LDAP-UX Client Services B.04.15 Administrator's Guide

Table 6-9 Return Codes for ldapugdel
MessageReturn Codes
Invalid POSIX attributes.
DEL_COMMANDLINE_ERR
Multiple entries found that match the same name. Please
use a DN to specify a specific entry.
DEL_MULTIPLE_ENTRY_FOUND
The LDAP deletion operation failed.
DEL_DELETE_FAILED
The LDAP search for subSchemaSubEntry, attributeTypes
or objectClasses failed.
DEL_SEARCH_FAILED
Unable to analyze LDAP directory server’s schema. This
operation is required in order to determine which
attributes may be legally removed.
DEL_PARSE_ERROR
6.3.7.6 Security Considerations
Be aware of the following security considerations when you use ldapugdel:
• Use of ldapugdel requires permissions of an LDAP administrator when it performs its
operations on the directory server. The rights to delete or modify existing LDAP directory
entries under the requested subtree and to remove the required attributes in that entry must
be granted to the administrator identity that you specify when you execute ldapugdel.
• Removal of a POSIX account does not automatically remove that account’s membership in
groups, unless the LDAP directory server provides that capability. Some LDAP directory
servers have a feature called “referential integrity”, which performs modification or removal
of DN-type attributes if the specified DN is either changed or removed.
• As it may occur in any identity repository, modifying the repository can likely have impacts
as defined by the organization security policy. When using ldapugdel, you are expected
to have full knowledge of the organization security policy and the impact of deleting identity
information from that identity repository.
• Do not use ldapugdel as part of a modification process on a user or group entry (deleting
and re-adding the entry as a way to modify that entry.) User and group entries in an LDAP
directory often contain information about the user or group that is outside the POSIX
information model. Deleting an entry will delete all information about the user or group.
When the entry is re-added, recovery of the non-POSIX information may not be possible.
6.3.7.7 Limitations
Because LDAP directory servers require data to be stored according to the UTF-8 (RFC3629)
character encoding method, all characters provided to ldapugdel are assumed to be UTF-8 and
part of the ISO-10646 character set. The ldapugdel tool does not perform conversion of the
locale character set to or from the UTF-8 character set.
6.3.7.8 Examples
The section provides examples of using ldapugdel:
Run the following commands to specify the LDAP_BINDDN and LDAP_BINDCRED environment
variables:
export LDAP_BINDDN = "cn=Jane Admin,ou=admins,dc=exampe,dc=com" export LDAP_BINDCRED
= "Jane's password"
Run the following command to go to the /opt/ldapux/bin directory where ldapugdel
resides:
cd /opt/ldapux/bin
Run the following command to delete the entire user account entry, astein, on the LDAP
directory server, ldapsrvA. The -h option overrides the server list defined by the LDAP-UX
configuration profile.
6.3 LDAP User and Group Management Tools 189