Re: ldapmodify on multiple dn's

[Jon Roberts <jon@jonanddeb.net>]

Jason Joines wrote:
>    I need to delete a user from a large number of groups.  Is there 
> anyway to use ldapmodify to remove the user from all the groups at 
> once?  

LDIF is probably the right idea.

> I tried using an LDIF like the following but as soon as 
> ldapmodify gets to the next dn, it throws an error about unknown 
> attribute type.

It helps if you post the exact error message you get.

> I also tried with just a blank line instead of a dash 
> and with no separator.

Use a blank like between entries. A dash is used to separate operations 
on different attributes from the same dn.

> dn: cn=web,dc=my,dc=domain,dc=org
> changetype: modify
> delete: memberuid
> memberuid: jadoe

Assuming these are posixgroups from the nis.schema and jadoe is a value 
of each groups memberuid attribute, this should work. If they aren't 
posixgroup but rather groupofnames entries, you need something more like:

dn: cn=web,dc=my,dc=domain,dc=org
changetype: modify
delete: member
member: uid=jadoe,dc=my,dc=domain,dc=org

Jon Roberts
www.mentata.com