ldapuglist.1m (2010 09)

l
ldapuglist(1M) ldapuglist(1M)
As with ldapux (5), ldapuglist will attempt to contact the first available directory server as defined in
the ldapux (5) host list. As soon as a connection is established, further directory servers on the host list
will not be contacted.
Once connected,
ldapuglist will first determine if the environment variables
LDAP_BINDDN and
LDAP_BINDCRED
have been specified. If so, then ldapuglist will attempt to bind to the directory
server using the specified credentials and configured LDAP-UX authentication method.
If the above mentioned environment variables have not been specified, then
ldapuglist will determine
if the configured credential type is "proxy" and if so, attempt to bind to the directory server using the
configured LDAP-UX proxy credential. If configured, the acred proxy credential will be used for adminis-
trative users (determined if the user running
ldapuglist has enough privilege to read the
/etc/opt/ldapux/acred
file). Otherwise the credential configured in
/etc/opt/ldapux/pcred
will be used.
Note: to prevent discovery of the LDAP administrator’s credentials, the LDAP user DN and password
may not be specified as command-line options to the
ldapuglist utility.
Security Considerations
In order to support non-interactive use of the
ldapuglist command, specification of the LDAP
administrator’s credentials is required through use of the
LDAP_BINDDN and
LDAP_BINDCRED environ-
ment variables. To prevent exposure of these environment variables, they should be unset after use.
Note also that shells (4) command history log may contain copies of the executed commands that show set-
ting of these variables. Access to a shell’s history file must be protected. Specification of the LDAP
administrator’s credentials on the command line is not allowed since information about the currently run-
ning processes can be exposed externally from the session.
Use of the
-P eliminates the need to set the mentioned environment variables by interactively prompting
for the required credentials.
LDAP-UX PROFILE
ldapuglist makes use of the LDAP-UX configuration profile to determine the information model used
in the directory server to store POSIX attributes. Please refer to the LDAP-UX Client Services
Administrator’s Guide for additional information about the configuration profile.
OUTPUT FORMAT
Output from
ldapuglist will follow a consistent format, regardless of which attributes are used to
define information in an LDAP directory. The output format is:
dn
: dn1
field1: value1
field2: value2
field3:: base64-encodeded-value3
dn: dn2
field1: value1
field2: value2
Each entry will be preceded by a DN, followed by one or more field-value pairs. The DN and each field-
value pair will be on a separate line, separated by a carriage-return and line-feed character. The field
and value will be separated by a colon and space character. And each entry will be separated by a blank
line.
In the case when an unencodable character is encountered (carriage-return or line-feed for example) in a
value string, the whole value will be base64 encoded and the field-value separator will change to two
colons and a space character. See Unencodable Characters below. When the
-t passwd option is
specified, the following fields will be returned:
cn
uid
userPassword
uidNumber
gidNumber
homeDirectory
loginShell
gecos
HP-UX 11i v3: June 2010 Web Release − 5 − Hewlett-Packard Company 5