I'm currently doing openldap via command line. I added user John and added group devgroup, and I assigned John into devgroup group. When I deleted a user(John) via command line

ldapdelete -Y EXTERNAL -H ldapi:/// -D "cn=admin,dc=example,dc=local" 

The user is gone but not in previously assigned group member (devgroup).

I noticed that the user and the group's assigned user have no linkage. Basically I can add any nonexistence user in the group. Is there way I can link these two?


2 Answers 2


I believe you're just deleting the user with that command but not all their entries from the OU. It's my understanding that LDAP doesn't maintain linkages with disparate objects like you're thinking, rather you're expected to do ldapsearch's first to produce lists of objects that you then want to act on either using ldapdelete or ldapmodify.

We typically will write results from ldapsearch to .ldif files first and then act on them using ldapmodify or ldapdelete. You can however parse the output from ldapsearch and pipe it to ldapmodify as shown in this example from this U&L Q&A titled: ldapdelete, want to remove all UID's of people OU, but preserve OU?.

$ ldapsearch -ZZ -W -D 'cn=Manager,dc=site,dc=fake' \
   -b 'ou=people,dc=site,dc=fake' -s one  dn | \
   grep dn: | cut -b 5- | ldapdelete -ZZ -W -D 'cn=Manager,dc=site,dc=fake'

I believe you'll need to do something similar, finding all the group's that the user is a memberUid of, then pass that list to ldapmodify, and then run your ldapdelete command once they've been removed from all groups.

Incidentally to remove user's from a group:

dn: cn=Manager,dc=site,dc=fake
changetype: modify
delete: memberuid
memberuid: john

With respect to the .ldif files, the examples on this page titled: Managing Users with Lightweight Directory Access Protocol (LDAP) are excellent. They show how to do all the basic operations with .ldif snippets which can be expanded upon to do operations across multiple objects.


As you already recognized group entries and their member entries are just that: Separate entries without hard linkage.

You have two options:

  1. Implement your own script to remove a member entry and remove its DN from attribute member in the group entry.
  2. Use OpenLDAP overlay slapo-refint to let slapd remove the member reference from the group entry in case you delete the member entry.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .