| blob | a60aefe6205548108b0e60e6b6d112fb41ea2555 |
1 '\" te
2 .\" Copyright (C) 2002, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
4 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
5 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH LDAPADDENT 8 "May 13, 2017"
7 .SH NAME
8 ldapaddent \- create LDAP entries from corresponding /etc files
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBldapaddent\fR [\fB-cpv\fR] [\fB-a\fR \fIauthenticationMethod\fR] [\fB-b\fR \fIbaseDN\fR]
13 \fB-D\fR \fIbindDN\fR [\fB-w\fR \fIbind_password\fR] [\fB-j\fR \fIpasswdFile\fR] [\fB-f\fR \fIfilename\fR]
14 \fIdatabase\fR
15 .fi
17 .LP
18 .nf
19 \fBldapaddent\fR [\fB-cpv\fR] \fB-a\fR sasl/GSSAPI [\fB-b\fR \fIbaseDN\fR] [\fB-f\fR \fIfilename\fR]
20 \fIdatabase\fR
21 .fi
23 .LP
24 .nf
25 \fBldapaddent\fR \fB-d\fR [\fB-v\fR] [\fB-a\fR \fIauthenticationMethod\fR] [\fB-D\fR \fIbindDN\fR]
26 [\fB-w\fR \fIbind_password\fR] [\fB-j\fR \fIpasswdFile\fR] \fIdatabase\fR
27 .fi
29 .LP
30 .nf
31 \fBldapaddent\fR [\fB-cpv\fR] \fB-h\fR \fILDAP_server\fR[:\fIserverPort\fR] [\fB-M\fR \fIdomainName\fR]
32 [\fB-N\fR \fIprofileName\fR] [\fB-P\fR \fIcertifPath\fR] [\fB-a\fR \fIauthenticationMethod\fR]
33 [\fB-b\fR \fIbaseDN\fR] \fB-D\fR \fIbindDN\fR [\fB-w\fR \fIbind_password\fR] [\fB-f\fR \fIfilename\fR]
34 [\fB-j\fR \fIpasswdFile\fR] \fIdatabase\fR
35 .fi
37 .LP
38 .nf
39 \fBldapaddent\fR [\fB-cpv\fR] \fB-h\fR \fILDAP_server\fR[:\fIserverPort\fR] [\fB-M\fR \fIdomainName\fR]
40 [\fB-N\fR \fIprofileName\fR] [\fB-P\fR \fIcertifPath\fR] [\fB-a\fR \fIauthenticationMethod\fR]
41 [\fB-b\fR \fIbaseDN\fR] [\fB-f\fR \fIfilename\fR] \fIdatabase\fR
42 .fi
44 .LP
45 .nf
46 \fBldapaddent\fR \fB-d\fR [\fB-v\fR] \fB-h\fR \fILDAP_server\fR[:\fIserverPort\fR] [\fB-M\fR \fIdomainName\fR]
47 [\fB-N\fR \fIprofileName\fR] [\fB-P\fR \fIcertifPath\fR] [\fB-a\fR \fIauthenticationMethod\fR]
48 [\fB-b\fR \fIbaseDN\fR] \fB-D\fR \fIbindDN\fR [\fB-w\fR \fIbind_password\fR] [\fB-j\fR \fIpasswdFile\fR]
49 \fIdatabase\fR
50 .fi
52 .SH DESCRIPTION
53 .LP
54 \fBldapaddent\fR creates entries in LDAP containers from their corresponding
55 \fB/etc\fR files. This operation is customized for each of the standard
56 containers that are used in the administration of Solaris systems. The
57 \fIdatabase\fR argument specifies the type of the data being processed. Legal
58 values for this type are one of \fBaliases\fR, \fBauto_*\fR, \fBbootparams\fR,
59 \fBethers\fR, \fBgroup\fR, \fBhosts\fR (including both IPv4 and IPv6
60 addresses), \fBipnodes\fR (alias for \fBhosts\fR), \fBnetgroup\fR,
61 \fBnetmasks\fR, \fBnetworks\fR, \fBpasswd\fR, \fBshadow\fR, \fBprotocols\fR,
62 \fBpublickey\fR, \fBrpc\fR, and \fBservices\fR. In addition to the preceding,
63 the \fIdatabase\fR argument can be one of the RBAC-related files (see
64 \fBrbac\fR(5)):
65 .RS +4
66 .TP
67 .ie t \(bu
68 .el o
69 \fB/etc/user_attr\fR
70 .RE
71 .RS +4
72 .TP
73 .ie t \(bu
74 .el o
75 \fB/etc/security/auth_attr\fR
76 .RE
77 .RS +4
78 .TP
79 .ie t \(bu
80 .el o
81 \fB/etc/security/prof_attr\fR
82 .RE
83 .RS +4
84 .TP
85 .ie t \(bu
86 .el o
87 \fB/etc/security/exec_attr\fR
88 .RE
89 .sp
90 .LP
91 By default, \fBldapaddent\fR reads from the standard input and adds this data
92 to the LDAP container associated with the database specified on the command
93 line. An input file from which data can be read is specified using the \fB-f\fR
94 option.
