We are using an ldapmodify command to remove and add users to groups. It seems to work just fine.
printf "\tCreating code to delete the
group for: $CN\n"
printf "dn: cn=$CN,ou=resources,o=lwsnrmdata,o=lwsn,dc=domain\n" >> ${LDIF}
printf "changetype: modify\n" >> ${LDIF}
printf "delete: zzlwsnattrGroup\n" >> ${LDIF}
printf "zzlwsnattrGroup: \n" >> ${LDIF}
printf "\n\n" >> ${LDIF}
printf "\tCreating code to assign the group for: $CN\n\n"
printf "dn: cn=$CN,ou=resources,o=lwsnrmdata,o=lwsn,dc=domain\n" >> ${LDIF}
printf "changetype: modify\n" >> ${LDIF}
printf "add: zzlwsnattrGroup\n" >> ${LDIF}
printf "zzlwsnattrGroup: \n" >> ${LDIF}
printf "\n\n" >> ${LDIF}
Then
ldapmodify -D cn= -w -h -p 389 -v -c -f ${LDIF} >> ${LDIF}_log 2>&1
Feed in a list of user's to ${CN} and it works for us. We are using this to enable and disable the "New Hire" link for Benefit enrollment after the person has been hired for 30 days.