signficant contributors include
+ *    Jong Hyuk Choi
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+#include <ac/ctype.h>
+#include <ac/socket.h>
+#include <ac/string.h>
+
+#include "slapcommon.h"
+
+int
+slapcat( int argc, char **argv )
+{
+	ID id;
+	int rc = EXIT_SUCCESS;
+	Operation op = {0};
+	const char *progname = "slapcat";
+
+	slap_tool_init( progname, SLAPCAT, argc, argv );
+
+	if( !be->be_entry_open ||
+		!be->be_entry_close ||
+		!be->be_entry_first ||
+		!be->be_entry_next ||
+		!be->be_entry_get )
+	{
+		fprintf( stderr, "%s: database doesn't support necessary operations.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	if( be->be_entry_open( be, 0 ) != 0 ) {
+		fprintf( stderr, "%s: could not open database.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	for ( id = be->be_entry_first( be );
+		id != NOID;
+		id = be->be_entry_next( be ) )
+	{
+		char *data;
+		int len;
+		Entry* e = be->be_entry_get( be, id );
+		op.o_bd = be;
+
+		if ( e == NULL ) {
+			printf("# no data for entry id=%08lx\n\n", (long) id );
+			rc = EXIT_FAILURE;
+			if( continuemode ) continue;
+			break;
+		}
+
+		if( sub_ndn.bv_len && !dnIsSuffix( &e->e_nname, &sub_ndn ) ) {
+			be_entry_release_r( &op, e );
+			continue;
+		}
+
+		if ( retrieve_ctxcsn == 0 ) {
+			if ( is_entry_syncProviderSubentry( e ) ) {
+				be_entry_release_r( &op, e );
+				continue;
+			}
+		}
+
+		if ( retrieve_synccookie == 0 ) {
+			if ( is_entry_syncConsumerSubentry( e ) ) {
+				be_entry_release_r( &op, e );
+				continue;
+			}
+		}
+
+		if( verbose ) {
+			printf( "# id=%08lx\n", (long) id );
+		}
+
+		data = entry2str( e, &len );
+		be_entry_release_r( &op, e );
+
+		if ( data == NULL ) {
+			printf("# bad data for entry id=%08lx\n\n", (long) id );
+			rc = EXIT_FAILURE;
+			if( continuemode ) continue;
+			break;
+		}
+
+		fputs( data, ldiffp );
+		fputs( "\n", ldiffp );
+	}
+
+	be->be_entry_close( be );
+
+	slap_tool_destroy();
+	return rc;
+}
diff --git a/servers/slapd/slapcommon.c b/servers/slapd/slapcommon.c
new file mode 100644
index 0000000000000000000000000000000000000000..b1a01cc5a1b942a4d0a3208f91c7fc270fd040ce
--- /dev/null
+++ b/servers/slapd/slapcommon.c
@@ -0,0 +1,419 @@
+/* slapcommon.c - common routine for the slap tools */
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1998-2003 Kurt D. Zeilenga.
+ * Portions Copyright 2003 IBM Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Kurt Zeilenga for inclusion
+ * in OpenLDAP Software.  Additional signficant contributors include
+ *    Jong Hyuk Choi
+ *    Hallvard B. Furuseth
+ *    Howard Chu
+ *    Pierangelo Masarati
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+#include <ac/ctype.h>
+#include <ac/string.h>
+#include <ac/socket.h>
+#include <ac/unistd.h>
+
+#include "slapcommon.h"
+#include "lutil.h"
+
+tool_vars tool_globals;
+
+#ifdef CSRIMALLOC
+static char *leakfilename;
+static FILE *leakfile;
+#endif
+
+static void
+usage( int tool, const char *progname )
+{
+	char *options = NULL;
+	fprintf( stderr,
+		"usage: %s [-v] [-c] [-d debuglevel] [-f configfile]\n"
+			"\t[-n databasenumber | -b suffix]", progname );
+
+	switch( tool ) {
+	case SLAPADD:
+		options = "\n\t[-l ldiffile] [-u] [-p [-w] | -r [-i syncreplidlist] [-w]]\n";
+		break;
+
+	case SLAPCAT:
+		options = "\t[-l ldiffile] [-m] [-k]\n";
+		break;
+
+	case SLAPINDEX:
+		options = "\n";
+		break;
+	}
+
+	if( options != NULL ) {
+		fputs( options, stderr );
+	}
+	exit( EXIT_FAILURE );
+}
+
+
+/*
+ * slap_tool_init - initialize slap utility, handle program options.
