MAN page from PLD openldap-2.0.27-1.i386.rpm


Section: User Commands (1)
Updated: 20 August 2001


ldapsearch - LDAP search tool 


ldapsearch[-n][-u][-v][-k][-K][-t][-A][-C][-L[L[L]]][-M[M]][-d debuglevel][-f file][-D binddn][-W][-w bindpasswd][-H ldapuri][-h ldaphost][-p ldapport][-P 2|3][-b searchbase][-s base|one|sub][-a never|always|search|find][-l timelimit][-z sizelimit][-O security-properties][-I][-Q][-U authcid][-x][-X authzid][-Y mech][-Z[Z]]filter[attrs...] 


ldapsearchis a shell-accessible interface to theldap_search(3)library call.

ldapsearchopens a connection to an LDAP server, binds, and performs a searchusing specified parameters. The filter should conform tothe string representation for search filters as defined in RFC 2254.If not provided, the default filter, (objectClass=*), is used.

Ifldapsearch finds one or more entries, the attributes specified byattrs are returned. If * is listed, all user attributes arereturned. If + is listed, all operational attributes are returned.If no attrs are listed, all attributes are returned. If only1.1 is listed, no attributes will be returned. 


Show what would be done, but don't actually perform the search. Useful fordebugging in conjunction with -v.
Include the User Friendly Name form of the Distinguished Name (DN)in the output.
Run in verbose mode, with many diagnostics written to standard output.
Use Kerberos IV authentication instead of simple authentication. It isassumed that you already have a valid ticket granting ticket.ldapsearchmust be compiled with Kerberos support for this option to have any effect.
Same as -k, but only does step 1 of the Kerberos IV bind. This is usefulwhen connecting to a slapd and there is no x500dsa.hostname principalregistered with your Kerberos Domain Controller(s).
Write retrieved values to a set of temporary files. This is useful fordealing with non-ASCII values such as jpegPhoto or audio.
Retrieve attributes only (no values). This is useful when you just want tosee if an attribute is present in an entry and are not interested in thespecific values.
Search results are display in LDAP Data Interchange Format detailed inldif(5).A single -L restricts the output to LDIFv1.A second -L disables comments.A third -L disables printing of the LDIF version.The default is to use an extended version of LDIF.
Enable manage DSA IT control.-MMmakes control critical.
Automatically chase referrals.
-S attribute
Sort the entries returned based on attribute. The default is notto sort entries returned. If attribute is a zero-length string (""),the entries are sorted by the components of their Distingished Name. Seeldap_sort(3)for more details. Note thatldapsearchnormally prints out entries as it receives them. The use of the-Soption defeats this behavior, causing all entries to be retrieved,then sorted, then printed.
-d debuglevel
Set the LDAP debugging level to debuglevel.ldapsearchmust be compiled with LDAP_DEBUG defined for this option to have any effect.
-f file
Read a series of lines from file, performing one LDAP search foreach line. In this case, the filter given on the command lineis treated as a pattern where the first occurrence of %s isreplaced with a line from file. If file is a single -character, then the lines are read from standard input.
Use simple authentication instead of SASL.
-D binddn
Use the Distinguished Name binddn to bind to the LDAP directory.
Prompt for simple authentication.This is used instead of specifying the password on the command line.
-w bindpasswd
Use bindpasswd as the password for simple authentication.
-H ldapuri
Specify URI(s) referring to the ldap server(s).
-h ldaphost
Specify an alternate host on which the ldap server is running.Deprecated in favor of -H.
-p ldapport
Specify an alternate TCP port where the ldap server is listening.Deprecated in favor of -H.
-b searchbase
Use searchbase as the starting point for the search instead ofthe default.
-s base|one|sub
Specify the scope of the search to be one ofbase,one,orsubto specify a base object, one-level, or subtree search. The defaultissub.
-a never|always|search|find
Specify how aliases dereferencing is done. Should be one ofnever,always,search,orfindto specify that aliases are never dereferenced, always dereferenced,dereferenced when searching, or dereferenced only when locating thebase object for the search. The default is to never dereference aliases.
-P 2|3
Specify the LDAP protocol version to use.
-l timelimit
wait at most timelimit seconds for a search to complete. Atimelimit of0(zero) removes theldap.conflimit.A server may impose a maximal timelimit which onlythe root user may override.
-z sizelimit
retrieve at most sizelimit entries for a search. A sizelimitof 0(zero) removes the ldap.conflimit.A server may impose a maximal sizelimit which onlythe root user may override.
-O security-properties
Specify SASL security properties.
Enable SASL Interactive mode. Always prompt. Default is to promptonly as needed.
Enable SASL Quiet mode. Never prompt.
-U authcid
Specify the authentication ID for SASL bind. The form of the IDdepends on the actual SASL mechanism used.
-X authzid
Specify the requested authorization ID for SASL bind.authzidmust be one of the following formats:dn:<distinguished name>oru:<username>
-Y mech
Specify the SASL mechanism to be used for authentication. If it's notspecified, the program will choose the best mechanism the server knows.
Issue StartTLS (Transport Layer Security) extended operation. If you use-ZZ, the command will require the operation to be successful.


