OpenLDAP : Add User Accounts2023/04/27

	Add LDAP User Accounts in the OpenLDAP Server.
[1]	Add a user account.

# generate encrypted password

root@dlp:~#

slappasswd

New password:
Re-enter new password:
{SSHA}xxxxxxxxxxxxxxxxx

root@dlp:~#

vi ldapuser.ldif

# create new
# replace to your own domain name for [dc=***,dc=***] section

dn: uid=lunar,ou=people,dc=srv,dc=world
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: lunar
sn: ubuntu
userPassword: {SSHA}xxxxxxxxxxxxxxxxx
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/lunar

dn: cn=lunar,ou=groups,dc=srv,dc=world
objectClass: posixGroup
cn: lunar
gidNumber: 2000
memberUid: lunar

root@dlp:~#

ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif

Enter LDAP Password:

adding new entry "uid=lunar,ou=people,dc=srv,dc=world"

adding new entry "cn=lunar,ou=groups,dc=srv,dc=world"

[2]	Add users and groups in local passwd/group to LDAP directory.

root@dlp:~#

vi ldapuser.sh

# extract local users and groups who have [1000-9999] digit UID
# replace [SUFFIX=***] to your own domain name
# this is an example, free to modify

#!/bin/bash

SUFFIX='dc=srv,dc=world'
LDIF='ldapuser.ldif'

echo -n > $LDIF
GROUP_IDS=()
grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | (while read TARGET_USER
do
    USER_ID="$(echo "$TARGET_USER" | cut -d':' -f1)"

    USER_NAME="$(echo "$TARGET_USER" | cut -d':' -f5 | cut -d',' -f1 )"
    [ ! "$USER_NAME" ] && USER_NAME="$USER_ID"

    LDAP_SN="$(echo "$USER_NAME" | awk '{print $2}')"
    [ ! "$LDAP_SN" ] && LDAP_SN="$USER_ID"

    LASTCHANGE_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f3)"
    [ ! "$LASTCHANGE_FLAG" ] && LASTCHANGE_FLAG="0"

    SHADOW_FLAG="$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f9)"
    [ ! "$SHADOW_FLAG" ] && SHADOW_FLAG="0"

    GROUP_ID="$(echo "$TARGET_USER" | cut -d':' -f4)"
    [ ! "$(echo "${GROUP_IDS[@]}" | grep "$GROUP_ID")" ] && GROUP_IDS=("${GROUP_IDS[@]}" "$GROUP_ID")

    echo "dn: uid=$USER_ID,ou=people,$SUFFIX" >> $LDIF
    echo "objectClass: inetOrgPerson" >> $LDIF
    echo "objectClass: posixAccount" >> $LDIF
    echo "objectClass: shadowAccount" >> $LDIF
    echo "sn: $LDAP_SN" >> $LDIF
    echo "givenName: $(echo "$USER_NAME" | awk '{print $1}')" >> $LDIF
    echo "cn: $(echo "$USER_NAME" | awk '{print $1}')" >> $LDIF
    echo "displayName: $USER_NAME" >> $LDIF
    echo "uidNumber: $(echo "$TARGET_USER" | cut -d':' -f3)" >> $LDIF
    echo "gidNumber: $(echo "$TARGET_USER" | cut -d':' -f4)" >> $LDIF
    echo "userPassword: {crypt}$(grep "${USER_ID}:" /etc/shadow | cut -d':' -f2)" >> $LDIF
    echo "gecos: $USER_NAME" >> $LDIF
    echo "loginShell: $(echo "$TARGET_USER" | cut -d':' -f7)" >> $LDIF
    echo "homeDirectory: $(echo "$TARGET_USER" | cut -d':' -f6)" >> $LDIF
    echo "shadowExpire: $(passwd -S "$USER_ID" | awk '{print $7}')" >> $LDIF
    echo "shadowFlag: $SHADOW_FLAG" >> $LDIF
    echo "shadowWarning: $(passwd -S "$USER_ID" | awk '{print $6}')" >> $LDIF
    echo "shadowMin: $(passwd -S "$USER_ID" | awk '{print $4}')" >> $LDIF
    echo "shadowMax: $(passwd -S "$USER_ID" | awk '{print $5}')" >> $LDIF
    echo "shadowLastChange: $LASTCHANGE_FLAG" >> $LDIF
    echo >> $LDIF
done

for TARGET_GROUP_ID in "${GROUP_IDS[@]}"
do
    LDAP_CN="$(grep ":${TARGET_GROUP_ID}:" /etc/group | cut -d':' -f1)"

    echo "dn: cn=$LDAP_CN,ou=groups,$SUFFIX" >> $LDIF
    echo "objectClass: posixGroup" >> $LDIF
    echo "cn: $LDAP_CN" >> $LDIF
    echo "gidNumber: $TARGET_GROUP_ID" >> $LDIF

    for MEMBER_UID in $(grep ":${TARGET_GROUP_ID}:" /etc/passwd | cut -d':' -f1,3)
    do
        UID_NUM=$(echo "$MEMBER_UID" | cut -d':' -f2)
        [ $UID_NUM -ge 1000 -a $UID_NUM -le 9999 ] && echo "memberUid: $(echo "$MEMBER_UID" | cut -d':' -f1)" >> $LDIF
    done
    echo >> $LDIF
done
)

root@dlp:~#

bash ldapuser.sh

root@dlp:~#

ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif

Enter LDAP Password:

adding new entry "uid=ubuntu,ou=people,dc=srv,dc=world"

adding new entry "uid=redhat,ou=people,dc=srv,dc=world"

adding new entry "uid=debian,ou=people,dc=srv,dc=world"

adding new entry "uid=lunar,ou=people,dc=srv,dc=world"

adding new entry "cn=ubuntu,ou=groups,dc=srv,dc=world"

adding new entry "cn=redhat,ou=groups,dc=srv,dc=world"

adding new entry "cn=debian,ou=groups,dc=srv,dc=world"

adding new entry "cn=lunar,ou=groups,dc=srv,dc=world"

[3]	If you'd like to delete LDAP User or Group, Do like follows.

root@dlp:~#

ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "uid=lunar,ou=people,dc=srv,dc=world"

Enter LDAP Password:
root@dlp:~#

ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "cn=lunar,ou=groups,dc=srv,dc=world"

Enter LDAP Password:

Matched Content