Overview

ldifanon is a utility developed by Symas for anonymizing sensitive data in LDIF (LDAP Data Interchange Format) files. It is particularly useful for LDAP administrators who need to share LDIF files without exposing confidential information. The utility allows specific attributes to be anonymized according to customizable lists. This guide will help you get started with ldifanon, covering installation, usage, and troubleshooting.

Installation

Prerequisites

Operating System: Tested on Linux, e.g., Rocky Linux.

Dependencies: Requires SQLite, GNU Bison, Flex, and OpenLDAP for compilation.

Clone the Repository: Run the following command to get the source code. The Repository can be found here.

git clone git@git.symas.net:Symas/ldifanon.git
cd ldifanon

Build and Install:

make install-lib
make

This will install the library and create the executable.

Usage

Basic Command

To anonymize an LDIF file, use the following command:

./ldifanon -b <blacklist-file> <input-ldif-file> > <output-file>

Options:

-b <blacklist-file>: Specifies the attributes to anonymize.

-n: Creates a fresh database each time, avoiding conflicts with old data.

Example

Step 1: Create a blacklist file (blacklist.txt) containing the attributes you want to anonymize, e.g.:

mail
description

Step 2: Run ldifanon with your LDIF input file and blacklist:

./ldifanon -n -b blacklist.txt input.ldif > anonymized_output.ldif

This command anonymizes the mail and description attributes from input.ldif and outputs the anonymized version to anonymized_output.ldif.

For an example of what to expect from the output click on this link: LDIFAnon Example: Input and Anonymized Output. 

Important Considerations

• ldifanon cannot process the same LDIF file twice in the same database, as duplicate DNs would violate constraints.
• If processing multiple LDIF files, ensure that their DNs and other unique identifiers do not overlap.
• The specific constraint violation messages may vary based on the SQLite version, but the important point is to maintain uniqueness across multiple runs.

Troubleshooting Tips

• Ensure that your LDIF file is formatted properly with blank lines between entries.
• Use the -n option if you encounter errors related to unique constraints, as this starts a fresh database.

Conclusion

ldifanon is a useful tool for anonymizing LDAP data in LDIF files, allowing administrators to share sensitive directory information without exposing confidential data. With the proper configuration, including blacklists and careful handling of constraints, ldifanon can make data anonymization straightforward and efficient.