95 .sp
96 .LP
97 If you specify the \fB-h\fR option, \fBldapaddent\fR establishes a connection
98 to the server indicated by the option in order to obtain a \fBDUAProfile\fR
99 specified by the \fB-N\fR option. The entries will be stored in the directory
100 described by the configuration obtained.
101 .sp
102 .LP
103 By default (if the \fB-h\fR option is not specified), entries will be stored in
104 the directory based on the client's configuration. To use the utility in the
105 default mode, the Solaris LDAP client must be set up in advance.
106 .sp
107 .LP
108 The location where entries are to be written can be overridden by using the
109 \fB-b\fR option.
110 .sp
111 .LP
112 If the entry to be added exists in the directory, the command displays an error
113 and exits, unless the \fB-c\fR option is used.
114 .sp
115 .LP
116 Although, there is a \fBshadow\fR database type, there is no corresponding
117 \fBshadow\fR container. Both the \fBshadow\fR and the \fBpasswd\fR data is
118 stored in the \fBpeople\fR container itself. Similarly, data from
119 \fBnetworks\fR and \fBnetmasks\fR databases are stored in the \fBnetworks\fR
120 container.
121 .sp
122 .LP
123 The \fBuser_attr\fR data is stored by default in the
124 \fBpeople\fR container. The \fBprof_attr\fR and \fBexec_attr\fR data is stored
125 by default in the \fBSolarisProfAttr\fR container.
126 .sp
127 .LP
128 You must add entries from the \fBpasswd\fR database before you attempt to add
129 entries from the \fBshadow\fR database. The addition of a \fBshadow\fR entry
130 that does not have a corresponding \fBpasswd\fR entry will fail.
131 .sp
132 .LP
133 The \fBpasswd\fR database must precede the \fBuser_attr\fR database.
134 .sp
135 .LP
136 For better performance, the recommended order in which the databases should be
137 loaded is as follows:
