The Google Secure LDAP Schema lists these two attributes as having default values:

  • homeDirectory: The user’s POSIX home directory. Defaults to “/home/< username>”.
  • loginShell: The user’s POSIX login shell. Defaults to “/bin/bash”.

Google Secure LDAP is read-only, going by this (emphasis mine):



  • Returned when a request specifies an unsupported action. Google supports AbandonBindExtended (for StartTLS), Search, and Unbind. Unsupported actions are: Add, Compare, Del, Modify, and ModifyDn.

This means that the usual ways of modifying login shells on LDAP (using chsh.ldap, or writing an LDIF file and applying it using ldapmodify, etc.) won't work (and they don't - I tried anyway).

I have gone through the various attributes I can modify for a user, and I don't see an entry for either setting. While the default home directory isn't a problem, users can be picky about their shells (I am too).

Given this is a "default", it seems it should be possible to set a non-default value. How can I do that?


1 Answer 1


I opened a ticket with Google since I needed this answer too. The answer is the users posixAccount with "posixAccounts[].systemId" set to empty string ("") and "posixAccounts[].primary" set to true will be the one seen in Google LDAPS. Update the settings using the update API. Request body for the update would be:

  "posixAccounts": [
      "username": "youruser",
      "homeDirectory": "/home/youruser",
      "shell": "/bin/bash",
      "primary": true,
      "operatingSystemType": "unspecified",
      "systemId": ""

I confirmed that the above is now seen with a ldapsearch on the same user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.