LDAPMODIFY(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

✨ LDAPMODIFY(1) ✨

okay bestie, welcome to the General Commands Manual page for ldapmodify 💅 this is the manual-name glow-up moment — yes, the section number is 1 because she's a user command. Sit down, grab a boba, and let's get you fluent in LDAP in like ten minutes. 🧚

🌸 NAME 🌸

ldapmodify, ldapadd — the LDAP modify entry and LDAP add entry tools. That's it, that's the whole vibe: she modifies, she adds, she serves. 👑

🦋 SYNOPSIS 🦋

ldapmodify [-V[V]] [-d debuglevel] [-n] [-v] [-a] [-c] [-f file]
[-i time] [-j lineno] [-S file] [-M[M]] [-x] [-D binddn] [-W]
[-w passwd] [-y passwdfile] [-H ldapuri] [-P {2|3}]
[-e [!]ext[=extparam]] [-E [!]ext[=extparam]] [-o opt[=optparam]]
[-O security-properties] [-I] [-Q] [-N] [-U authcid] [-R realm]
[-X authzid] [-Y mech] [-Z[Z]]

ldapadd [-V[V]] [-d debuglevel] [-n] [-v] [-c] [-f file] [-i time]
[-j lineno] [-S file] [-M[M]] [-x] [-D binddn] [-W] [-w passwd]
[-y passwdfile] [-H ldapuri] [-P {2|3}] [-e [!]ext[=extparam]]
[-E [!]ext[=extparam]] [-o opt[=optparam]] [-O security-properties] [-I]
[-Q] [-N] [-U authcid] [-R realm] [-X authzid] [-Y mech] [-Z[Z]]

notice how ldapadd is missing -a? that's not a typo bestie, that's lore. keep reading. 🙈

💖 DESCRIPTION 💖

ldapmodify is a shell-accessible interface to the ldap_add_ext(3), ldap_modify_ext(3), ldap_delete_ext(3) and ldap_rename(3) library calls. (the original page has a stray period after "calls" and honestly? she ate, we're keeping her iconic punctuation. ✨)

ldapadd is implemented as a hard link to the ldapmodify tool. And when you invoke it as ldapadd, the -a (add new entry) flag is turned on automatically. That's the whole plot twist — same binary, different name, different main-character energy. 💅

So what does she actually do? ldapmodify opens a connection to an LDAP server, binds, and then modifies or adds entries. The entry information gets read from standard input, or from a file if you use the -f option. That's the tea. 🍓

🔥 OPTIONS 🔥

okay queen, this is the long part. every single flag, no skips, no summaries, we're doing this properly. 🌈

  • -V[V] — Print version info. If you pass -VV, only the version information is printed. (yes, only screaming -VV gets you the pure version drip.) ⭐
  • -d debuglevel — Set the LDAP debugging level to debuglevel. Heads up though: ldapmodify must be compiled with LDAP_DEBUG defined for this option to have any effect. no define, no debug tea. 💀
  • -n — Show what would be done, but don't actually modify entries. Super useful for debugging when you pair it with -v. it's giving ✨window shopping✨
  • -v — Use verbose mode, with many diagnostics written to standard output. she will not stop talking and that's on purpose.
  • -a — Add new entries. The default for ldapmodify is to modify existing entries, so this flips the script. And if you invoked the tool as ldapadd, this flag is always set. 🫶
  • -c — Continuous operation mode. Errors are reported, but ldapmodify will keep going with the modifications. The default is to exit right after reporting an error. so -c is the "we don't stop, we don't quit" flag. 🔥
  • -f file — Read the entry modification information from file instead of from standard input. 💖
  • -i time — Wait time microseconds before issuing an operation. tiny lil breather between ops. 🌸
  • -j lineno — Jump to the specified line number in the LDIF file before processing any entries. This lets you resume a load that got aborted by errors in the input LDIF, once you've fixed the errors. it's the "rewind and retry" button. 🎀
  • -S file — Add or change records which were skipped due to an error get written to file, and the error message returned by the server gets added as a comment. Most useful when paired with -c. lowkey the receipts file. 🧾
  • -M[M] — Enable manage DSA IT control. -MM makes the control critical. (one M = chill, two M = serious 👑)
  • -x — Use simple authentication instead of SASL. no fancy mechanisms, just vibes.
  • -D binddn — Use the Distinguished Name binddn to bind to the LDAP directory. For SASL binds, the server is expected to ignore this value. 🙈
  • -W — Prompt for simple authentication. This is used instead of specifying the password on the command line. safer, cuter, better. 💜
  • -w passwd — Use passwd as the password for simple authentication. (it's right there in your shell history, bestie, be careful 😭)
  • -y passwdfile — Use the complete contents of passwdfile as the password for simple authentication.
  • -H ldapuri — Specify URI(s) referring to the ldap server(s). Only the protocol/host/port fields are allowed, and a list of URI separated by whitespace or commas is expected. 👯‍♀️ servers, plural, it's a party.
  • -P {2|3} — Specify the LDAP protocol version to use. pick your era: 2 or 3. ✨
  • -e [!]ext[=extparam]
  • -E [!]ext[=extparam]

Specify general extensions with -e and modify extensions with -E. The ! character indicates criticality. ok so here's the whole menu:

General extensions:

[!]assert=<filter>    (an RFC 4515 Filter)
!authzid=<authzid>    ("dn:<dn>" or "u:<user>")
[!]bauthzid           (RFC 3829 authzid control)
[!]chaining[=<resolve>[/<cont>]]
[!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>] (a comma-separated attribute list)
[!]preread[=<attrs>]  (a comma-separated attribute list)
[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)

Modify extensions:

[!]txn[=abort|commit]

and yes, the original literally says the abandon/cancel/ignore trio is "not really controls" and we respect that honesty 🌈

  • -o opt[=optparam]] — Specify any ldap.conf(5) option, or one of these:
nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)

(the double bracket at the end of the flag? that's exactly how the original page writes it, so we keep it, character for character, periodt 💅)

  • -O security-properties — Specify SASL security properties. 🔐
  • -I — Enable SASL Interactive mode. Always prompt. The default is to prompt only as needed. needy on purpose. 🥺
  • -Q — Enable SASL Quiet mode. Never prompt. she said 🤐
  • -N — Do not use reverse DNS to canonicalize SASL host name. skip the lookup, save the time. ⚡
  • -U authcid — Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used. 🦋
  • -R realm — Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used. ✨
  • -X authzid — Specify the requested authorization ID for SASL bind. authzid must be one of these formats: dn:<distinguished name> or u:<username>. no other formats, she's strict about this one. 👑
  • -Y mech — Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows. let her pick, she's got taste. 💖
  • -Z[Z] — Issue StartTLS (Transport Layer Security) extended operation. If you use -ZZ, the command will require the operation to be successful. one Z = "please", two Z = "I said what I said". 🔒

🎀 INPUT FORMAT 🎀

The contents of file (or standard input, if no -f flag is given on the command line) must conform to the format defined in ldif(5) — that's LDIF as defined in RFC 2849. no custom formats, no freestyle, she follows the spec. 🧚

👑 EXAMPLES 👑

let's actually do the thing, bestie. 💅

replacing, adding, and deleting attributes

Say the file /tmp/entrymods exists and has these contents:

dn: cn=Modify Me,dc=example,dc=com
changetype: modify
replace: mail
mail: modme@example.com
-
add: title
title: Grand Poobah
-
add: jpegPhoto
jpegPhoto:< file:///tmp/modme.jpeg
-
delete: description
-

then this command:

ldapmodify -f /tmp/entrymods

will replace the contents of the "Modify Me" entry's mail attribute with the value "modme@example.com", add a title of "Grand Poobah", add the contents of the file "/tmp/modme.jpeg" as a jpegPhoto, and completely remove the description attribute. one command, four glow-ups. ✨

adding a whole new entry

Say /tmp/newentry exists with these contents:

dn: cn=Barbara Jensen,dc=example,dc=com
objectClass: person
cn: Barbara Jensen
cn: Babs Jensen
sn: Jensen
title: the world's most famous mythical manager
mail: bjensen@example.com
uid: bjensen

then this command:

ldapadd -f /tmp/newentry

will add a new entry for Babs Jensen, using the values from the file /tmp/newentry. new entry, who dis. 🌸

deleting an entry

Say /tmp/entrymods exists with these contents:

dn: cn=Barbara Jensen,dc=example,dc=com
changetype: delete

then this command:

ldapmodify -f /tmp/entrymods

will remove Babs Jensen's entry. she's gone, bestie. she was here, and now she is not. 💀

🌈 DIAGNOSTICS 🌈

Exit status is zero if no errors occur. Errors result in a non-zero exit status, and a diagnostic message gets written to standard error. so if your script's $? isn't 0, something went sideways. check stderr, she told you what happened. 👀

💜 SEE ALSO 💜

ldapadd(1), ldapdelete(1), ldapmodrdn(1), ldapsearch(1), ldap.conf(5), ldap(3), ldap_add_ext(3), ldap_delete_ext(3), ldap_modify_ext(3), ldap_modrdn_ext(3), ldif(5).

(the whole friend group, go say hi 🫶)

⭐ AUTHOR ⭐

The OpenLDAP Project <http://www.openldap.org/>

🦋 ACKNOWLEDGEMENTS 🦋

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. shoutout to the ancestors, we love a legacy. 💖

lowkey reminder: -w passwd puts your password straight in the command line, and the manpage itself says -W exists as the "instead of" option. choose wisely, bestie. 🙈

okay that's the whole page, you're officially fluent, go modify some entries. this manual was brought to you by OpenLDAP 2.7.2, dated 2026/10/21 — and honestly? she's iconic. 💅✨🎀

📦 where this page comes from