Using ldifdiff.pl and ldapmodify to syncronise LDAP directories

Dear list,

I'm trying to cause a 'slave' LDAP directory (in this case, the
Embedded LDAP server in WebLogic 8.1sp5) to become the same as a
'primary' directory (also in WL 8.1sp5).

The approach taken so far is to perform an ldapsearch on both, then
use ldifdiff.pl (from the LDAP perl's contrib directory) and finally
use ldapmodify (testing with OpenLDAP's, but will be using HP-UX's) to
import the changes.

We use ldifsort.pl before ldifdiff.pl, as per the recommendation in
ldifdiff.pl.

Our problem is that this process creates an LDIF file which contains
actions we need to be performed in a particular order, but they are
not in that order yet. For example, the output of ldifdiff.pl might
be:

dn: ou=EPredicate,ou=newrealm,dc=examples
changetype: add
objectclass: organizationalUnit
objectclass: top
ou: EPredicate

dn: ou=newrealm,dc=examples
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: newrealm

but in order for ldapmodify to be successful, the file would need to
be:

dn: ou=newrealm,dc=examples
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: newrealm

dn: ou=EPredicate,ou=newrealm,dc=examples
changetype: add
objectclass: organizationalUnit
objectclass: top
ou: EPredicate

A similar problem happens with delete, which need to be depth-first.

Is there a straight forward way to order the file so the adds are
depth-last, and then the deletes are depth-first? I would expect this
to be a common problem, so it's possible that I'm misunderstanding
some part.

Any advice gratefully received!

Thank you,

Nick