LDAP-UX Client Services B.05.00 Administrator's Guide

7.3 LDAP user and group management tools
The LDAP-UX Integration product supports the following new LDAP command-line tools which
enable you to manage user accounts and groups in an LDAP directory server. These new tools
exist in the /opt/ldapux/bin directory and perform their operations based on the LDAP-UX
profile's configuration. Each tool provides command options that enable you to alter these
configuration parameters. For detailed information about tool usage, syntax, options, arguments,
environment variables, template files, return codes supported by these tools, see Section 7.3
(page 219), or see the ldapuglist(1M), ldapugadd(1M), ldapcfinfo(1M), ldapugmod(1M), and
ldapugdel(1M) manpages.
ldapuglist Use the ldapuglist tool to display and enumerate subsets of POSIX-like
account and group entries that reside in an LDAP directory server.
ldapugadd Use the ldapugadd tool to add new POSIX accounts or groups to an LDAP
directory server.
ldapugmod Use the ldapugmod tool to modify existing accounts or groups in an LDAP
directory server. You can use ldapugmod with extended options to modify
arbitrary attributes for user or group entries.
ldapugdel Use the ldapugdel tool to remove POSIX related user or group entries from
an LDAP directory server. Use the -O option to remove POSIX related attributes
and object classes from a user or a group entry without removing entire entry
itself.
ldapcfinfo Use the ldapcfinfo tool to retrieve LDAP-UX configuration information
details about required attributes when creating new users or groups. Use this
tool to discover LDAP UG configuration defaults, a list of available template
files and attribute mapping information. You can also use ldapcfinfo to check
whether the LDAP-UX product is properly configured and active.
When performing modification, creation and deletion operations on the LDAP directory server,
use these tools to input the LDAP administrator bind identity and credential interactively with
a prompt (-P) option or by specifying the LDAP_BINDDN environment variable for the
administrator identity and LDAP_BINDCRED environment variable for the administrator's
credential. Values set with a prompt (-P) option override values specified in the environment
variables. If the two previously mentioned methods have not been specified, the LDAP tool
follows the bind configuration specified in the LDAP-UX configuration profile. If the LDAP-UX
profile has specified a proxy bind, the LDAP tool reads the credential from either the /etc/opt/
ldapux/acred or /etc/opt/ldapux/pcred file. The /etc/opt/ldapux/acred file is used
only by users who have sufficient administrative privilege to read this file.
7.3.1 Environment variables
The ldapuglist, ldapugadd, ldapugmod and ldapugdel tools support the following
environment variables:
LDAP_BINDDN
Specifies the distinguished name (DN) or other appropriate identity
indicator (such as a Kerberos principle id) of a user with sufficient directory
server privilege to view, add, modify or delete users and/or groups in the
LDAP directory server. If LDAP_BINDDN is specified, LDAP_BINDCRED
must also be specified.
LDAP_BINDCRED
Specifies a password or other type of credential used for the LDAP user
specified by LDAP_BINDDN.
The ldapugadd and ldapugmod tools support the following environment variable:
LDAP_UGCRED
This variable specifies the new password of a user or group being created or
modified. You must use the -PW command option when you use this
environment variable, to indicate this variable has been set and is used for the
7.3 LDAP user and group management tools 219