I'd like to write a ldapmodify command and pass in a ldif file to move computers to a new OU. This means I need to change the DNs.
Example:
CN=joesworkstation,OU=training,OU=computers,DC=my,DC=domain,DC=com
to
CN=joesworkstation,OU=laptops,DC=my,DC=domain,DC=com
The man ldif shows how to rename a CN for a user, but not changing a DN for a computer. Based on their example though, this is my ldif file format guess:
dn: CN=joesworkstation,OU=training,OU=computers,DC=my,DC=domain,DC=com
changetype: modify
replace: dn
dn: CN=joesworkstation,OU=laptops,DC=my,DC=domain,DC=com
deleteoldrdn: 1
Is this the most correct way to do this?
Depending on LDAP Server Implementation an LDIF should be something like:
dn: CN=joesworkstation,OU=training,OU=computers,DC=my,DC=domain,DC=com
changetype: moddn
newsuperior: OU=laptops,DC=my,DC=domain,DC=com
# remove old RDN entry
deleteoldrdn: 1
There could be restraints on such activities.
Perform due diligence.
There maybe better methods for Microsoft Active Directory.
-jim
I was able to get a solution to work finally today.
To update the DN of computer objects I used the following LDIF formatted file:
dn: CN=joesworkstation,OU=training,OU=computers,DC=my,DC=domain,DC=com
changetype: moddn
newrdn: joesworkstation
deleteoldrdn: 1
newsuperior: OU=laptops,DC=my,DC=domain,DC=com
This worked quite well and kept all the values of the attributes of the computer object in tact as well.
Related
I created an OpenLDAP server on Ubuntu 22.04, and created users but forgot to add them to a organizational unit (ou). How can I associate them all to an ou now ?
The actual server looks like this:
dn=company
ou=Users
uid=user1
uid=user2
uid=user3
...
What I would like is:
dn=company
ou=Users
uid=user1
uid=user2
uid=user3
...
Concretely, I would like to go from this:
uid=user1,dc=example,dc=fr
to this:
uid=user1,ou=Users,dc=example,dc=fr
Adding an ou attribute to the entry is one thing, moving the entry in the DIT is another thing. For the latter, you need to use the newsuperior directive.
Using ldapmodify -f with changetype: (modrdn|moddn) :
dn: uid=user1,dc=example,dc=fr
changetype: modrdn
# rdn unchanged
newrdn: uid=user1
# deletes old entry
deleteoldrdn: 1
# adds to Users hierarchy
newsuperior: ou=Users,dc=example,dc=com
Using ldapmodrdn -r -s <newsuperior> <dn> <newrdn> :
ldapmodrdn -r -s "ou=Users,dc=example,dc=com" "uid=user1,dc=example,dc=fr" "uid=user1"
Actually I just found an answer on my own.
I simply did a LDIF file modify.ldif:
dn: uid=user1,dc=example,dc=fr
changetype: modify
add: ou
ou: Users
And then ldapmodify -x -D cn=admin,dc=example,dc=fr -W -f ./modify.ldif
I'm connected to my LDAP connection.
I'm trying to import an LDIF file to it by right clicking and using the wizard.
As I choose the file, check the overwrite option and press OK,
I get the following error:
Error while importing LDIF
javax.naming.NameAlreadyBoundException:
at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.java:1359)
And this appears in the Modification Logs tab:
#!RESULT ERROR
#!CONNECTION ldap://192.168.99.100:389
#!DATE 2018-01-24T11:01:17.743
#!ERROR
dn: dc=mycompany,dc=net
changetype: add
dc: mycompany
objectclass: dcObject
objectclass: organization
o: mycompany.net
I tried googling around with the error but can't find anything on this particular matter.
Also, as I choose the LDIF-file, even after uninstalling and reinstalling the program, it warns already upon selecting the LDIF-file that "selected logfile already exists".
The description of javax.naming.NameAlreadyBoundException sounds like this is a weird name for the LDAP result code entryAlreadyExists(68) returned when processing the LDAP Add Operation.
It means just that: An LDAP entry with this DN already exists. You cannot add a second one with the same DN.