138 .RS +4
139 .TP
140 .ie t \(bu
141 .el o
142 \fBpasswd\fR database followed by \fBshadow\fR database
143 .RE
144 .RS +4
145 .TP
146 .ie t \(bu
147 .el o
148 \fBnetworks\fR database followed by \fBnetmasks\fR database
149 .RE
150 .RS +4
151 .TP
152 .ie t \(bu
153 .el o
154 \fBbootparams\fR database followed by \fBethers\fR database
155 .RE
156 .sp
157 .LP
158 Only the first entry of a given type that is encountered will be added to the
159 LDAP server. The \fBldapaddent\fR command skips any duplicate entries.
160 .SH OPTIONS
161 .LP
162 The \fBldapaddent\fR command supports the following options:
163 .sp
164 .ne 2
165 .na
166 \fB\fB-a\fR \fIauthenticationMethod\fR\fR
167 .ad
168 .sp .6
169 .RS 4n
170 Specify authentication method. The default value is what has been configured in
171 the profile. The supported authentication methods are:
172 .RS +4
173 .TP
174 .ie t \(bu
175 .el o
176 \fBsimple\fR
177 .RE
178 .RS +4
179 .TP
180 .ie t \(bu
181 .el o
182 \fBsasl/CRAM-MD5\fR
183 .RE
184 .RS +4
185 .TP
186 .ie t \(bu
187 .el o
188 \fBsasl/DIGEST-MD5\fR
189 .RE
190 .RS +4
191 .TP
192 .ie t \(bu
193 .el o
194 \fBsasl/GSSAPI\fR
195 .RE
196 .RS +4
197 .TP
198 .ie t \(bu
199 .el o
200 \fBtls:simple\fR
201 .RE
202 .RS +4
203 .TP
204 .ie t \(bu
205 .el o
206 \fBtls:sasl/CRAM-MD5\fR
207 .RE
208 .RS +4
209 .TP
210 .ie t \(bu
211 .el o
212 \fBtls:sasl/DIGEST-MD5\fR
213 .RE
214 Selecting \fBsimple\fR causes passwords to be sent over the network in clear
215 text. Its use is strongly discouraged. Additionally, if the client is
216 configured with a profile which uses no authentication, that is, either the
217 \fBcredentialLevel\fR attribute is set to \fBanonymous\fR or
218 \fBauthenticationMethod\fR is set to \fBnone\fR, the user must use this option
219 to provide an authentication method. If the authentication method is
220 \fBsasl/GSSAPI\fR, \fIbindDN\fR and \fIbindPassword\fR is not required and the
221 \fBhosts\fR and \fBipnodes\fR fields of \fB/etc/nsswitch.conf\fR must be
222 configured as:
223 .sp
224 .in +2
225 .nf
226 hosts: dns files
227 ipnodes: dns files
228 .fi
229 .in -2
231 See \fBnsswitch.conf\fR(4).
232 .RE
234 .sp
235 .ne 2
236 .na
237 \fB\fB-b\fR\ \fIbaseDN\fR\fR
238 .ad
239 .sp .6
240 .RS 4n
241 Create entries in the \fIbaseDN\fR directory. \fIbaseDN\fR is not relative to
242 the client's default search base, but rather. it is the actual location where
243 the entries will be created. If this parameter is not specified, the first
244 search descriptor defined for the service or the default container will be
245 used.
246 .RE
248 .sp
249 .ne 2
250 .na
251 \fB\fB-c\fR\fR
252 .ad
253 .sp .6
254 .RS 4n
255 Continue adding entries to the directory even after an error. Entries will not
256 be added if the directory server is not responding or if there is an
257 authentication problem.
258 .RE
260 .sp
261 .ne 2
262 .na
263 \fB\fB-D\fR\ \fIbindDN\fR\fR
264 .ad
265 .sp .6
266 .RS 4n
267 Create an entry which has write permission to the \fIbaseDN\fR. When used with
268 \fB-d\fR option, this entry only needs read permission.
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fB\fB-d\fR\fR
275 .ad
276 .sp .6
277 .RS 4n
278 Dump the LDAP container to the standard output in the appropriate format for
279 the given database.
280 .RE
282 .sp
283 .ne 2
284 .na
285 \fB\fB-f\fR \fIfilename\fR\fR
286 .ad
287 .sp .6
288 .RS 4n
289 Indicates input file to read in an \fB/etc/\fR file format.
290 .RE
292 .sp
293 .ne 2
294 .na
295 \fB\fB-h\fR \fILDAP_server\fR[:\fIserverPort\fR]\fR
296 .ad
297 .sp .6
298 .RS 4n
299 Specify an address (or a name) and an optional port of the LDAP server in which
300 the entries will be stored. The current naming service specified in the
301 \fBnsswitch.conf\fR file is used. The default value for the port is \fB389\fR,
302 except when TLS is specified as the authentication method. In this case, the
303 default LDAP server port number is \fB636\fR.
304 .RE
306 .sp
307 .ne 2
308 .na
309 \fB\fB-j\fR\ \fIpasswdFile\fR\fR
310 .ad
311 .sp .6
312 .RS 4n
313 Specify a file containing the password for the bind DN or the password for the
314 SSL client's key database. To protect the password, use this option in scripts
315 and place the password in a secure file. This option is mutually exclusive of
316 the \fB-w\fR option.
317 .RE
319 .sp
320 .ne 2
321 .na
322 \fB\fB-M\fR\ \fIdomainName\fR\fR
323 .ad
324 .sp .6
325 .RS 4n
326 The name of a domain served by the specified server. If not specified, the
327 default domain name will be used.
328 .RE
330 .sp
331 .ne 2
332 .na
333 \fB\fB-N\fR\ \fIprofileName\fR\fR
334 .ad
335 .sp .6
336 .RS 4n
337 Specify the \fBDUAProfile\fR name. A profile with such a name is supposed to
338 exist on the server specified by \fB-h\fR option. Otherwise, a default
339 \fBDUAProfile\fR will be used. The default value is \fBdefault\fR.
340 .RE
342 .sp
343 .ne 2
344 .na
345 \fB\fB-P\fR\ \fIcertifPath\fR\fR
346 .ad
347 .sp .6
348 .RS 4n
349 The certificate path for the location of the certificate database. The value is
350 the path where security database files reside. This is used for TLS support,
351 which is specified in the \fBauthenticationMethod\fR and
352 \fBserviceAuthenticationMethod\fR attributes. The default is \fB/var/ldap\fR.
353 .RE
355 .sp
356 .ne 2
357 .na
358 \fB\fB-p\fR\fR
359 .ad
360 .sp .6
361 .RS 4n
362 Process the \fBpassword\fR field when loading password information from a file.
363 By default, the \fBpassword\fR field is ignored because it is usually not
364 valid, as the actual password appears in a \fBshadow\fR file.
365 .RE
367 .sp
368 .ne 2
369 .na
370 \fB\fB-w\fR\ \fIbindPassword\fR\fR
371 .ad
372 .sp .6
373 .RS 4n
374 Password to be used for authenticating the \fIbindDN\fR. If this parameter is
375 missing, the command will prompt for a password. \fBNULL\fR passwords are not
376 supported in LDAP.
377 .sp
378 When you use \fB-w\fR\ \fIbindPassword\fR to specify the password to be used
379 for authentication, the password is visible to other users of the system by
380 means of the \fBps\fR command, in script files or in shell history.
381 .sp
382 If you supply "\fB-\fR" (hyphen) as a password, you will be prompted to enter a
383 password.
384 .RE
386 .sp
387 .ne 2
388 .na
389 \fB\fB-v\fR\fR
390 .ad
391 .sp .6
392 .RS 4n
393 Verbose.
394 .RE
396 .SH OPERANDS
397 .LP
398 The following operands are supported:
399 .sp
400 .ne 2
401 .na
402 \fB\fIdatabase\fR\fR
403 .ad
404 .sp .6
405 .RS 4n
406 The name of the database or service name. Supported values are: \fBaliases\fR,
407 \fBauto_*\fR, \fBbootparams\fR, \fBethers\fR, \fBgroup\fR, \fBhosts\fR
408 (including IPv6 addresses), \fBnetgroup\fR, \fBnetmasks\fR, \fBnetworks\fR,
409 \fBpasswd\fR, \fBshadow\fR, \fBprotocols\fR, \fBpublickey\fR, \fBrpc\fR, and
410 \fBservices\fR. Also supported are \fBauth_attr\fR, \fBprof_attr\fR,
411 \fBexec_attr\fR, \fBuser_attr\fR, and \fBprojects\fR.
