The OpenLDAP command-line tools are the primary way to interact with any LDAP directory from Linux. They work against OpenLDAP, Active Directory, FreeIPA, and any other LDAP-compliant server.
| Item | Syntax / Value | Description |
|---|---|---|
| ldapsearch | ldapsearch -x -H ldap://host -b baseDN filter [attrs] | Search the directory |
| -x | ldapsearch -x | Simple bind (no SASL) |
| -H | ldapsearch -H ldap://ldap.example.com | LDAP URI (ldap:// or ldaps://) |
| -b | ldapsearch -b 'dc=example,dc=com' | Base DN for search |
| -D | ldapsearch -D 'cn=admin,dc=example,dc=com' | Bind DN (who you authenticate as) |
| -W | ldapsearch -W | Prompt for bind password |
| -w | ldapsearch -w 'password' | Bind password on command line (insecure) |
| -s | ldapsearch -s base/one/sub | Search scope: base=entry only, one=direct children, sub=subtree |
| -LLL | ldapsearch -LLL | Output clean LDIF without version/comments |
| -o ldif-wrap=no | ldapsearch -o ldif-wrap=no | Disable line wrapping in output |
| filter | ldapsearch '(uid=alice)' | LDAP search filter |
| attributes | ldapsearch '(uid=alice)' cn mail uid | Specify attributes to return (default: all) |
| '*' | ldapsearch '(uid=alice)' '*' | Return all user attributes |
| '+' | ldapsearch '(uid=alice)' '+' | Return operational attributes (createTimestamp etc.) |
| -z | ldapsearch -z 100 | Limit results to 100 entries |
| -l | ldapsearch -l 30 | Time limit in seconds |
| -Z | ldapsearch -Z | Use StartTLS |
| ldapadd | ldapadd -x -H ldap://host -D bindDN -W -f file.ldif | Add entries from LDIF file |
| ldapmodify | ldapmodify -x -H ldap://host -D bindDN -W -f modify.ldif | Modify entries from LDIF file |
| ldapdelete | ldapdelete -x -H ldap://host -D bindDN -W dn1 dn2 | Delete entries by DN |
| ldappasswd | ldappasswd -x -H ldap://host -D bindDN -W -S userDN | Change user password |
| ldapwhoami | ldapwhoami -x -H ldap://host -D bindDN -W | Show current bind identity |
| slapcat | sudo slapcat -n 0 | Export entire OpenLDAP database to LDIF (server-side) |
| slapadd | sudo slapadd -n 0 -l backup.ldif | Import LDIF directly to OpenLDAP (server must be stopped) |
| slaptest | sudo slaptest -u | Test slapd configuration |
# ── ldapsearch examples ─────────────────────────────────────── # Search all users (anonymous) ldapsearch -x -H ldap://localhost -b "dc=mywebuniversity,dc=com" "(objectClass=inetOrgPerson)" # Find specific user ldapsearch -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W -b "ou=users,dc=mywebuniversity,dc=com" "(uid=alice)" cn mail uid telephoneNumber # Search with authentication, clean output ldapsearch -LLL -x -H ldaps://ldap.mywebuniversity.com -D "uid=ldap-bind,ou=services,dc=mywebuniversity,dc=com" -W -b "ou=users,dc=mywebuniversity,dc=com" -s sub "(&(objectClass=inetOrgPerson)(departmentNumber=Engineering))" cn uid mail title # Count all users ldapsearch -LLL -x -H ldap://localhost -b "ou=users,dc=mywebuniversity,dc=com" "(objectClass=inetOrgPerson)" dn | grep "^dn:" | wc -l # Find all members of a group ldapsearch -LLL -x -H ldap://localhost -b "ou=groups,dc=mywebuniversity,dc=com" "(cn=developers)" member # Check if user is in group (Active Directory style) ldapsearch -LLL -x -H ldap://ad.example.com -b "DC=example,DC=com" "(&(objectClass=user)(sAMAccountName=alice)(memberOf=CN=Developers,OU=Groups,DC=example,DC=com))" # Find users who haven't logged in recently (shadowLastChange) ldapsearch -LLL -x -H ldap://localhost -b "ou=users,dc=mywebuniversity,dc=com" "(shadowLastChange<=18000)" uid cn mail # Active Directory specific ldapsearch -LLL -x -H ldap://dc01.example.com -D "DOMAIN\\binduser" -W -b "DC=example,DC=com" "(&(objectCategory=person)(objectClass=user)(sAMAccountName=alice))" sAMAccountName displayName mail department memberOf # Add entries ldapadd -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W -f add_users.ldif # Modify entries ldapmodify -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W -f modify.ldif # Delete a user ldapdelete -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W "uid=bob,ou=users,dc=mywebuniversity,dc=com" # Change password ldappasswd -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W -S "uid=alice,ou=users,dc=mywebuniversity,dc=com" # Backup entire directory sudo slapcat > /backup/ldap-backup-$(date +%Y%m%d).ldif # Test bind (authentication check) ldapwhoami -x -H ldap://localhost -D "uid=alice,ou=users,dc=mywebuniversity,dc=com" -W