+ * arguments:
+ *	name		program name
+ *	tool		tool code
+ *	argc, argv	command line arguments
+ */
+
+void
+slap_tool_init(
+	const char* progname,
+	int tool,
+	int argc, char **argv )
+{
+	char *options;
+	char *conffile = SLAPD_DEFAULT_CONFIGFILE;
+	struct berval base = { 0, NULL };
+	char *subtree = NULL;
+	char *ldiffile	= NULL;
+	int rc, i, dbnum;
+	int mode = SLAP_TOOL_MODE;
+	int truncatemode = 0;
+
+#ifdef CSRIMALLOC
+	leakfilename = malloc( strlen( progname ) + sizeof(".leak") );
+	sprintf( leakfilename, "%s.leak", progname );
+	if( ( leakfile = fopen( leakfilename, "w" )) == NULL ) {
+		leakfile = stderr;
+	}
+	free( leakfilename );
+#endif
+
+	switch( tool ) {
+	case SLAPADD:
+		options = "b:cd:f:i:l:n:prtuvWw";
+		break;
+
+	case SLAPINDEX:
+		options = "b:cd:f:n:v";
+		mode |= SLAP_TOOL_READMAIN;
+		break;
+
+	case SLAPCAT:
+		options = "b:cd:f:kl:mn:s:v";
+		mode |= SLAP_TOOL_READMAIN | SLAP_TOOL_READONLY;
+		break;
+
+	default:
+		fprintf( stderr, "%s: unknown tool mode (%d)\n",
+		         progname, tool );
+		exit( EXIT_FAILURE );
+	}
+
+	dbnum = -1;
+	while ( (i = getopt( argc, argv, options )) != EOF ) {
+		switch ( i ) {
+		case 'b':
+			base.bv_val = strdup( optarg );
+			base.bv_len = strlen( base.bv_val );
+			break;
+
+		case 'c':	/* enable continue mode */
+			continuemode++;
+			break;
+
+		case 'd':	/* turn on debugging */
+			ldap_debug += atoi( optarg );
+			break;
+
+		case 'f':	/* specify a conf file */
+			conffile = strdup( optarg );
+			break;
+
+		case 'i': /* specify syncrepl id list */
+			replica_id_string = strdup( optarg );
+			if ( !isdigit( (unsigned char) *replica_id_string )) {
+				usage( tool, progname );
+				exit( EXIT_FAILURE );
+			}
+			str2clist( &replica_id_strlist, replica_id_string, "," );
+			for ( i = 0; replica_id_strlist && replica_id_strlist[i]; i++ ) ;
+			replica_id_list = ch_calloc( i + 1, sizeof( int ) );
+			for ( i = 0; replica_id_strlist && replica_id_strlist[i]; i++ ) {
+				replica_id_list[i] = atoi( replica_id_strlist[i] );
+				if ( replica_id_list[i] >= 1000 ) {
+					fprintf(stderr,
+						"%s: syncrepl id %d is out of range [0..999]\n",
+						progname, replica_id_list[i] );
+					exit( EXIT_FAILURE );
+				}
+			}
+			replica_id_list[i] = -1;
+			break;
+
+		case 'k':	/* Retrieve sync cookie entry */
+			retrieve_synccookie = 1;
+			break;
+
+		case 'l':	/* LDIF file */
+			ldiffile = strdup( optarg );
+			break;
+
+		case 'm':	/* Retrieve ldapsync entry */
+			retrieve_ctxcsn = 1;
+			break;
+
+		case 'n':	/* which config file db to index */
+			dbnum = atoi( optarg ) - 1;
+			break;
+
+		case 'p':	/* replica promotion */
+			replica_promotion = 1;		
+			break;
+
+		case 'r':	/* replica demotion */
+			replica_demotion = 1;		
+			break;
+
+		case 's':	/* dump subtree */
+			subtree = strdup( optarg );
+			break;
+
+		case 't':	/* turn on truncate */
+			truncatemode++;
+			mode |= SLAP_TRUNCATE_MODE;
+			break;
+
+		case 'u':	/* dry run */
+			dryrun++;
+			break;
+
+		case 'v':	/* turn on verbose */
+			verbose++;
+			break;
+
+		case 'W':	/* write context csn on every entry add */
+			update_ctxcsn = SLAP_TOOL_CTXCSN_BATCH;
