Table of Contents
Abstract
This chapter details the following tasks:
Adding entries to the directory
Deleting entries from the directory
Modifying entries
Password policies
The command-line utilities allow for manipulation of the directory content in an automated way. They are ideally suited for use in scripts to perform bulk operations. Information can be specified from the command-line, or using an LDIF input file.
The ldapmodify and ldapdelete commands read statements from the command line in the same way as if they were being read from a file. Use the EOF escape character when you have finished (typically Control+D):
userprompt> ldapmodify -D bindDN -w password -h server1 > dn: cn=Niels Nelissen,ou=people,dc=example,dc=com > changetype: modify > delete: telephonenumber > - > add: manager > manager: cn=Peter Petersen,ou=people,dc=example,dc=com > ^D userprompt>
Note that because both commands use LDIF update statements, ldapmodify can do everything that ldapdelete can do.
Schema checking can be enabled to check validity of the data entered.
A typical ldapmodify command for adding a new entry looks like this:
ldapmodify -a -D "cn=Directory Manager,dc=example,dc=com" -w password -h server1 -f new.ldif
Usually, a file containing the LDIF information is specified, rather than providing the data manually.
To modify LDAP entries, we also create a file first containing the LDIF update statements, and then use the following command:
ldapmodify -D "cn=Directory Manager,dc=example,dc=com" -w password -h server1 -f modify_statements.ldif
Entries cannot be deleted if they have children. First delete the children, then the parent.
For deleting a user entry, this command is advised:
ldapdelete -D "cn=Directory Manager,dc=example,dc=com" -w password -h server1 "cn=Peter Petersen,ou=people,dc=example,dc=com"
The information in an LDIF statement is generally a series of statements specifying the distinguished names that will be affected, the type of change (add, delete, modify or modrdn), and a series of attributes and values.
When specifying the -a option to the ldapmodify, a change type of add is assumed. Other change types override this option.
If a change type of modify is specified, a change operation is required describing how the entry should be changed.
If a change type of modrdn is specified, a change operation is required describing how the relative distinguished name (RDN, the left-most part of the DN) should be changed. This is typically used to rename an entry in the directory.
Change operations are separated in the file by a line containing only a dash (-).
For making an LDIF dump of the directory's database, use the following command on Solaris:
/usr/sbin/directoryserver db2ldif
And with OpenLDAP tools:
slapcat -l my_directory.ldif
![[Note]](images/note.gif) | Caution! |
|---|---|
Stop the LDAP service before running this command, since it can do damage on a running OpenLDAP system. | |
Such a dump can be used as a backup of the directory server: the LDIF file can be imported into a restored server.
This is a typical example file for adding a new user:
dn: cn=Niels Nelissen,ou=people,dc=example,dc=com changetype: add objectclass: top objectclass: person objectclass: organizationalPerson objectClass: inetOrgPerson objectClass: account objectClass: posixAccount host: * cn: Niels Nelissen cn: Niels N. Nelissen sn: Nelissen uid: nnelisse uidNumber: 1012 gidNumber: 1012 homeDirectory: /home/nnelisse mail: nnelisse@example.com loginShell: /bin/bash o: example.com l: Leuven gecos: Niels Nelissen ou: People ou: TechSupport userPassword:: e2NyeXB0fSQxJDBMe2c2dFBs4EI4WGmaFrFUE10MotiR3h6WDE= telephonenumber: +32-16-777-777 description: Job Student
The above example assigns all necessary UNIX account attributes.
Adding a new organizational unit (not to be confused with UNIX-style groups) is done using this type of input:
dn: ou=Marketing,dc=example,dc=com changetype: add objectclass: top objectclass: organizationalUnit ou: Marketing
Adding a group of users is done using these declarations in LDIF:
dn: cn=JobStudents,ou=Groups,dc=example,dc=com changetype: add objectclass: top objectclass: groupOfNames member: cn=Niels Nelissen,ou=people,dc=example,dc=com member: cn=Bart Bartolomeusen,ou=people,dc=example,dc=com cn: JobStudents
Usually we are not going to recycle LDAP entries, but sometimes they might need renaming, for instance when a spelling mistake occurred in the name of a person. This LDIF update statement renames the entry, but keeps the old name as a backup common name, using the deleteoldrdn: 0 declaration:
dn: cn=Bart Bartolomeusen,ou=people,dc=example,dc=com changetype: modrdn newrdn: cn=Bart Bartholomeussen deleteoldrdn: 0
This results in this user having two common names, of which the most recently changed defines the distinguished name.
If you want the old name to be completely removed from the entry, use the deleteoldrdn: 1 statement.
Note that renaming can never place an entry in a different subtree of the directory. Entries with children can not be renamed.
To change existing entries, use the changetype: modify declaration in an LDIF file. The following example adds a telephone number to an entry:
dn: cn=Bart Bartholomeussen,dc=example,dc=com changetype: modify add: telephonenumber telephonenumber: +32-16-888-888 telephonenumber: 888
Multiple attributes can be added at once if they are separated by a dash (-):
dn: cn=Bart Bartholomeussen,dc=example,dc=com changetype: modify add: telephonenumber telephonenumber: +32-16-888-888 telephonenumber: 888 - add: physicalDeliveryOfficeName physicalDeliveryOfficeName: hq - add: givenName givenName: Bart
Use the replace statement for changing attribute values. In the case only one instance of an attribute is defined in the entry, the change statements are simple:
dn: cn=Bart Bartholomeussen,dc=example,dc=com changetype: modify replace: physicalDeliveryOfficeName physicalDeliveryOfficeName: BXL
If you want to change the telephone number 888 into 999, however, while leaving the full number as it is, a somewhat longer statement is needed:
dn: cn=Bart Bartholomeussen,dc=example,dc=com changetype: modify delete: telephonenumber telephonenumber: 888 - add: telephonenumber telephonenumber: 999
If you just want to delete all telephone numbers related to a specific entry, do like this:
dn: cn=Bart Bartholomeussen,dc=example,dc=com changetype: modify delete: telephonenumber