# ldapmodify

## NAME



           ldapmodify, ldapadd - LDAP modify entry and LDAP add entry tools
    


## SYNOPSIS



           **ldapmodify**[**-V**[**V**]] [**-d** _debuglevel_] [**-n**] [**-v**] [**-a**] [**-c**] [**-f** _file_]
           [**-i** _time_] [**-j** _lineno_] [**-S** _file_] [**-M**[**M**]] [**-x**] [**-D** _binddn_] [**-W**]
           [**-w** _passwd_] [**-y** _passwdfile_] [**-H** _ldapuri_] [**-P**{**2** |**3**}]
           [**-e**[**!**]_ext_[**=**_extparam_]] [**-E**[**!**]_ext_[**=**_extparam_]] [**-o** _opt_[=_optparam_]]
           [**-O** _security-properties_] [**-I**] [**-Q**] [**-N**] [**-U** _authcid_] [**-R** _realm_]
           [**-X** _authzid_] [**-Y** _mech_] [**-Z**[**Z**]]
    
           **ldapadd**[**-V**[**V**]] [**-d** _debuglevel_] [**-n**] [**-v**] [**-c**] [**-f** _file_] [**-i** _time_]
           [**-j** _lineno_] [**-S** _file_] [**-M**[**M**]] [**-x**] [**-D** _binddn_] [**-W**] [**-w** _passwd_]
           [**-y** _passwdfile_] [**-H** _ldapuri_] [**-P**{**2** |**3**}] [**-e**[**!**]_ext_[**=**_extparam_]]
           [**-E**[**!**]_ext_[**=**_extparam_]] [**-o** _opt_[=_optparam_]] [**-O** _security-_
           _properties_] [**-I**] [**-Q**] [**-N**] [**-U** _authcid_] [**-R** _realm_] [**-X** _authzid_]
           [**-Y** _mech_] [**-Z**[**Z**]]
    


## DESCRIPTION



           **ldapmodify** is a shell-accessible interface to the ldap_add_ext(3),
           ldap_modify_ext(3), ldap_delete_ext(3) and ldap_rename(3).
           library calls.  **ldapadd** is implemented as a hard link to the
           ldapmodify tool.  When invoked as **ldapadd** the **-a**(add new entry)
           flag is turned on automatically.
    
           **ldapmodify** opens a connection to an LDAP server, binds, and
           modifies or adds entries.  The entry information is read from
           standard input or from _file_ through the use of the **-f** option.
    


## OPTIONS



           **-V**[**V**]  Print version info.  If **-VV** is given, only the version
                  information is printed.
    
           **-d** _debuglevel_
                  Set the LDAP debugging level to _debuglevel_.  **ldapmodify**
                  must be compiled with LDAP_DEBUG defined for this option to
                  have any effect.
    
           **-n** Show what would be done, but don't actually modify entries.
                  Useful for debugging in conjunction with **-v**.
    
           **-v** Use verbose mode, with many diagnostics written to standard
                  output.
    
           **-a** Add new entries.  The default for **ldapmodify** is to modify
                  existing entries.  If invoked as **ldapadd** , this flag is
                  always set.
    
           **-c** Continuous operation mode.  Errors are reported, but
                  **ldapmodify** will continue with modifications.  The default
                  is to exit after reporting an error.
    
           **-f** _file_
                  Read the entry modification information from _file_ instead
                  of from standard input.
    
           **-i** _time_
                  Wait _time_ microseconds before issuing an operation.
    
           **-j** _lineno_
                  Jump to the specified line number in the LDIF file before
                  processing any entries.  This allows a load that was
                  aborted due to errors in the input LDIF to be resumed after
                  the errors are corrected.
    
           **-S** _file_
                  Add or change records which were skipped due to an error
                  are written to _file_ and the error message returned by the
                  server is added as a comment. Most useful in conjunction
                  with **-c**.
    
           **-M**[**M**]  Enable manage DSA IT control.  **-MM** makes control critical.
    
           **-x** Use simple authentication instead of SASL.
    
           **-D** _binddn_
                  Use the Distinguished Name _binddn_ to bind to the LDAP
                  directory.  For SASL binds, the server is expected to
                  ignore this value.
    
           **-W** Prompt for simple authentication.  This is used instead of
                  specifying the password on the command line.
    
           **-w** _passwd_
                  Use _passwd_ as the password for simple authentication.
    
           **-y** _passwdfile_
                  Use complete contents of _passwdfile_ as the password for
                  simple authentication.
    
