LDAP-UX Client Services B.05.00 Administrator's Guide

7.3.7 ldapugdel tool
Use the ldapugdel tool to remove POSIX-related user or group entries from an LDAP directory
server. If you use ldapugdel with the -O option, ldapugdel removes the POSIX related
attributes and object classes from user or group entries, without removing the entire entry itself.
7.3.7.1 Removing attributes only
You can use ldapugdel to remove POSIX user and group entire entries from an LDAP directory
server. With the -O option, ldapugdel enables you to remove only POSIX related attributes
and object classes from user or group entries, without removing entire entries.
Because mapped attributes are attributes that are often shared with other LDAP-enabled
applications, ldapugdel does not support attribute mapping. For example, if the uidNumber
attribute has been mapped to the employeeNumber attribute, ldapugdel attempts to remove
uidNumber and not employeeNumber.
The usePassword, uid, cn, and description attributes are commonly used by most other
user and group schemas. With the -O option, the ldapugdel tool does not attempt to remove
these attributes. The uidNumber, gidNUmber, loginShell, homeDirectory, gecos, and
memberUid attributes are more unique to the POSIX schema, and are removed when the -O
option is specified. Use the ldapugdel -t passwd -O command, ldapugdel removes the
posixAccount object class and attributes, uidNumber, gidNumber, homeDirecotry,
loginShell, and gecos. Use the ldapugdel -t group -O command, ldapugdel removes
the posixGroup object class and the gidNumber, memberUId, and userPassword attributes.
The ldapugdel tool also supports a <protAttr> list with the -O option that enables you to
tell ldapugdel not to remove specific attributes defined in the <protoAttr> list.
Using the -O -x -t option forces ldapugdel to remove the additional attributes, cn, uid, or
description. Removal of these attributes only occurs if allowed by the remaining object classes
for that entry.
For detailed information, see the description of the -O, -x and -y arguments that follow.
7.3.7.2 Synopsis
ldapugdel [options] [-t <type>] [-h <hostname>] [-p <port>]
[-O [<protAttr>[,...]]] <-D <DN>>|<uid_name>|<group_name>
7.3.7.3 Options
The ldapugdel tool supports the following command options:
-P
Prompts for the administrator's bind identity (typically LDAP DN or Kerberos principal)
and bind password. If you do not specify the -P option, ldapugdel discovers the bind
identity and password from the environment variables LDAP_BINDDN and
LDAP_BINDCRED. If you do not specify the LDAP_BINDDN and LDAP_BINDCRED
environment variables, ldapugdel uses the bind configuration specified in the LDAP-UX
configuration profile. If the LDAP-UX configuration profile specifies the “proxy” bind,
ldapugdel reads the bind credential from either the /etc/opt/ldapux/acred or
the /etc/opt/ldapux/pcred file. The /etc/opt/ldapux/acred file is only used
by users who have sufficient administrative privilege to read this file.
-x Uses this option only with the -O option. Use -O -x -t passwd to force the ldapugdel
tool to remove the common uid, cn, and description attributes from a user entry.
Use -O -x -t group to force the ldapugdel tool to remove the cn and description
attributes from a group entry. Because use of -x removes common attributes typically
used by other LDAP-enabled applications, HP rarely recommends you to use the -x
option when removing posixAccount or posixGroup related attributes. If removal of the
uid, cn, or description causes an object class violation, ldapugdel generates a
7.3 LDAP user and group management tools 261