Chapter 10. Using ldapmodify to manage IdM users externally As an IdM administrators you can use the ipa commands to manage your directory content. Alternatively, you can use the ldapmodify command to achieve similar goals. You can use this command interactively and provide all the data directly in the command line. You also can provide data in the file in the LDAP Data Interchange Format (LDIF) to ldapmodify command. 10.1. Templates for managing IdM user accounts externally The following templates can be used for various user management operations in IdM. The templates show which attributes you must modify using ldapmodify to achieve the following goals: Adding a new stage user Modifying a user's attribute Enabling a user Disabling a user Preserving a user The templates are formatted in the LDAP Data Interchange Format (LDIF). LDIF is a standard plain text data interchange format for representing LDAP directory content and update requests. Using the templates, you can configure the LDAP provider of your provisioning system to manage IdM user accounts. For detailed example procedures, see the following sections: Adding an IdM stage user defined in an LDIF file Adding an IdM stage user directly from the CLI using ldapmodify Preserving an IdM user with ldapmodify Templates for adding a new stage user A template for adding a user with UID and GID assigned automatically . The distinguished name (DN) of the created entry must start with uid=user_login : A template for adding a user with UID and GID assigned statically : You are not required to specify any IdM object classes when adding stage users. IdM adds these classes automatically after the users are activated. Templates for modifying existing users Modifying a user's attribute : Disabling a user : Enabling a user : Updating the nssAccountLock attribute has no effect on stage and preserved users. Even though the update operation completes successfully, the attribute value remains nssAccountLock: TRUE . Preserving a user : Note Before modifying a user, obtain the user's distinguished name (DN) by searching using the user's login. In the following example, the user_allowed_to_modify_user_entries user is a user allowed to modify user and group information, for example activator or IdM administrator. The password in the example is this user's password: 10.2. Templates for managing IdM group accounts externally The following templates can be used for various user group management operations in IdM. The templates show which attributes you must modify using ldapmodify to achieve the following aims: Creating a new group Deleting an existing group Adding a member to a group Removing a member from a group The templates are formatted in the LDAP Data Interchange Format (LDIF). LDIF is a standard plain text data interchange format for representing LDAP directory content and update requests. Using the templates, you can configure the LDAP provider of your provisioning system to manage IdM group accounts. Creating a new group Modifying groups Deleting an existing group : Adding a member to a group : Do not add stage or preserved users to groups. Even though the update operation completes successfully, the users will not be updated as members of the group. Only active users can belong to groups. Removing a member from a group : Note Before modifying a group, obtain the group's distinguished name (DN) by searching using the group's name. 10.3. Using ldapmodify command interactively You can modify Lightweight Directory Access Protocol (LDAP) entries in the interactive mode. Procedure In a command line, enter the LDAP Data Interchange Format (LDIF) statement after the ldapmodify command. Example 10.1. Changing the telephone number for a testuser Note that you need to obtain a Kerberos ticket for using -Y option. Press Ctlr+D to exit the interactive mode. Alternatively, provide an LDIF file after ldapmodify command: Example 10.2. The ldapmodify command reads modification data from an LDIF file Additional resources For more information about how to use the ldapmodify command see ldapmodify(1) man page on your system. For more information about the LDIF structure, see ldif(5) man page on your system. 