What's changed: Initial version (topic 2.07, subtopics 2.07.1–2.07.4)
1.3Using LDAP Clients
Learn the basic commands for operating an LDAP directory server from a client: ldapadd to add entries, ldapdelete to remove them, ldapmodify to change attributes, ldapsearch to search, and ldappasswd to change passwords.
An LDAP (Lightweight Directory Access Protocol) directory centralizes user and organizational information for search and sharing across the company. As a lead-in to server configuration, Exam 202 tests the standard commands for operating a directory from the client side at weight 2. The core is mapping five commands, each with a distinct purpose.
1.3.1Adding, deleting, and modifying entries
- ldapadd adds new entries written in LDIF format to the directory (
ldapadd -x -D <bindDN> -W -f new.ldif). - ldapdelete removes the entry at a given DN (Distinguished Name) (
ldapdelete -x -D <bindDN> -W "<DN>"). - ldapmodify applies attribute add/replace/delete to an existing entry via LDIF (including
changetype: modify). A single command can also perform add/delete-equivalent operations by switching thechangetypeinside the LDIF.
1.3.2Searching and changing passwords
- ldapsearch searches the directory using a search filter (e.g.,
(uid=alice)) and a base DN (ldapsearch -x -b "<baseDN>" "(uid=alice)"). It is the most commonly used read-only verification command. - ldappasswd is dedicated to changing just the password attribute of a user entry (
ldappasswd -x -D <bindDN> -W -S "<userDN>"). While ldapmodify can also rewrite the userPassword attribute directly, ldappasswd's practical advantage is that it properly handles hashing and related details as a dedicated command. - Most of these commands share common options:
-x(simple authentication),-D <bindDN>(the bind DN),-W(prompt for the bind password), and-b <baseDN>(search base).
The most-tested pattern is a one-to-one mapping of purpose to command name: add = ldapadd, delete = ldapdelete, modify attributes = ldapmodify, search = ldapsearch, password-only = ldappasswd. Also watch the new-vs-existing distinction: creating a whole new entry is ldapadd, while rewriting a few attributes of an existing entry is ldapmodify.
Trace it end to end, from onboarding to offboarding. When HR sends over a new hire's info, gather name, email, and department into an LDIF file and register it with ldapadd. Confirm the entry landed correctly with ldapsearch (e.g., ldapsearch -x -b "dc=example,dc=com" "(uid=suzuki)")—the standard way to visually verify. When the person transfers and their department (ou attribute) changes, write just the delta as an LDIF with changetype: modify and run ldapmodify. For issuing an initial password or letting a user change their own, use ldappasswd to rewrite the userPassword attribute safely (technically ldapmodify can also write userPassword directly, but the password-dedicated ldappasswd is the more appropriate practical choice). When someone leaves, remove the entry entirely with ldapdelete (targeting its DN). Remember: these five commands are client-side tools for manipulating directory contents, not for configuring the LDAP server itself.
| Command | Purpose | Target |
|---|---|---|
| ldapadd | Add a new entry | LDIF (new) |
| ldapdelete | Delete an entry | DN |
| ldapmodify | Modify attributes on an existing entry | LDIF (changetype: modify) |
| ldapsearch | Search for entries | Search filter + base DN |
| ldappasswd | Change a password | User DN |
Trap: "use ldapadd to change an existing user's department" is wrong—ldapadd is only for adding new entries; modifying attributes on an existing entry requires ldapmodify. Also, "ldapsearch can rewrite directory contents" is wrong—ldapsearch is search-only (read-only) and never writes changes.
1.3.3Section summary
- Add = ldapadd / delete = ldapdelete / attribute change = ldapmodify / search = ldapsearch / password = ldappasswd
- Input is LDIF (add/modify), a DN (delete), or a search filter + base DN (search)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to change only the department attribute of an existing user entry in the LDAP directory. Which command is appropriate?
Q2. You want to verify whether the entry uid=suzuki was correctly registered, by searching from base DN "dc=example,dc=com". Which command is appropriate?
Q3. You want to completely remove the LDAP entry of a user who has left the company. Which combination of required information and command is correct?