# ldapdelete

## NAME



           ldapdelete - LDAP delete entry tool
    


## SYNOPSIS



           **ldapdelete**[**-V**[**V**]] [**-d** _debuglevel_] [**-n**] [**-v**] [**-c**] [**-f** _file_] [**-r**]
           [**-z** _sizelimit_] [**-M**[**M**]] [**-x**] [**-D** _binddn_] [**-W**] [**-w** _passwd_]
           [**-y** _passwdfile_] [**-H** _ldapuri_] [**-P**{**2** |**3**}] [**-e**[**!**]_ext_[**=**_extparam_]]
           [**-E**[**!**]_ext_[**=**_extparam_]] [**-o** _opt_[=_optparam_]] [**-O** _security-_
           _properties_] [**-I**] [**-Q**] [**-N**] [**-U** _authcid_] [**-R** _realm_] [**-X** _authzid_]
           [**-Y** _mech_] [**-Z**[**Z**]] [_DN_ [_..._]]
    


## DESCRIPTION



           _ldapdelete_ is a shell-accessible interface to the
           ldap_delete_ext(3) library call.
    
           **ldapdelete** opens a connection to an LDAP server, binds, and
           deletes one or more entries.  If one or more _DN_ arguments are
           provided, entries with those Distinguished Names are deleted.
           Each _DN_ should be provided using the LDAPv3 string representation
           as defined in RFC 4514.  If no _DN_ arguments are provided, a list
           of DNs is read from standard input (or from _file_ if the **-f** flag is
           used).
    


## OPTIONS



           **-V**[**V**]  Print version info.  If **-VV** is given, only the version
                  information is printed.
    
           **-d** _debuglevel_
                  Set the LDAP debugging level to _debuglevel_.  **ldapdelete**
                  must be compiled with LDAP_DEBUG defined for this option to
                  have any effect.
    
           **-n** Show what would be done, but don't actually delete entries.
                  Useful for debugging in conjunction with **-v**.
    
           **-v** Use verbose mode, with many diagnostics written to standard
                  output.
    
           **-c** Continuous operation mode.  Errors  are  reported,  but
                  **ldapdelete** will  continue  with  deletions.   The default
                  is to exit after reporting an error.
    
           **-f** _file_
                  Read a series of DNs from _file_ , one per line, performing an
                  LDAP delete for each.
    
           **-r** Do a recursive delete.  If the DN specified isn't a leaf,
                  its children, and all their children are deleted down the
                  tree.  No verification is done, so if you add this switch,
                  ldapdelete will happily delete large portions of your tree.
                  Use with care.
    
           **-z** _sizelimit_
                  Use _sizelimit_ when searching for children DN to delete, to
                  circumvent any server-side size limit.  Only useful in
                  conjunction with **-r**.
    
           **-M**[**M**]  Enable manage DSA IT control.  **-MM** makes control critical.
    
           **-x** Use simple authentication instead of SASL.
    
           **-D** _binddn_
                  Use the Distinguished Name _binddn_ to bind to the LDAP
                  directory.  For SASL binds, the server is expected to
                  ignore this value.
    
           **-W** Prompt for simple authentication.  This is used instead of
                  specifying the password on the command line.
    
           **-w** _passwd_
                  Use _passwd_ as the password for simple authentication.
    
           **-y** _passwdfile_
                  Use complete contents of _passwdfile_ as the password for
                  simple authentication.
    
           **-H** _ldapuri_
                  Specify URI(s) referring to the ldap server(s); only the
                  protocol/host/port fields are allowed; a list of URI,
                  separated by whitespace or commas is expected.
    
           **-P**{**2** |**3**}
                  Specify the LDAP protocol version to use.
    
           **-e**[**!**]_ext_[**=**_extparam_]
    
           **-E**[**!**]_ext_[**=**_extparam_]
    
                  Specify general extensions with **-e** and delete extensions
                  with **-E**.  ´**!** ´ indicates criticality.
    
                  General extensions:
                    [!]assert=<filter>    (an RFC 4515 Filter)
                    !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
                    [!]bauthzid           (RFC 3829 authzid control)
                    [!]chaining[=<resolve>[/<cont>]]
                    [!]manageDSAit
                    [!]noop
                    ppolicy
                    [!]postread[=<attrs>] (a comma-separated attribute list)
                    [!]preread[=<attrs>]  (a comma-separated attribute list)
                    [!]relax
                    sessiontracking[=<username>]
                    abandon,cancel,ignore (SIGINT sends abandon/cancel,
                    or ignores response; if critical, doesn't wait for SIGINT.
                    not really controls)
    
                  Delete extensions:
                    (none)
    
           **-o** _opt_[=_optparam_]
    
                  Specify any ldap.conf(5) option or one of the following:
                    nettimeout=<timeout>  (in seconds, or "none" or "max")
                    ldif_wrap=<width>     (in columns, or "no" for no wrapping)
    
           **-O** _security-properties_
                  Specify SASL security properties.
    
           **-I** Enable SASL Interactive mode.  Always prompt.  Default is
                  to prompt only as needed.
    
           **-Q** Enable SASL Quiet mode.  Never prompt.
    
           **-N** Do not use reverse DNS to canonicalize SASL host name.
    
           **-U** _authcid_
                  Specify the authentication ID for SASL bind. The form of
                  the identity depends on the actual SASL mechanism used.
    
           **-R** _realm_
                  Specify the realm of authentication ID for SASL bind. The
                  form of the realm depends on the actual SASL mechanism
                  used.
    
           **-X** _authzid_
                  Specify the requested authorization ID for SASL bind.
                  _authzid_ must be one of the following formats:
                  **dn:**_< distinguished name>_ or **u:**_< username>_
    
           **-Y** _mech_
                  Specify the SASL mechanism to be used for authentication.
                  If it's not specified, the program will choose the best
                  mechanism the server knows.
    
           **-Z**[**Z**]  Issue StartTLS (Transport Layer Security) extended
                  operation. If you use **-ZZ** , the command will require the
                  operation to be successful.
    


## EXAMPLE



           The following command:
    
               ldapdelete "cn=Delete Me,dc=example,dc=com"
    
           will attempt to delete the entry named "cn=Delete
           Me,dc=example,dc=com".  Of course it would probably be necessary
           to supply authentication credentials.
    


## DIAGNOSTICS



           Exit status is 0 if no errors occur.  Errors result in a non-zero
           exit status and a diagnostic message being written to standard
           error.
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *