HP-UX Reference (11i v2 07/12) - 1M System Administration Commands A-M (vol 3)

l
ldapuglist(1M) ldapuglist(1M)
Once connected, ldapuglist will first determine if the environment variables
LDAP_BINDDN and
LDAP_BINDCRED
have been specified. If so, then ldapuglist will attempt to bind to the directory
server using the specified credentials and configured LDAP-UX authentication method.
If the above mentioned environment variables have not been specified, then
ldapuglist will determine
if the configured credential type is "proxy" and if so, attempt to bind to the directory server using the
configured LDAP-UX proxy credential. If configured, the acred proxy credential will be used for adminis-
trative users (determined if the user running
ldapuglist has enough privilege to read the
/etc/opt/ldapux/acred
file). Otherwise the credential configured in
/etc/opt/ldapux/pcred
will be used.
Note: to prevent discovery of the LDAP administrator’s credentials, the LDAP user DN and password may
not be specified as command-line options to the
ldapuglist utility.
Security Considerations
In order to support non-interactive use of the
ldapuglist command, specification of the LDAP
administrator’s credentials is required through use of the
LDAP_BINDDN and LDAP_BINDCRED
environ-
ment variables. To prevent exposure of these environment variables, they should be unset after use.
Note also that
shells command history log may contain copies of the executed commands that show set-
ting of these variables. Access to a shell’s history file must be protected. Specification of the LDAP
administrator’s credentials on the command line is not allowed since information about the currently run-
ning processes can be exposed externally from the session.
Use of the -P eliminates the need to set the mentioned environment variables by interactively prompting
for the required credentials.
LDAP-UX PROFILE
ldapuglist makes use of the LDAP-UX configuration profile to determine the information model used
in the directory server to store POSIX attributes. Please refer to the LDAP-UX Client Services
Administrator’s Guide for additional information about the configuration profile.
OUTPUT FORMAT
Output from
ldapuglist will follow a consistent format, regardless of which attributes are used to
define information in an LDAP directory. The output format is:
dn: dn1
field1: value1
field2: value2
field3:: base64-encodeded-value3
dn: dn2
field1: value1
field2: value2
Each entry will be preceded by a DN, followed by one or more field-value pairs. The DN and each field-
value pair will be on a separate line, separated by a carriage-return and line-feed character. The field and
value will be separated by a colon and space character. And each entry will be separated by a blank line.
In the case when an unencodable character is encountered (carriage-return or line-feed for example) in a
value string, the whole value will be base64 encoded and the field-value separator will change to two colons
and a space character. See Unencodable Characters below. When the -t passwd option is specified, the
following fields will be returned:
cn
uid
userPassword
uidNumber
gidNumber
homeDirectory
loginShell
gecos
When the -t group option is specified, the following fields will be returned:
cn
userPassword
HP-UX 11i Version 2: December 2007 Update − 5 − Hewlett-Packard Company 483