I believe you're just deleting the user with that command but not all their entries from the OU. It's my understanding that LDAP doesn't maintain linkages with disparate objects like you're thinking, rather you're expected to do
ldapsearch's first to produce lists of objects that you then want to act on either using
We typically will write results from
.ldif files first and then act on them using
ldapdelete. You can however parse the output from
ldapsearch and pipe it to
ldapmodify as shown in this example from this U&L Q&A titled: ldapdelete, want to remove all UID's of people OU, but preserve OU?.
$ ldapsearch -ZZ -W -D 'cn=Manager,dc=site,dc=fake' \
-b 'ou=people,dc=site,dc=fake' -s one dn | \
grep dn: | cut -b 5- | ldapdelete -ZZ -W -D 'cn=Manager,dc=site,dc=fake'
I believe you'll need to do something similar, finding all the group's that the user is a
memberUid of, then pass that list to
ldapmodify, and then run your
ldapdelete command once they've been removed from all groups.
Incidentally to remove user's from a group:
With respect to the
.ldif files, the examples on this page titled: Managing Users with Lightweight Directory Access Protocol (LDAP) are excellent. They show how to do all the basic operations with
.ldif snippets which can be expanded upon to do operations across multiple objects.