10.4. Preserving an IdM user with ldapmodify Follow this procedure to use ldapmodify to preserve an IdM user; that is, how to deactivate a user account after the employee has left the company. Prerequisites You can authenticate as an IdM user with a role to preserve users. Procedure Log in as an IdM user with a role to preserve users: Enter the ldapmodify command and specify the Generic Security Services API (GSSAPI) as the Simple Authentication and Security Layer (SASL) mechanism to be used for authentication: Enter the dn of the user you want to preserve: Enter modrdn as the type of change you want to perform: Specify the newrdn for the user: Indicate that you want to preserve the user: Specify the new superior DN : Preserving a user moves the entry to a new location in the directory information tree (DIT). For this reason, you must specify the DN of the new parent entry as the new superior DN. Press Enter again to confirm that this is the end of the entry: Exit the connection using Ctrl + C . Verification Verify that the user has been preserved by listing all preserved users:

Commands:
dn: uid=user_login ,cn=staged users,cn=accounts,cn=provisioning,dc=idm,dc=example,dc=com changetype: add objectClass: top objectClass: inetorgperson uid: user_login sn: surname givenName: first_name cn: full_name
dn: uid=user_login,cn=staged users,cn=accounts,cn=provisioning,dc=idm,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: inetorgperson objectClass: organizationalperson objectClass: posixaccount uid: user_login uidNumber: UID_number gidNumber: GID_number sn: surname givenName: first_name cn: full_name homeDirectory: /home/user_login
dn: distinguished_name changetype: modify replace: attribute_to_modify attribute_to_modify: new_value
dn: distinguished_name changetype: modify replace: nsAccountLock nsAccountLock: TRUE
dn: distinguished_name changetype: modify replace: nsAccountLock nsAccountLock: FALSE
dn: distinguished_name changetype: modrdn newrdn: uid=user_login deleteoldrdn: 0 newsuperior: cn=deleted users,cn=accounts,cn=provisioning,dc=idm,dc=example,dc=com
ldapsearch -LLL -x -D "uid= user_allowed_to_modify_user_entries ,cn=users,cn=accounts,dc=idm,dc=example,dc=com" -w "Secret123" -H ldap://r8server.idm.example.com -b "cn=users,cn=accounts,dc=idm,dc=example,dc=com" uid=test_user dn: uid=test_user,cn=users,cn=accounts,dc=idm,dc=example,dc=com memberOf: cn=ipausers,cn=groups,cn=accounts,dc=idm,dc=example,dc=com
dn: cn=group_name,cn=groups,cn=accounts,dc=idm,dc=example,dc=com changetype: add objectClass: top objectClass: ipaobject objectClass: ipausergroup objectClass: groupofnames objectClass: nestedgroup objectClass: posixgroup uid: group_name cn: group_name gidNumber: GID_number
dn: group_distinguished_name changetype: delete
dn: group_distinguished_name changetype: modify add: member member: uid=user_login,cn=users,cn=accounts,dc=idm,dc=example,dc=com
dn: distinguished_name changetype: modify delete: member member: uid=user_login,cn=users,cn=accounts,dc=idm,dc=example,dc=com
ldapsearch -YGSSAPI -H ldap://server.idm.example.com -b "cn=groups,cn=accounts,dc=idm,dc=example,dc=com" "cn=group_name" dn: cn=group_name,cn=groups,cn=accounts,dc=idm,dc=example,dc=com ipaNTSecurityIdentifier: S-1-5-21-1650388524-2605035987-2578146103-11017 cn: testgroup objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup objectClass: ipantgroupattrs ipaUniqueID: 569bf864-9d45-11ea-bea3-525400f6f085 gidNumber: 1997010017
ldapmodify -Y GSSAPI -H ldap://server.example.com dn: uid=testuser,cn=users,cn=accounts,dc=example,dc=com changetype: modify replace: telephoneNumber telephonenumber: 88888888
ldapmodify -Y GSSAPI -H ldap://server.example.com -f ~/example.ldif
kinit admin
ldapmodify -Y GSSAPI SASL/GSSAPI authentication started SASL username: admin@IDM.EXAMPLE.COM SASL SSF: 256 SASL data security layer installed.
dn: uid=user1,cn=users,cn=accounts,dc=idm,dc=example,dc=com
changetype: modrdn
newrdn: uid=user1
deleteoldrdn: 0
newsuperior: cn=deleted users,cn=accounts,cn=provisioning,dc=idm,dc=example,dc=com
[Enter] modifying rdn of entry "uid=user1,cn=users,cn=accounts,dc=idm,dc=example,dc=com"
ipa user-find --preserved=true -------------- 1 user matched -------------- User login: user1 First name: First 1 Last name: Last 1 Home directory: /home/user1 Login shell: /bin/sh Principal name: user1@IDM.EXAMPLE.COM Principal alias: user1@IDM.EXAMPLE.COM Email address: user1@idm.example.com UID: 1997010003 GID: 1997010003 Account disabled: True Preserved user: True ---------------------------- Number of entries returned 1 ----------------------------