If one or more entries are found, each entry is written to standardoutput in LDAP Data Interchange Format orldif(5):

        version: 1        # bjensen, example, net        dn: uid=bjensen, dc=example, dc=net        objectClass: person        objectClass: dcObject        uid: bjensen        cn: Barbara Jensen        sn: Jensen    ...

If the -t option is used, the URI of a temporary fileis used in place of the actual value. If the -A optionis given, only the "attributename" part is written. 


The following command:

    ldapsearch -LLL "(sn=smith)" cn sn telephoneNumber

will perform a subtree search (using the default search base definedinldap.conf(5))for entries with a surname (sn) of smith. The common name (cn), surname(sn) and telephoneNumber values will be retrieved and printed tostandard output.The output might look something like this if two entries are found:

    dn: uid=jts, dc=example, dc=com        cn: John Smith        cn: John T. Smith        sn: Smith        sn;lang-en: Smith        sn;lang-de: Schmidt        telephoneNumber: 1 555 123-4567        dn: uid=sss, dc=example, dc=com        cn: Steve Smith        cn: Steve S. Smith        sn: Smith        sn;lang-en: Smith        sn;lang-de: Schmidt        telephoneNumber: 1 555 765-4321

The command:

    ldapsearch -LLL -u -t "(uid=xyz)" jpegPhoto audio

will perform a subtree search using the default search base for entrieswith user id of "xyz". The user friendly form of the entry's DN will beoutput after the line that contains the DN itself, and the jpegPhotoand audio values will be retrieved and written to temporary files. Theoutput might look like this if one entry with one value for each of therequested attributes is found:

    dn: uid=xyz, dc=example, dc=com    ufn: xyz, example, com    audio:< file::/tmp/ldapsearch-audio-a19924    jpegPhoto:< file::=/tmp/ldapsearch-jpegPhoto-a19924

This command:

    ldapsearch -LLL -s one -b "c=US" "(o=University*)" o description

will perform a one-level search at the c=US level for all entrieswhose organization name (o) begins begins with University.The organization name and description attribute values will be retrievedand printed to standard output, resulting in output similar to this:

    dn: o=University of Alaska Fairbanks, c=US    o: University of Alaska Fairbanks    description: Preparing Alaska for a brave new yesterday    description: leaf node only    dn: o=University of Colorado at Boulder, c=US    o: University of Colorado at Boulder    description: No personnel information    description: Institution of education and research    dn: o=University of Colorado at Denver, c=US    o: University of Colorado at Denver    o: UCD    o: CU/Denver    o: CU-Denver    description: Institute for Higher Learning and Research    dn: o=University of Florida, c=US    o: University of Florida    o: UFl    description: Warper of young minds    etc....


Exit status is zero if no errors occur.Errors result in a non-zero exit status anda diagnostic message being written to standard error. 




The OpenLDAP Project <> 


is developed and maintained by The OpenLDAP Project ( derived from University of Michigan LDAP 3.3 Release.




This document was created byman2html,using the manual pages.