LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

LDAP User and Group Management Tools
The LDAP-UX Integration product supports the following new LDAP command-line tools which
enable you to manage user accounts and groups in an LDAP directory server. These new tools
exist in the /opt/ldapux/bin directory and perform their operations based on the LDAP-UX
profile's configuration. Each tool provides command options that enable you to alter these
configuration parameters. For detailed information about tool usage, syntax, options, arguments,
environment variables, template files, return codes supported by these tools, See “The ldapuglist
Tool” (page 175), “The ldapugadd Tool” (page 185),“The ldapcfinfo Tool” (page 219), “The
ldapugmod Tool” (page 202), “The ldapugdel Tool” (page 213) or the ldapuglist(1M),
ldapugadd(1M), ldapcfinfo(1M), ldapugmod(1M) and ldapugdel(1M) man pages.
ldapuglist Use the ldapuglist tool to display and enumerate subsets of account and
group entries that reside in an LDAP directory server.
ldapugadd Use the ldapugadd tool to add new POSIX accounts or groups to an LDAP
directory server.
ldapugmod Use the ldapugmod tool to modify existing POSIX accounts or groups in an
LDAP directory server. You can use ldapugmod with extended options to
modify arbitrary attributes for user or group entries.
ldapugdel Use the ldapugdel tool to remove POSIX related user or group entries from
an LDAP directory server. Use the -O to remove POSIX related attributes and
object classes from a user or a group entry without removing entire entry itself.
ldapcfinfo Use the ldapcfinfo tool to retrieve LDAP-UX configuration information
details about required attributes when creating new users or groups. Use this
tool to discover the LDAP user and group configuration defaults, attribute
mapping and a list of available template files. You can also use ldapcfinfo
to check to see if the LDAP-UX product is properly configured and active.
When performing modification, creation and deletion operations on the LDAP directory server,
use these tools to input LDAP administrator bind identity and credential interactively with a
prompt (-P) option or by specifying the LDAP_BINDDN environment variable for the
administrator's identity and LDAP_BINDCRED environment variable for the administrator's
credential. Values set with a prompt (-P) option override values specified in the environment
variable. If the two previously mentioned methods have not been specified, the LDAP tool follows
the bind configuration specified in the LDAP-UX configuration profile. If the LDAP-UX profile
has specified a proxy bind, the LDAP tool reads the credential from either the
/etc/opt/ldapux/acred or /etc/opt/ldapux/pcred file. The /etc/opt/ldapux/acred
file is used only by users who have sufficient administrative privilege to read this file.
Environment Variables
The ldapuglist, ldapugadd, ldapugmod and ldapugdel tools support the following
environment variables:
LDAP_BINDDN
Specifies the Distinguished Name (DN) or other appropriate identity
indicator (such as a Kerberos principle id) of a user with sufficient directory
server privilege to display, add, modify or delete users and/or groups in
the LDAP directory server. If LDAP_BINDDN is specified, LDAP_BINDCRED
must also be specified.
LDAP_BINDCRED
Specifies a password or other type of credential used for the LDAP user
specified by LDAP_BINDDN.
The ldapugadd and ldapugmod tools support the following environment variables:
LDAP_UGCRED
This variable specifies the new password of a user or group being created or
modified. You must use the -PW command option when you use this
environment variable to indicate this variable has been set and is used for the
current command. If attribute mapping for the userPassword attribute has
not been defined or set to “*NULL*” in the LDAP-UX configuration profile,
ldapugadd or ldapugmod creates new passwords using the userPassword
attribute. See the -PW option of “The ldapugadd Tool” (page 185) or “The
ldapugmod Tool” (page 202) for more information.
LDAP User and Group Management Tools 171