fprintf( stderr, "    -g\t\tdo not send a password policy request control\n" );
ldaptool_common_usage( int two_hosts ){    fprintf( stderr, "    -n\t\tshow what would be done but don't actually do it\n" );    fprintf( stderr, "    -v\t\trun in verbose mode (diagnostics to standard output)\n" );    if ( two_hosts ) {	fprintf( stderr, "    -h host\tLDAP server1 name or IP address (default: %s)\n", LDAPTOOL_DEFHOST );	fprintf( stderr, "    -p port\tLDAP server1 TCP port number (default: %d)\n", LDAP_PORT );	fprintf( stderr, "    -h host\tLDAP server2 name or IP address (default: %s)\n", LDAPTOOL_DEFHOST );	fprintf( stderr, "    -p port\tLDAP server2 TCP port number (default: %d)\n", LDAP_PORT );    } else {	fprintf( stderr, "    -h host\tLDAP server name or IP address (default: %s)\n", LDAPTOOL_DEFHOST );	fprintf( stderr, "    -p port\tLDAP server TCP port number (default: %d)\n", LDAP_PORT );    }    fprintf( stderr,	    "    -V n\tLDAP protocol version number (%d or %d; default: %d)\n",	    LDAP_VERSION2, LDAP_VERSION3, LDAP_VERSION3 );#if defined(NET_SSL)    fprintf( stderr, "    -Z\t\tmake an SSL-encrypted connection\n" );    fprintf( stderr, "    -P pathname\tpath to SSL certificate database (default: current directory)\n" );    fprintf( stderr, "    -N\t\tname of certificate to use for SSL client authentication\n" );    fprintf( stderr, "    -K pathname\tpath to key database to use for SSL client authentication\n" );    fprintf( stderr, "    \t\t(default: path to certificate database provided with -P option)\n" );#ifdef LDAP_TOOL_PKCS11    fprintf( stderr, "    -m pathname\tpath to security module database\n");#endif /* LDAP_TOOL_PKCS11 */    fprintf( stderr, "    -W\t\tSSL key password\n" );    fprintf( stderr, "    -3\t\tcheck hostnames in SSL certificates\n" );#ifdef LDAP_TOOL_PKCS11    fprintf( stderr, "    -Q [token][:certificate name]\tPKCS 11\n" );    fprintf( stderr, "    -X pathname\tFORTEZZA compromised key list (CKL)\n" );    fprintf( stderr, "    -I pin\tcard password file\n" );#endif /* LDAP_TOOL_PKCS11 */#endif /* NET_SSL */    fprintf( stderr, "    -D binddn\tbind dn\n" );    fprintf( stderr, "    -w passwd\tbind passwd (for simple authentication)\n" );    fprintf( stderr, "    -w - \tprompt for bind passwd (for simple authentication)\n" );    fprintf( stderr, "    -j file\tread bind passwd from 'file' (for simple authentication)\n" );    fprintf( stderr, "    -E\t\task server to expose (report) bind identity\n" );#ifdef LDAP_DEBUG    fprintf( stderr, "    -d level\tset LDAP debugging level to `level'\n" );#endif    fprintf( stderr, "    -R\t\tdo not automatically follow referrals\n" );    fprintf( stderr, "    -O limit\tmaximum number of referral hops to traverse (default: %d)\n", LDAPTOOL_DEFREFHOPLIMIT );    fprintf( stderr, "    -M\t\tmanage references (treat them as regular entries)\n" );    fprintf( stderr, "    -0\t\tignore LDAP library version mismatches\n" );#ifndef NO_LIBLCACHE    fprintf( stderr, "    -C cfgfile\tuse local database described by cfgfile\n" );#endif    fprintf( stderr, "    -i charset\tcharacter set for command line input (default taken from locale)\n" );    fprintf( stderr, "    -k dir\tconversion routine directory (default: current directory)\n" );#if 0/* * Suppress usage for -y (old proxied authorization control) even though * we still support it.  We want to encourage people to use -Y instead (the * new proxied authorization control). */    fprintf( stderr, "    -y proxydn\tDN used for proxy authorization\n" );#endif    fprintf( stderr, "    -Y proxyid\tproxied authorization id,\n" );    fprintf( stderr, "              \te.g, dn:uid=bjensen,dc=example,dc=com\n" );    fprintf( stderr, "    -H\t\tdisplay usage information\n" );    fprintf( stderr, "    -J controloid[:criticality[:value|::b64value|:<fileurl]]\n" );    fprintf( stderr, "\t\tcriticality is a boolean value (default is false)\n" );}