ldapmodify Command Cheat Sheet: Change OpenLDAP Entries

About	ldapmodify applies LDIF changes to LDAP entries. It adds, replaces, or deletes attributes using a StartTLS simple bind, and can modify local cn=config through LDAPI SASL EXTERNAL.
Tested on	Rocky Linux 10.2; OpenLDAP 2.6.10; openldap-clients from EPEL
Package	openldap-clients (apt/deb) · openldap-clients (dnf/rpm)
Man page	ldapmodify(1)
Privilege	bind DN with write access; root for LDAPI EXTERNAL
Distros	RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream (openldap-clients package).
Related guide	Manage OpenLDAP users and groups Configure OpenLDAP TLS on RHEL

Tested on: Rocky Linux 10.2; OpenLDAP 2.6.10; openldap-clients from EPEL.

ldapmodify — quick reference

Apply LDIF changes

Use explicit changetype: modify records. Each change uses add, replace, or delete and ends with a dash when another change follows on the same entry.

When to use	Command
Apply an LDIF change file over StartTLS	`ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f change.ldif`
Provide a lab password non-interactively	`ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f change.ldif`
Read the bind password from a protected file	`ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -y /root/ldap.pass -f change.ldif`
Pipe LDIF from standard input	`ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W < change.ldif`
Continue after failed records in a batch	`ldapmodify -c -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f batch.ldif`
Add entries with ldapmodify itself	`ldapmodify -a -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f new.ldif`

Rename, preview, and recovery

When to use	Command
Rename an entry with `changetype: modrdn`	`ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f rename.ldif`
Preview changes without applying them	`ldapmodify -n -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f change.ldif`
Resume from a specific LDIF line number	`ldapmodify -j 4 -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f batch.ldif`
Write skipped modifications to another file	`ldapmodify -c -S skipped.ldif -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f batch.ldif`

Debugging and local configuration

When to use	Command
Print an operation transcript	`ldapmodify -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f change.ldif`
Raise the LDAP client debug level	`ldapmodify -d 1 -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f change.ldif`
Modify an `cn=config` LDIF as local root	`sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f config-change.ldif`

Help

When to use	Command
Show usage	`ldapmodify 2>&1 \| head`
Print version and exit	`ldapmodify -VV`

ldapmodify — command syntax

Synopsis from ldapmodify on OpenLDAP 2.6.10:

text


ldapmodify [-V[V]] [-d debuglevel] [-n] [-v] [-a] [-c] [-f file] [-j lineno]
           [-S file] [-M[M]] [-x] [-D binddn] [-W] [-w passwd] [-y passwdfile]
           [-H ldapuri] [-P {2|3}] [-e [!]<ext>[=<extparam>]]
           [-E [!]<ext>[=<extparam>]] [-o opt[=optparam]] [-I] [-Q]
           [-Y mech] [-Z[Z]]

Without -a, ldapmodify expects modification LDIF. Plan user attribute changes with the OpenLDAP users and groups guide, after installing OpenLDAP on RHEL. Password hashes belong in LDIF as {SSHA} values from slappasswd.

ldapmodify — command examples

Essential Replace an attribute value

Use a replace change when the entry should have one known new value for an attribute.

LDIF:

text


dn: uid=alice,ou=people,dc=example,dc=com
changetype: modify
replace: mail
mail: [email protected]

Apply it:

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f /root/replace-mail.ldif

Sample output:

output

Enter LDAP Password:
modifying entry "uid=alice,ou=people,dc=example,dc=com"

Success prints the target DN, not the new attribute value.

Essential Verify a changed attribute

Read only the attribute you changed before moving on.

bash

ldapsearch -x -LLL -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -b "uid=alice,ou=people,dc=example,dc=com" -s base "(objectClass=*)" mail

Sample output:

output

Enter LDAP Password:
dn: uid=alice,ou=people,dc=example,dc=com
mail: [email protected]

The base-scope read proves the server stored the replacement value.

Essential Add a second attribute

Use add only when the attribute or value is not already present.

LDIF:

text


dn: uid=alice,ou=people,dc=example,dc=com
changetype: modify
add: title
title: Directory Engineer

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f /root/add-title.ldif

Sample output:

output

Enter LDAP Password:
modifying entry "uid=alice,ou=people,dc=example,dc=com"

For a duplicate value, the server returns error 20; use replace when that is the desired state.

Common Apply several changes in one LDIF record

Separate multiple operations on the same DN with a lone - line. Order matters when later changes depend on earlier ones.

