1 .TH LDAPSEARCH 1 "RELEASEDATE" "OpenLDAP LDVERSION"
3 .\" Copyright 1998-2004 The OpenLDAP Foundation All Rights Reserved.
4 .\" Copying restrictions apply. See COPYRIGHT/LICENSE.
6 ldapsearch \- LDAP search tool
28 .BI \-d \ debuglevel\fR]
38 .BI \-y \ passwdfile\fR]
42 .BI \-h \ ldaphost\fR]
44 .BI \-p \ ldapport\fR]
46 .BI \-P \ 2\fR\||\|\fI3\fR]
48 .BI \-b \ searchbase\fR]
50 .BI \-s \ base\fR\||\|\fIone\fR\||\|\fIsub\fR]
52 .BI \-a \ never\fR\||\|\fIalways\fR\||\|\fIsearch\fR\||\|\fIfind\fR]
54 .BI \-l \ timelimit\fR]
56 .BI \-z \ sizelimit\fR]
58 .BR \-O \ security-properties ]
80 is a shell-accessible interface to the
85 opens a connection to an LDAP server, binds, and performs a search
86 using specified parameters. The \fIfilter\fP should conform to
87 the string representation for search filters as defined in RFC 2254.
88 If not provided, the default filter, (objectClass=*), is used.
91 .B ldapsearch finds one or more entries, the attributes specified by
92 \fIattrs\fP are returned. If * is listed, all user attributes are
93 returned. If + is listed, all operational attributes are returned.
94 If no \fIattrs\fP are listed, all user attributes are returned. If only
95 1.1 is listed, no attributes will be returned.
99 Show what would be done, but don't actually perform the search. Useful for
100 debugging in conjunction with -v.
103 Include the User Friendly Name form of the Distinguished Name (DN)
107 Run in verbose mode, with many diagnostics written to standard output.
110 Use Kerberos IV authentication instead of simple authentication. It is
111 assumed that you already have a valid ticket granting ticket.
113 must be compiled with Kerberos support for this option to have any effect.
116 Same as \-k, but only does step 1 of the Kerberos IV bind. This is useful
117 when connecting to a slapd and there is no x500dsa.hostname principal
118 registered with your Kerberos Domain Controller(s).
121 Write retrieved values to a set of temporary files. This is useful for
122 dealing with non-ASCII values such as jpegPhoto or audio.
125 Retrieve attributes only (no values). This is useful when you just want to
126 see if an attribute is present in an entry and are not interested in the
130 Search results are display in LDAP Data Interchange Format detailed in
132 A single -L restricts the output to LDIFv1.
133 A second -L disables comments.
134 A third -L disables printing of the LDIF version.
135 The default is to use an extended version of LDIF.
138 Enable manage DSA IT control.
140 makes control critical.
143 Sort the entries returned based on \fIattribute\fP. The default is not
144 to sort entries returned. If \fIattribute\fP is a zero-length string (""),
145 the entries are sorted by the components of their Distingished Name. See
147 for more details. Note that
149 normally prints out entries as it receives them. The use of the
151 option defeats this behavior, causing all entries to be retrieved,
152 then sorted, then printed.
155 Set the LDAP debugging level to \fIdebuglevel\fP.
157 must be compiled with LDAP_DEBUG defined for this option to have any effect.
160 Read a series of lines from \fIfile\fP, performing one LDAP search for
161 each line. In this case, the \fIfilter\fP given on the command line
162 is treated as a pattern where the first occurrence of \fB%s\fP is
163 replaced with a line from \fIfile\fP. If \fIfile\fP is a single \fI-\fP
164 character, then the lines are read from standard input.
167 Use simple authentication instead of SASL.
170 Use the Distinguished Name \fIbinddn\fP to bind to the LDAP directory.
173 Prompt for simple authentication.
174 This is used instead of specifying the password on the command line.
177 Use \fIpasswd\fP as the password for simple authentication.
180 Use complete contents of \fIpasswdfile\fP as the password for
181 simple authentication.
