General usage

Used for adding, deleting, modifying and renaming entries. All operations are specified using LDIF statements.

The syntax for the ldapmodify command is as follows:

ldapmodify -D binddn -w passwd -h host [options]

Adding an entry

When adding new entries, make sure that a parent entry exists (a branch point) before adding entries in that branch.

The “changetype: add” statement is used in the LDIF format to indicate a new entry. The following statements illustrate the creation of a new user. Note that distinguished names usually contain the LDAP domain name, which is, for convenience, often the DNS domain name:

dn: cn=Mieke Michiels, ou=People,
changetype: add
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: Mieke Michiels
givenName: Mieke
sn: Michiels
ou: People
ou: Management
uid: mmichiel

Modifying an entry

The “changetype: modify” statement can be used to add, replace or remove attributes and/or attribute values to the entry. When using this statement, also specify the type of change operation. This change type can be either “add: attributename”, “replace: attributename” or “delete: attributename”. These update statements would add a telephone number to the above defined new user entry:

dn: cn=Mieke Michiels, ou=People,
changetype: modify
add: telephonenumber
telephonenumber: 016 345 678

Adding, modifying and deleting user and group entries is discussed in detail in Chapter 2, More on users and groups.

Deleting an entry

The “changetype: delete” statement is used to remove an entry from the directory server. Only entries at the end of a branch can be deleted. The following LDIF update statements remove a user:

dn: cn=Mieke Michiels, ou=People,
changetype: delete


The ldapdelete tool allows for removal of directory server entries. The general syntax is as follows:

ldapdelete -D binddn -w passwd -h host dn


The ldapsearch command returns results for searches in the directory server database in LDIF format.

We will discuss this tool in detail in Chapter 3, Searching the directory.

LDIF tools

On Solaris systems, the ldif tool is used to convert binary data to LDIF format. This command is used for converting images:

ldif -b jpegPhoto < jan.jpg > jan-jansen-pic.ldif

The OpenLDAP distribution includes the slapadd program, which allows for easy management of LDIF files, for instance:

slapadd -f my_data.ldif

However, the slapadd command should not be used on a running server!