1LDAPDELETE(1)               General Commands Manual              LDAPDELETE(1)
2
3
4

NAME

6       ldapdelete - LDAP delete entry tool
7

SYNOPSIS

9       ldapdelete  [-V[V]]  [-d debuglevel]  [-n]  [-v]  [-c]  [-f file]  [-r]
10       [-z sizelimit] [-M[M]] [-x] [-D binddn]  [-W]  [-w passwd]  [-y passwd‐
11       file]        [-H ldapuri]       [-P {2|3}]       [-e [!]ext[=extparam]]
12       [-E [!]ext[=extparam]]   [-o opt[=optparam]]   [-O security-properties]
13       [-I]  [-Q]  [-N] [-U authcid] [-R realm] [-X authzid] [-Y mech] [-Z[Z]]
14       [DN [...]]
15

DESCRIPTION

17       ldapdelete is a shell-accessible interface  to  the  ldap_delete_ext(3)
18       library call.
19
20       ldapdelete opens a connection to an LDAP server, binds, and deletes one
21       or more entries.  If one or more DN  arguments  are  provided,  entries
22       with those Distinguished Names are deleted.  Each DN should be provided
23       using the LDAPv3 string representation as defined in RFC 4514.   If  no
24       DN  arguments  are  provided, a list of DNs is read from standard input
25       (or from file if the -f flag is used).
26

OPTIONS

28       -V[V]  Print version info.  If -VV is given, only the version  informa‐
29              tion is printed.
30
31       -d debuglevel
32              Set  the LDAP debugging level to debuglevel.  ldapdelete must be
33              compiled with LDAP_DEBUG defined for this option to have any ef‐
34              fect.
35
36       -n     Show  what  would  be  done,  but don't actually delete entries.
37              Useful for debugging in conjunction with -v.
38
39       -v     Use verbose mode, with many diagnostics written to standard out‐
40              put.
41
42       -c     Continuous   operation   mode.    Errors   are   reported,   but
43              ldapdelete will  continue  with  deletions.   The default is  to
44              exit after reporting an error.
45
46       -f file
47              Read a series of DNs from file, one per line, performing an LDAP
48              delete for each.
49
50       -r     Do a recursive delete.  If the DN specified isn't  a  leaf,  its
51              children,  and all their children are deleted down the tree.  No
52              verification is done, so if you add this switch, ldapdelete will
53              happily delete large portions of your tree.  Use with care.
54
55       -z sizelimit
56              Use  sizelimit when searching for children DN to delete, to cir‐
57              cumvent any server-side size limit.  Only useful in  conjunction
58              with -r.
59
60       -M[M]  Enable manage DSA IT control.  -MM makes control critical.
61
62       -x     Use simple authentication instead of SASL.
63
64       -D binddn
65              Use the Distinguished Name binddn to bind to the LDAP directory.
66              For SASL binds, the server is expected to ignore this value.
67
68       -W     Prompt for simple authentication.  This is used instead of spec‐
69              ifying the password on the command line.
70
71       -w passwd
72              Use passwd as the password for simple authentication.
73
74       -y passwdfile
75              Use  complete  contents of passwdfile as the password for simple
76              authentication.
77
78       -H ldapuri
79              Specify URI(s) referring to the ldap server(s); only the  proto‐
80              col/host/port  fields  are  allowed; a list of URI, separated by
81              whitespace or commas is expected.
82
83       -P {2|3}
84              Specify the LDAP protocol version to use.
85
86       -e [!]ext[=extparam]
87
88       -E [!]ext[=extparam]
89
90              Specify general extensions with -e and  delete  extensions  with
91              -E.  ´!´ indicates criticality.
92
93              General extensions:
94                [!]assert=<filter>    (an RFC 4515 Filter)
95                !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
96                [!]bauthzid           (RFC 3829 authzid control)
97                [!]chaining[=<resolve>[/<cont>]]
98                [!]manageDSAit
99                [!]noop
100                ppolicy
101                [!]postread[=<attrs>] (a comma-separated attribute list)
102                [!]preread[=<attrs>]  (a comma-separated attribute list)
103                [!]relax
104                sessiontracking[=<username>]
105                abandon,cancel,ignore (SIGINT sends abandon/cancel,
106                or ignores response; if critical, doesn't wait for SIGINT.
107                not really controls)
108
109              Delete extensions:
110                (none)
111
112       -o opt[=optparam]
113
114              Specify any ldap.conf(5) option or one of the following:
115                nettimeout=<timeout>  (in seconds, or "none" or "max")
116                ldif_wrap=<width>     (in columns, or "no" for no wrapping)
117
118
119       -O security-properties
120              Specify SASL security properties.
121
122       -I     Enable  SASL  Interactive  mode.   Always prompt.  Default is to
123              prompt only as needed.
124
125       -Q     Enable SASL Quiet mode.  Never prompt.
126
127       -N     Do not use reverse DNS to canonicalize SASL host name.
128
129       -U authcid
130              Specify the authentication ID for SASL bind.  The  form  of  the
131              identity depends on the actual SASL mechanism used.
132
133       -R realm
134              Specify  the  realm of authentication ID for SASL bind. The form
135              of the realm depends on the actual SASL mechanism used.
136
137       -X authzid
138              Specify the requested authorization ID for SASL  bind.   authzid
139              must be one of the following formats: dn:<distinguished name> or
140              u:<username>
141
142       -Y mech
143              Specify the SASL mechanism to be  used  for  authentication.  If
144              it's  not  specified, the program will choose the best mechanism
145              the server knows.
146
147       -Z[Z]  Issue StartTLS (Transport Layer Security) extended operation. If
148              you  use  -ZZ, the command will require the operation to be suc‐
149              cessful.
150

EXAMPLE

152       The following command:
153
154           ldapdelete "cn=Delete Me,dc=example,dc=com"
155
156       will  attempt  to  delete  the  entry  named   "cn=Delete   Me,dc=exam‐
157       ple,dc=com".   Of  course  it would probably be necessary to supply au‐
158       thentication credentials.
159

DIAGNOSTICS

161       Exit status is 0 if no errors occur.  Errors result in a non-zero  exit
162       status and a diagnostic message being written to standard error.
163

SEE ALSO

165       ldap.conf(5),  ldapadd(1), ldapmodify(1), ldapmodrdn(1), ldapsearch(1),
166       ldap(3), ldap_delete_ext(3)
167

AUTHOR

169       The OpenLDAP Project <http://www.openldap.org/>
170

ACKNOWLEDGEMENTS

172       OpenLDAP Software is developed and maintained by The  OpenLDAP  Project
173       <http://www.openldap.org/>.  OpenLDAP Software is derived from the Uni‐
174       versity of Michigan LDAP 3.3 Release.
175
176
177
178OpenLDAP 2.6.2                    2022/05/04                     LDAPDELETE(1)
Impressum