1LDAPDELETE(1)               General Commands Manual              LDAPDELETE(1)
2
3
4

NAME

6       ldapdelete - LDAP delete entry tool
7

SYNOPSIS

9       ldapdelete  [-V[V]]  [-d debuglevel]  [-n]  [-v]  [-c]  [-f file]  [-r]
10       [-z sizelimit] [-M[M]] [-x] [-D binddn]  [-W]  [-w passwd]  [-y passwd‐
11       file]     [-H ldapuri]     [-h ldaphost]    [-p ldapport]    [-P {2|3}]
12       [-e [!]ext[=extparam]]    [-E [!]ext[=extparam]]    [-o opt[=optparam]]
13       [-O security-properties]   [-I]   [-Q]   [-N]  [-U authcid]  [-R realm]
14       [-X authzid] [-Y mech] [-Z[Z]] [DN [...]]
15

DESCRIPTION

17       ldapdelete is a shell-accessible interface  to  the  ldap_delete_ext(3)
18       library call.
19
20       ldapdelete opens a connection to an LDAP server, binds, and deletes one
21       or more entries.  If one or more DN  arguments  are  provided,  entries
22       with those Distinguished Names are deleted.  Each DN should be provided
23       using the LDAPv3 string representation as defined in RFC 4514.   If  no
24       DN  arguments  are  provided, a list of DNs is read from standard input
25       (or from file if the -f flag is used).
26

OPTIONS

28       -V[V]  Print version info.  If -VV is given, only the version  informa‐
29              tion is printed.
30
31       -d debuglevel
32              Set  the LDAP debugging level to debuglevel.  ldapdelete must be
33              compiled with LDAP_DEBUG defined for this  option  to  have  any
34              effect.
35
36       -n     Show  what  would  be  done,  but don't actually delete entries.
37              Useful for debugging in conjunction with -v.
38
39       -v     Use verbose mode, with many diagnostics written to standard out‐
40              put.
41
42       -c     Continuous   operation   mode.    Errors   are   reported,   but
43              ldapdelete will  continue  with  deletions.   The default is  to
44              exit after reporting an error.
45
46       -f file
47              Read a series of DNs from file, one per line, performing an LDAP
48              delete for each.
49
50       -r     Do a recursive delete.  If the DN specified isn't  a  leaf,  its
51              children,  and all their children are deleted down the tree.  No
52              verification is done, so if you add this switch, ldapdelete will
53              happily delete large portions of your tree.  Use with care.
54
55       -z sizelimit
56              Use  sizelimit when searching for children DN to delete, to cir‐
57              cumvent any server-side size limit.  Only useful in  conjunction
58              with -r.
59
60       -M[M]  Enable manage DSA IT control.  -MM makes control critical.
61
62       -x     Use simple authentication instead of SASL.
63
64       -D binddn
65              Use the Distinguished Name binddn to bind to the LDAP directory.
66              For SASL binds, the server is expected to ignore this value.
67
68       -W     Prompt for simple authentication.  This is used instead of spec‐
69              ifying the password on the command line.
70
71       -w passwd
72              Use passwd as the password for simple authentication.
73
74       -y passwdfile
75              Use  complete  contents of passwdfile as the password for simple
76              authentication.
77
78       -H ldapuri
79              Specify URI(s) referring to the ldap server(s); only the  proto‐
80              col/host/port  fields  are  allowed; a list of URI, separated by
81              whitespace or commas is expected.
82
83       -h ldaphost
84              Specify an alternate host on which the ldap server  is  running.
85              Deprecated in favor of -H.
86
87       -p ldapport
88              Specify  an  alternate TCP port where the ldap server is listen‐
89              ing.  Deprecated in favor of -H.
90
91       -P {2|3}
92              Specify the LDAP protocol version to use.
93
94       -e [!]ext[=extparam]
95
96       -E [!]ext[=extparam]
97
98              Specify general extensions with -e and  delete  extensions  with
99              -E.  ´!´ indicates criticality.
100
101              General extensions:
102                [!]assert=<filter>    (an RFC 4515 Filter)
103                !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
104                [!]bauthzid           (RFC 3829 authzid control)
105                [!]chaining[=<resolve>[/<cont>]]
106                [!]manageDSAit
107                [!]noop
108                ppolicy
109                [!]postread[=<attrs>] (a comma-separated attribute list)
110                [!]preread[=<attrs>]  (a comma-separated attribute list)
111                [!]relax
112                sessiontracking
113                abandon,cancel,ignore (SIGINT sends abandon/cancel,
114                or ignores response; if critical, doesn't wait for SIGINT.
115                not really controls)
116
117              Delete extensions:
118                (none)
119
120       -o opt[=optparam]
121
122              Specify general options.
123
124              General options:
125                nettimeout=<timeout>  (in seconds, or "none" or "max")
126                ldif-wrap=<width>     (in columns, or "no" for no wrapping)
127
128       -O security-properties
129              Specify SASL security properties.
130
131       -I     Enable  SASL  Interactive  mode.   Always prompt.  Default is to
132              prompt only as needed.
133
134       -Q     Enable SASL Quiet mode.  Never prompt.
135
136       -N     Do not use reverse DNS to canonicalize SASL host name.
137
138       -U authcid
139              Specify the authentication ID for SASL bind.  The  form  of  the
140              identity depends on the actual SASL mechanism used.
141
142       -R realm
143              Specify  the  realm of authentication ID for SASL bind. The form
144              of the realm depends on the actual SASL mechanism used.
145
146       -X authzid
147              Specify the requested authorization ID for SASL  bind.   authzid
148              must be one of the following formats: dn:<distinguished name> or
149              u:<username>
150
151       -Y mech
152              Specify the SASL mechanism to be  used  for  authentication.  If
153              it's  not  specified, the program will choose the best mechanism
154              the server knows.
155
156       -Z[Z]  Issue StartTLS (Transport Layer Security) extended operation. If
157              you  use  -ZZ, the command will require the operation to be suc‐
158              cessful.
159

EXAMPLE

161       The following command:
162
163           ldapdelete "cn=Delete Me,dc=example,dc=com"
164
165       will  attempt  to  delete  the  entry  named   "cn=Delete   Me,dc=exam‐
166       ple,dc=com".   Of  course  it  would  probably  be  necessary to supply
167       authentication credentials.
168

DIAGNOSTICS

170       Exit status is 0 if no errors occur.  Errors result in a non-zero  exit
171       status and a diagnostic message being written to standard error.
172

SEE ALSO

174       ldap.conf(5),  ldapadd(1), ldapmodify(1), ldapmodrdn(1), ldapsearch(1),
175       ldap(3), ldap_delete_ext(3)
176

AUTHOR

178       The OpenLDAP Project <http://www.openldap.org/>
179

ACKNOWLEDGEMENTS

181       OpenLDAP Software is developed and maintained by The  OpenLDAP  Project
182       <http://www.openldap.org/>.  OpenLDAP Software is derived from the Uni‐
183       versity of Michigan LDAP 3.3 Release.
184
185
186
187OpenLDAP 2.4.46                   2018/03/22                     LDAPDELETE(1)
Impressum