LDAP-UX Client Services B.05.00 Administrator's Guide

type, ldapugmod uses the first attribute defined by the mapping. If
the specified <member> does not exist in the LDAP directory, you
must use -F to define the member, and only use the memberUid
attribute syntax.
NOTE: The ldapugmod tool can add members only to a group that
follow a static membership syntax (such as memberUid, member and
uniqueMember). If the only membership mapping defined in the
LDAP-UX configuration profile uses a dynamic group membership
syntax (such as memberURL), ldapugmod fails to add a member to
a group.
-r <member>[,...]
Removes one or more members from the specified group.
The ldapugmod tool searches for membership in the group using
the memberUid, member, uniqueMember, and
msSFU30posixMember attributes and removes all values that
represent the specified user (either DN or UID name). The ldapugmod
tool consults the LDAP-UX configuration profile for attribute
mappings to determine which attributes need to be modified to
remove the user membership. When specifying a list of members,
you must use a comma with no white space to separate each member.
-c <comment> Replaces a comment that is stored in the description attribute as
defined by RFC 2307. LDAP-UX does not support attribute mappings
for the description attribute. If <comment> is an empty string,
ldapugmod removes the description or mapped attribute.
<attr>=<value>>
Enables modification of arbitrary LDAP attributes and values. The
<value> parameter may be an empty string. However this usage
does not remove attributes and their values from the directory server.
Instead, use the -R option to remove arbitrary attributes. See the
“WARNING” section below for impacts when using this option
7.3.6.4 Warnings
Under common usage, ldapugmod uses the LDAP replace operation when changing values of
an attribute in an entry. This feature can impact attributes that have multiple values, by removing
all occurrences of an attribute value and replacing it with the one specified on the ldapugmod
command line. For example, if the -n argument is used to specify a new name for a posixGroup,
all occurances of the cn attribute are replaced by the value specified for the -n argument. This
mode of operation applies to all command argument specified values, including -u, -g, -s, -d,
-I and -c.
When you use the <attr>=<value> parameter to modify an existing attribute, the ldapugmod
command also uses the LDAP replace operation. The replace operation removes all occurrences
of the specified attribute for an entry and replaces it with the value specified. If there are multiple
values for a single attribute in an entry, the use of a single <attr>=<value> parameter will
replace all values with the single value specified on the command line. You can specify more
than one occurrence of the same attribute on the command line, if that attribute is multi-valued.
In that case, both values are created in the entry.
Use of -A or -R changes this behavior (for both the above-listed command arguments and the
<attr>=<value> parameter). Any attribute specified as an argument to the -A or -R causes
ldapugmod to perform an LDAP add operation instead of an LDAP replace operation.
256 Command and tool reference