LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

-ZZ
Attempts a TLS connection to the directory server, even if the LDAP-UX configuration
does not require the use of TLS. If a TLS connection cannot be established, a non-TLS
and non-SSL connection will be established. Do not use -ZZ unless alternative methods
are used to protect against network eavesdropping. Use of -ZZ requires that you define
a valid server or a CA certificate in the /etc/opt/ldapux/cert8.db file.
-ZZZ
Requires a TLS connection to the LDAP directory server, even if the LDAP-UX
configuration profile does not specify the use of TLS. Using the -ZZZ option requires
that you define a valid directory server or a CA certificate in the
/etc/opt/ldapux/cert8.db file. An error occurs if the TLS connection cannot be
established.
-N
Allows you to rename the Relative Distinguished Name (RDN) of an LDAP directory
server. In some cases, when an attribute is modified, it might be the same attribute that
is used in the RDN portion of the entry’s distinguished name. Changing the attribute
and value that is used in the RDN requires changing the RDN.
For example, an entry in the directory server is named “cn=Robert
Smith,ou=IT,dc=example,dc=com”. If the cn attribute is changed to “cn=Bob
Smith”, then the entry DN also needs to change to “cn=Bob
Smith,ou=IT,dc=example,dc=com”
Modification of an RDN is generally discouraged because the DN is often used as a
unique way to identify the entry in the directory server. Often DN is used to define
membership in a group. To prevent accidental changes to the DN, you must specify the
-N option to allow changes to the RDN. When the DN of an entry changes, the group
membership information for this entry might be inconsistent. Most directory servers
have the inherent ability to update all entries that refer to the updated DN of a changed
entry. Therefore, ldapugmod does not attempt to perform modifications to other entries
in the directory server that refer to this entry by its DN.
NOTE: The ldapugmod tool does not allow you to rename multi-valued RDNs. For
example, an RDN of “cn=test1+cn=test2” is not supported
-F Forces ldapugmod to modify the user or group entry in an LDAP directory server even
if particular error conditions occur. Those error conditions that can be overwritten are
as follows:
• The changed user name or group name already exists in the directory server.
• The changed user ID or group ID number already exists in the directory server.
• An attempt is made to modify the group of a user with a group ID that cannot be
found in any name service repository. In this case, the group ID number must be
specified.
• An attempt is made to force ldapugmod to add a member to a group when that
member is not defined in the LDAP directory server. In this case, membership is
always defined using the memberUid attribute, regardless of attribute mapping
defined for group membership.
-S
Displays the Distinguish Name (DN) of the deleted or updated entry when the operation
successfully completes.
Arguments
The following describes command arguments:
-t <type>
Specifies whether the command-line arguments are applicable to modify
the user or group entry. The valid types of this argument are passwd and
group. If you do not specify this argument, ldapugmod defaults to passwd.
The passwd type represents LDAP user entries that contain POSIX
account-related information. The group type represents LDAP group
entries that contain POSIX group-related information.
-h <hostname> Specifies the host name and optional port number (hostname:port) of
the LDAP directory server. This option overrides the server list specified
by the LDAP-UX configuration profile. This field supports specification of
LDAP User and Group Management Tools 203