ldapsearch

Every OpenLDAP client takes the same connection options: -H the server URI (ldap:// on 389, ldaps:// on 636), -x for a simple bind, -D the DN to bind as and -w its password (none of them: anonymous), -ZZ to insist on StartTLS. ldapsearch then takes a base (-b), a filter in prefix notation and the attributes to print, and answers in LDIF: dn: then one attribute: value per line (attribute:: when the value is base64). ldapwhoami only binds and says who the server thinks you are, the quickest test of a password. A failure prints the LDAP result: 49 Invalid credentials, 50 Insufficient access, 32 No such object, -1 Can't contact LDAP server.

ldapsearch command usage

ldapsearch -x [-ZZ] -H URI [-D DN -w PASSWORD] -b BASE [-s base|one|sub] [FILTER] [ATTRIBUTE...]
ldapwhoami -x [-ZZ] -H URI [-D DN -w PASSWORD]
ldappasswd -x [-ZZ] -H URI -D DN -w PASSWORD -s NEW
ldapadd|ldapmodify|ldapdelete -x [-ZZ] -H URI -D DN -w PASSWORD [-f FILE | DN]

Options

-x

simple bind (DN and password), not SASL

-H ldap://HOST

the server: ldap:// on 389, ldaps:// on 636

-D DN -w PASSWORD

bind as that entry, with that password (-W asks for it)

-ZZ

StartTLS before binding, and stop if the certificate does not check out

-b BASE -s base|one|sub

where to search, and how deep: the entry, its children, or all below

-LLL

plain LDIF, without comments

ldapsearch examples

ldapsearch -x -LLL -H ldap://directory.lab -b dc=office,dc=lab '(uid=alice)'

Anonymous search for alice's entry, printing every attribute you may read.

ldapwhoami -x -ZZ -H ldap://directory.lab -D uid=alice,ou=people,dc=office,dc=lab -w correct-horse

Checks alice's password over StartTLS: prints her DN, or Invalid credentials (49).

ldappasswd -x -ZZ -H ldap://directory.lab -D uid=alice,ou=people,dc=office,dc=lab -w OLD -s NEW

Alice changes her own password; the server hashes it.

ldapdelete -x -H ldap://directory.lab -D cn=admin,dc=office,dc=lab -w SECRET uid=carol,ou=people,dc=office,dc=lab

The admin removes carol's entry.

Pitfalls

• Without -ZZ or ldaps://, -w sends the password readable over the network.
• A filter needs its parentheses, quoted for the shell: '(&(objectClass=posixGroup)(cn=builders))'.
• With TLS, the name in -H must match the server's certificate: an IP address usually does not.

Run it on real machines