IBM Directory Server(LDAP)：如何通过LDIF文件添加用户到组

Hey Borna, let's break down exactly what you need in that LDIF file to add a user to your group cn=group1,ou=Groups,dc=mydom,dc=com. Since you already have changetype: modify, here's the rest of the required content and how to structure it properly:

Key Components to Include #

• The Group's Distinguished Name (DN)
  You must start the LDIF with the full DN of the group you're modifying. This tells LDAP exactly which entry you're targeting.
• The add Operation Directive
  Since you're adding a user to the group, use the add directive to specify which membership attribute you're updating. IBM Directory Server typically uses either member (for groupOfNames object class groups) or uniqueMember (for groupOfUniqueNames object class groups)—double-check your group's object class to confirm which one applies.
• The User's Full DN
  List the complete DN of the user you want to add as the value of the membership attribute. If you're adding multiple users, you can include multiple lines of the same attribute.

Complete LDIF Example #

Here's a working example using the member attribute (swap it for uniqueMember if your group uses that):

dn: cn=group1,ou=Groups,dc=mydom,dc=com
changetype: modify
add: member
member: uid=jdoe,ou=Users,dc=mydom,dc=com
member: uid=asmith,ou=Users,dc=mydom,dc=com  # Optional: Add multiple users in one modification

Important Tips #

• User Existence: The user's DN must already exist in the directory—LDAP will throw an error if you try to add a non-existent user to the group.
• Permissions: Ensure the account you use to run the ldapmodify command has write access to the group entry.
• Multiple Actions in One LDIF: If you need to add and remove users in the same file, separate actions with a hyphen (-), like this:

  dn: cn=group1,ou=Groups,dc=mydom,dc=com
  changetype: modify
  add: member
  member: uid=jdoe,ou=Users,dc=mydom,dc=com
  -
  delete: member
  member: uid=olduser,ou=Users,dc=mydom,dc=com
  

Applying the LDIF #

Run this command (replace the admin DN and password with your own credentials):

ldapmodify -D cn=admin,dc=mydom,dc=com -w your_admin_password -f your_group_modify.ldif

内容的提问来源于stack exchange，提问作者borna