use strict;
use Net::LDAP;

my $ld = Net::LDAP->new('myserver');
$ld->bind(dn=>'username',password=>'passwd');

my $result = $ld->search(base=>'cn=mydir',
                         scope=>'sub',
                         filter=>'(objectclass=*)');

while (my $entry = $result->entry())
{
  #do comparison here
}
[download]

You'll probably need to use page support and/or async searching if your directory contains much in the way of data.

One thing to watch out for: I've done this sort of thing a few times, and tended to find that detecting when entries/attributes aren't there is the trickiest bit. It's also worth noting that there are commercial apps available that will do this sort of thing for you.

I suggest using 'callbacks' if you have many entries. This should be faster because you don't have to wait until the search is finished etc.

See ldap.perl.org/FAQG.htm
and there using the callback subroutine approach
There's also an example.

Edit: thanks to bart for the direct link to the callback! :)

Thanks. The callback may work for me since I am walking the entire ldap tree and comparing entries against the secondary ldap entries.

Another way could be to dump the contents of both directories to LDIF files (e.g. with Net::LDAP::LDIF or ldap server tools), sorted by dn (e.g. with Net::LDAP::Control::SortResult) and then iterate over the two LDIF files and compare objects one by one.

if o1 eq o2: no change, read next both objects
if o1 lt o2: add, read next object from LDIF1
if o1 gt o2: delete, read next object from LDIF2
[download]

Disadvantage: this way you usually can't compare values from userPassword.

my ldap entries have millions entry. Would Net::LDAP::LDIF be able to handle it; does it has a call back option? Thanks.

I haven't tried Net::LDAP::LDIF with several million entries, but I think it can do it. For writing the objects to the LDIF you don't need callbacks from Net::LDAP::LDIF, only the callback from Net::LDAP::Search could be a good idea. If you dump your search result in a sorted way, you can read the objects one-by-one from the LDIF with a code similar to the synopsis from Net::LDAP::LDIF.

Best regards,
perl -e "s>>*F>e=>y)\*martinF)stronat)=>print,print v8.8.8.32.11.32"