Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having issues importing users with ldapadd and ldif files. The error I'm getting is:

ldap_add: Constraint violation (19)
additional info: structuralObjectClass: no user modification allowed

The users imported are all part of ou=People,dc=example,dc=org. The LDAP server already contains this base DN.

The /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif file contains the following ACL entry:

olcAccess: {2}to dn.base="ou=People,dc=example,dc=org" attrs=children by gr
 oup.exact="cn=Manager,ou=Roles,dc=example,dc=org" manage

The ldif file is imported as follows:

ldapadd -f import.ldif -xv -D "cn=drupal,ou=Apps,dc=example,dc=org" -h localhost -W

The cn=drupal,ou=Apps[...] entry is a member of cn=Manager,ou=Roles,dc=example,dc=org so accordingly it should have sufficient permissions to write (since manage is the highest level of permissions available).

When I issue the ldapadd command the import fails on the very first ldif entry. The full command output is then:

add objectClass:
add uid:
add mail:
add cn:
    John D Merrell
add structuralObjectClass:
add entryUUID:
add creatorsName:
add createTimestamp:
add userPassword:
add givenName:
    John D
add sn:
add entryCSN:
add modifiersName:
add modifyTimestamp:
adding new entry ",ou=People,dc=example,dc=org"
ldap_add: Constraint violation (19)
    additional info: structuralObjectClass: no user modification allowed

I've tested importing users that did or did not exist on the LDAP and I get the aforementioned error in either case.

Can someone explain the origin of the problem and how it may be circumvented?

share|improve this question
up vote 3 down vote accepted

How did you generate those LDIF files? structuralObjectClass is one of the internal values in OpenLDAP and user - even administrator - cannot normally modify those.

Either remove those structuralObjectClass lines from your LDIF or import the entries back with slapadd (I bet you generated the LDIF files with slapcat).

share|improve this answer
I did generate my LDIF files with slapcat. If there is a better way please advise. Following your advise I had to remove the following fields for the import to work: structuralObjectClass, entryUUID, creatorsName, createTimestamp, entryCSN, modifiersName, modifyTimestamp. – Max Jul 14 '11 at 10:05
You should use slapadd if you need to restore an LDIF file generated with slapcat. The slapadd man page says: "The output of slapcat is intended to be used as input to slapadd(8). The output of slapcat cannot generally be used as input to ldapadd(1) or other LDAP clients with‐ out first editing the output. This editing would normally include reordering the records into superior first order and removing no-user-modification operational attributes." – Janne Pikkarainen Jul 14 '11 at 10:14
Oh - you can generate an ldapadd compatible LDIF with ldapsearch -L [your_other_options] >your_data.ldif – Janne Pikkarainen Jul 14 '11 at 10:16
Indeed, that's what I'm going to be using. – Max Jul 14 '11 at 10:25

Below is not solution to question, but utility code to remove structural elements. Sample python code remove structural elements. Use out.ldif

structural_elements = ["structuralObjectClass","entryUUID", "creatorsName","createTimestamp","entryCSN", "modifiersName","modifyTimestamp"]
    with open("ldap_data_out.ldif","w+") as outfile:
        with open("ldap_data_in.ldif", "r") as infile:
            lines = infile.readlines()
            for line in lines:
                print line.split(":")[0]
                if line.split(":")[0] in structural_elements:
                    print "ignoring ,", line
share|improve this answer

you need delete the following lines in the ldif file:

share|improve this answer
Full answers are preferred here. A 'try this' answer without explanation isn't really useful on a question several years old. – richardb Feb 5 at 11:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.