ldap-diff

Description

Compare the contents of two LDAP servers.

The 'ldap-diff' tool outputs the difference between data stored in two LDAP servers into an LDIF file. This file could be used with the 'ldapmodify' command to bring the source directory server in sync with the target directory server. The specific entries to compare can be controlled with the --searchFilter option. In addition, only a subset of attributes can be compared by listing those attributes as trailing arguments of the command. Specific attributes can also be excluded by prepending a ^ character to the attribute. On Windows operating systems, excluded attributes must be quoted, for example, "^attrToExclude". When retrieving entries from a Ping Identity Directory Server, the @objectClassName notation can be used to compare only attributes that are defined for a given objectclass.

This command can be used on servers actively being modified, without reporting false positives due to replication delays, by checking differing entries multiple times. By default, it will re-check each differing entry twice, pausing two seconds between checks. These settings can be configured with the --numPasses and --secondsBetweenPass options. The output is formatted so that delete operations come first, modify operations come next, and add operations come last. This gives the best chance that the resulting output file can be used to bring the source server into sync with the target server without causing any conflicts. This takes into account attribute uniqueness constraints as well as that child entries must be deleted before parents and parents must be added before children.

The directory user specified for performing the searches must be privileged enough to see all of the entries being compared and to issue a long-running, unindexed search. For the Ping Identity Directory Server, the out-of-the-box cn=Directory Manager user has these privileges, but you can assign the necessary privileges by setting the following attributes in the user entry

ds-cfg-default-root-privilege-name: unindexed-search
ds-cfg-default-root-privilege-name: bypass-acl
ds-rlim-size-limit: 0
ds-rlim-time-limit: 0
ds-rlim-idle-time-limit: 0
ds-rlim-lookthrough-limit: 0

For servers from other vendors, consult their documentation for configuring the proper privileges.

The 'ldap-diff' tool tries to make efficient use of memory, but it must store the DNs of all entries in memory. For directories that contain tens of millions of entries, the tool might require a few gigabytes of memory. If the progress of the tool slows dramatically, it might be running low on memory. The memory used by ldap-diff can be customized by editing the ldap-diff.java-args setting in the config/java.properties file and running the dsjavaproperties command.

Examples

ldap-diff --outputLDIF difference.ldif --baseDN dc=example,dc=com \
     --sourceHost server1.example.com --targetHost server2.example.com \
     --sourceBindDN uid=admin,dc=example,dc=com --sourceBindPassword password

Arguments

-V
--version

-H
--help

--help-debug

-h {host}
--sourceHost {host}

-p {port}
--sourcePort {port}

--sourceUseSSL

--sourceUseStartTLS

-D {bindDN}
--sourceBindDN {bindDN}

-w {bindPassword}
--sourceBindPassword {bindPassword}

--sourceBindPasswordFile {bindPasswordFile}

--sourceSASLOption {name=value}

--sourceDNsFile {file-with-dns}

-O {host}
--targetHost {host}

--targetPort {port}

--targetUseSSL

--targetUseStartTLS

--targetBindDN {bindDN}

--targetBindPassword {bindPassword}

-F {bindPasswordFile}
--targetBindPasswordFile {bindPasswordFile}

--targetSASLOption {name=value}

--targetDNsFile {file-with-dns}

-X
--trustAll

-K {keystorePath}
--keyStorePath {keystorePath}

-W {keystorePassword}
--keyStorePassword {keystorePassword}

-u {keystorePasswordFile}
--keyStorePasswordFile {keystorePasswordFile}

-N {nickname}
--certNickname {nickname}

-P {truststorePath}
--trustStorePath {truststorePath}

--trustStorePassword {truststorePassword}

-U {path}
--trustStorePasswordFile {path}

-b {baseDN}
--baseDN {baseDN}

-f {filter}
--searchFilter {filter}

-s (base|one|sub|subordinate)
--searchScope (base|one|sub|subordinate)

-B {branchDN}
--excludeBranch {branchDN}

-o {file}
--outputLDIF {file}

-Q
--quiet

--numConnections {num-connections}

--numPasses {num-passes}

--secondsBetweenPass {seconds}

--missingOnly