2

With this cli:

$ ldapdelete -ZZ -W -D "cn=Manager,dc=site,dc=fake" -r  ou=People,dc=site,dc=fake

I remove all UID's of People, but the problem is it also removes People OU. I know it's easy to recreate a empty OU, but I'd like to remove all UID's of People OU, but preserve the actual People OU?

  • 1
    You could create a list of the DNs to delete using ldapsearch and pipe it to ldapdelete (without -roption). – ridgy Dec 29 '17 at 20:45
  • Add as answer,so i can close the question – elbarna Dec 30 '17 at 9:30
4

Sorry for the delay, but I had to install and populate an LDAP server first to test the correct procedure. As ldapdelete reads the list of objects from STDIN if there are none presented on the command line (or in a file), you can use a pipe like

ldapsearch -ZZ -W -D 'cn=Manager,dc=site,dc=fake' \
-b 'ou=people,dc=site,dc=fake' -s one  dn |\
 grep dn: | cut -b 5- | ldapdelete -ZZ -W -D 'cn=Manager,dc=site,dc=fake'

This will ask you for the password twice; maybe you can use some other authentication method.

Instead of -b ... -s one you might have to define some other search base/scope/filter, depending on the directory structure.

I leave the part grep dn: | cut -b 5- | for those of you familiar to awk/sed/... any other constructs to optimize. I just like to keep things simple.

  • Just to clarify, the cut -b 5- is needed to get rid of the 0x0a character in each line of output right after the : character. If you pipe that newline to ldapdelete or other utility (not sure how grep is dealing with it above), it's going to botch it. To forego passwords, and local to the LDAP server, you might be able to use: ldapdelete -Y EXTERNAL -H ldapi:/// – Server Fault Jun 18 '19 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.