Nick Sabine

Script to add users to LDAP

I have a cluster of servers that manage user authentication and group membership in OpenLDAP. The OpenLDAP clients support adding users by importing LDIF files to create the user and set appropriate group membership. I find this process a little annoying and typically find myself sloppily managing template LDIF files. I wrote the following script to simplify the process.

  1. #!/bin/bash
  2. #
  3. # add_user.sh: Add user to LDAP
  4. # Author: Nick Sabine
  5. #
  6.  
  7. # Defaults
  8. LDAP_BASE="dc=ORG,dc=local"
  9. LDAP_ACCOUNTS_DN="ou=people,${LDAP_BASE}"
  10. LDAP_USER_GROUP="cn=user_group,ou=groups,${LDAP_BASE}"
  11. LDAP_ADMIN_GROUP="cn=admin_group,ou=groups,${LDAP_BASE}"
  12. LDAP_BIND_DN="cn=Manager,${LDAP_BASE}"
  13. USER_NAME=
  14. USER_CN=
  15. USER_SN=
  16. USER_ID=
  17. GROUP_ID=1000
  18. IS_ADMIN=
  19. LDAP_OPTIONS=
  20.  
  21. usage()
  22. {
  23. cat << EOF
  24. usage $0 options
  25.  
  26. This script creates a user in LDAP
  27.  
  28. OPTIONS
  29.   -h         Show this message
  30.   -n   Username
  31.   -c     User CN
  32.   -s     User SN
  33.   -i    User ID Number (default: next available number)
  34.   -g    Primary group ID Number (default: $GROUP_ID)
  35.   -a         Add user to administrator group
  36.   -D         LDAP Bind DN (default: $LDAP_BIND_DN)
  37.   -b         LDAP Base (default: $LDAP_BASE)
  38.   -P         LDAP Accounts DN (default: $LDAP_ACCOUNTS_DN)
  39.   -U         LDAP User Group DN (default: $LDAP_USER_GROUP)
  40.   -A         LDAP Admin Group DN (default: $LDAP_ADMIN_GROUP)
  41.   -t         Test. Show what would be done, but don’t actually modify LDAP.
  42. EOF
  43. }
  45. error_ldap() {
  46.   echo "Error: Error connecting to LDAP or uninitialized user tree"
  47. }
  49. while getopts "hn:c:s:i:g:aD:b:P:U:A:t" OPTION
  50. do
  51.   case $OPTION in
  52.     h)
  53.       usage
  54.       exit 1
  55.       ;;
  56.     n)
  57.       USER_NAME=$OPTARG
  58.       ;;
  59.     c)
  60.       USER_CN=$OPTARG
  61.       ;;
  62.     s)
  63.       USER_SN=$OPTARG
  64.       ;;
  65.     i)
  66.       USER_ID=$OPTARG
  67.       ;;
  68.     g)
  69.       GROUP_ID=$OPTARG
  70.       ;;
  71.     a)
  72.       IS_ADMIN=1
  73.       ;;
  74.     D)
  75.      LDAP_BIND_DN=$OPTARG
  76.      ;;
  77.     b)
  78.      LDAP_BASE=$OPTARG
  79.      ;;
  80.     P)
  81.      LDAP_ACCOUNTS_DN=$OPTARG
  82.      ;;
  83.     U)
  84.       LDAP_USER_GROUP=$OPTARG
  85.       ;;
  86.     A)
  87.       LDAP_ADMIN_GROUP=$OPTARG
  88.       ;;
  89.     t)
  90.       LDAP_OPTIONS+=" -n "
  91.       ;;
  92.     ?)
  93.       usage
  94.       exit
  95.       ;;
  96.   esac
  97. done
  99. if [ -z $USER_NAME        ] ||
  100.    [ -z $USER_CN          ] ||
  101.    [ -z $USER_SN          ] ||
  102.    [ -z $GROUP_ID         ] ||
  103.    [ -z $LDAP_BIND_DN     ] ||
  104.    [ -z $LDAP_ACCOUNTS_DN ] ||
  105.    [ -z $LDAP_USER_GROUP  ] ||
  106.    [ -z $LDAP_ADMIN_GROUP ]
  107. then
  108.   usage
  109.   exit 1
  110. fi
  112. read -p "LDAP Manager Password: " -s LDAPPASS
  113. echo
  115. # If USER_ID not supplied, find next using ldap query
  116. if [ -z $USER_ID ]
  117. then
  118.   HIGHEST_UID=$(ldapsearch -x -w "$LDAPPASS" -b "${LDAP_ACCOUNTS_DN}" -D "${LDAP_BIND_DN}" "(objectclass=posixaccount)" uidnumber | grep -e '^uid' | cut -d':' -f2 | sort | tail -1)
  119.   if [ -z $HIGHEST_UID ]
  120.   then
  121.     error_ldap
  122.     exit 1
  123.   fi
  124.   let USER_ID=HIGHEST_UID+1
  125. fi
  127. read -p "${USER_NAME} Initial Password: " -s USER_CLEARTEXT_PASS
  128. echo
  130. USER_PASS=$(slappasswd -h {SSHA} -s $USER_CLEARTEXT_PASS)
  132. unset USER_CLEARTEXT_PASS
  134. CHANGE_DATE=$(echo "$(date +%s) / ( 60 * 60 * 24 )" | bc)
  136. LDIF=$(cat << EOF
  137. dn: uid=${USER_NAME},${LDAP_ACCOUNTS_DN}
  138. changetype: add
  139. uid: ${USER_NAME}
  140. cn: ${USER_CN}
  141. sn: ${USER_SN}
  142. objectClass: inetOrgPerson
  143. objectClass: posixAccount
  144. objectClass: top
  145. objectClass: shadowAccount
  146. userPassword: ${USER_PASS}
  147. shadowLastChange: ${CHANGE_DATE}
  148. shadowMax: 99999
  149. shadowWarning: 7
  150. loginShell: /bin/bash
  151. uidNumber: ${USER_ID}
  152. gidNumber: ${GROUP_ID}
  153. homeDirectory: /home/${USER_NAME}
  155. dn: ${LDAP_USER_GROUP}
  156. changetype: modify
  157. add: memberuid
  158. memberuid: ${USER_NAME}
  160. EOF
  161. )
  163. if [ $IS_ADMIN ]
  164. then
  165.   LDIF+=$(cat << EOF
  167. dn: ${LDAP_ADMIN_GROUP}
  168. changetype: modify
  169. add: memberuid
  170. memberuid: ${USER_NAME}
  172. EOF
  173. )
  174. fi
  176. echo "--------------------"
  177. echo "Adding ${LDIF}"
  178. echo "--------------------"
  179. echo "$LDIF" | ldapmodify -x -w "$LDAPPASS" -D "${LDAP_BIND_DN}" $LDAP_OPTIONS
  181. unset LDAPPASS
https://gist.github.com/nsabine/6599630
comments powered by Disqus