Manual Pages for UNIX Darwin command on man ldapmodify

LDAPMODIFY(1) LDAPMODIFY(1)

NAME

ldapmodify, ldapadd - LDAP modify entry and LDAP add entry tools

SYNOPSIS

llddaappmmooddiiffyy [-aa] [-cc] [-SS file] [-nn] [-vv] [-kk] [-KK] [-MM[[MM]]] [-dd debu-

glevel] [-DD binddn] [-WW] [-ww passwd] [-yy passwdfile] [-HH ldapuri]

[-hh ldaphost] [-pp ldapport] [-PP 2|3] [-OO security-properties]] [-II] [-QQ]

[-UU authcid] [-RR realm] [-xx] [-XX authzid] [-YY mech] [-ZZ[[ZZ]]] [-ff file]

llddaappaadddd [-cc] [-SS file] [-nn] [-vv] [-kk] [-KK] [-MM[[MM]]] [-dd debuglevel]

[-DD binddn] [-WW] [-ww passwd] [-yy passwdfile] [-hh ldaphost] [-pp ldap-

port] [-PP 2|3] [-OO security-properties]] [-II] [-QQ] [-UU authcid]

[-RR realm] [-xx] [-XX authzid] [-YY mech] [-ZZ[[ZZ]]] [-ff file]

DESCRIPTION

llddaappmmooddiiffyy is a shell-accessible interface to the llddaappmmooddiiffyy(3) and

llddaappaadddd(3) library calls. llddaappaadddd is implemented as a hard link to

the ldapmodify tool. When invoked as llddaappaadddd the -a (add new entry)

flag is turned on automatically. llddaappmmooddiiffyy opens a connection to an LDAP server, binds, and modifies or adds entries. The entry information is read from standard input or

from file through the use of the -f option.

OOPPTTIIOONNSS

-aa Add new entries. The default for llddaappmmooddiiffyy is to modify exist-

ing entries. If invoked as llddaappaadddd, this flag is always set.

-cc Continuous operation mode. Errors are reported, but llddaappmmooddiiffyy

will continue with modifications. The default is to exit after reporting an error.

-SS file

Add or change records which where skipped due to an error are written to file and the error message returned by the server is

added as a comment. Most useful in conjunction with -c.

-nn Show what would be done, but don't actually modify entries.

Useful for debugging in conjunction with -v.

-vv Use verbose mode, with many diagnostics written to standard out-

put.

-kk Use Kerberos IV authentication instead of simple authentication.

It is assumed that you already have a valid ticket granting ticket. You must compile with Kerberos support for this option to have any effect.

-KK Same as -k, but only does step 1 of the Kerberos IV bind. This

is useful when connecting to a slapd and there is no x500dsa.hostname principal registered with your Kerberos Domain Controller(s).

-FF Force application of all changes regardless of the contents of

input lines that begin with replica: (by default, replica: lines are compared against the LDAP server host and port in use to decide if a replog record should actually be applied).

-MM[[MM]] Enable manage DSA IT control. -MMMM makes control critical.

-dd debuglevel

Set the LDAP debugging level to debuglevel. llddaappmmooddiiffyy must be compiled with LDAPDEBUG defined for this option to have any effect.

-ff file

Read the entry modification information from file instead of from standard input.

-xx Use simple authentication instead of SASL.

-DD binddn

Use the Distinguished Name binddn to bind to the LDAP directory.

-WW Prompt for simple authentication. This is used instead of spec-

ifying the password on the command line.

-ww passwd

Use passwd as the password for simple authentication.

-yy passwdfile

Use complete contents of passwdfile as the password for simple authentication.

-HH ldapuri

Specify URI(s) referring to the ldap server(s).

-hh ldaphost

Specify an alternate host on which the ldap server is running.

Deprecated in favor of -H.

-pp ldapport

Specify an alternate TCP port where the ldap server is listen-

ing. Deprecated in favor of -H.

-PP 2|3 Specify the LDAP protocol version to use.

-OO security-properties

Specify SASL security properties.

-II Enable SASL Interactive mode. Always prompt. Default is to

prompt only as needed.

-QQ Enable SASL Quiet mode. Never prompt.

-UU authcid

Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.

-RR realm

Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.

-XX authzid

Specify the requested authorization ID for SASL bind. authzid must be one of the following formats: ddnn:: or uu::

-YY mech

Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows.

-ZZ[[ZZ]] Issue StartTLS (Transport Layer Security) extended operation. If

you use -ZZZZ, the command will require the operation to be suc-

cessful. IINNPPUUTT FFOORRMMAATT

The contents of file (or standard input if no -f flag is given on the

command line) should conform to the format defined in ssllaappdd..rreepplloogg(5), with the exceptions noted below. Lines that begin with "replica:" are matched against the LDAP server host and port in use to decide if a particular replog record should be applied. Any other lines that precede the "dn:" line are ignored. The

-F flag can be used to force ldapmodify to apply all of the replog

changes, regardless of the presence or absence of any "replica:" lines.

If no "changetype:" line is present, the default is "add" if the -a

flag is set (or if the program was invoked as ldapadd) and "modify" otherwise. If changetype is "modify" and no "add:", "replace:", or "delete:" lines

appear, the default is "replace" for llddaappmmooddiiffyy(1) and "add" for llddaa-

ppaadddd(1). Note that the above exceptions to the ssllaappdd..rreepplloogg(5) format allow

llddiiff(5) entries to be used as input to ldapmodify or ldapadd.

EEXXAAMMPPLLEESS Assuming that the file //ttmmpp//eennttrryymmooddss exists and has the contents: dn: cn=Modify Me,dc=example,dc=com changetype: modify replace: mail mail: modme@example.com

add: title title: Grand Poobah

add: jpegPhoto jpegPhoto:< file:///tmp/modme.jpeg

delete: description

the command:

ldapmodify -f /tmp/entrymods

will replace the contents of the "Modify Me" entry's mail attribute with the value "modme@example.com", add a title of "Grand Poobah", and

the contents of the file "/tmp/modme.jpeg" as a jpegPhoto, and com-

pletely remove the description attribute. Assuming that the file //ttmmpp//nneewweennttrryy exists and has the contents: dn: cn=Barbara Jensen,dc=example,dc=com objectClass: person cn: Barbara Jensen cn: Babs Jensen sn: Jensen title: the world's most famous mythical manager mail: bjensen@example.com uid: bjensen the command:

ldapadd -f /tmp/newentry

will add a new entry for Babs Jensen, using the values from the file //ttmmpp//nneewweennttrryy.. Assuming that the file //ttmmpp//eennttrryymmooddss exists and has the contents: dn: cn=Barbara Jensen,dc=example,dc=com changetype: delete the command:

ldapmodify -f /tmp/entrymods

will remove Babs Jensen's entry. DIAGNOSTICS

Exit status is zero if no errors occur. Errors result in a non-zero

exit status and a diagnostic message being written to standard error.