Is it possible to change the login shell on Google Secure LDAP?

Question

The Google Secure LDAP Schema lists these two attributes as having default values:

• homeDirectory: The user’s POSIX home directory. Defaults to “/home/< username>”.
• loginShell: The user’s POSIX login shell. Defaults to “/bin/bash”.

Google Secure LDAP is read-only, going by this (emphasis mine):

PROTOCOL_ERROR (2)

[...]

• Returned when a request specifies an unsupported action. Google supports Abandon, Bind, Extended (for StartTLS), Search, and Unbind. Unsupported actions are: Add, Compare, Del, Modify, and ModifyDn.

This means that the usual ways of modifying login shells on LDAP (using chsh.ldap, or writing an LDIF file and applying it using ldapmodify, etc.) won't work (and they don't - I tried anyway).

I have gone through the various attributes I can modify for a user, and I don't see an entry for either setting. While the default home directory isn't a problem, users can be picky about their shells (I am too).

Given this is a "default", it seems it should be possible to set a non-default value. How can I do that?

Notes:

• I do have super-admin privileges (necessary for enabling and configuring LDAP in the first place)
• I posted this on the G Suite Admin community forum as well.

Answer 1

I opened a ticket with Google since I needed this answer too. The answer is the users posixAccount with "posixAccounts[].systemId" set to empty string ("") and "posixAccounts[].primary" set to true will be the one seen in Google LDAPS. Update the settings using the update API. Request body for the update would be:

{
  "posixAccounts": [
    {
      "username": "youruser",
      "homeDirectory": "/home/youruser",
      "shell": "/bin/bash",
      "primary": true,
      "operatingSystemType": "unspecified",
      "systemId": ""
    }
  ]
}

I confirmed that the above is now seen with a ldapsearch on the same user.