Lin.DS.Op.SetProperty
Top  Previous  Next


Sets or edits Linux object operation properties

The Lin.DS.Op.SetProperty command can not be used on its own, it must always be used together with Lin.DS.Op.Init and Lin.DS.Op.Commit, see Lin.DS.Op.Init for more information.

Before using this command it is important to know about the objectclass property.

All objects in the directory has an objectclass property that holds information about which kind of object the object is. An organizational unit belongs to the "organizationalUnit" class, a group belongs to the "posixGroup" class and an account may belong to the "Account, "inetOrgPerson", "posixAccount" and "sambaAccount" classes.

Each object class defines a set of properties that the objects that belong to the class must or main contain. The class definitions can be found in the schema files (nis.schema, inetorgperson.schema, samba.schema etc.) pointed to by the OpenLDAP server configuration file slapd.conf.

Example: the following posixAccount declaration can be found in the /etc/openldap/schema/nis.schema file:

objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' SUP top AUXILIARY
   DESC 'Abstraction of an account with POSIX attributes'
   MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
   MAY ( userPassword $ loginShell $ gecos $ description ) )

This means that when creating an object that belongs to posixAccount, all of cn, uid, uidNumber, gidNumber and homeDirectory MUST be defined. userPassword, loginShell, gecos and description may be defined. If the object only belongs to the posixAccount you will not be able to set any other properties than these.

Notice that some values will be declared more than once for some objects, for instance for account objects, "cn" is usually set to same value as "uid".

Requirements
·Linux server with OpenLDAP 2.0 or higher, configured to accept SSL connections on port 636.  
·A locally installed SSL certificate.  

Category
Linux

Script section
All

Lin.DS.Op.SetProperty PropertyName, Value

PropertyName
Name of property to set  
 
See table 1-6 below for information about some common properties  

Value
New value for property  
 
Use the paragraph character ("§") to delimit multiple values for multi-valued properties  

Table 1 - general properties
PropertyName
Comment
objectclass
Object class. An object can belong to more than one object class. Use paragraph characters ("§") to delimit multiple classes. The objectclass property can usually not be modified after an object has been created, therefore, be careful to examine exactly which classes your application needs before creating a large number of objects.


Table 2 - common Linux user account properties (objectclass='posixAccount')
PropertyName
Comment
cn
User name (same as uid), must be unique, Lin.DS.Op.SetProperty will stop with an error if not
gecos
Full name

Notice: If you enter national characters (ascii code 128 and higher) in this attribute and get the error message "Invalid Syntax (#0) - gecos: value #0 invalid per syntax.", you probably need to modify the gecos definition in the nis.schema file to something like this:

attributetype ( 1.3.6.1.1.1.1.2 NAME 'gecos'
   DESC 'The GECOS field; the common name'
   EQUALITY caseIgnoreMatch
   SUBSTR caseIgnoreSubstringsMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )

Remember to restart the LDAP server after modifying the schema.
gidNumber
Linux primary group number or name, Lin.DS.Op.SetProperty will stop with an error if a non-existing group is specified
homeDirectory
Linux home directory
loginShell
Linux logon shell
uid
User name (same as cn), must be unique, Lin.DS.Op.SetProperty will stop with an error if not

Warning: do not rename objects by changing uid with Lin.DS.Op.SetProperty, this will make uid out of sync with the dn, instead use Lin.DS.OU.MoveObject
uidNumber
Linux user id number, must be unique, Lin.DS.Op.SetProperty will stop with an error if not

Specify "Auto" in value parameter to automatically use next available number higher than 1000 (generated value stored in %LinuxUidNumber% variable)
userPassword
Linux password for systems using NSS/PAM LDAP, the SHA hash of the password is stored
userPasswordHash
Linux password hash, use this attribute as destination when moving hashes between systems

Supported hash types: any that destination OS supports


Table 3 - common directory properties (objectclass='inetOrgPerson')
PropertyName
Comment
givenName
First name
homePhone
Home Phone
initials
Initials
mail
Mail
sn
Last name


Table 4 - common Samba 2.2.x user account properties (objectclass='sambaAccount')
PropertyName
Comment
acctFlags
Account flags, 11-character string surrounded by [ ], U=user account, W=workstation account, D=disabled, X=no password expiration, check Samba documentation for more information
homeDrive
Drive letter to which to map smbHome
lmPassword
Lanman password, for users who logs on from non-NT clients (Windows 95, 98, ME)

Warning! Lanman passwords are weak, do not set lmPassword unless you have a client that requires it
lmPasswordHash
Lanman password hash, use this attribute as destination when moving hashes between systems
ntPassword
NT password, for users who logs on from NT clients (NT, 2000, XP, 2003)
ntPasswordHash
NT password hash, use this attribute as destination when moving hashes between systems
primaryGroupID
Relative identifier or name of primary group, Lin.DS.Op.SetProperty will stop with an error if a non-existing group is specified
profilePath
User profile path
pwdCanChange
User can change password, 0 to clear or 2147483647 to set
pwdMustChange
User must change password, 0 to clear or 2147483647 to set
rid
Relative identifier of user, must be unique, Lin.DS.Op.SetProperty will stop with an error if not

Specify "Auto" in value parameter to automatically calculate from (2*uid)+1000

Use BuildRID to calculate yourself
scriptPath
Script path, relative to netlogon share
smbHome
Home directory path


Table 5 - common Samba 3.0 user account properties (objectclass='sambaSamAccount')
PropertyName
Comment
sambaAcctFlags
Account flags, string surrounded by [ ], U=user account, W=workstation account, D=disabled, X=no password expiration, check Samba documentation for more information
sambaHomeDrive
Drive letter to which to map smbHome
sambaHomePath
Home directory path
sambaLMPassword
Lanman password, for users who logs on from non-NT clients (Windows 95, 98, ME)

