LDIF idempotent apply tool

Latest on Hackage:0.2.0

This package is not currently in any snapshots. If you're interested in using it, we recommend adding it to Stackage Nightly. Doing so will make builds more reliable, and allow stackage.org to host generated Haddocks.

MIT licensed and maintained by Igor Pashev


LDIF idempotent apply tool. This tool is similar to ldapmodify with one exception: it’s idempotent. It was written to help declarative deployments with NixOS.

How it works

  1. If change type is not specified, it adds or replaces an entry.
  2. If change type is specified, it acts like normal ldapmodify.


ldapply is written in Haskell with GHC. All required Haskell libraries are listed in ldapply.cabal. Use cabal-install to fetch and build all pre-requisites automatically.


Type ldapply --help to see usage summary:

  ldapply [options] LDIF...

  -H <ldapuri>       LDAP URL to connect to [default: ldapi:///]

  -x                 Use simple bind instead of default SASL External
  -D <binddn>        Use <binddn> for the distinguished name or authorization identity
  -w <passwd>        Use <passwd> as the password for simple bind
  -y <passwdfile>    Read password from <passwdfile>, only the first line is read

  -h, --help         Show this message

If option -w is given, -y is ignored.

LDIF example

dn: dc=nodomain
objectClass: top
objectClass: dcObject
objectClass: organization
dc: nodomain
o: Example, Inc.

dn: cn=reader,dc=nodomain
objectclass: top
objectclass: organizationalRole
objectclass: simpleSecurityObject
cn: reader
description: Initial description
userPassword: qwerty123lol

# description will be removed, userPassword changed:
dn: cn=reader,dc=nodomain
objectclass: top
objectclass: simpleSecurityObject
objectclass: organizationalRole
cn: reader
userPassword: foobar12345

# userPassword will be changed:
dn: cn=reader,dc=nodomain
changetype: modify
replace: userPassword
userPassword: anothersecretstuff

dn: cn=reader,dc=nodomain
changetype: modify
replace: description
description: foo

# This will be deleted if exists:
dn: cn=reader,dc=nodomain
changetype: delete



  • Require LDAP > 0.6.0 for ldapExternalSaslBind.
  • Support simple bind. Added options -x, -D, -w, -y similar to ldapmodify.
  • changetype: delete works if entry to be deleted does not exist.


  • Initial release.
  • Works only with UNIX socket authentication.
comments powered byDisqus