+			/* FIXME : update_ctxcsn = SLAP_TOOL_CTXCSN_ENTRY; */
+			break;
+
+		case 'w':	/* write context csn on at the end */
+			update_ctxcsn = SLAP_TOOL_CTXCSN_BATCH;
+			break;
+
+		default:
+			usage( tool, progname );
+			break;
+		}
+	}
+
+	if ( ( argc != optind ) || (dbnum >= 0 && base.bv_val != NULL ) ) {
+		usage( tool, progname );
+	}
+
+	if ( replica_promotion && replica_demotion ) {
+		usage( tool, progname );
+	} else if ( !replica_promotion && !replica_demotion ) {
+		if ( update_ctxcsn != SLAP_TOOL_CTXCSN_KEEP ) {
+			usage( tool, progname );
+		}
+	}
+
+	if ( ldiffile == NULL ) {
+		ldiffp = tool == SLAPCAT ? stdout : stdin;
+
+	} else if( (ldiffp = fopen( ldiffile, tool == SLAPCAT ? "w" : "r" ))
+		== NULL )
+	{
+		perror( ldiffile );
+		exit( EXIT_FAILURE );
+	}
+
+	/*
+	 * initialize stuff and figure out which backend we're dealing with
+	 */
+
+#ifdef SLAPD_MODULES
+	if ( module_init() != 0 ) {
+		fprintf( stderr, "%s: module_init failed!\n", progname );
+		exit( EXIT_FAILURE );
+	}
+#endif
+		
+	rc = slap_init( mode, progname );
+
+	if ( rc != 0 ) {
+		fprintf( stderr, "%s: slap_init failed!\n", progname );
+		exit( EXIT_FAILURE );
+	}
+
+	rc = slap_schema_init();
+
+	if ( rc != 0 ) {
+		fprintf( stderr, "%s: slap_schema_init failed!\n", progname );
+		exit( EXIT_FAILURE );
+	}
+
+	rc = read_config( conffile, 0 );
+
+	if ( rc != 0 ) {
+		fprintf( stderr, "%s: bad configuration file!\n", progname );
+		exit( EXIT_FAILURE );
+	}
+
+	if ( !nbackends ) {
+		fprintf( stderr, "No databases found in config file\n" );
+		exit( EXIT_FAILURE );
+	}
+
+	rc = glue_sub_init();
+
+	if ( rc != 0 ) {
+		fprintf( stderr, "Subordinate configuration error\n" );
+		exit( EXIT_FAILURE );
+	}
+
+	rc = slap_schema_check();
+
+	if ( rc != 0 ) {
+		fprintf( stderr, "%s: slap_schema_prep failed!\n", progname );
+		exit( EXIT_FAILURE );
+	}
+
+	if( subtree ) {
+		struct berval val;
+		val.bv_val = subtree;
+		val.bv_len = strlen( subtree );
+		rc = dnNormalize( 0, NULL, NULL, &val, &sub_ndn, NULL );
+		if( rc != LDAP_SUCCESS ) {
+			fprintf( stderr, "Invalid subtree DN '%s'\n", optarg );
+			exit( EXIT_FAILURE );
+		}
+
+		if( base.bv_val == NULL && dbnum == -1 )
+			base = val;
+		else
+			free( subtree );
+	}
+
+	if( base.bv_val != NULL ) {
+		struct berval nbase;
+
+		rc = dnNormalize( 0, NULL, NULL, &base, &nbase, NULL );
+		if( rc != LDAP_SUCCESS ) {
+			fprintf( stderr, "%s: slap_init invalid suffix (\"%s\")\n",
+				progname, base.bv_val );
+			exit( EXIT_FAILURE );
+		}
+
+		be = select_backend( &nbase, 0, 0 );
+		ber_memfree( nbase.bv_val );
+
+		if( be == NULL ) {
+			fprintf( stderr, "%s: slap_init no backend for \"%s\"\n",
+				progname, base.bv_val );
+			exit( EXIT_FAILURE );
+		}
+		/* If the named base is a glue master, operate on the
+		 * entire context
+		 */
+		if (SLAP_GLUE_INSTANCE(be)) {
+			nosubordinates = 1;
+		}
+
+	} else if ( dbnum == -1 ) {
+		if ( nbackends <= 0 ) {
+			fprintf( stderr, "No available databases\n" );
+			exit( EXIT_FAILURE );
+		}
+		
+		be = &backends[dbnum=0];
+		/* If just doing the first by default and it is a
+		 * glue subordinate, find the master.
