LDAP-UX Client Services B.05.01 Administrator Guide for HP directory servers and Windows ADS

Use of the ldapugadd, ldapugmod and ldapugdel tools requires specification of LDAP
administrator credentials with sufficient privilege to perform the requested operations in an LDAP
directory server. Specification of these credentials can be done through the LDAP_BINDDN and
LDAP_BINDCRED environment variables or an interactive prompt (-P) option. If the LDAP
administrator credential has not been specified using the two previous methods, and if configured,
the LDAP-UX administrator credential is used if the user running the tool has sufficient privilege to
read the /etc/opt/ldapux/acred file.
• ldapuglist
You can use the ldapuglist tool to display and enumerate POSIX-like account and group
entries that reside in an LDAP directory server. The ldapuglist provides features that enable
users and applications to discover and evaluate account and group information stored in an
LDAP directory server, without requiring extensive knowledge of in-use data models or the
methods used to retrieve and evaluate that information in the LDAP directory server.
The ldapuglist tool uses the LDAP-UX profile configuration, requiring minimal command
line options to discover where to search for user or group information, such as the directory
server host and proper search filters for finding users and groups. The ldapuglist tool also
uses attribute mapping defined in the profile to translate information to POSIX syntax. By
default, ldapuglist only displays POSIX-related attributes using RFC 2307 attribute names
unless you specifically request an attribute list with the <attr> option on the command line.
This tool provides command options that enable you to alter these configuration parameters.
• ldapugadd
You can use the ldapugadd tool to add new POSIX accounts and groups to an LDAP directory
server. Because the deployed data model might require user or group attributes beyond that
of the standard POISIX attributes, the ldapugadd tool uses user and group template files to
discover the required data model for the types of entries being created. These templates may
define arbitrary data models beyond just the required POSIX attributes. Applications can use
ldpacfinfo to discover the attributes required by the templates that are not part of the
standard POSIX data model. To use ldapugadd, you must provide LDAP administrator
credentials who have sufficient privilege to perform the user or group add operation in the
directory server.
• ldapugmod
The ldapugmod tool enables HP-UX administrators to modify existing POSIX accounts or
groups in an LDAP directory server. When using extended options, you can use ldapugmod
to modify arbitrary attributes for user or group entries or you can extend existing user or group
entries with the POSIX data model. To use ldapugmod, you must provide LDAP administrator
credentials that have sufficient privilege to perform the user or group modify operations in the
directory server.
• ldapugdel
Use the ldapugdel tool to remove POSIX related user or group entries from an LDAP directory
server. The ldapugdel tool can also remove the POSIX related attributes and object classes
from user or group entries, without removing the entire entry itself.
• ldapcfinfo
The ldapcfinfo tool provides several capabilities used to report LDAP-UX configuration and
status. When used specifically with the LDAP UG tools, ldapcfinfo can be used to discover
LDAP-UX configuration details about required attributes when adding new users or groups to
a directory server.
7.7 Managing users and groups 219