LDAP(1) | General Commands Manual | LDAP(1)

# NAME

`ldap` — simple LDAP client

# SYNOPSIS

`ldap` | `search` [`-LvWxZ`] [`-b` basedn] [`-c` CAfile] [`-D` binddn] [`-H` host] [`-l` timelimit] [`-s` scope] [`-w` secret] [`-y` secretfile] [`-z` sizelimit] [filter] [attributes ...]

# DESCRIPTION

The `ldap` utility is a simple LDAP client. It queries an LDAP server to perform a command and outputs the results in the LDAP Data Interchange Format (LDIF).

`search` options [filter] [attributes ...]
  Perform a directory search request. The optional filter argument specifies the LDAP filter for the directory search. The default is (objectClass=*) and the format must comply to the “String Representation of Search Filters” as described in RFC 4515. If one or more attribute options are specified, `ldap` restricts the output to the specified attributes.

The options are as follows:

`-b` basedn
  Use the specified distinguished name (dn) as the starting point for directory search requests.
`-c` CAfile
  When TLS is enabled, load the CA bundle for certificate verification from the specified file. The default is /etc/ssl/cert.pem. If the LDAP server uses a self-signed certificate, use a file that contains the server certificate in PEM format, e.g. /etc/ssl/ldapserver.example.com.crt.
`-D` binddn
  Use the specified distinguished name to bind to the directory.
`-H` host
  The hostname of the LDAP server or an LDAP URL. The LDAP URL is described in RFC 4516 with the following format:

  [protocol://]host[:port][`/`basedn`?`attribute,...`?`scope`?`filter]

  The default is ldap://localhost:389/. Each of basedn, attribute, scope and filter may be omitted, but the preceding ‘/’ or ‘?’ is required if a subsequent field is non-empty.

  The following protocols are supported:

  ldap
    Connect with TCP in plain text. This is the default.
  ldaps
    Connect with TLS. The default port is 636.
  ldap+tls
    Connect with TCP and enable TLS using the StartTLS operation. This is the same as the `-Z` option.
  ldapi
    Connect to a UNIX-domain socket. The host argument is required to be a URL-encoded path, for example ldapi://%2fvar%2frun%2fldapi for /var/run/ldapi.
`-L`
  Output the directory search result in a standards-compliant version of the LDAP Data Interchange Format (LDIF). This encodes attribute values that include non-printable or UTF-8 characters in the Base64 format and wraps lines at a 79-character limit. If this option is not specified, `ldap` encodes “unsafe” characters and newlines in a visual format using vis(3) instead.
`-l` timelimit
  Request the server to abort the search request after timelimit seconds. The default value is 0 for no limit.
`-s` scope
  Specify the scope to be either `base`, `one`, or `sub`. The default is `sub` for subtree searches.
`-v`
  Produce more verbose output.
`-W`
  Prompt for the bind secret with echo turned off.
`-w` secret
  Specify the bind secret on the command line.
`-x`
  Use simple authentication. This is the default as `ldap` does not support SASL authentication.
`-y` secretfile
  Read the bind secret from the first line of the specified file or from standard input if the secretfile argument is ‘-’. The file must not be world-readable if it is a regular file.
`-Z`
  Enable TLS using the StartTLS operation.
`-z` sizelimit
  Request the server to limit the search result to a maximum number of sizelimit entries. The default value is 0 for no limit.

# FILES

/etc/ssl/cert.pem
  Default CA file.

# EXAMPLES

The following script can be used with the AuthorizedKeysCommand option of sshd(8):

    #!/bin/sh
    ldap search -D cn=Reader,dc=example,dc=com -w mypass123 \
    	-b ou=People,dc=example,dc=com \
    	-H ldapserver -c /etc/ssl/ldapserver.crt -Z \
    	"(&(objectClass=bsdAccount)(uid=$1))" sshPublicKey | \
    	sed 's/^sshPublicKey: //p;d;'
    exit 0

And the related configuration in sshd_config(5):

    Match Group ldapusers
    	AuthorizedKeysCommand /etc/ssh/ldap-authorized_keys.sh
    	AuthorizedKeysCommandUser _ldap

# SEE ALSO

sshd_config(5), ldapd(8), sshd(8)

# STANDARDS

G. Good, The LDAP Data Interchange Format (LDIF) - Technical Specification, RFC 2849, June 2000.

M. Smith, Ed. and T. Howes, Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters, RFC 4515, June 2006.

M. Smith, Ed. and T. Howes, Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator, RFC 4516, June 2006.

# HISTORY

The `ldap` utility first appeared in OpenBSD 6.4.

# AUTHORS

The `ldap` utility was written by Reyk Floeter <reyk@openbsd.org>.

# CAVEATS

SASL authentication is not supported. Authentication should be performed using simple authentication over a TLS connection.

February 10, 2021 | Debian