LDAP Modify Operations

Overview

Changes to Active Directory object attributes can be expressed as LDAP modify operations. With ldapmodify, LDIF (LDAP Data Interchange Format) makes add, delete, and replace explicit. This helps record changes to multi-valued attributes such as SPNs and delegation attributes.

Types of LDAP Modify Operations

Operation	Meaning	Caution
`add`	Add an attribute value.	On a multi-valued attribute, existing values can remain in place.
`delete`	Delete an attribute value.	Specifying a value deletes only that value; specifying only the attribute name deletes the entire attribute.
`replace`	Replace attribute values.	On a multi-valued attribute, all values not specified are removed, so record the existing values first.

For a multi-valued attribute such as servicePrincipalName, it is safer to delete or add only the necessary values. replace changes the whole attribute and can easily break existing SPNs.

LDIF Example: Moving an SPN

This example moves HTTP/web01.example.local from WEB01$ to DC01$. In a real environment, verify the DN and SPN against their current values first.

dn: CN=WEB01,OU=Servers,DC=example,DC=local
changetype: modify
delete: servicePrincipalName
servicePrincipalName: HTTP/web01.example.local
-

dn: CN=DC01,OU=Domain Controllers,DC=example,DC=local
changetype: modify
add: servicePrincipalName
servicePrincipalName: HTTP/web01.example.local
-

Create the restoration LDIF in the opposite direction.

dn: CN=DC01,OU=Domain Controllers,DC=example,DC=local
changetype: modify
delete: servicePrincipalName
servicePrincipalName: HTTP/web01.example.local
-

dn: CN=WEB01,OU=Servers,DC=example,DC=local
changetype: modify
add: servicePrincipalName
servicePrincipalName: HTTP/web01.example.local
-

Why Use ldapmodify

Explicit delete and add operations leave the changes recorded as LDIF.
Change only the necessary values in a multi-valued attribute.
Make review before execution and creation of a restoration LDIF easier.
Show the LDAP operation more clearly than a GUI or custom tool.

It does not necessarily provide AD-specific validation or safeguards. For SPNs, check for duplicates with setspn -Q and setspn -X. For routine administration, also consider a dedicated tool such as setspn -S.

Pre-execution Checklist

Is the target object’s DN correct?
Have you recorded the target attribute’s current values?
Are you avoiding replace on multi-valued attributes?
Have you checked for duplicate SPNs and delegation effects?
Are the environment’s security requirements for LDAPS, LDAP signing, and authentication methods met?
Have you considered DC replication delay?
Have you prepared a rollback LDIF?

Common Errors

Error	Main meaning
`Insufficient access rights`	No write permission on the target object or attribute.
`No such attribute`	The value or attribute you tried to delete does not exist.
`Type or value exists`	The value you tried to add already exists.
`Constraint violation`	An AD constraint, duplicate, or invalid format was encountered.
`Strong(er) authentication required`	Stronger authentication protection, such as signing or LDAPS, is required.