I'd like to modify some entries in our LDAP. In the field gecos currently some users only have their user name which I would like to replace by their full name. In general this isn't a problem, but I guess doing this in plain text with names containing special characters like accents isn't a good idea, which is why I'd like to encode those as base64. Now I know how it should work in theory, but it only gives me an error. What I do:

ldapmodifyuser user
changetype: modify
replace: gecos
gecos:: YmFzZTY0LVRleHQK


This only gives me a very cryptic Error modifying user entry uid=username,ou=people,dc=domain,dc=de in LDAP. What am I doing wrong? It's successfull when modifying a user with plain text gecos, it only fails when trying to insert base64 with the double colon upfront neccessary to indicate non-printable text.

1 Answer 1


The gecos attribute normally holds a one-line value, but your Base64-encoded data contains a 0x0A "Line feed" character (i.e. \n). Some LDAP servers may be configured to reject this, on the grounds that multi-line values cannot be represented in the traditional /etc/passwd format.

$ echo YmFzZTY0LVRleHQK | base64 -d | hexdump -C
00000000  62 61 73 65 36 34 2d 54  65 78 74 0a              |base64-Text.|
                                            ^^                          ^
py3.10 >>> import base64
py3.10 >>> base64.b64decode("YmFzZTY0LVRleHQK")
  • It's not supposed to have multiple lines, just a space between name and surname. And that's also no problem in plain text gecos Sep 13, 2022 at 9:42
  • That's exactly my point – it's not supposed to have multiple lines, but your provided value has multiple lines anyway. Look at the actual data that you've Base64-encoded. Sep 13, 2022 at 9:52
  • I don't know how it was added there, I created this example with 'echo 'base64-Text' | base64'. Anyways, the actual base64 text actually ends with 0x6c, which should correspond correctly with an l, so that shouldn't be the Problem. Sep 13, 2022 at 10:30
  • @RichardRosner echo adds one trailing newline character by design. Sep 13, 2022 at 10:42
  • Good to know for the future. Now the question is only why it still fails with a text that doesn't contain a newline character at all. The only non-letter character I have is 0x20 for the space. Other non-standard characters are 0xc3 and 0ca9. Not sure where they come from. They should be 0xe9 and 0x65, but when I convert the name with base64 the result is still the same, minus the encoded newline character. But I don't mind that as long as it works in the first place, corrections can be made later. Sep 13, 2022 at 11:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .