Reference

Using ldapadd

Tags: cli, ldapadd, utility

Date: 11-04-2022

What `ldapadd` Does

ldapadd is part of the OpenLDAP client utilities (ldap-utils, symas-openldap-clients, etc.). It performs an LDAP Add operation using data in LDIF format (LDAP Data Interchange Format.)

The tool connects to an LDAP server (via ldap://, ldaps://, or ldapi:///) and adds one or more entries to the directory tree.

Basic Syntax

ldapadd [options] -f file.ldif

The ldapadd command is used to add new entries to a directory using plain LDIF data (not a change-type LDIF)
One or more entries may be added in the LDIF file being used. To add multiple entries, simply place an empty line between entries.

Below is an example of an LDIF file that will add two new OU entries to the example database.

dn: ou=assets,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: assets
description: Organizational Unit for storing asset data

dn: ou=policies,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: policies
description: Organizational Unit for storing password policies

Common Options

Option	Description
`-x`	Use simple authentication (no SASL)
`-H ldap://hostname`	Specify the LDAP URI
`-D "cn=admin,dc=example,dc=com"`	Bind DN (the user who performs the add)
`-W`	Prompt for password interactively
`-w password`	Supply password directly (not recommended)
`-f file.ldif`	Specify the LDIF file to read from
`-c`	Continue on errors (use carefully)
`-S logfile`	Write skipped entries (errors) to a file
`-ZZ`	StartTLS (when using `ldap://`)
`-v`	Verbose output

ldapadd Examples

Example: use a simple bind to authenticate to the server and verbose output when running the ldapadd command:

ldapadd -x -D dc=example,dc=com -w secret -H "ldap:///" -f add-OUs.ldif -v

If the add is successful, you'll see the following verbose output:

add objectClass:
    top
    organizationalUnit
add ou:
    assets
add description:
    Organizational Unit for storing asset data
adding new entry "ou=assets,dc=example,dc=com"
modify complete

Troubleshooting Common Errors

Error	Meaning	Fix
`No such object (32)`	Parent entry doesn’t exist	Add parent first
`Already exists (68)`	DN already present	Modify or delete existing entry
`Invalid syntax (21)`	Attribute value doesn’t conform to schema	Check schema syntax rules
`Constraint violation (19)`	Missing required attribute	Add required field
`Insufficient access (50)`	Bind DN lacks write permission	Use rootDN or update ACL
`Server is unwilling to perform (53)`	Accesslog or overlay preventing modification	Check overlays and policies