+		 */
+		while (SLAP_GLUE_SUBORDINATE(be) || SLAP_MONITOR(be)) {
+			if (SLAP_GLUE_SUBORDINATE(be)) {
+				nosubordinates = 1;
+			}
+			be++;
+			dbnum++;
+		}
+
+
+		if ( dbnum >= nbackends ) {
+			fprintf( stderr, "Available database(s) "
+					"do not allow %s\n", progname );
+			exit( EXIT_FAILURE );
+		}
+		
+		if ( nosubordinates == 0 && dbnum > 0 ) {
+#ifdef NEW_LOGGING
+			LDAP_LOG( BACKEND, ERR, 
+"The first database does not allow %s; using the first available one (%d)\n",
+				progname, dbnum + 1, 0 );
+#else
+			Debug( LDAP_DEBUG_ANY,
+"The first database does not allow %s; using the first available one (%d)\n",
+				progname, dbnum + 1, 0 );
+#endif
+		}
+
+	} else if ( dbnum < 0 || dbnum > (nbackends-1) ) {
+		fprintf( stderr,
+			"Database number selected via -n is out of range\n"
+			"Must be in the range 1 to %d"
+				" (number of databases in the config file)\n",
+			nbackends );
+		exit( EXIT_FAILURE );
+
+	} else {
+		be = &backends[dbnum];
+	}
+
+#ifdef CSRIMALLOC
+	mal_leaktrace(1);
+#endif
+
+	if ( slap_startup( be ) ) {
+		fprintf( stderr, "slap_startup failed\n" );
+		exit( EXIT_FAILURE );
+	}
+}
+
+void slap_tool_destroy( void )
+{
+	slap_shutdown( be );
+	slap_destroy();
+#ifdef SLAPD_MODULES
+	if ( slapMode == SLAP_SERVER_MODE ) {
+	/* always false. just pulls in necessary symbol references. */
+		lutil_uuidstr(NULL, 0);
+	}
+	module_kill();
+#endif
+	schema_destroy();
+#ifdef HAVE_TLS
+	ldap_pvt_tls_destroy();
+#endif
+	config_destroy();
+
+#ifdef CSRIMALLOC
+	mal_dumpleaktrace( leakfile );
+#endif
+}
diff --git a/servers/slapd/slapcommon.h b/servers/slapd/slapcommon.h
new file mode 100644
index 0000000000000000000000000000000000000000..fdeb68a1a461b7ade2e57e96e4a2358d81046e7f
--- /dev/null
+++ b/servers/slapd/slapcommon.h
@@ -0,0 +1,77 @@
+/* slapcommon.h - common definitions for the slap tools */
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+
+#ifndef SLAPCOMMON_H_
+#define SLAPCOMMON_H_ 1
+
+#define SLAPD_TOOLS 1
+#include "slap.h"
+
+enum slaptool {
+	SLAPADD=1,	/* LDIF -> database tool */
+	SLAPCAT,	/* database -> LDIF tool */
+	SLAPINDEX,	/* database index tool */
+	SLAPPASSWD	/* password generation tool */
+};
+
+#define SLAP_TOOL_CTXCSN_KEEP	0
+#define SLAP_TOOL_CTXCSN_ENTRY	1
+#define SLAP_TOOL_CTXCSN_BATCH	2
+
+typedef struct tool_vars {
+	Backend *tv_be;
+	int tv_verbose;
+	int tv_update_ctxcsn;
+	int tv_retrieve_ctxcsn;
+	int tv_retrieve_synccookie;
+	int tv_replica_promotion;
+	int tv_replica_demotion;
+	char    *tv_replica_id_string;
+	char    **tv_replica_id_strlist;
+	int     *tv_replica_id_list;
+	int tv_continuemode;
+	int tv_nosubordinates;
+	int tv_dryrun;
+	struct berval tv_sub_ndn;
+	FILE	*tv_ldiffp;
+} tool_vars;
+
+extern tool_vars tool_globals;
+
+#define	be tool_globals.tv_be
+#define verbose tool_globals.tv_verbose
