LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Adding a User or a Group
When adding user or group entries to the LDAP directory server, the ldapugadd tool uses
template files to discover the required data models for a new user and group entry. Template
files define what object classes and attributes are required to create new user and group entries.
LDAP-UX provides the flexibility that allows you to define unique data models for user and
group entries. LDAP-UX supports two default template files (for passwd and group services)
for a standard LDAP directory server, along with two default template files for the Windows
Active Directory Server. These template files can be found under
/etc/opt/ldapux/ug_templates directory. For detailed information on how to define
template files and how to name and create template files, see “Template Files” (page 194).
NOTE: The LDAP-UX Client Services provides two default template files to work with Windows
2000, 2003 or 2003 R2 Active Directory Server. If you use ldapugadd to access a Windows ADS,
you must manually use the following commands to re-link the default templates to the default
templates for the Windows ADS:
• ln -fs /etc/opt/ldapux/ug_templates/ug_passwd_ads.tmpl \
/etc/opt/ldapux/ug_templates/ug_passwd_default.tmpl
• ln -fs /etc/opt/ldapux/ug_templates/ug_group_ads.tmpl \
/etc/opt/ldapux/ug_templates/ug_group_default.tmpl
The ldapugadd tool uses a local configuration file, /etc/opt/ldapux/ldapug.conf, to
manage the default values of the uidNumber_range, gidNumber_range, user_gidNumber,
default_homeDirectory and default_loginShell parameters when creating user or
group entries to an LDAP directory server. See “LDAP UG Tool Configuration File” (page 193)
for details.
Examples of Adding a User
You can use ldapugadd to add new POSIX accounts or groups to an LDAP directory server.
Use LDAP_BINDDN to specify the Distinguished Name (DN) of a user with sufficient directory
server privilege to add users or groups in the directory server. Use LDAP_BINDCRED to specify
a password for the LDAP user specified by LDAP_BINDDN. Alternately, you can input LDAP
administrator bind identity and credential interactively with a prompt (-P) option.
The LDAP_UGCRED environment variable specifies the new password of a user or group being
created. You must specify the -PW option when using LDAP_UGCRED. The use of passwords for
the new groups is not recommended. Alternately, you can use the -PP command option to
prompt for the password of the user or group being created.
Below are examples of using ldapugadd to add user entries.
Run the following command to set the LDAP_BINDDN and LDAP_BINDCRED environment
variables
export LDAP_BINDDN = "cn=Jane Admin,ou=admins,dc=org,dc=example,dc=com""
export LDAP_BINDCRED = "Jane's password"
Run the following command to specify the LDAP_URCRED environment variable:
export LDAP_UGCRED = "user_password"
The following commands add an account entry for the user, mtam, with the user's primary login
group id, 200. ldapugadd creates the password for new user, mtam, using the user password
specified in the LDAP_UGCRED environment variable. After creating the user entry, ldapugadd
User and Group Management 129