MAN page from PLD openldap-2.0.27-1.i386.rpm

LDAPMODIFY

Section: User Commands (1)
Updated: 20 August 2001
Index

NAME

ldapmodify, ldapadd - LDAP modify entry and LDAP add entry tools

SYNOPSIS

ldapmodify[-a][-c][-n][-v][-k][-K][-M[M]][-d debuglevel][-D binddn][-W][-w passwd][-H ldapuri][-h ldaphost][-p ldapport][-P 2|3][-O security-properties][-I][-Q][-U authcid][-x][-X authzid][-Y mech][-Z[Z]][-f file]

ldapadd[-c][-n][-v][-k][-K][-M[M]][-d debuglevel][-D binddn][-W][-w passwd][-h ldaphost][-p ldapport][-P 2|3][-O security-properties][-I][-Q][-U authcid][-x][-X authzid][-Y mech][-Z[Z]][-f file]

DESCRIPTION

ldapmodifyis a shell-accessible interface to theldap_modify(3)andldap_add(3)library calls.ldapaddis implemented as a hard link to the ldapmodify tool. When invoked asldapaddthe -a (add new entry) flag is turned on automatically.

ldapmodifyopens a connection to an LDAP server, binds, and modifies or adds entries.The entry information is read from standard input or from file throughthe use of the -f option.

OPTIONS

-a: Add new entries. The default forldapmodifyis to modify existing entries. If invoked asldapadd,this flag is always set.
-c: Continuous operation mode. Errors are reported, butldapmodifywill continue with modifications. The default is to exit afterreporting an error.
-n: Show what would be done, but don't actually modify entries. Useful fordebugging in conjunction with -v.
-v: Use verbose mode, with many diagnostics written to standard output.
-k: Use Kerberos IV authentication instead of simple authentication. It isassumed that you already have a valid ticket granting ticket. You mustcompile with Kerberos support for this option to have any effect.
-K: Same as -k, but only does step 1 of the Kerberos IV bind. This is usefulwhen connecting to a slapd and there is no x500dsa.hostname principalregistered with your Kerberos Domain Controller(s).
-F: Force application of all changes regardless of the contents of inputlines that begin withreplica:(by default, replica: lines are compared against the LDAP server hostand port in use to decide if a replog record should actually be applied).
-M[M]: Enable manage DSA IT control.-MMmakes control critical.
-d debuglevel: Set the LDAP debugging level to debuglevel.ldapmodifymust be compiled with LDAP_DEBUG defined for this option to have any effect.
-f file: Read the entry modification information from file instead of fromstandard input.
-x: Use simple authentication instead of SASL.
-D binddn: Use the Distinguished Name binddn to bind to the LDAP directory.
-W: Prompt for simple authentication.This is used instead of specifying the password on the command line.
-w passwd: Use passwd as the password for simple authentication.
-H ldapuri: Specify URI(s) referring to the ldap server(s).
-h ldaphost: Specify an alternate host on which the ldap server is running.Deprecated in favor of -H.
-p ldapport: Specify an alternate TCP port where the ldap server is listening.Deprecated in favor of -H.
-P 2|3: Specify the LDAP protocol version to use.
-O security-properties: Specify SASL security properties.
-I: Enable SASL Interactive mode. Always prompt. Default is to promptonly as needed.
-Q: Enable SASL Quiet mode. Never prompt.
-U authcid: Specify the authentication ID for SASL bind. The form of the IDdepends on the actual SASL mechanism used.
-X authzid: Specify the requested authorization ID for SASL bind.authzidmust be one of the following formats:dn:<distinguished name>oru:<username>
-Y mech: Specify the SASL mechanism to be used for authentication. If it's notspecified, the program will choose the best mechanism the server knows.
-Z[Z]: Issue StartTLS (Transport Layer Security) extended operation. If you use-ZZ, the command will require the operation to be successful.

INPUT FORMAT

The contents of file (or standard input if no -f flag is given onthe command line) should conform to the format defined inslapd.replog(5),with the exceptions noted below.

Lines that begin with "replica:" are matched against the LDAP server hostand port in use to decide if a particular replog record should be applied.Any other lines that precede the "dn:" line are ignored.The -F flag can be used to forceldapmodifyto apply all of the replog changes, regardless of the presence orabsence of any "replica:" lines.

If no "changetype:" line is present, the default is "add" if the -aflag is set (or if the program was invoked asldapmodify)and "modify" otherwise.

If changetype is "modify" and no "add:", "replace:", or "delete:" linesappear, the default is "replace" for and "add"ldapmodify(1)forldapadd(1).

Note that the above exceptions to theslapd.replog(5)format allowldif(5)entries to be used as input toldapmodifyorldapadd.

EXAMPLES

Assuming that the file/tmp/entrymodsexists and has the contents:

    dn: cn=Modify Me, dc=example, dc=com    changetype: modify    replace: mail    mail: modmeAATTOpenLDAP.org    -    add: title    title: Grand Poobah    -    add: jpegPhoto    jpegPhoto:< file://tmp/modme.jpeg    -    delete: description    -

the command:

    ldapmodify -r -f /tmp/entrymods

will replace the contents of the "Modify Me" entry'smailattribute with the value "modmeAATTexample.com", add atitleof "Grand Poobah", and the contents of the file "/tmp/modme.jpeg"as ajpegPhoto,and completely remove thedescriptionattribute.

Assuming that the file/tmp/newentryexists and has the contents:

    dn: cn=Barbara Jensen, dc=example, dc=com    objectClass: person    cn: Barbara Jensen    cn: Babs Jensen    sn: Jensen    title: the world's most famous mythical manager    mail: bjensenAATTexample.com    uid: bjensenthe command:    ldapadd -f /tmp/entrymods

will add a new entry for Babs Jensen, using the values from thefile/tmp/newentry.

Assuming that the file/tmp/newentryexists and has the contents:

    dn: cn=Barbara Jensen, dc=example, dc=com    changetype: deletethe command:    ldapmodify -f /tmp/entrymods

will remove Babs Jensen's entry.

DIAGNOSTICS

Exit status is zero if no errors occur. Errors result in a non-zeroexit status and a diagnostic message being written to standard error.

BUGS

There is no interactive mode, but there probably should be.

AUTHOR

The OpenLDAP Project <http://www.openldap.org/>

ACKNOWLEDGEMENTS

is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).is derived from University of Michigan LDAP 3.3 Release.

This document was created byman2html,using the manual pages.