Modify only one attribute that has multiple values of the same name

[Brian Gaber]

I have a LDAP object that contains an attribute SFTrule that can have multiple values. How do I change just one of the SFTrule attribute values?

Thanks.

Brian Gaber

[Francis Swasey]

On Apr 25, 2013, at 11:57 AM, Brian Gaber <Brian...@ssc-spc.gc.ca> wrote:

> I have a LDAP object that contains an attribute SFTrule that can have multiple values. How do I change just one of the SFTrule attribute values?

In pure ldif:

dn: existing dn
changetype: modify
delete: SFTrule
SFTrule: old value
-
add: SFTrule
SFTrule: new value
-

[Jerome Cartagena]

There is no such thing as "modify" on a multivalued attribute. As
mentioned by Francis, you will have to delete the value you want to change
and add a new one in place of it. The real warning is that you never
really want to use the changetype: replace on a multi-valued attribute.
This is because you will essentially be deleting-all existing value and
replacing it with the new value you are adding. Most often than not, this
is not what you want to do.

-Jerome

--

~Jerome

[Brian Gaber]

Would this be the correct Net::LDAP syntax to delete the particular multivalued attribute?

$del_mesg = $ldap->modify( $dn,
delete => {
member => [
"SFTrule=$value" # Remove only this member
],
}
);

I ask because I am getting this error:

LDAP Error Code: 21 - member: value #0 invalid per syntax

Thanks.

[Brian Gaber]

Or should the syntax be:

$del_mesg = $ldap->modify( $dn,
delete => {

SFTrule => [
"$value" # Remove only this SFTrule value
],
}
);

This produces a LDAP Error Code: 16 - modify/delete: SFTrule: no such value

[Francis Swasey]

Brian,

What you really want is:

$del_msg = $ldap->modify( $dn,
changes => [
# delete old value
delete => [ SFTrule => [ "$old_value" ] ],
# add new value
add => [ SFTrule => [ "$new_value" ] ]
]
);

Why do both the add and delete in a single modify? So that it is treated as an atom and if EITHER fails, NEITHER happens (which is the creed -- "at the very least, do no harm")

This is straight out of the perl-ldap documentation, have you read it?

- Frank

[Brian Gaber]

Francis,

I have read it on CPAN. I guess I missed that part.

Thanks.

Brian