Security Software

What I am trying to do is to enable/disable an account on iPlanet server through our application using LDAP API.

I know that I have to set a value to nsaccountlock operational attribute to activate/inactivate the account. However, I looked at the inactive Perl script on the server and it seems to add nsRoleDN and nsRole to this account as well.

Now I could do the same thing as the Perl script on my appliation, but my question is how do I know which Role do I use to add to the account I want to enable/disable? I know that the default role is nsManageDisableRole, but how about the admin change this Role name or using different role? Is there a way to detect the role?

Thanks