LDIF is the LDAP Data Interchange Format defined in RFC 2849. It is a text format that describes directory entries or changes to them. Entry records and modification records never share a file. Modification records use four types named add, delete, modify and modrdn.
LDIF files move directory data between LDAP servers and apply batch edits. Small syntax slips break an import so the rules matter.
Rules follow RFC 2849. Samples below are illustrations and not exports from a real server.
What is an LDIF File?
LDIF is a plain text format for directory entries and for changes to them. Administrators use it to import and export data between LDAP directory servers or to describe a set of changes.
How is an LDIF File Structured?
- Version line. Files start with
version: 1. - Records. Blank lines separate records.
- One kind per file. Entry records and modification records never share a file.
- Comments. Lines that start with # are ignored.
version: 1
dn: cn=Barbara Jensen,ou=People,dc=example,dc=com
cn: Barbara Jensen
sn: Jensen
mail: bjensen@example.comEvery entry record starts with a dn: line and continues with attribute and value lines.
Which Modification Types Exist?
| Type | Purpose |
|---|---|
| add | Create an entry |
| delete | Remove an entry |
| modify | Edit attributes with add, delete or replace blocks ended by a line with a single dash |
| modrdn | Rename an entry. Needs newrdn and deleteoldrdn lines |
dn: cn=Barbara Jensen,ou=People,dc=example,dc=com
changetype: modify
replace: mail
mail: barbara@example.com
-When do Values Need Base64?
Double colons after the attribute name mark a base64 value. RFC 2849 requires it for values with unsafe characters and for values that start with a space, a colon or a less than sign. Values that end with a space should use it too.
Long lines may fold. One line break plus one space joins the lines again. Folding must not split a multi byte UTF-8 character.
What should You Watch Before an Import?
RFC 2849 warns that LDIF files often contain personal data and that file references can add local content. Treat files from unknown sources with care and verify their integrity. LDIF has no built in authentication.
Related reading: IBM Db2 and the ICS file format.
Frequently Asked Questions
What is LDIF?
It is a text format for LDAP directory entries and changes defined in RFC 2849.
What does the First Line of an LDIF File Say?
It says version: 1.
Can One LDIF File Mix Entries and Modifications?
No. Entry records and modification records never share a file.
What does a Double Colon Mean in LDIF?
It marks a base64 encoded value.
How do I Add a Comment to LDIF?
Start the line with the # character.
Key Takeaways
- LDIF describes LDAP entries and changes in plain text.
- Files start with version: 1.
- One file never mixes entry and modification records.
- Double colon marks base64 values.
- Check files from unknown sources before import.
Sources and References
Rules follow the RFC.
- RFC 2849 The LDAP Data Interchange Format (LDIF) Technical Specification www.rfc-editor.org