New to LDAP. Exported the DIT as an LDIF from Apache Studio. Tried to import the LDIF file. Error occurs:
...
#!ERROR [LDAP: error code 32 - Unable to add entry 'dc=example,dc=com' because its parent entry 'dc=com' does not exist in the server.]
dn: dc=example,dc=com
changetype: add
dc: example
objectClass: domain
objectClass: top
The LDAP server is UnboundID LDAP SDK for Java 3.2.0.
I don't know enough LDAP to fix it.
Should Apache Studio have created dc=com before this entry?
LDIF export does not guarentee ordering. LDIF import assumes ordering.
So to answer your question, yes, you should have created dc=com first.
There is a subtle exception where you can have a dc=example.com as a single node which looks confusing. But periods are legal in a name.
I have created 4 new attributes on cn=schema and also created a new objectclass with the 4 attributes set as MUST.
I tried to add the objectclass to existing entry which obviously return an error because those 4 new attributes are not setup for the ldap entry.
I created an ldif file and ran ldapmodify but get object violation error. Can anyone tellme whats causing this error and if I'm missing anything.
ldif
#ldapmodify.bat -h localhost -p 1389 -D "cn=Directory Manager" -w xxxxx -a -f entry.ldif
dn: uid=user.0,ou=People,dc=example,dc=com
changetype: modify
add: disabledFlag
disabledFlag: n
-
add: passwordData
passwordData:< file:/C:\\oud\\asinst_1\\OUD\\bat\\images.png
-
add: anonymousID
anonymousID: nah
-
add: challengeResponse
challengeResponse: nah
Error after executing the command.
Processing MODIFY request for uid=user.0,ou=People,dc=example,dc=com
MODIFY operation failed
Result Code: 65 (Object Class Violation)
Additional Information: Entry uid=user.0,ou=People,dc=example,dc=com cannot not be modified because the resulting entry would have violated the server schema: Entry uid=user.0,ou=People,dc=example,dc=com violates the Directory Server schema configuration because it includes attribute anonymousID which is not allowed by any of the objectclasses defined in that entry
LDAP installed is OUD 11gR2.
Finally able to solve the question myself.
This is what I did
Changed STRUCTURAL to ABSTRACT for the objectclass since there can be only one STRUCTURAL and updated objectclass to have MAY attributes instead of MUST.
used ldap port instead of admin port in the ldap modify command.
I still couldn't figure out why cant objectclass be created with MUST ? Is this chicken and egg kind of problem?
I'm trying to setup an LDIF file which shall add a new attribute value to an existing node. The attribute is a mandatory attribute of custom objectclass.
Here is the contents of the LDIF file 'add.ldif':
dn: cn=hna,cn=Users,DC=lan,DC=test,DC=de
changetype: modify
add: objectclass
objectclass: MyCustomObjectClass
-
add: myCustomAttribute
myCustomAttribute: someValue
-
Problem: when I try add that to the LDAP server using
ldapmodify -h ... -D ... -w ... -x -f add.ldif
I get the error message
ldap_modify: Objectclass violation (65)
additional info: 00002014: objectclass_attrs: attribute 'myCustomAttribute'
on entry 'cn=hna,cn=Users,DC=lan,DC=test,DC=de' does not exist in the
specified objectclasses
When I leave out the 'add' of 'myCustomAtribute' then of course then I get:
ldap_modify: Objectclass violation (65)
additional info: 00002014: objectclass_attrs: at least one mandatory attribute
('myCustomAttribute') on entry 'cn=hna,cn=Users,DC=lan,DC=test,DC=de'
wasn't specified!
Any idea what is wrong with my approach?
ldapmodify is the one from OpenLDAP; the server is a Samba V4 LDAP.
This should work:
dn: cn=hna,cn=Users,DC=lan,DC=test,DC=de
changetype: modify
add: objectclass
objectclass: MyCustomObjectClass
add: myCustomAttribute
myCustomAttribute: someValue
There MUST be an empty line after the last line.
The "-" is only needed if you want to perform separate modify operations and have them be atomic. (ie all work or all fail).
As adding the objectclass requires MUST attributes must happen in the same modification.
By the way I have noticed that some ldapmodify programs do not handle these properly.
-jim