Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have installed a mail server which comes with an OpenLDAP schema and some additional attributes. One of the attributes controls which users have administration rights on the calendar and public folders feature of the server. How do I set these attributes on our existing users in the LDAP database?

share|improve this question
@David - what kind of mail system is this? – Systemsninja Jun 9 '09 at 8:18
It's Zarafa ( – David Holm Jun 9 '09 at 8:22
up vote 7 down vote accepted

ldapmodify is your friend.

Create a "modify" ldif file.


dn: cn=Elmer Fudd,
changetype: modify
add: isAdmin
isAdmin: 1

Save file and use it with ldapmodify:

ldapmodify -v -D "cn=manager," -h <host> -W -f changes.ldif
share|improve this answer
I had to use simple authentication (-x) but it worked. Thanks! – David Holm Jun 9 '09 at 8:54
Happy to help :) – rkthkr Jun 9 '09 at 8:57

The easiest way I've discovered to do this is to use gq. It's not the prettiest of applications, but does work reasonably well.

If you find yourself doing the same tasks over and over again, it might be worth writing a script in your favourite scripting language. In Perl you can use Net::LDAP.

share|improve this answer

smbldap-tools and SMBLDAP-TOOLS Addons are perl scripts to manage user and group accounts stored in an LDAP directory.

For examples: smbldap-attribute is a simple and powerful script. This script can add/modify/delete any attribute.

add attribute and value (support multiple values):

smbldap-attribute "uid=user1,dc=example,dc=com" "attribute:value"
smbldap-attribute "uid=user1" "attribute:value"
smbldap-attribute user1 "attribute:value"
smbldap-attribute -s "_" "uid=user1,dc=example,dc=com" "attribute_value"

modify value:

smbldap-attribute "uid=user1,dc=example,dc=com" "attribute:current:new"
smbldap-attribute "uid=user1" "attribute:current:new"
smbldap-attribute user1 "attribute:current:new"
smbldap-attribute -s "/" user1 "attribute/current/new"

delete value:

smbldap-attribute -d "uid=user1,dc=example,dc=com" "attribute:value"
smbldap-attribute -d "uid=user1" "attribute"
smbldap-attribute -d user1 "attribute"
share|improve this answer

There was a Java based LDAP browser/Editor that was quite nice and easy to use. It had not been updated in two or three years, and the link to it seems to have gone away. Gowars was the author, and once you authenticated to a tree, it would allow you to edit entries in a UI which was nice.

Alas, it did not understand schema types, and thus all attribute values were entered freeform, with the expectation that you knew the correct syntax for each attribute.

I have the install binaries (Well Java based, so whatever you want to call them) but all links to the original site seems to be gone. Which is a shame.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.