Looking at man page, I think I will have to run two instances of
ldapmodify. If infile.ldif is my starting ldif file, I can run:
ldapmodify -D "cn=..." -w XXX -S noexist.ldif -x -r -f infile.ldif
The -r will cause existing entries to be overwritten (which I want), the
-S will cause errors to be written to noexist.ldif and skipped. In my
case, the errors would be entries where the dn does not exist in ldap.
So, after the above, just run:
ldapmodify -D "..." -w XXX -x -a -f noexist.ldif
That effectively does what I want to achieve, right?!