MAN page from PLD openldap-2.0.27-1.i386.rpm
Section: User Commands (1)
Updated: 20 August 2001Index
ldapsearch - LDAP search tool
is a shell-accessible interface to theldap_search
ldapsearchopens a connection to an LDAP server, binds, and performs a searchusing specified parameters. The filter should conform tothe string representation for search filters as defined in RFC 2254.If not provided, the default filter, (objectClass=*), is used.
Ifldapsearch finds one or more entries, the attributes specified byattrs are returned. If * is listed, all user attributes arereturned. If + is listed, all operational attributes are returned.If no attrs are listed, all attributes are returned. If only1.1 is listed, no attributes will be returned.
- Show what would be done, but don't actually perform the search. Useful fordebugging in conjunction with -v.
- Include the User Friendly Name form of the Distinguished Name (DN)in the output.
- Run in verbose mode, with many diagnostics written to standard output.
- Use Kerberos IV authentication instead of simple authentication. It isassumed that you already have a valid ticket granting ticket.ldapsearchmust be compiled with Kerberos support for this option to have any effect.
- Same as -k, but only does step 1 of the Kerberos IV bind. This is usefulwhen connecting to a slapd and there is no x500dsa.hostname principalregistered with your Kerberos Domain Controller(s).
- Write retrieved values to a set of temporary files. This is useful fordealing with non-ASCII values such as jpegPhoto or audio.
- Retrieve attributes only (no values). This is useful when you just want tosee if an attribute is present in an entry and are not interested in thespecific values.
- Search results are display in LDAP Data Interchange Format detailed inldif(5).A single -L restricts the output to LDIFv1.A second -L disables comments.A third -L disables printing of the LDIF version.The default is to use an extended version of LDIF.
- Enable manage DSA IT control.-MMmakes control critical.
- Automatically chase referrals.
- -S attribute
- Sort the entries returned based on attribute. The default is notto sort entries returned. If attribute is a zero-length string (""),the entries are sorted by the components of their Distingished Name. Seeldap_sort(3)for more details. Note thatldapsearchnormally prints out entries as it receives them. The use of the-Soption defeats this behavior, causing all entries to be retrieved,then sorted, then printed.
- -d debuglevel
- Set the LDAP debugging level to debuglevel.ldapsearchmust be compiled with LDAP_DEBUG defined for this option to have any effect.
- -f file
- Read a series of lines from file, performing one LDAP search foreach line. In this case, the filter given on the command lineis treated as a pattern where the first occurrence of %s isreplaced with a line from file. If file is a single -character, then the lines are read from standard input.
- Use simple authentication instead of SASL.
- -D binddn
- Use the Distinguished Name binddn to bind to the LDAP directory.
- Prompt for simple authentication.This is used instead of specifying the password on the command line.
- -w bindpasswd
- Use bindpasswd as the password for simple authentication.
- -H ldapuri
- Specify URI(s) referring to the ldap server(s).
- -h ldaphost
- Specify an alternate host on which the ldap server is running.Deprecated in favor of -H.
- -p ldapport
- Specify an alternate TCP port where the ldap server is listening.Deprecated in favor of -H.
- -b searchbase
- Use searchbase as the starting point for the search instead ofthe default.
- -s base|one|sub
- Specify the scope of the search to be one ofbase,one,orsubto specify a base object, one-level, or subtree search. The defaultissub.
- -a never|always|search|find
- Specify how aliases dereferencing is done. Should be one ofnever,always,search,orfindto specify that aliases are never dereferenced, always dereferenced,dereferenced when searching, or dereferenced only when locating thebase object for the search. The default is to never dereference aliases.
- -P 2|3
- Specify the LDAP protocol version to use.
- -l timelimit
- wait at most timelimit seconds for a search to complete. Atimelimit of0(zero) removes theldap.conflimit.A server may impose a maximal timelimit which onlythe root user may override.
- -z sizelimit
- retrieve at most sizelimit entries for a search. A sizelimitof 0(zero) removes the ldap.conflimit.A server may impose a maximal sizelimit which onlythe root user may override.
- -O security-properties
- Specify SASL security properties.
- Enable SASL Interactive mode. Always prompt. Default is to promptonly as needed.
- Enable SASL Quiet mode. Never prompt.
- -U authcid
- Specify the authentication ID for SASL bind. The form of the IDdepends on the actual SASL mechanism used.
- -X authzid
- Specify the requested authorization ID for SASL bind.authzidmust be one of the following formats:dn:<distinguished name>oru:<username>
- -Y mech
- Specify the SASL mechanism to be used for authentication. If it's notspecified, the program will choose the best mechanism the server knows.
- Issue StartTLS (Transport Layer Security) extended operation. If you use-ZZ, the command will require the operation to be successful.
If one or more entries are found, each entry is written to standardoutput in LDAP Data Interchange Format orldif
version: 1 # bjensen, example, net dn: uid=bjensen, dc=example, dc=net objectClass: person objectClass: dcObject uid: bjensen cn: Barbara Jensen sn: Jensen ...
If the -t option is used, the URI of a temporary fileis used in place of the actual value. If the -A optionis given, only the "attributename" part is written.
The following command:
ldapsearch -LLL "(sn=smith)" cn sn telephoneNumber
will perform a subtree search (using the default search base definedinldap.conf(5))for entries with a surname (sn) of smith. The common name (cn), surname(sn) and telephoneNumber values will be retrieved and printed tostandard output.The output might look something like this if two entries are found:
dn: uid=jts, dc=example, dc=com cn: John Smith cn: John T. Smith sn: Smith sn;lang-en: Smith sn;lang-de: Schmidt telephoneNumber: 1 555 123-4567 dn: uid=sss, dc=example, dc=com cn: Steve Smith cn: Steve S. Smith sn: Smith sn;lang-en: Smith sn;lang-de: Schmidt telephoneNumber: 1 555 765-4321
ldapsearch -LLL -u -t "(uid=xyz)" jpegPhoto audio
will perform a subtree search using the default search base for entrieswith user id of "xyz". The user friendly form of the entry's DN will beoutput after the line that contains the DN itself, and the jpegPhotoand audio values will be retrieved and written to temporary files. Theoutput might look like this if one entry with one value for each of therequested attributes is found:
dn: uid=xyz, dc=example, dc=com ufn: xyz, example, com audio:< file::/tmp/ldapsearch-audio-a19924 jpegPhoto:< file::=/tmp/ldapsearch-jpegPhoto-a19924
ldapsearch -LLL -s one -b "c=US" "(o=University*)" o description
will perform a one-level search at the c=US level for all entrieswhose organization name (o) begins begins with University.The organization name and description attribute values will be retrievedand printed to standard output, resulting in output similar to this:
dn: o=University of Alaska Fairbanks, c=US o: University of Alaska Fairbanks description: Preparing Alaska for a brave new yesterday description: leaf node only dn: o=University of Colorado at Boulder, c=US o: University of Colorado at Boulder description: No personnel information description: Institution of education and research dn: o=University of Colorado at Denver, c=US o: University of Colorado at Denver o: UCD o: CU/Denver o: CU-Denver description: Institute for Higher Learning and Research dn: o=University of Florida, c=US o: University of Florida o: UFl description: Warper of young minds etc....
Exit status is zero if no errors occur.Errors result in a non-zero exit status anda diagnostic message being written to standard error.
The OpenLDAP Project <http://www.openldap.org/
is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
is derived from University of Michigan LDAP 3.3 Release.
- OUTPUT FORMAT
- SEE ALSO
This document was created byman2html,using the manual pages.