LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

User and Group Management
LDAP-UX Integration B.04.15 supports the new set of non-interactive LDAP command-line tools
that allow you to list, add, modify or delete user accounts and groups in an LDAP directory
server. These new tools provide capabilities to perform those operations without needing to
discover the LDAP server information. Each tool uses the LDAP-UX profile's configuration to
discover server information, such as the host name and port number of the LDAP directory
server and proper search filters for finding users and groups. Each tool provides command
options that enable you to alter these configuration parameters. Using these new tools does not
require you to have extensive knowledge of the LDAP schema, protocol and LDAP-UX
configuration of each directory server product. These tools performs installation specific data
model interpretation, such as converting uid-name based group membership (POSIX-style) to
X.500 DN based membership (LDAP-style).
The LDAP User and Group (UG) management tools support the following features:
• Create, modify, delete, or list users and groups in an LDAP directory server.
• Modify user or group password.
• Support attribute mapping for definition of POSIX attributes used when creating or modifying
entries.
• Support specification of group membership using X.500-style DN based member attributes.
• Provide customized and default templates for defining new user and group entries, which
allows arbitrary data models to be used.
• Support SSL or TLS encryption of data connections to the LDAP directory server if requested.
• Provide the ability to connect to an alternate directory server other than that specified by
the LDAP-UX configuration profile.
• Discover programmatically if LDAP-UX is installed, configured and operating properly for
a specified service.
The HP System Management Homepage (SMH) Users and Groups interface uses these LDAP
UG command line tools to implement the web-based user interface functionality that manages
POSIX users and groups in an LDAP directory server. This enables HP-UX system administrators
to manage users and groups in an LDAP directory server using SMH UG-LDAP web-based
interface on an HP-UX 11i v3 system. The HP System Management Homepage (SMH) product
supports the LDAP user and group web-based management feature via HP-UX 11i v3 September,
2007 release.
LDAP User and Group Command-Line Tools
The LDAP-UX Integration product supports the following LDAP command-line tools for
management of user and group information in an LDAP directory server. These LDAP user and
group tools exist in the /opt/ldapux/bin directory. For detailed information about tool usage,
syntax, options, arguments, environment variables and return codes supported by these tools,
see “The ldapuglist Tool” (page 175), “The ldapugadd Tool” (page 185),“The ldapcfinfo Tool”
(page 219), “The ldapugmod Tool” (page 202), “The ldapugdel Tool” (page 213) in the appendix
C, “Command, Tool, Schema Extension Utility, and Migration Script Reference” or the
ldapuglist(1M), ldapugadd(1M), ldapcfinfo(1M), ldapugmod(1M) and ldapugdel(1M)
man pages.
Use of the ldapugadd, ldapugmod and ldapugdel tools requires specification of LDAP
administrator credentials with sufficient privilege to perform the requested operations in an
LDAP directory server. Specification of these credentials can be done through the LDAP_BINDDN
and LDAP_BINDCRED environment variables or an interactive prompt (-P) option. If the LDAP
administrator credential has not been specified using the two previous methods, and if configured,
124 Administering LDAP-UX Client Services