LDAP-UX Client Services B.05.01 Administrator Guide for HP directory servers and Windows ADS

Table 31 Return codes for ldapugdel
MessageReturn Codes
Invalid POSIX attributes.DEL_COMMANDLINE_ERR
Multiple entries found that match the same name. Please
use a DN to specify a specific entry.
DEL_MULTIPLE_ENTRY_FOUND
The LDAP deletion operation failed.DEL_DELETE_FAILED
The LDAP search for subSchemaSubEntry, attributeTypes
or objectClasses failed.
DEL_SEARCH_FAILED
Unable to analyze LDAP directory server’s schema. This
operation is required in order to determine which attributes
may be legally removed.
DEL_PARSE_ERROR
9.3.7.6 Security considerations
Be aware of the following security considerations when you use ldapugdel:
• Use of ldapugdel requires permissions of an LDAP administrator when it performs its
operations on the directory server. The rights to delete or modify existing LDAP directory entries
under the requested subtree and to remove the required attributes in that entry must be granted
to the administrator identity that you specify when you execute ldapugdel.
• Removal of a POSIX account does not automatically remove that account’s membership in
groups, unless the LDAP directory server provides that capability. Some LDAP directory servers
have a feature called “referential integrity”, which performs modification or removal of DN-type
attributes if the specified DN is either changed or removed.
• As may occur in any identity repository, modifying this repository can open exposure to risks.
The impact of such changes depends on the organization security policy. When using
ldapugdel, you are expected to have full knowledge of the organization security policy and
the impact of deleting identity information from that identity repository.
• Do not use ldapugdel as part of a modification process on a user or group entry (deleting
and readding the entry as a way to modify that entry.) User and group entries in an LDAP
directory often contain information about the user or group that is outside the POSIX information
model. Deleting an entry will delete all information about the user or group. When the entry
is readded, recovery of the nonPOSIX information might not be possible.
9.3.7.7 Limitations
Because LDAP directory servers require data to be stored according to the UTF-8 (RFC3629)
character encoding method, all characters provided to ldapugdel are assumed to be UTF-8 and
part of the ISO-10646 character set. The ldapugdel tool does not perform conversion of the
locale character set to or from the UTF-8 character set.
9.3.7.8 Examples
The section provides examples of using ldapugdel:
Run the following commands to specify the LDAP_BINDDN and LDAP_BINDCRED environment
variables:
export LDAP_BINDDN = "cn=Jane Admin,ou=admins,dc=exampe,dc=com"
export LDAP_BINDCRED = "Jane's password"
Run the following command to go to the /opt/ldapux/bin directory where ldapugdel resides:
cd /opt/ldapux/bin
328 Command and tool reference