+#define update_ctxcsn tool_globals.tv_update_ctxcsn
+#define retrieve_ctxcsn tool_globals.tv_retrieve_ctxcsn
+#define retrieve_synccookie tool_globals.tv_retrieve_synccookie
+#define replica_promotion tool_globals.tv_replica_promotion
+#define replica_demotion tool_globals.tv_replica_demotion
+#define replica_id_string tool_globals.tv_replica_id_string
+#define replica_id_strlist tool_globals.tv_replica_id_strlist
+#define replica_id_list tool_globals.tv_replica_id_list
+#define continuemode tool_globals.tv_continuemode
+#define nosubordinates tool_globals.tv_nosubordinates
+#define dryrun tool_globals.tv_dryrun
+#define sub_ndn tool_globals.tv_sub_ndn
+#define ldiffp tool_globals.tv_ldiffp
+
+void slap_tool_init LDAP_P((
+	const char* name,
+	int tool,
+	int argc, char **argv ));
+
+void slap_tool_destroy LDAP_P((void));
+
+#endif /* SLAPCOMMON_H_ */
diff --git a/servers/slapd/slapindex.c b/servers/slapd/slapindex.c
new file mode 100644
index 0000000000000000000000000000000000000000..e9466c04276c824504a87e2f358a39a38d804ea2
--- /dev/null
+++ b/servers/slapd/slapindex.c
@@ -0,0 +1,83 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1998-2003 Kurt D. Zeilenga.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Kurt Zeilenga for inclusion
+ * in OpenLDAP Software.
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+
+#include <ac/ctype.h>
+#include <ac/string.h>
+#include <ac/socket.h>
+#include <ac/unistd.h>
+
+#include "slapcommon.h"
+
+int
+slapindex( int argc, char **argv )
+{
+	ID id;
+	int rc = EXIT_SUCCESS;
+	const char *progname = "slapindex";
+
+	slap_tool_init( progname, SLAPINDEX, argc, argv );
+
+	if( !be->be_entry_open ||
+		!be->be_entry_close ||
+		!be->be_entry_first ||
+		!be->be_entry_next  ||
+		!be->be_entry_reindex )
+	{
+		fprintf( stderr, "%s: database doesn't support necessary operations.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	if( be->be_entry_open( be, 0 ) != 0 ) {
+		fprintf( stderr, "%s: could not open database.\n",
+			progname );
+		exit( EXIT_FAILURE );
+	}
+
+	for ( id = be->be_entry_first( be );
+		id != NOID;
+		id = be->be_entry_next( be ) )
+	{
+		int rtn;
+
+		if( verbose ) {
+			printf("indexing id=%08lx\n", (long) id );
+		}
+
+		rtn =  be->be_entry_reindex( be, id );
+
+		if( rtn != LDAP_SUCCESS ) {
+			rc = EXIT_FAILURE;
+			if( continuemode ) continue;
+			break;
+		}
+	}
+
+	(void) be->be_entry_close( be );
+
+	slap_tool_destroy();
+	return( rc );
+}
diff --git a/servers/slapd/slappasswd.c b/servers/slapd/slappasswd.c
new file mode 100644
index 0000000000000000000000000000000000000000..c90e811d04f881c6a7311f7ed8eb7406f64274b8
--- /dev/null
+++ b/servers/slapd/slappasswd.c
@@ -0,0 +1,150 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1998-2003 Kurt D. Zeilenga.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Kurt Zeilenga for inclusion
+ * in OpenLDAP Software.
