Understanding LDIF (LDAP Data Interchange Format)
Tags: ldif, ldap
Published: 2021-01-14 23:06:45

> _This article was written by Stuart Squibb. He is a frequent contributor to the Adam the Automator (ATA) blog. If you'd like to read more from this author, check out his [ATA author page](http://adamtheautomator.com/author/stuart). Be sure to also check out [more how-to posts on cloud computing, system administration, IT, and DevOps on adamtheautomator.com](https://adamtheautomator.com)!_

<!-- wp:paragraph -->
<p>If you've worked with LDAP (Lightweight Directory Access Protocol) before, you've probably run across LDIF files. LDIF is a schema defined in text files that defines LDAP directory content as a set of records. LDIF files define one record for each object (or entry) and store actions to perform on those objects like adding, modifying, removing and renaming objects.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In this article, you'll get a deeper understanding of what the LDIF format is, what a file looks like and how it's used by various tools.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="the-ldif-format">The LDIF Format</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The LDIF format is always represented in plain-text files with an LDF extension. Because they are plain-text, &nbsp;you can easily view them in your favorite text editor. <a href="https://code.visualstudio.com/">Visual Studio Code</a>, for example, has a <a href="https://marketplace.visualstudio.com/items?itemName=jtavin.ldif">syntax highlighter extension for LDIF files</a> that you can install which will make working with LDIF files easier.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>An LDIF file consists of a number of <em>records</em> each separated from the next by a blank line. Each record refers to a single <em>object</em> and consists of a number of lines. You can see an example of the structure below.</p>
<!-- /wp:paragraph -->

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9zu6576n3ig2bathvlwp.png)

<!-- wp:paragraph -->
<p>Each line of a record can contains:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><strong>An LDAP attribute</strong> - This is a line that consists of an LDAP attribute name, followed by a colon, a space and then the attribute value.</li><li><em><em><strong>A <em>changetype</em></strong></em> -</em> A changetype line in a record identifies the type of change to be made to the AD object (add, delete, modify, moddn/modrdn). A changetype of modify is followed by the change <em>operations</em> themselves.</li><li><strong>A change operation</strong> - These lines represent the changes to be made (add, delete or replace). If object is being changed more than one way, you may also notice a dash representing separating multiple change operations within a <em>modify</em> <em>changetype</em>.</li><li><strong>A comment line</strong> - These are lines that start with the hash (“#”) character.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Each record correlates to an AD object. Each AD object that the record refers to is identified by the first line of the record, which contains the distinguished name (DN) attribute for the LDAP object.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="example-ldf-file">Example LDF File</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>In the next screenshot, you will see a snippet of an LDIF file generated for a user LDAP object type. This file was exported with the <a href="https://adamtheautomator.com/csvde-ldifde">LDIFDE tool</a> representing a user account for Paul Cox.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Each line of the example file below represents one of the attributes for Paul, apart from the comment line.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You'll see that this record has two multi-valued LDAP/Active Directory attributes such as <code>objectClass</code> and <code>memberOf</code>. These attributes are represented by multiple lines - one for each value. Also note that the <code>objectGUID</code> attribute is <a href="https://en.wikipedia.org/wiki/Base64">base64</a> encoded. Attributes are encoded in the LDIF file because that particular attribute is not stored in LDAP as a plain text or numeric value. Instead, it is stored as a 16-byte binary value.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Since this example file was exported with the ldifde tool, it is ready to be re-imported elsewhere so it has a <em>changetype</em> of <em>add</em>.</p>
<!-- /wp:paragraph -->

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/gsupumwgkr82s6bclgdv.png)

<!-- wp:heading -->
<h2 id="ldif-support-in-tools">LDIF Support in Tools</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>As mentioned earlier, one tool you can work with LDIF files is called <a href="https://adamtheautomator.com/csvde-ldifde">ldifde in Windows</a> but others exist as well. LDIF files can be generated and consumed by a variety of tools such the <a href="https://www.openldap.org/">OpenLDAP</a> tools available on Linux and Mac OS, the python module <a href="https://www.python-ldap.org/en/latest/reference/ldif.html">python-ldap</a> and the perl <a href="https://metacpan.org/pod/Net::LDAP::LDIF">Net::LDAP::LDIF</a> module.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="further-reading">Further Reading</h2>
<!-- /wp:heading -->

<!-- wp:list -->
<ul><li><a href="https://tools.ietf.org/html/rfc2849"><strong><em>RFC 2849 - The LDAP Data Interchange Format technical specification</em></strong></a></li></ul>
<!-- /wp:list -->