184 Specify URI(s) referring to the ldap server(s).
187 Specify an alternate host on which the ldap server is running.
188 Deprecated in favor of -H.
191 Specify an alternate TCP port where the ldap server is listening.
192 Deprecated in favor of -H.
195 Use \fIsearchbase\fP as the starting point for the search instead of
198 .BI \-s \ base\fR\||\|\fIone\fR\||\|\fIsub
199 Specify the scope of the search to be one of
204 to specify a base object, one-level, or subtree search. The default
208 .BI \-a \ never\fR\||\|\fIalways\fR\||\|\fIsearch\fR\||\|\fIfind
209 Specify how aliases dereferencing is done. Should be one of
215 to specify that aliases are never dereferenced, always dereferenced,
216 dereferenced when searching, or dereferenced only when locating the
217 base object for the search. The default is to never dereference aliases.
219 .BI \-P \ 2\fR\||\|\fI3
220 Specify the LDAP protocol version to use.
223 wait at most \fItimelimit\fP seconds for a search to complete. A
229 A server may impose a maximal timelimit which only
230 the root user may override.
233 retrieve at most \fIsizelimit\fP entries for a search. A sizelimit
239 A server may impose a maximal sizelimit which only
240 the root user may override.
242 .BI \-O \ security-properties
243 Specify SASL security properties.
246 Enable SASL Interactive mode. Always prompt. Default is to prompt
250 Enable SASL Quiet mode. Never prompt.
253 Specify the authentication ID for SASL bind. The form of the ID
254 depends on the actual SASL mechanism used.
257 Specify the realm of authentication ID for SASL bind. The form of the realm
258 depends on the actual SASL mechanism used.
261 Specify the requested authorization ID for SASL bind.
263 must be one of the following formats:
265 .I <distinguished name>
271 Specify the SASL mechanism to be used for authentication. If it's not
272 specified, the program will choose the best mechanism the server knows.
275 Issue StartTLS (Transport Layer Security) extended operation. If you use
277 , the command will require the operation to be successful.
279 If one or more entries are found, each entry is written to standard
280 output in LDAP Data Interchange Format or
286 # bjensen, example, net
287 dn: uid=bjensen,dc=example,dc=net
289 objectClass: dcObject
296 If the -t option is used, the URI of a temporary file
297 is used in place of the actual value. If the -A option
298 is given, only the "attributename" part is written.
300 The following command:
303 ldapsearch -LLL "(sn=smith)" cn sn telephoneNumber
306 will perform a subtree search (using the default search base defined
309 for entries with a surname (sn) of smith. The common name (cn), surname
310 (sn) and telephoneNumber values will be retrieved and printed to
312 The output might look something like this if two entries are found:
315 dn: uid=jts,dc=example,dc=com
321 telephoneNumber: 1 555 123-4567
323 dn: uid=sss,dc=example,dc=com
329 telephoneNumber: 1 555 765-4321
335 ldapsearch -LLL -u -t "(uid=xyz)" jpegPhoto audio
338 will perform a subtree search using the default search base for entries
339 with user id of "xyz". The user friendly form of the entry's DN will be
340 output after the line that contains the DN itself, and the jpegPhoto
341 and audio values will be retrieved and written to temporary files. The
342 output might look like this if one entry with one value for each of the
343 requested attributes is found:
346 dn: uid=xyz,dc=example,dc=com
347 ufn: xyz, example, com
348 audio:< file:///tmp/ldapsearch-audio-a19924
349 jpegPhoto:< file:///tmp/ldapsearch-jpegPhoto-a19924
355 ldapsearch -LLL -s one -b "c=US" "(o=University*)" o description
358 will perform a one-level search at the c=US level for all entries
359 whose organization name (o) begins begins with \fBUniversity\fP.
360 The organization name and description attribute values will be retrieved
361 and printed to standard output, resulting in output similar to this:
364 dn: o=University of Alaska Fairbanks,c=US
365 o: University of Alaska Fairbanks
366 description: Preparing Alaska for a brave new yesterday
367 description: leaf node only
369 dn: o=University of Colorado at Boulder,c=US
370 o: University of Colorado at Boulder
371 description: No personnel information
372 description: Institution of education and research
374 dn: o=University of Colorado at Denver,c=US
375 o: University of Colorado at Denver
379 description: Institute for Higher Learning and Research
381 dn: o=University of Florida,c=US
382 o: University of Florida
384 description: Warper of young minds
389 Exit status is zero if no errors occur.
390 Errors result in a non-zero exit status and
391 a diagnostic message being written to standard error.
402 The OpenLDAP Project <http://www.openldap.org/>
405 is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
407 is derived from University of Michigan LDAP 3.3 Release.