Warning! Lanman passwords are weak, do not set lmPassword unless you have a client that requires it
sambaLMPasswordHash
Lanman password hash, use this attribute as destination when moving hashes between systems
sambaLogonScript
Script path, relative to netlogon share
sambaNTPassword
NT password, for users who logs on from NT clients (NT, 2000, XP, 2003)
sambaNTPasswordHash
NT password hash, use this attribute as destination when moving hashes between systems
sambaPrimaryGroupSID
SID or name of primary group, Lin.DS.Op.SetProperty will stop with an error if a non-existing group is specified
sambaProfilePath
User profile path
sambaPwdCanChange
User can change password, 0 to clear or 2147483647 to set
sambaPwdMustChange
User must change password, 0 to clear or 2147483647 to set
sambaSID
User SID, must be unique, Lin.DS.Op.SetProperty will stop with an error if not

Specify "Auto" in value parameter to automatically build from domain SID and (2*uid)+1000

Use BuildRID to build yourself


Table 6 - group properties (objectclass='posixGroup')
PropertyName
Comment
cn
Group name, must be unique, Lin.DS.Op.SetProperty will stop with an error if not
gidNumber
Linux group id number, must be unique, Lin.DS.Op.SetProperty will stop with an error if not

Specify "Auto" in value parameter to automatically use next available number higher than 600
memberUid
List of member objects, can be managed with Lin.DS.Group.AddObject and Lin.DS.Group.RemoveObject


Examples
1) Create OU MyOU

Lin.DS.Op.Init Create, dc=com/dc=my-domain/ou=MyOU   
Lin.DS.Op.SetProperty objectClass, organizationalUnit   
Lin.DS.Op.SetProperty ou, MyOU   
Lin.DS.Op.Commit

(Normally you should use
Lin.DS.OU.Create dc=com/dc=my-domain/ou=MyOU
instead, but the above code is useful if you need to specify additional object classes etc.)

2) Create group MyGroup in OU MyOU

Lin.DS.Op.Init Create, dc=com/dc=my-domain/ou=MyOU/cn=MyGroup   
Lin.DS.Op.SetProperty objectClass, posixGroup   
Lin.DS.Op.SetProperty cn, MyGroup   
Lin.DS.Op.SetProperty gidNumber, Auto   
Lin.DS.Op.Commit

(Normally you should use
Lin.DS.Group.Create dc=com/dc=my-domain/ou=MyOU/cn=MyGroup
instead, but the above code is useful if you need to specify additional object classes etc.)

3) Create Linux account in OU People and set group membership to group with ID 100

Lin.DS.Op.Init Create, dc=com/dc=my-domain/ou=People/uid=MyAccount   
Lin.DS.Op.SetProperty objectClass, Account§posixAccount§   
Lin.DS.Op.SetProperty uid, MyAccount   
Lin.DS.Op.SetProperty cn, MyAccount   
Lin.DS.Op.SetProperty userPassword, Password   
Lin.DS.Op.SetProperty gidNumber, 100   
Lin.DS.Op.SetProperty uidNumber, Auto   
Lin.DS.Op.SetProperty homeDirectory, /home/MyAccount   
Lin.DS.Op.SetProperty loginShell, /bin/bash      
Lin.DS.Op.SetProperty gecos, Full Name   
Lin.DS.Op.Commit

4) Create Linux and Samba 2.2.x account (see table 5 above for Samba 3.0 properties)

Lin.DS.Op.Init Create, dc=com/dc=my-domain/ou=People/uid=MyAccount   
Lin.DS.Op.SetProperty objectClass, Account§posixAccount§sambaAccount§   
// posixAccount attrs   
Lin.DS.Op.SetProperty uid, MyAccount   
Lin.DS.Op.SetProperty cn, MyAccount   
Lin.DS.Op.SetProperty userPassword, Password   
Lin.DS.Op.SetProperty gidNumber, 100   
Lin.DS.Op.SetProperty uidNumber, Auto   
Lin.DS.Op.SetProperty homeDirectory, /home/MyAccount   
Lin.DS.Op.SetProperty loginShell, /bin/bash      
Lin.DS.Op.SetProperty gecos, Full Name   
// sambaAccount attrs   
Lin.DS.Op.SetProperty rid, Auto   
Lin.DS.Op.SetProperty ntPassword, Password   
Lin.DS.Op.SetProperty smbHome, \\SAMBAPDC\MyAccount   
Lin.DS.Op.SetProperty homeDrive, H:   
Lin.DS.Op.SetProperty scriptPath, MyScript.cmd   
Lin.DS.Op.SetProperty profilePath, \\SAMBAPDC\MyProfile   
Lin.DS.Op.SetProperty primaryGroupID, 100   
Lin.DS.Op.SetProperty acctFlags, [UX         ]   
Lin.DS.Op.Commit

5) Change home directory and gidNumber for above account

Lin.DS.Op.Init Modify, dc=com/dc=my-domain/ou=People/uid=MyAccount   
Lin.DS.Op.SetProperty homeDirectory, /home3/MyAccount   
Lin.DS.Op.SetProperty gidNumber, 600   
Lin.DS.Op.Commit

6) Change/set Linux and Samba password for above account

Lin.DS.Op.Init Modify, dc=com/dc=my-domain/ou=People/uid=MyAccount   
// Linux   
Lin.DS.Op.SetProperty userPassword, NewPassword   
// Samba   
Lin.DS.Op.SetProperty ntPassword, NewPassword   
Lin.DS.Op.Commit

Full examples
·Various Linux examples  
·Transfer accounts including passwords between Linux, Novell and Windows