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+
+#include <ac/ctype.h>
+#include <ac/signal.h>
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/unistd.h>
+
+#include <ldap.h>
+#include <lutil.h>
+
+#include "ldap_defaults.h"
+
+static int	verbose = 0;
+
+static void
+usage(const char *s)
+{
+	fprintf(stderr,
+		"Usage: %s [options]\n"
+		"  -h hash\tpassword scheme\n"
+		"  -s secret\tnew password\n"
+		"  -c format\tcrypt(3) salt format\n"
+		"  -u\t\tgenerate RFC2307 values (default)\n"
+		"  -v\t\tincrease verbosity\n"
+		"  -T file\tread file for new password\n"
+		, s );
+
+	exit( EXIT_FAILURE );
+}
+
+int
+slappasswd( int argc, char *argv[] )
+{
+	char	*scheme = "{SSHA}";
+	char	*newpw = NULL;
+	char	*pwfile = NULL;
+	const char *text;
+	const char *progname = "slappasswd";
+
+	int		i;
+	struct berval passwd;
+	struct berval *hash = NULL;
+
+	while( (i = getopt( argc, argv,
+		"c:d:h:s:T:vu" )) != EOF )
+	{
+		switch (i) {
+		case 'c':	/* crypt salt format */
+			scheme = "{CRYPT}";
+			lutil_salt_format( optarg );
+			break;
+
+		case 'h':	/* scheme */
+			scheme = strdup( optarg );
+			break;
+
+		case 's':	/* new password (secret) */
+			{
+				char* p;
+				newpw = strdup( optarg );
+
+				for( p = optarg; *p != '\0'; p++ ) {
+					*p = '\0';
+				}
+			} break;
+
+		case 'T':	/* password file */
+			pwfile = optarg;
+			break;
+
+		case 'u':	/* RFC2307 userPassword */
+			break;
+
+		case 'v':	/* verbose */
+			verbose++;
+			break;
+
+		default:
+			usage ( progname );
+		}
+	}
+
+	if( argc - optind != 0 ) {
+		usage( progname );
+	} 
+
+	if( pwfile != NULL ) {
+		if( lutil_get_filed_password( pwfile, &passwd )) {
+			return EXIT_FAILURE;
+		}
+	} else {
+		if( newpw == NULL ) {
+			/* prompt for new password */
+			char *cknewpw;
+			newpw = strdup(getpassphrase("New password: "));
+			cknewpw = getpassphrase("Re-enter new password: ");
+	
+			if( strcmp( newpw, cknewpw )) {
+				fprintf( stderr, "Password values do not match\n" );
+				return EXIT_FAILURE;
+			}
+		}
+
+		passwd.bv_val = newpw;
+		passwd.bv_len = strlen(passwd.bv_val);
+	}
+
+	hash = lutil_passwd_hash( &passwd, scheme, &text );
+	if( hash == NULL || hash->bv_val == NULL ) {
+		fprintf( stderr,
+			"Password generation failed for scheme %s: %s\n",
+			scheme, text ? text : "" );
+		return EXIT_FAILURE;
+	}
+
+	if( lutil_passwd( hash, &passwd, NULL, &text ) ) {
+		fprintf( stderr, "Password verification failed. %s\n",
+			text ? text : "" );
+		return EXIT_FAILURE;
+	}
+
+	printf( "%s\n" , hash->bv_val );
+	return EXIT_SUCCESS;
+}