LDAPDELETE(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 LDAPDELETE — the ldapdelete entry-deletion tool, bestie edition 💖

okay so welcome to LDAPDELETE(1) from the General Commands Manual, and bestie, this one is so useful once it clicks. it's the lil command-line bestie that goes into your LDAP directory and yeets entries out of existence. powerful? yes. dangerous if you're sloppy? also yes. let's go. ✨

🌸 NAME 🌸

ldapdelete — LDAP delete entry tool. that's it, that's the whole vibe. it deletes entries. 🗑️

🎀 SYNOPSIS 🎀

ldapdelete [-V[V]] [-d debuglevel] [-n] [-v] [-c] [-f file] [-r]
[-z sizelimit] [-M[M]] [-x] [-D binddn] [-W] [-w passwd] [-y passwdfile]
[-H ldapuri] [-P {2|3}] [-e [!]ext[=extparam]] [-E [!]ext[=extparam]]
[-o opt[=optparam]] [-O security-properties] [-I] [-Q] [-N] [-U authcid]
[-R realm] [-X authzid] [-Y mech] [-Z[Z]] [DN [...]]

yes, that's a lot of flags. no, you don't need all of them. yes, we're gonna go through every single one anyway because that's the assignment. 💅

🦋 DESCRIPTION 🦋

so ldapdelete is a shell-accessible interface to the ldap_delete_ext(3) library call. meaning: all that fancy library energy, but you get to just type it in your terminal like a normal person. iconic behavior honestly.

here's the flow: ldapdelete opens a connection to an LDAP server, binds, and deletes one or more entries. ✨

if you hand it one or more DN arguments, it deletes the entries with those Distinguished Names. and heads up — each DN should be given using the LDAPv3 string representation as defined in RFC 4514. no freestyling the format, bestie, the server will NOT be charmed by your creativity.

if you give it no DN arguments at all? it reads a list of DNs from standard input instead — or from file if you used the -f flag. super chill. 🌈

👑 OPTIONS 👑

every flag, in order, no skips, no shortcuts. let's get into it. 💜

  • -V[V] — print version info. and if you go full -VV, it prints only the version information, nothing else. minimalism era.
  • -d debuglevel — sets the LDAP debugging level to debuglevel. important caveat though: ldapdelete must be compiled with LDAP_DEBUG defined for this option to have any effect. so if it's doing nothing, that's why, don't come for me. 🫶
  • -n — shows you what would be done but does not actually delete entries. a dry run, basically. super useful for debugging, especially if you pair it with -v. please use this before you do something unhinged.
  • -v — verbose mode. lots and lots of diagnostics written to standard output. chatty. we love a yapper. 😭
  • -c — continuous operation mode. errors get reported, but ldapdelete will keep going with the deletions. the default is to exit after reporting an error, so this flag is you saying "keep moving, bestie, we'll deal with it later".
  • -f file — read a series of DNs from file, one per line, and do an LDAP delete for each one. bulk delete energy.
  • -r — recursive delete. if the DN you specified isn't a leaf, its children, and all their children, get deleted down the tree.
🚨 okay so listen. no verification is done. if you add this switch, ldapdelete will happily delete large portions of your tree. happily. with zero remorse. use with care. this is the "main character energy" flag but for destroying your own directory. 😭
  • -z sizelimit — use sizelimit when searching for children DN to delete, so you can circumvent any server-side size limit. only useful in conjunction with -r, so don't bother otherwise. 💅
  • -M[M] — enable the manage DSA IT control. and -MM makes the control critical. ✨
  • -x — use simple authentication instead of SASL.
  • -D binddn — use the Distinguished Name binddn to bind to the LDAP directory. for SASL binds, the server is expected to ignore this value, so don't get attached.
  • -W — prompt for simple authentication. this is used instead of putting the password on the command line. (safe queen behavior, honestly.)
  • -w passwd — use passwd as the password for simple authentication.
  • -y passwdfile — use the complete contents of passwdfile as the password for simple authentication. whole file, every byte, that's the password. 🎀
  • -H ldapuri — specify URI(s) pointing at the ldap server(s). only the protocol/host/port fields are allowed. a list of URIs is expected, separated by whitespace or commas. yes you can give multiple, no you can't put paths in there.
  • -P {2|3} — specify the LDAP protocol version to use.
  • -e [!]ext[=extparam]
  • -E [!]ext[=extparam]

specify general extensions with -e and delete extensions with -E. the ! character indicates criticality.

General extensions:

[!]assert=<filter>    (an RFC 4515 Filter)
!authzid=<authzid>    ("dn:<dn>" or "u:<user>")
[!]bauthzid           (RFC 3829 authzid control)
[!]chaining[=<resolve>[/<cont>]]
[!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>] (a comma-separated attribute list)
[!]preread[=<attrs>]  (a comma-separated attribute list)
[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)

Delete extensions:

(none)

yep, delete extensions list is literally empty. nothing there. we love a humble king. 💀

  • -o opt[=optparam] — specify any ldap.conf(5) option, or one of these:
nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)
  • -O security-properties — specify SASL security properties.
  • -I — enable SASL Interactive mode. always prompt. the default is to prompt only as needed, so this is the "yes ask me every single time" setting.
  • -Q — enable SASL Quiet mode. never prompt. the exact opposite vibe of -I. pick your fighter. 🥊
  • -N — do not use reverse DNS to canonicalize the SASL host name.
  • -U authcid — specify the authentication ID for SASL bind. the form of the identity depends on the actual SASL mechanism used, so it's giving "it depends".
  • -R realm — specify the realm of the authentication ID for SASL bind. again, the form of the realm depends on the actual SASL mechanism used.
  • -X authzid — specify the requested authorization ID for SASL bind. authzid must be one of these formats: dn:<distinguished name> or u:<username>. those two, no others, periodt.
  • -Y mech — specify the SASL mechanism to be used for authentication. if you don't specify it, the program will choose the best mechanism the server knows. letting it cook. 🔥
  • -Z[Z] — issue the StartTLS (Transport Layer Security) extended operation. and if you use -ZZ, the command will require the operation to succeed. no TLS, no deal. 🛡️

⭐ EXAMPLE ⭐

okay so the following command:

ldapdelete "cn=Delete Me,dc=example,dc=com"

will attempt to delete the entry named "cn=Delete Me,dc=example,dc=com". and of course, it would probably be necessary to supply authentication credentials. like, they named the entry "Delete Me", the universe is literally giving you a sign. 😭

💀 DIAGNOSTICS 💀

exit status is 0 if no errors occur. errors result in a non-zero exit status, plus a diagnostic message written to standard error. so like — check your exit codes, bestie, the shell is telling you things.

🔥 SEE ALSO 🔥

ldap.conf(5), ldapadd(1), ldapmodify(1), ldapmodrdn(1), ldapsearch(1), ldap(3), ldap_delete_ext(3)

(the whole LDAP friendgroup, together as always 🫶)

🌟 AUTHOR 🌟

The OpenLDAP Project <http://www.openldap.org/>

🙈 ACKNOWLEDGEMENTS 🙈

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

and that's the whole page, bestie! 🎀 this was OpenLDAP 2.7.2, dated 2026/10/21, and it's the LDAPDELETE(1) page from the General Commands Manual. go forth, delete responsibly, and please use -n first. ✨💖 no cap. 💅

📦 where this page comes from