Updating Unix system users into LLDAP with SSSD #1121

TheRustifyer · 2025-03-03T19:43:33Z

TheRustifyer
Mar 3, 2025

Hi there! And excuse me before all since I am really new to LLDAP, and LDAP in general.

I successfully run LLDAP and can add users and manage things as expected. But one thing that I'd like is to automatically load the users on my Raspberry 5 into LLDAP.

Since I am running Manjaro ARM, I went with SSSD, which cause me a lot of work to get it work with LLDAP, but finally everything is set up.

Since I assume that there's no automagic migration, I wrote a simple bash script that populates the LLDAP db with my system users.

┌─>   vv at  raspy in @192.168.10.62 ~ via  v3.13.1
❯ sudo cat lldap_users_sync.sh
[sudo] password for vv:
#!/bin/bash

# Variables
BASE_DN="ou=people,dc=raspy,dc=local"           # Change this to your LLDAP base DN
ADMIN_DN="uid=admin,$BASE_DN"          # LLDAP admin DN
LDAP_URI="ldaps://xxx:6360"           # Change if using a different LDAP server
PASSWORD="xxx"   # LLDAP admin password
LDAP_BASE_ADMIN_CALL="ldapsearch -x -H $LDAP_URI -D $ADMIN_DN -w $PASSWORD -b $BASE_DN"

# Loop through /etc/passwd and add users
while IFS=: read -r username _ uid gid fullname _; do
    if [ "$uid" -ge 1000 ]; then      # Avoid system users (usually UID 0-999)
        echo "Adding user: $username (UID: $uid, GID: $gid)"

        # Check if the user already exists by uid (for user_id conflict)
        user_exists=$($LDAP_BASE_ADMIN_CALL "(uid=$username)" | grep -c "^dn: ")
        echo "Exists $username? => $user_exists"
        if [ "$user_exists" -gt 0 ]; then
            echo "User $username already exists, skipping."
            continue
        else
            echo "User $username not found on the LLDAP database. Going ahead..."
        fi

        # Check for existing email in the GECOS field (if present), or use a default email
        email=$(echo "$fullname" | grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,6}')
        if [ -z "$email" ]; then
            email="${username}@raspy.local"  # Default email if none found
        fi

        # Check if the email is unique (for lowercase_email conflict)
        email_exists=$($LDAP_BASE_ADMIN_CALL "(mail=$email)" | grep -c "^dn: ")
        if [ "$email_exists" -gt 0 ]; then
            echo "Email $email already exists for another user, skipping user $username."
            continue
        fi

        # Add user to LLDAP without password
        ldapadd -x -H "$LDAP_URI" -D "$ADMIN_DN" -w "$PASSWORD" <<EOF
dn: uid=$username,$BASE_DN
objectClass: inetOrgPerson
objectClass: posixAccount
uid: $username
cn: $fullname
sn: $fullname
mail: $email
uidnumber: $uid
gidnumber: $gid
homedirectory: /home/$username
loginshell: /bin/zsh
EOF
        echo "User $username created in LLDAP."
    fi
done < /etc/passwd

The issues starts here. I created several new user attributes on my installation.

And they appear on my users. When I launch the script, it correctly adds the system users to LLDAP, but none of the custom attributes.

But if I add them from the web ui, I can query them and retrieve them with ldapsearch without problem.

Could I get some help figuring out what's wrong? Probably tomorrow will be another day and I could figure out more things, but I spent lots of hours between yesterday and today and I am kinda exhausted.

First of all, is this "doable"?
I also saw the bootstrap script. I assume that I could have a script that converts the users into the required json files, but that w'd be annoying to deal with when I create more users.

Thanks to anyone interested in helping me for your time! :)

nitnelave · 2025-03-03T19:49:26Z

nitnelave
Mar 3, 2025
Maintainer

Hey! The LDAP integration, when it comes to writing new information (creating users and so on) is barebones.
For scripting in particular, I would recommend using lldap-cli. See also docs/scripting.md

2 replies

TheRustifyer Mar 3, 2025
Author

Nice point! I am checking it out.
Just a quick doubt. What w'd be the difference between ldapadd and lldap-cli for adding those custom attribute values?

Sorry 'bout my ignorance

nitnelave Mar 3, 2025
Maintainer

Ldapadd uses the LDAP interface, whereas lldap-cli uses our GraphQL interface (what powers the frontend)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Updating Unix system users into LLDAP with SSSD #1121

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Updating Unix system users into LLDAP with SSSD #1121

Uh oh!

Uh oh!

TheRustifyer Mar 3, 2025

Replies: 1 comment · 2 replies

Uh oh!

nitnelave Mar 3, 2025 Maintainer

Uh oh!

TheRustifyer Mar 3, 2025 Author

Uh oh!

nitnelave Mar 3, 2025 Maintainer

TheRustifyer
Mar 3, 2025

Replies: 1 comment 2 replies

nitnelave
Mar 3, 2025
Maintainer

TheRustifyer Mar 3, 2025
Author

nitnelave Mar 3, 2025
Maintainer