diff --git a/lib/ulib/ldif b/lib/ulib/ldif
index 671857c..1d5c794 100644
--- a/lib/ulib/ldif
+++ b/lib/ulib/ldif
@@ -502,6 +502,84 @@ END {
     awk "$script"
 }
 
+function tl_ensureval() {
+    local attr="$1"; shift
+    local script="$(def_match_attr "$attr")
+function resetp() {
+  ensure = 0
+  found = 0
+}
+function get_attrvalue(line) {
+  sub(/^[^:]+::?[ ]+/, \"\", line)
+  return line
+}
+function add_to_found_values(value) {
+  found_values[found_count] = value
+  found_count++
+}
+function in_found_values(value,             i) {
+  for (i = 0; i < found_count; i++) {
+    if (found_values[i] == value) {
+      return 1
+    }
+  }
+  return 0
+}
+function print_ensure_values() {
+  for (i = 0; i < ensure_count; i++) {
+    print attr \" \" ensure_values[i]
+  }
+  resetp()
+}
+function print_missing_values(              value) {
+  for (i = 0; i < ensure_count; i++) {
+    value = ensure_values[i]
+    if (!in_found_values(value)) {
+      print attr \" \" value
+    }
+  }
+  resetp()
+}
+BEGIN {
+  resetp()
+  attr = fix_attr($(quoted_awk "$attr"))
+  ensure_count = $#"
+    local i value
+    let i=0
+    for value in "$@"; do
+        script="$script
+  ensure_values[$i] = $(quoted_awk "$value")"
+        let i=$i+1
+    done
+    script="$script
+  found_count = 0
+  found_values[0] = 0
+  delete found_values
+}"'
+/^dn:/ {
+  ensure = 1
+}
+ensure && match_attr($1) {
+  found = 1
+  value = get_attrvalue($0)
+  add_to_found_values(value)
+  next
+}
+ensure && $0 == "" {
+  if (found) print_missing_values()
+  else print_ensure_values()
+}
+{ print }
+END {
+  if (ensure) {
+    if (found) print_missing_values()
+    else print_ensure_values()
+  }
+}
+'
+    awk "$script"
+}
+
 function tl_decode() {
     local match_attr="$1"
     awkrun -f "$match_attr"'
@@ -973,6 +1051,11 @@ av, addval ATTR VALUES...
 fv, defval ATTR VALUES...
     Ajouter un nouvel attribut avec les valeurs spécifiées, s'il n'existe pas
     déjà. Si l'attribut existe déjà, cette opération est un NOP.
+ev, ensureval ATTR VALUES...
+    A utiliser avec modaddval, ne garder que les valeurs que l'attribut n'a pas
+    déjà. Par exemple, pour s'assurer que l'attribut ATTR a les valeurs V0 et
+    V1, on ferait:
+        ensureval ATTR V0 V1 // modaddval
 sed ARGS
 awk ARGS
 grep ARGS
@@ -1239,6 +1322,10 @@ function get_transform_cmd() {
             cmdparts=(tl_defval "$@")
             xempty=1
             ;;
+        ev|ensureval)
+            cmdparts=(tl_ensureval "$@")
+            xempty=1
+            ;;
         xe|xempty|excludeempty) cmdparts=(ensure_complete_objects);;
         sed|awk|grep|sort) cmdparts=(LANG=C "$cmd" "$@");;
         csed|cawk|cgrep|csort) cmdparts=(LANG=C "${cmd#c}" "$@");;