Learn LDAP - Modifying & Deleting Entries

#Introduction

In episode 7 you populated the directory with users and groups. Episode 8 covers the other side of the data lifecycle: changing attributes, adding new values, removing attributes, renaming entries, moving entries between parents, and deleting entries — all through ldapmodify, ldapmodrdn, and ldapdelete. This is the episode where the data you've entered starts to move and change.

#Understanding changetype

ldapmodify reads LDIF files containing the changetype directive. Four values are available:

Episode 7 used changetype: add implicitly through ldapadd. Now we focus on modify and modrdn.

#Modification Operations: add, delete, replace

There are three attribute-change operations:

In an LDIF file, each operation block ends with a single dash line:

dn: uid=budi,ou=People,dc=example,dc=com
changetype: modify
add: mail
mail: budi.santoso@example.com
-
replace: description
description: Budi's primary account
-
delete: telephoneNumber

Run it with ldapmodify:

ldapmodify -x -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f ubah-budi.ldif

The changetype: modify directive marks this as a modify operation. The add: followed by mail: block adds the mail attribute; replace: replaces the value of description; delete: removes the telephoneNumber attribute. For multi-valued attributes, you can specify the specific value you want to remove:

dn: cn=devel,ou=Groups,dc=example,dc=com
changetype: modify
delete: member
member: uid=aji,ou=People,dc=example,dc=com

#Batch Modification

ldapmodify processes many operations at once in a single file. Each entry carries its own changetype, and each operation block still ends with a single dash:

dn: uid=sari,ou=People,dc=example,dc=com
changetype: modify
add: telephoneNumber
telephoneNumber: +62 21 555 0101
 
dn: uid=aji,ou=People,dc=example,dc=com
changetype: modify
replace: loginShell
loginShell: /bin/zsh

One file can mix modify, add, even delete for different entries. As in episode 7, use -c so processing continues even if an operation fails, and check the return code in scripts.

#Renaming & Moving Entries

The ModifyDN operation changes an entry's Relative Distinguished Name (RDN) and/or moves it to a new parent. There are two tools: ldapmodrdn for command-line form, or ldapmodify with changetype: modrdn.

#Changing an RDN

dn: uid=budi,ou=People,dc=example,dc=com
changetype: modrdn
newrdn: uid=budi.santoso
deleteoldrdn: 0

newrdn specifies the new RDN; deleteoldrdn: 1 removes the old RDN attribute, while 0 keeps it as an ordinary attribute. Run it:

ldapmodify -x -D "cn=admin,dc=example,dc=com" -W -f rename-rdn.ldif

The command-line form uses ldapmodrdn:

ldapmodrdn -x -D "cn=admin,dc=example,dc=com" -W -r "uid=budi,ou=People,dc=example,dc=com" "uid=budi.santoso"

The -r option removes the old RDN — equivalent to deleteoldrdn: 1.

#Moving an entry to another parent

The newsuperior directive moves an entry under a new parent:

dn: uid=budi,ou=People,dc=example,dc=com
changetype: modrdn
newrdn: uid=budi
deleteoldrdn: 0
newsuperior: ou=Contractors,dc=example,dc=com

After this operation, the entry sits at uid=budi,ou=Contractors,dc=example,dc=com. Note that newsuperior is only available on servers that support it and requires appropriate access rights — usually admin only.

#Deleting Entries

ldapdelete accepts one or several DNs, or a list of DNs from a file with -f:

ldapdelete -x -D "cn=admin,dc=example,dc=com" -W "uid=test,ou=People,dc=example,dc=com"

#Deleting a subtree (recursive)

The LDAP protocol doesn't define a delete-subtree operation. Deleting an entry that still has children is rejected by the server with code 66 notAllowedOnNonLeaf. So to delete a subtree, delete from the leaves up to the root:

ldapdelete -x -D "cn=admin,dc=example,dc=com" -W "uid=test,ou=People,dc=example,dc=com"
ldapdelete -x -D "cn=admin,dc=example,dc=com" -W "ou=People,dc=example,dc=com"

The bottom-up delete loop can be written in a shell script with the help of ldapsearch to list child DNs first.

#Referential integrity

When a user is deleted, the DN references in a group's member attribute aren't removed automatically — this is what's called a dangling reference. The impact: the group still lists members who no longer exist. The solution is the refint overlay (episode 11) or manual cleanup:

dn: cn=devel,ou=Groups,dc=example,dc=com
changetype: modify
delete: member
member: uid=aji,ou=People,dc=example,dc=com

#Best Practices for Modification

• Back up before modifying — run slapcat to back up the database contents (full discussion in the backup and restore episode).
• Test in development first — don't touch the production directory directly.
• Use LDIF files — keep them in version control so changes can be reproduced and reviewed.
• Validate the result — verify after modification with ldapsearch:

ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "uid=budi,ou=People,dc=example,dc=com" -s base "(objectClass=*)"

• Keep an audit trail — enable the auditlog overlay (episode 11) to record who changed what.

#Closing

Episode 8 completes the entry lifecycle: the three modification operations add, delete, replace; the changetype directive including modify and modrdn; renaming RDNs with newrdn; moving entries with newsuperior; deleting entries and their subtrees; and the practice of keeping references clean.

Key takeaways:

• Every ldapmodify operation block ends with a single dash.
• deleteoldrdn determines whether the old RDN attribute is also removed.
• LDAP has no delete-subtree; delete from leaves to root.
• Always back up and validate before and after changes.

In the next episode, episode 9, you'll sharpen your reading skills: search scopes, filters like wildcards and comparisons, logical operators, attribute selection techniques, and keeping search performance in check.