Some dskeymgr sub-commands' usage puts some arguments in the "LDAP connection options", even though the tool doesn't not create LDAP connections:
Usage: dskeymgr {options} export-ca-cert {options} Exports the CA certificate associated with a deployment key to a keystore or as a PEM file Global Options: See "dskeymgr --help" SubCommand Options: -a, --alias {alias} The CA certificate alias, must not already exist in the keystore Default value: ca-cert -f, --outputFile {outputFile} Optional path to a file where the CA certificate will be written in the PEM format, overwriting the file if it exists -j, --deploymentKeyPasswordFile {deploymentKeyPasswordFile} Path to a file containing the deployment key password -k, --deploymentKey {deploymentKey} The deployment key -K, --keyStoreFile {keyStoreFile} Path to an existing PKCS12 keystore file or a path indicating where a new keystore file should be created -w, --deploymentKeyPassword {deploymentKeyPassword} The deployment key password LDAP connection options: -u, --keyStorePasswordFile {keyStorePasswordFile} Path to a file containing the keystore password -W, --keyStorePassword {keyStorePassword} Keystore cleartext password
It appears many tools are using this method: com.forgerock.opendj.cli.ArgumentHolder#getStandardGroup(). It would be better if they were able to choose the grouping, similar to the setup tool. See org.forgerock.opendj.setup.cli.SetupCliNonInteractive.KeyStoreArguments#KeyStoreArguments.