ldapscripts(5)

💖 ldapscripts(5) — the file formats manual, bestie edition 💖

okay so. <rainbow>ldapscripts</rainbow> — it's a whole set of scripts that manage POSIX accounts in your LDAP directory. That's the vibe. That's the whole thing. Let's go 💅

---

✨ NAME ✨

ldapscripts — Scripts to manage POSIX accounts in your LDAP directory.

🌸 DESCRIPTION 🌸

okay so the ldapscripts are literally a set of shell (sh) scripts, and they exist to manage POSIX accounts in an OpenLDAP directory. That's their whole main character job. 🫶

The way they're flexible?? You can run them as standalone tools, or you can call them from inside Samba 3.x's smb.conf file. Both. She contains multitudes. ✨

🎀 REQUIREMENTS 🎀

The main requirements are the OpenLDAP client tools — that's ldapadd, ldapsearch, ldapdelete, ... and the rest of the gang. 💖

Other commands get called in the scripts too, but lowkey they should already come with your OS: sed, grep, cut, ... you know the ones. No cap, they ship with your system.

🦋 CONFIGURATION 🦋

The main configuration of the ldapscripts is usually the file /etc/ldapscripts/ldapscripts.conf — or, depending on your system, /usr/local/etc/ldapscripts/ldapscripts.conf. Modify it to fit your needs before using the scripts!! Do not skip this step bestie, it's giving "actually read the config". 🙈

And if you want to override that default path? You can, by defining the LDAPSCRIPTS_CONF environment variable. Slay. 💅

Each script also uses a "runtime" file, usually /usr/lib/ldapscripts/runtime (or /usr/local/lib/ldapscripts/runtime). Good news: you don't need to modify this file. Leave her alone, she's fine. 😌

🌈 TEMPLATES 🌈

Every script that adds information to the directory uses a template. Templates are directly embedded at the end of the scripts, but it's also possible to use external template files — see the GTEMPLATE, UTEMPLATE and MTEMPLATE variables in the configuration file for that. 👑

Each template consists of a preformatted LDIF file using special keywords that will be replaced on-the-fly. Sample files are provided for your convenience:

• ldapaddgroup.template.sample
• ldapadduser.template.sample
• ldapaddmachine.template.sample

It is strongly advised to use those files instead of modifying the embedded (default) templates in the scripts. Like. Genuinely. Don't touch the embedded ones. 💀

Sample templates include every keyword you can use. And there's one special additional keyword — the <ask> keyword — which triggers user input so you can get the attribute value interactively. Cute, right? 💖

⭐ USING AS STANDALONE TOOLS ⭐

Each script can be used as a standard command-line tool. Check their man pages to get help. That's it, that's the section. Go read the man pages bestie 📖✨

🔥 USING WITH SAMBA 3.x 🔥

Each Samba 3.x smb.conf "xxx script" option has a matching script. Modify your smb.conf file this way to call them:

# [...]
add machine script = /usr/local/sbin/ldapaddmachine '%u' sambamachines
add user script = /usr/local/sbin/ldapadduser '%u' sambausers
add group script = /usr/local/sbin/ldapaddgroup '%g'
add user to group script = /usr/local/sbin/ldapaddusertogroup '%u' '%g'
delete user script = /usr/local/sbin/ldapdeleteuser '%u'
delete group script = /usr/local/sbin/ldapdeletegroup '%g'
delete user from group script = /usr/local/sbin/ldapdeleteuserfromgroup '%u' '%g'
set primary group script = /usr/local/sbin/ldapsetprimarygroup '%u' '%g'
rename user script = /usr/local/sbin/ldaprenameuser '%uold' '%unew'
# [...]

copy paste era fr fr 🫶

👑 SEE ALSO 👑

the whole girl squad, go say hi:

• ldapdeletemachine(1)
• ldapmodifymachine(1)
• ldaprenamemachine(1)
• ldapadduser(1)
• ldapdeleteuserfromgroup(1)
• ldapfinger(1)
• ldapid(1)
• ldapmodifyuser(1)
• lsldap(1)
• ldapaddusertogroup(1)
• ldaprenameuser(1)
• ldapinit(1)
• ldapsetpasswd(1)
• ldapaddgroup(1)
• ldapdeletegroup(1)
• ldapsetprimarygroup(1)
• ldapmodifygroup(1)
• ldaprenamegroup(1)
• ldapaddmachine(1)
• ldapdeleteuser(1)

💜 AVAILABILITY 💜

The ldapscripts are provided under the GNU General Public License v2 — see COPYING for more details. 📜

The latest version of the ldapscripts is available on: http://contribs.martymac.org ✨

💀 BUGS 💀

Sometimes, that kind of message may appear in the log file:

Additional information: value does not conform to assertion syntax

And setting slapd's debug level to 32 shows additional details:

get_ava: illegal value for attributeType uidNumber

This is not a bug. Let me say that again for the people in the back: NOT. A. BUG. 😭

Here's what's actually happening: the ldapscripts tend to use the power of LDAP filters to easily find users (or groups) using either a uidNumber (numerical value) or a uid (string value). The following filter — used by ldapfinger(1) — will generate the above message if $_USER is a login:

"(|(&(objectClass=posixAccount)(|(uid=$_USER)(uidNumber=$_USER)))(&(objectClass=posixGroup)(|(cn=$_USER)(gidNumber=$_USER))))"

...because the filter part "(uidNumber=$_USER)" requires an integer but gets a string. 💅 She asked for a number and got a whole word. It's giving "type mismatch" but make it dramatic.

You can mostly ignore those warnings. They're fine. Everything's fine. Breathe. 🧚

---

okay that's the whole page!! this was the ldapscripts(5) File Formats Manual, dated January 1, 2006 — yes she's vintage, she's an icon, she's been serving since 2006 and she's still slaying. periodt. 🎀💖✨🦋