3

With this cli:

$ ldapdelete -ZZ -W -D "cn=Manager,dc=site,dc=fake" -r  ou=People,dc=site,dc=fake

I remove all UID's of People, but the problem is it also removes People OU. I know it's easy to recreate a empty OU, but I'd like to remove all UID's of People OU, but preserve the actual People OU?

2
  • 1
    You could create a list of the DNs to delete using ldapsearch and pipe it to ldapdelete (without -roption).
    – ridgy
    Dec 29, 2017 at 20:45
  • Add as answer,so i can close the question
    – elbarna
    Dec 30, 2017 at 9:30

1 Answer 1

Reset to default
5

Sorry for the delay, but I had to install and populate an LDAP server first to test the correct procedure. As ldapdelete reads the list of objects from STDIN if there are none presented on the command line (or in a file), you can use a pipe like

ldapsearch -ZZ -W -D 'cn=Manager,dc=site,dc=fake' \
-b 'ou=people,dc=site,dc=fake' -s one  dn |\
 grep dn: | cut -b 5- | ldapdelete -ZZ -W -D 'cn=Manager,dc=site,dc=fake'

This will ask you for the password twice; maybe you can use some other authentication method.

Instead of -b ... -s one you might have to define some other search base/scope/filter, depending on the directory structure.

I leave the part grep dn: | cut -b 5- | for those of you familiar to awk/sed/... any other constructs to optimize. I just like to keep things simple.

1
  • Just to clarify, the cut -b 5- is needed to get rid of the 0x0a character in each line of output right after the : character. If you pipe that newline to ldapdelete or other utility (not sure how grep is dealing with it above), it's going to botch it. To forego passwords, and local to the LDAP server, you might be able to use: ldapdelete -Y EXTERNAL -H ldapi:///
    – Server Fault
    Jun 18, 2019 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .