Searching for soft deletes
Soft-deleted entries are excluded from normal LDAP searches because they represent deleted entries. The updated ldapsearch
tool supports these types of searches.
About this task
There are three different ways to search for soft-deleted entries.
Steps
-
To perform a base-level search on a soft-deleted entry by distinguished name (DN), run the
ldapsearch
command and specify the base DN of the specific soft-deleted entry that you are searching for. -
To filter your search by
ds-soft-delete-entry
object class, run a search for all soft-deleted entries with theldapsearch
command with a filter on theds-soft-delete-entry
object class. -
To return soft-deleted entries, use the soft-delete-entry-access-control with the LDAP search.
The
ldapsearch
tool provides a shortcut option,--includeSoftDeletedEntries
, that sends the control to the server for processing. The control allows for the following search possibilities:-
Return only soft-deleted entries.
-
Return non-deleted entries along with soft-deleted entries.
-
Return only soft-deleted entries in undeleted form.
-
Running a base-level search on a soft-deleted entry
Use the command line to run a base-level search on a soft-deleted entry.
Steps
-
Run the
ldapsearch
command using the base distinguished name (DN) of the specified soft-deleted entry.Example:
$ bin/ldapsearch \ --baseDN entryUUID=4e9b7847-edcb-3791-b11b-7505f4a55af4+uid=user.1,ou=People,dc=example,dc=com \ --searchScope base "(objectClass=*)"
Result:
# Soft-deleted entry DN: # entryUUID=4e9b7847-edcb-3791-b11b-7505f4a55af4+uid=user.1,ou=People,dc=example,dc=com dn: entryUUID=4e9b7847-edcb-3791-b11b-7505f4a55af4+uid=user.1,ou=People,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: ds-soft-delete-entry postalAddress: Aartjan Aalders$59748 Willow Street$Green Bay, TN 66239 postalCode: 66239 description: This is the description for Aartjan Aalders. uid: user.1 userPassword: {SSHA}RdBCwQ2kIw57LukRthjrFBS/oFylJARnmTnorA== employeeNumber: 1 initials: AKA givenName: Aartjan pager: +1 197 025 3730 mobile: +1 890 430 9077 cn: Aartjan Aalders sn: Aalders telephoneNumber: +1 094 100 7524 street: 59748 Willow Street homePhone: +1 332 432 4295 l: Green Bay mail: user.3@maildomain.net st: TN
Running a filtered search by soft-delete-entry object class
Retrieve all soft-deleted entries using the ds-soft-delete-entry
object class.
Steps
-
Run the
ldapsearch
command to retrieve all soft-deleted entries using theds-soft-delete-entry
object class.Example:
$ bin/ldapsearch --baseDN dc=example,dc=com \ "(objectclass=ds-soft-delete-entry)"
Running a search using the soft delete entry access control
The following examples use the --includeSoftDeleteEntries
\{with-non-deleted-entries \| without-non-deleted-entries \|
deleted-entries-in-undeleted-form}
option, which uses the soft delete entry access control.
About this task
You can use the --control
option with the soft delete entry access control symbolic name, softdeleteentryaccess
, or the --control
option with the actual soft delete entry access control OID, 1.3.6.1.4.1.30221.2.5.24
.
Steps
-
To return only soft-deleted entries, run
ldapsearch
using the--includeSoftDeletedEntries
option with the value ofwithout-non-deleted-entries
.Example:
$ bin/ldapsearch --baseDN dc=example,dc=com \ --includeSoftDeletedEntries without-non-deleted-entries \ --searchScope sub "(objectclass=*)"
-
To return non-deleted entries along with soft-deleted entries, run
ldapsearch
using the--includeSoftDeletedEntries
option with the value ofwith-non-deleted-entries
.Example:
$ bin/ldapsearch --baseDN dc=example,dc=com \ --includeSoftDeletedEntries with-non-deleted-entries \ --searchScope sub "(objectclass=*)"
-
To return only soft-deleted entries in undeleted form, run
ldapsearch
using the--includeSoftDeletedEntries
option with the value ofdeleted-entries-in-undeleted-form
.Some applications require access to all entries in the server, including both active and soft-deleted entries.
Example:
The following command returns all entries that were soft-deleted but presents it in a form that is similar to a regular entry with the soft-delete DN in comments. This regular entry format does not show the actual soft-deleted DN but displays it in an "undeleted" form even though it is not actually "undeleted". The object class,
ds-soft-delete-entry
, is also not displayed.$ bin/ldapsearch --baseDN dc=example,dc=com \ --includeSoftDeletedEntries deleted-entries-in-undeleted-form \ --searchScope sub "(ds-soft-delete-from-dn=*)" # Soft-deleted entry DN: # entryUUID=2b5511e2-7616-389b-ab0c-025c805ad32c+uid=user.14,ou=People,dc=exam- ple,dc=com dn: uid=user.14,ou=People,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson postalAddress: Abdalla Abdou$78929 Hillcrest Street$Elmira, ME 93080 postalCode: 93080 description: This is the description for Abdalla Abdou. uid: user.14 userPassword: {SSHA}7GkzWiMiU12m5m+xBV+ZsoX3gVacMcRtSwDTFg== employeeNumber: 14 initials: AFA givenName: Abdalla pager: +1 307 591 4870 mobile: +1 401 069 1289 cn: Abdalla Abdou sn: Abdou telephoneNumber: +1 030 505 6190 street: 78929 Hillcrest Street homePhone: +1 119 487 2328 l: Elmira mail: user.14@maildomain.net st: ME