412 .RE
414 .SH EXAMPLES
415 .LP
416 \fBExample 1 \fRAdding Password Entries to the Directory Server
417 .sp
418 .LP
419 The following example shows how to add password entries to the directory
420 server:
422 .sp
423 .in +2
424 .nf
425 example# \fBldapaddent -D "cn=directory manager" -w secret \e
426 -f /etc/passwd passwd\fR
427 .fi
428 .in -2
429 .sp
431 .LP
432 \fBExample 2 \fRAdding Group Entries
433 .sp
434 .LP
435 The following example shows how to add \fBgroup\fR entries to the directory
436 server using \fBsasl/CRAM-MD5\fR as the authentication method:
438 .sp
439 .in +2
440 .nf
441 example# \fBldapaddent -D "cn=directory manager" -w secret \e
442 -a "sasl/CRAM-MD5" -f /etc/group group\fR
443 .fi
444 .in -2
445 .sp
447 .LP
448 \fBExample 3 \fRAdding \fBauto_master\fR Entries
449 .sp
450 .LP
451 The following example shows how to add \fBauto_master\fR entries to the
452 directory server:
454 .sp
455 .in +2
456 .nf
457 example# \fBldapaddent -D "cn=directory manager" -w secret \e
458 -f /etc/auto_master auto_master\fR
459 .fi
460 .in -2
461 .sp
463 .LP
464 \fBExample 4 \fRDumping \fBpasswd\fR Entries from the Directory to File
465 .sp
466 .LP
467 The following example shows how to dump \fBpassword\fR entries from the
468 directory to a file \fBfoo\fR:
470 .sp
471 .in +2
472 .nf
473 example# \fBldapaddent -d passwd > foo\fR
474 .fi
475 .in -2
476 .sp
478 .LP
479 \fBExample 5 \fRAdding Password Entries to a Specific Directory Server
480 .sp
481 .LP
482 The following example shows how to add password entries to a directory server
483 that you specify:
485 .sp
486 .in +2
487 .nf
488 example# \fBldapaddent -h 10.10.10.10:3890 \e
489 -M another.domain.name -N special_duaprofile \e
490 -D "cn=directory manager" -w secret \e
491 -f /etc/passwd passwd\fR
492 .fi
493 .in -2
494 .sp
496 .SH EXIT STATUS
497 .LP
498 The following exit values are returned:
499 .sp
500 .ne 2
501 .na
502 \fB\fB0\fR\fR
503 .ad
504 .sp .6
505 .RS 4n
506 Successful completion.
507 .RE
509 .sp
510 .ne 2
511 .na
512 \fB>\fB0\fR\fR
513 .ad
514 .sp .6
515 .RS 4n
516 An error occurred.
517 .RE
519 .SH FILES
520 .ne 2
521 .na
522 \fB\fB/var/ldap/ldap_client_file\fR\fR
523 .ad
524 .br
525 .na
526 \fB\fB/var/ldap/ldap_client_cred\fR\fR
527 .ad
528 .sp .6
529 .RS 4n
530 Files containing the LDAP configuration of the client. These files are not to
531 be modified manually. Their content is not guaranteed to be human readable. Use
532 \fBldapclient\fR(8) to update these files.
533 .RE
535 .SH ATTRIBUTES
536 .LP
537 See \fBattributes\fR(5) for descriptions of the following attributes:
538 .sp
540 .sp
541 .TS
542 box;
543 c | c
544 l | l .
545 ATTRIBUTE TYPE ATTRIBUTE VALUE
546 _
547 Interface Stability Committed
548 .TE
550 .SH SEE ALSO
551 .LP
552 \fBldap\fR(1), \fBldaplist\fR(1), \fBldapmodify\fR(1), \fBldapmodrdn\fR(1),
553 \fBldapsearch\fR(1), \fBidsconfig\fR(8), \fBldapclient\fR(8),
554 \fBnsswitch.conf\fR(4), \fBattributes\fR(5)
555 .sp
556 .LP
557 \fI\fR
558 .SH CAUTION
559 .LP
560 Currently StartTLS is not supported by \fBlibldap.so.5\fR, therefore the port
561 number provided refers to the port used during a TLS open, rather than the port
562 used as part of a StartTLS sequence. For example:
563 .sp
564 .in +2
565 .nf
566 -h foo:1000 -a tls:simple
567 .fi
568 .in -2
569 .sp
571 .sp
572 .LP
573 The preceding refers to a raw TLS open on host \fBfoo\fR port 1000, not an
574 open, StartTLS sequence on an unsecured port 1000. If port 1000 is unsecured
575 the connection will not be made.