LDIF:

text


dn: uid=alice,ou=people,dc=example,dc=com
changetype: modify
add: description
description: LDAP lab account
-
replace: mail
mail: [email protected]

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/multi-modify.ldif

Sample output:

output

modifying entry "uid=alice,ou=people,dc=example,dc=com"

One modifying entry line can represent several operations inside the same LDIF record.

Common Delete an attribute

An LDIF delete: title operation removes the named attribute or the listed value.

LDIF:

text


dn: uid=alice,ou=people,dc=example,dc=com
changetype: modify
delete: title

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f /root/delete-title.ldif

Sample output:

output

Enter LDAP Password:
modifying entry "uid=alice,ou=people,dc=example,dc=com"

Deleting a missing attribute normally fails, which helps detect stale change files.

Common Replace userPassword with a hash

Never store a cleartext password in the directory. Generate a hash with slappasswd, then replace userPassword.

bash

slappasswd -s 'TempPass123!'

Sample output:

output

{SSHA}Q+dVbisIKzbbZ3DNAhQp04ObhMfa9LPq

LDIF (paste the hash from your run):

text


dn: uid=alice,ou=people,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: {SSHA}Q+dVbisIKzbbZ3DNAhQp04ObhMfa9LPq

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/set-password.ldif

Sample output:

output

modifying entry "uid=alice,ou=people,dc=example,dc=com"

Confirm the bind with ldapwhoami using the user's DN and the new password when ACLs allow self-bind.

Common Rename an entry with modrdn

changetype: modrdn changes the leftmost RDN while keeping the same parent. deleteoldrdn: 1 removes the old RDN attribute value.

LDIF:

text


dn: uid=bob,ou=people,dc=example,dc=com
changetype: modrdn
newrdn: uid=bob-renamed
deleteoldrdn: 1

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/modrdn.ldif

Sample output:

output

modifying rdn of entry "uid=bob,ou=people,dc=example,dc=com"

Confirm the server exposes the entry at the new RDN:

bash

ldapsearch -x -LLL -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -b "uid=bob-renamed,ou=people,dc=example,dc=com" -s base "(objectClass=*)" uid

Sample output:

output

dn: uid=bob-renamed,ou=people,dc=example,dc=com
uid: bob-renamed

Update group memberships and application configs that still reference the old DN.

Common Preview a modify with `-n`

-n validates and prints the planned change without sending it.

bash

ldapmodify -n -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/add-title.ldif

Sample output:

output

add title:
	Directory Engineer
!modifying entry "uid=alice,ou=people,dc=example,dc=com"

The ! prefix marks a dry-run line that was not applied to the directory.

Common Add an entry with `-a` mode

-a makes ldapmodify behave like ldapadd; use it only for a new complete entry record.

bash

ldapmodify -a -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/carol.ldif

Sample output:

output

adding new entry "uid=carol,ou=people,dc=example,dc=com"

For clarity in runbooks, ldapadd is usually the more readable command for this job.

Advanced Read the bind password from a file

-y passwdfile suits automation when the administrator password must not appear in the process list.

bash

ldapmodify -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -y /root/ldap.pass -f /root/add-title.ldif

Sample output:

output

ldap_modify: Type or value exists (20)
	additional info: modify/add: title: value #0 already exists
modifying entry "uid=alice,ou=people,dc=example,dc=com"

Error 20 here means the title was already present from an earlier run — expected when replaying the same LDIF.

Advanced Raise the client debug level with `-d`

Use -d 1 when StartTLS or bind negotiation fails before any modify reaches the server.

bash

ldapmodify -d 1 -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' -f /root/add-title.ldif

Sample output:

output

ldap_url_parse_ext(ldap://localhost)
ldap_create
ldap_connect_to_host: TCP localhost:389
ldap_bind: Type or value exists (20)

Higher levels print full protocol traffic; start low and increase only when needed.

Advanced Modify cn=config through LDAPI

The local server administrator can apply a dynamic configuration change through LDAPI EXTERNAL. Use sudo and keep the change LDIF under review per cn=config and MDB.

bash

sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /root/olc-loglevel.ldif

Sample output:

output

modifying entry "cn=config"

This succeeds only when the local root identity is mapped and authorized for cn=config.

ldapmodify — when to use / when not

Use ldapmodify when	Use something else when
You need an auditable LDIF update to an existing DN You must add, replace, or delete attributes in one or more steps You need to rename an entry with `changetype: modrdn` You manage dynamic server configuration locally over LDAPI	You are creating a new regular entry → ldapadd You only need to inspect an entry → ldapsearch You need to remove the whole DN → ldapdelete You are loading a full offline dataset → slapadd

ldapmodify vs ldapadd

	ldapmodify	ldapadd
Default action	Changes an existing entry	Adds a new entry
LDIF	Requires `changetype: modify` (or `modrdn`)	Entry attributes and object classes
Add mode	`-a` switches to add semantics	Always active
Rename	`changetype: modrdn`	Not supported — use ldapmodify

These client tools cover the normal OpenLDAP administration flow.

Command	One line
ldapsearch	Search and inspect directory entries.
ldapadd	Add entries from LDIF.
ldapmodify	Change attributes with LDIF.
ldapdelete	Remove entries by DN.
ldapwhoami	Confirm the authenticated identity.
slappasswd	Generate password hashes for OpenLDAP.

Browse Linux commands for more command references.

ldapmodify — interview corner

How does ldapmodify change an attribute?

It reads an LDIF record with a target DN and changetype: modify, then applies add, replace, or delete operations. Multiple operations on one entry are separated by a lone - line.

A strong answer is:

“I express every update in LDIF, so the exact directory change is reviewable and repeatable.”

When should you use replace rather than add?

Use replace when the value should become the desired value regardless of its previous contents. Use add only to append a new value on a multi-valued attribute.

A strong answer is:

“Replace is idempotent for a single-valued desired state; add can fail with error 20 if the value exists.”

How do you apply several attribute changes in one ldapmodify call?

List each operation under the same dn: and changetype: modify, then place a dash on its own line between operations. The final operation does not need a trailing dash.

A strong answer is:

“One LDIF record, multiple add/replace/delete blocks separated by - — fewer round trips and easier review.”

How do you rename an LDAP entry?

Use changetype: modrdn with newrdn and usually deleteoldrdn: 1. The parent DN stays the same unless you also issue a moddn operation.

A strong answer is:

“modrdn changes the leftmost RDN; I verify the new DN with ldapsearch and update anything that stored the old DN.”

What does ldapmodify -a do?

It changes the default mode to add entries, matching ldapadd behavior.

A strong answer is:

“It is convenient but ldapadd makes a creation operation clearer to readers.”

How should cn=config be modified?

On the server, authenticate through ldapi:/// with SASL EXTERNAL as local root rather than putting a config password on the network.

A strong answer is:

“I use LDAPI EXTERNAL for local configuration and retain the LDIF used for the change.”

Troubleshooting

Symptom	Likely cause	Fix
`No such object (32)`	Target DN or parent suffix is wrong	Search the DN and correct the LDIF base under `dc=example,dc=com`.
`Type or value exists (20)`	`add` requested an existing value	Use `replace` or delete the duplicate value first.
`Object class violation (65)`	Change violates schema	Include required attributes or use a suitable object class.
`Insufficient access (50)`	Bind DN cannot modify that attribute	Check write ACLs and use an authorized identity.
`Confidentiality required (13)`	Simple bind without TLS	Add `-ZZ` per the TLS guide.
`Invalid credentials (49)`	Wrong administrator DN or password	Confirm `cn=admin,dc=example,dc=com` and server `olcRootPW`.
`modify/add: title: value #0 already exists`	Replay of an `add` LDIF	Switch to `replace` or skip the operation.
modrdn succeeds but apps break	Group memberships or configs still use old DN	Re-link groups and update application bind DNs.
Dry-run passes, live modify fails	ACL or schema issue only visible after write	Remove `-n`, read the first server error, and fix the LDIF.
Cleartext password in directory	`userPassword` set without hashing	Generate `{SSHA}` with slappasswd and use `replace: userPassword`.

References

OpenLDAP ldapmodify(1) manual{: target="_blank" rel="noopener" }
RFC 2849 — LDIF format{: target="_blank" rel="noopener" }
Install and configure OpenLDAP on RHEL Linux
Manage OpenLDAP users and groups
OpenLDAP ACL examples

ldapmodify — quick reference

Apply LDIF changes

Rename, preview, and recovery

Debugging and local configuration

Help

ldapmodify — command syntax

ldapmodify — command examples

ldapmodify — when to use / when not

ldapmodify vs ldapadd

Related commands

ldapmodify — interview corner

Troubleshooting

References

Related Articles

Migrate Local Linux Users and Groups to OpenLDAP

ldapadd Command in Linux: Syntax, LDIF & Practical Examples

ldapdelete Command in Linux: Syntax, Recursive Deletes & Examples

Search GoLinuxCloud