LDAP-UX Client Services B.05.01 Administrator Guide for HP directory servers and Windows ADS

./ldapugmod -t group -r atam GroupB
The following command replaces all instances of the description attribute with value “Group
C Entry” for the group entry, GroupC:
./ldapugmod -t group GroupC "description=Group C Entry"
9.3.7 The ldapugdel tool
Use the ldapugdel tool to remove POSIX-related user or group entries from an LDAP directory
server. If you use ldapugdel with the -O option, ldapugdel removes the POSIX related attributes
and object classes from user or group entries, without removing the entire entry itself.
9.3.7.1 Removing attributes only
You can use ldapugdel to remove POSIX user and group entire entries from an LDAP directory
server. With the -O option, ldapugdel enables you to remove only POSIX related attributes and
object classes from user or group entries, without removing entire entries.
Because mapped attributes are attributes that are often shared with other LDAP-enabled applications,
ldapugdel does not support attribute mapping. For example, if the uidNumber attribute has
been mapped to the employeeNumber attribute, ldapugdel attempts to remove uidNumber
and not employeeNumber.
The usePassword, uid, cn, and description attributes are commonly used by most other
user and group schemas. With the -O option, the ldapugdel tool does not attempt to remove
these attributes. The uidNumber, gidNUmber, loginShell, homeDirectory, gecos, and
memberUid attributes are more unique to the POSIX schema, and are removed when the -O option
is specified. Use the ldapugdel -t passwd -O command, ldapugdel removes the
posixAccount object class and attributes, uidNumber, gidNumber, homeDirecotry,
loginShell, and gecos. Use the ldapugdel -t group -O command, ldapugdel removes
the posixGroup object class and the gidNumber, memberUId, and userPassword attributes.
The ldapugdel tool also supports a <protAttr> list with the -O option that enables you to tell
ldapugdel not to remove specific attributes defined in the <protoAttr> list.
Using the -O -x -t option forces ldapugdel to remove the additional attributes, cn, uid, or
description. Removal of these attributes only occurs if allowed by the remaining object classes
for that entry.
For detailed information, see the description of the -O, -x and -y arguments that follow.
9.3.7.2 Synopsis
ldapugdel [options] [-t <type>] [-h <hostname>] [-p <port>]
[-O [<protAttr>[,...]]] <-D <DN>>|<uid_name>|<group_name>
9.3.7.3 Options
The ldapugdel tool supports the following command options:
-P Prompts for the administrator's bind identity (typically LDAP DN or Kerberos principal) and
bind password. If you do not specify the -P option, ldapugdel discovers the bind identity
and password from the environment variables LDAP_BINDDN and LDAP_BINDCRED. If
you do not specify the LDAP_BINDDN and LDAP_BINDCRED environment variables,
ldapugdel uses the bind configuration specified in the LDAP-UX configuration profile. If
the LDAP-UX configuration profile specifies the “proxy” bind, ldapugdel reads the bind
credential from either the /etc/opt/ldapux/acred or the /etc/opt/ldapux/pcred
file. The /etc/opt/ldapux/acred file is only used by users who have sufficient
administrative privilege to read this file.
-x Uses this option only with the -O option. Use -O -x -t passwd to force the ldapugdel
tool to remove the common uid, cn, and description attributes from a user entry. Use
-O -x -t group to force the ldapugdel tool to remove the cn and description
324 Command and tool reference