           **-H** _ldapuri_
                  Specify URI(s) referring to the ldap server(s); only the
                  protocol/host/port fields are allowed; a list of URI,
                  separated by whitespace or commas is expected.
    
           **-P**{**2** |**3**}
                  Specify the LDAP protocol version to use.
    
           **-e**[**!**]_ext_[**=**_extparam_]
    
           **-E**[**!**]_ext_[**=**_extparam_]
    
                  Specify general extensions with **-e** and modify extensions
                  with **-E**.  ´**!** ´ indicates criticality.
    
                  General extensions:
                    [!]assert=<filter>    (an RFC 4515 Filter)
                    !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
                    [!]bauthzid           (RFC 3829 authzid control)
                    [!]chaining[=<resolve>[/<cont>]]
                    [!]manageDSAit
                    [!]noop
                    ppolicy
                    [!]postread[=<attrs>] (a comma-separated attribute list)
                    [!]preread[=<attrs>]  (a comma-separated attribute list)
                    [!]relax
                    sessiontracking[=<username>]
                    abandon,cancel,ignore (SIGINT sends abandon/cancel,
                    or ignores response; if critical, doesn't wait for SIGINT.
                    not really controls)
    
                  Modify extensions:
                    [!]txn[=abort|commit]
    
           **-o** _opt_[=_optparam_]]
    
                  Specify any ldap.conf(5) option or one of the following:
                    nettimeout=<timeout>  (in seconds, or "none" or "max")
                    ldif_wrap=<width>     (in columns, or "no" for no wrapping)
    
           **-O** _security-properties_
                  Specify SASL security properties.
    
           **-I** Enable SASL Interactive mode.  Always prompt.  Default is
                  to prompt only as needed.
    
           **-Q** Enable SASL Quiet mode.  Never prompt.
    
           **-N** Do not use reverse DNS to canonicalize SASL host name.
    
           **-U** _authcid_
                  Specify the authentication ID for SASL bind. The form of
                  the ID depends on the actual SASL mechanism used.
    
           **-R** _realm_
                  Specify the realm of authentication ID for SASL bind. The
                  form of the realm depends on the actual SASL mechanism
                  used.
    
           **-X** _authzid_
                  Specify the requested authorization ID for SASL bind.
                  _authzid_ must be one of the following formats:
                  **dn:**_< distinguished name>_ or **u:**_< username>_
    
           **-Y** _mech_
                  Specify the SASL mechanism to be used for authentication.
                  If it's not specified, the program will choose the best
                  mechanism the server knows.
    
           **-Z**[**Z**]  Issue StartTLS (Transport Layer Security) extended
                  operation. If you use **-ZZ** , the command will require the
                  operation to be successful.
    


## INPUT FORMAT



           The contents of _file_ (or standard input if no **-f** flag is given on
           the command line) must conform to the format defined in ldif(5)
           (LDIF as defined in RFC 2849).
    


## EXAMPLES



           Assuming that the file **/tmp/entrymods** exists and has the contents:
    
               dn: cn=Modify Me,dc=example,dc=com
               changetype: modify
               replace: mail
               mail: modme@example.com
               -
               add: title
               title: Grand Poobah
               -
               add: jpegPhoto
               jpegPhoto:< file:///tmp/modme.jpeg
               -
               delete: description
               -
    
           the command:
    
               ldapmodify -f /tmp/entrymods
    
           will replace the contents of the "Modify Me" entry's _mail_
           attribute with the value "modme@example.com", add a _title_ of
           "Grand Poobah", and the contents of the file "/tmp/modme.jpeg" as
           a _jpegPhoto_ , and completely remove the _description_ attribute.
    
           Assuming that the file **/tmp/newentry** exists and has the contents:
    
               dn: cn=Barbara Jensen,dc=example,dc=com
               objectClass: person
               cn: Barbara Jensen
               cn: Babs Jensen
               sn: Jensen
               title: the world's most famous mythical manager
               mail: bjensen@example.com
               uid: bjensen
    
           the command:
    
               ldapadd -f /tmp/newentry
    
           will add a new entry for Babs Jensen, using the values from the
           file **/tmp/newentry.**
    
           Assuming that the file **/tmp/entrymods** exists and has the contents:
    
               dn: cn=Barbara Jensen,dc=example,dc=com
               changetype: delete
    
           the command:
    
               ldapmodify -f /tmp/entrymods
    
           will remove Babs Jensen's entry.
    


## DIAGNOSTICS



           Exit status is zero if no errors occur.  Errors result in a non-
           zero exit status and a diagnostic message being written to
           standard error.
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *