LDAPMODRDN(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 ldapmodrdn 💖

okay bestie, listen up — this is ldapmodrdn from the General Commands Manual (section 1, the "you type it in a shell" section, iykyk). it's the LDAP rename entry tool and it's literally about to become your new fave. 🦋

✨ NAME ✨

ldapmodrdn — LDAP rename entry tool 🎀

✨ SYNOPSIS ✨

       ldapmodrdn [-V[V]] [-d debuglevel] [-n] [-v] [-r] [-s newsup] [-c]
       [-f file] [-M[M]] [-x] [-D binddn] [-W] [-w passwd] [-y passwdfile]
       [-H ldapuri] [-P {2|3}] [-e [!]ext[=extparam]] [-E [!]ext[=extparam]]
       [-o opt[=optparam]] [-O security-properties] [-I] [-Q] [-N] [-U authcid]
       [-R realm] [-X authzid] [-Y mech] [-Z[Z]] [dn rdn]

look at all those flags bestie, it's giving options menu at a fancy restaurant 🍓

✨ DESCRIPTION ✨

so ldapmodrdn is a shell-accessible interface to the ldap_rename(3) library call. that's the whole vibe. 💅

what it does: it opens a connection to an LDAP server, binds, and then modifies the RDN of entries. where does it get the entry info from, you ask? three options, pick your fighter:

  • from standard input
  • from a file, using the -f option
  • from the command-line pair dn and rdn

periodt. 👑

✨ OPTIONS ✨

  • -V[V] — print version info. if you pass -VV, it prints only the version info and nothing else. main character energy fr fr.
  • -d debuglevel — sets the LDAP debugging level to debuglevel. ⚠️ heads up though: ldapmodrdn has to be compiled with LDAP_DEBUG defined for this option to do literally anything.
  • -n — show what would be done, but don't actually change entries. super useful for debugging when you pair it with -v. no cap, this is the safe lil preview mode. 🫶
  • -v — verbose mode, bestie! lots of diagnostics get written to standard output. the way it just tells you everything?? obsessed.
  • -r — remove old RDN values from the entry. the default is to keep the old values, so without this flag your old RDN stays put.
  • -s newsup — specify a new superior entry. (i.e., it moves the target entry and makes it a child of the new superior.) 🚚 note: this option is not supported in LDAPv2, so don't even try it there.
  • -c — continuous operation mode. errors get reported, but ldapmodrdn will keep going with the modifications. the default is to exit right after reporting an error, so this is the "we don't stop, we keep going" flag. 🔥
  • -f file — read the entry modification information from file instead of from standard input or the command-line.
  • -M[M] — enable manage DSA IT control. -MM makes the control critical.
  • -x — use simple authentication instead of SASL.
  • -D binddn — use the Distinguished Name binddn to bind to the LDAP directory. for SASL binds, the server is expected to ignore this value.
  • -W — prompt for simple authentication. this is what you use instead of putting the password on the command line. 💜
  • -w passwd — use passwd as the password for simple authentication.
  • -y passwdfile — use the complete contents of passwdfile as the password for simple authentication.
  • -H ldapuri — specify URI(s) referring to the ldap server(s). only the protocol/host/port fields are allowed. a list of URI, separated by whitespace or commas, is expected.
  • -P {2|3} — specify the LDAP protocol version to use. pick your era bestie, 2 or 3.
  • -e [!]ext[=extparam] — specify general extensions. see the big list below.
  • -E [!]ext[=extparam] — specify modrdn extensions. see the big list below.

so -e is for general extensions and -E is for modrdn extensions. and ´!´ indicates criticality — like, "no seriously, this one matters". 💀

General extensions:

  [!]assert=<filter>    (an RFC 4515 Filter)
  !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
  [!]bauthzid           (RFC 3829 authzid control)
  [!]chaining[=<resolve>[/<cont>]]
  [!]manageDSAit
  [!]noop
  ppolicy
  [!]postread[=<attrs>] (a comma-separated attribute list)
  [!]preread[=<attrs>]  (a comma-separated attribute list)
  [!]relax
  sessiontracking[=<username>]
  abandon,cancel,ignore (SIGINT sends abandon/cancel,
  or ignores response; if critical, doesn't wait for SIGINT.
  not really controls)

quick translation on that last bit: abandon, cancel and ignore deal with Ctrl+C — SIGINT sends abandon/cancel, or ignores the response; if it's critical, it doesn't wait for SIGINT. and ngl, those aren't really controls. 🙈

Modrdn extensions:

  (none)

yeah. none. that's the whole list. iconic honestly. ✨

  • -o opt[=optparam] — specify any ldap.conf(5) option, or one of these two:
    • nettimeout=<timeout> — (in seconds, or "none" or "max")
    • ldif_wrap=<width> — (in columns, or "no" for no wrapping)
  • -O security-properties — specify SASL security properties.
  • -I — enable SASL Interactive mode. always prompt. the default is to prompt only as needed.
  • -Q — enable SASL Quiet mode. never prompt. 🤫
  • -N — do not use reverse DNS to canonicalize the SASL host name.
  • -U authcid — specify the authentication ID for SASL bind. the form of the ID depends on the actual SASL mechanism used.
  • -R realm — specify the realm of the authentication ID for SASL bind. the form of the realm depends on the actual SASL mechanism used.
  • -X authzid — specify the requested authorization ID for SASL bind. authzid must be one of these formats: dn:<distinguished name> or u:<username>.
  • -Y mech — specify the SASL mechanism to be used for authentication. if you don't specify it, the program will choose the best mechanism the server knows. it's got taste. 👑
  • -Z[Z] — issue StartTLS (Transport Layer Security) extended operation. if you use -ZZ, the command will require the operation to be successful. no chill, only success. 🔥

✨ INPUT FORMAT ✨

if the command-line arguments dn and rdn are given, then rdn will replace the RDN of the entry specified by the DN, dn. easy.

otherwise? the contents of file (or standard input, if you didn't pass a -f flag) should consist of one or more entries, formatted like this:

    Distinguished Name (DN)
    Relative Distinguished Name (RDN)

and you can separate each DN/RDN pair with one or more blank lines. spacing is your friend. 🌸

✨ EXAMPLE ✨

okay so let's say the file /tmp/entrymods exists and has these contents:

    cn=Modify Me,dc=example,dc=com
    cn=The New Me

then you run:

    ldapmodrdn -r -f /tmp/entrymods

and boom 💥 — it will change the RDN of the "Modify Me" entry from "Modify Me" to "The New Me", and because you passed -r, the old cn, "Modify Me", will be removed. glow-up complete. 🦋

✨ DIAGNOSTICS ✨

exit status is 0 if no errors occur. if there are errors, you get a non-zero exit status and a diagnostic message written to standard error. 😭 so like, always check that exit code bestie.

✨ SEE ALSO ✨

ldapadd(1), ldapdelete(1), ldapmodify(1), ldapsearch(1), ldap.conf(5), ldap(3), ldap_rename(3)

go read those next, the whole squad is there. 🫶

✨ AUTHOR ✨

The OpenLDAP Project <http://www.openldap.org/> 🌈

✨ ACKNOWLEDGEMENTS ✨

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. 💖

and that's the whole page bestie!! this lil doc came to you courtesy of OpenLDAP 2.7.2, dated 2026/10/21 — go rename some entries, you absolute legend. 💅✨🎀

📦 where this page comes from