-a     Add  new  entries.   The  default  for  ldapmodify  is  to modify existing entries.  If invoked as
       ldapadd, this flag is always set.

-c     Continuous operation mode.  Errors are reported, but ldapmodify will continue with  modifications.
       The default is to exit after reporting an error.

-S file
       Add or change records which were skipped due to an error are written to file and the error message
       returned by the server is added as a comment. Most useful in conjunction with -c.

-n     Show what would be done, but don't actually modify entries.  Useful for debugging  in  conjunction
       with -v.

-v     Use verbose mode, with many diagnostics written to standard output.

-M[M]  Enable manage DSA IT control.  -MM makes control critical.

-d debuglevel
       Set  the  LDAP debugging level to debuglevel.  ldapmodify must be compiled with LDAP_DEBUG defined
       for this option to have any effect.

-f file
       Read the entry modification information from file instead of from standard input.

-x     Use simple authentication instead of SASL.

-D binddn
       Use the Distinguished Name binddn to bind to the LDAP directory.  For SASL binds,  the  server  is
       expected to ignore this value.

-W     Prompt  for simple authentication.  This is used instead of specifying the password on the command
       line.

-w passwd
       Use passwd as the password for simple authentication.

-y passwdfile
       Use complete contents of passwdfile as the password for simple authentication.

-H ldapuri
       Specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed;  a
       list of URI, separated by whitespace or commas is expected.

-h ldaphost
       Specify an alternate host on which the ldap server is running.  Deprecated in favor of -H.

-p ldapport
       Specify an alternate TCP port where the ldap server is listening.  Deprecated in favor of -H.

-P {2|3}
       Specify the LDAP protocol version to use.

-O security-properties
       Specify SASL security properties.

-e [!]ext[=extparam]

-E [!]ext[=extparam]

       Specify general extensions with -e and search extensions with -E.  ´!´ indicates criticality.

       General extensions:
         [!]assert=<filter>   (an RFC 4515 Filter)
         [!]authzid=<authzid> ("dn:<dn>" or "u:<user>")
         [!]manageDSAit
         [!]noop
         ppolicy
         [!]postread[=<attrs>]        (a comma-separated attribute list)
         [!]preread[=<attrs>] (a comma-separated attribute list)
         abandon, cancel (SIGINT sends abandon/cancel; not really controls)

       Search extensions:
         [!]domainScope                               (domain scope)
         [!]mv=<filter>                               (matched values filter)
         [!]pr=<size>[/prompt|noprompt]       (paged results/prompt)
         [!]sss=[-]<attr[:OID]>[/[-]<attr[:OID]>...]  (server side sorting)
         [!]subentries[=true|false]           (subentries)
         [!]sync=ro[/<cookie>]                        (LDAP Sync refreshOnly)
                 rp[/<cookie>][/<slimit>]     (LDAP Sync refreshAndPersist)

-I     Enable SASL Interactive mode.  Always prompt.  Default is to prompt only as needed.

-Q     Enable SASL Quiet mode.  Never prompt.

-U authcid
       Specify  the  authentication  ID  for  SASL  bind.  The  form of the ID depends on the actual SASL
       mechanism used.

-R realm
       Specify the realm of authentication ID for SASL bind. The form of the realm depends on the  actual
       SASL mechanism used.

-X authzid
       Specify  the  requested  authorization  ID  for  SASL  bind.  authzid must be one of the following
       formats: dn:<distinguished name> or u:<username>

-Y mech
       Specify the SASL mechanism to be used for authentication. If it's not specified, the program  will
       choose the best mechanism the server knows.

-Z[Z]  Issue  StartTLS  (Transport  Layer  Security) extended operation. If you use -ZZ, the command will
       require the operation to be successful.