mirror of
https://git.openldap.org/openldap/openldap.git
synced 2025-12-22 07:39:35 -05:00
73276e84ae
Includes support for update referral for each replicated backend. Reworked replication test to use update referral. Includes major rewrite of response encoding codes (result.c). Includes reworked alias support and eliminates old suffix alias codes (can be emulated using named alias). Includes (untested) support for the Manage DSA IT control. Works in LDAPv2 world. Still testing in LDAPv3 world. Added default referral (test009) test.
348 lines
9.5 KiB
Groff
348 lines
9.5 KiB
Groff
.TH LDAPSEARCH 1 "10 November 1998" "OpenLDAP LDVERSION"
|
|
.SH NAME
|
|
ldapsearch \- ldap search tool
|
|
.SH SYNOPSIS
|
|
.B ldapsearch
|
|
[\c
|
|
.BR \-n ]
|
|
[\c
|
|
.BR \-u ]
|
|
[\c
|
|
.BR \-v ]
|
|
[\c
|
|
.BR \-k ]
|
|
[\c
|
|
.BR \-K ]
|
|
[\c
|
|
.BR \-t ]
|
|
[\c
|
|
.BR \-A ]
|
|
[\c
|
|
.BR \-B ]
|
|
[\c
|
|
.BR \-L ]
|
|
[\c
|
|
.BR \-M[M] ]
|
|
[\c
|
|
.BR \-R ]
|
|
[\c
|
|
.BI \-d \ debuglevel\fR]
|
|
[\c
|
|
.BI \-F \ sep\fR]
|
|
[\c
|
|
.BI \-f \ file\fR]
|
|
[\c
|
|
.BI \-D \ binddn\fR]
|
|
[\c
|
|
.BR \-W ]
|
|
[\c
|
|
.BI \-w \ bindpasswd\fR]
|
|
[\c
|
|
.BI \-h \ ldaphost\fR]
|
|
[\c
|
|
.BI \-p \ ldapport\fR]
|
|
[\c
|
|
.BI \-P \ 2\fR\||\|\fI3\fR]
|
|
[\c
|
|
.BI \-b \ searchbase\fR]
|
|
[\c
|
|
.BI \-s \ base\fR\||\|\fIone\fR\||\|\fIsub\fR]
|
|
[\c
|
|
.BI \-a \ never\fR\||\|\fIalways\fR\||\|\fIsearch\fR\||\|\fIfind\fR]
|
|
[\c
|
|
.BI \-l \ timelimit\fR]
|
|
[\c
|
|
.BI \-z \ sizelimit\fR]
|
|
.I filter
|
|
[\c
|
|
.IR attrs... ]
|
|
.SH DESCRIPTION
|
|
.I ldapsearch
|
|
is a shell-accessible interface to the
|
|
.BR ldap_search (3)
|
|
library call.
|
|
.LP
|
|
.B ldapsearch
|
|
opens a connection to an LDAP server, binds, and performs a search
|
|
using the filter \fIfilter\fP. The \fIfilter\fP should conform to
|
|
the string representation for LDAP filters as defined in RFC 1558.
|
|
.LP
|
|
If
|
|
.B ldapsearch
|
|
finds one or more entries, the attributes specified by
|
|
\fIattrs\fP are retrieved and the entries and values are printed to
|
|
standard output. If no \fIattrs\fP are listed, all attributes are
|
|
returned.
|
|
.SH OPTIONS
|
|
.TP
|
|
.B \-n
|
|
Show what would be done, but don't actually perform the search. Useful for
|
|
debugging in conjunction with -v.
|
|
.TP
|
|
.B \-u
|
|
Include the User Friendly form of the Distinguished Name (DN) in the output
|
|
.TP
|
|
.B \-v
|
|
Run in verbose mode, with many diagnostics written to standard output
|
|
.TP
|
|
.B \-k
|
|
Use Kerberos authentication instead of simple authentication. It is
|
|
assumed that you already have a valid ticket granting ticket.
|
|
.B ldapsearch
|
|
must be compiled with KERBEROS defined for this option to have any effect.
|
|
.TP
|
|
.B \-K
|
|
Same as \-k, but only does step 1 of the kerberos bind. This is useful
|
|
when connecting to a slapd and there is no x500dsa.hostname principal
|
|
registered with your kerberos servers.
|
|
.TP
|
|
.B \-t
|
|
Write retrieved values to a set of temporary files. This is useful for
|
|
dealing with non-ASCII values such as jpegPhoto or audio.
|
|
.TP
|
|
.B \-A
|
|
Retrieve attributes only (no values). This is useful when you just want to
|
|
see if an attribute is present in an entry and are not interested in the
|
|
specific values.
|
|
.TP
|
|
.B \-B
|
|
Do not suppress display of non-ascii values. This is useful when
|
|
dealing with values that appear in alternate characters sets such as
|
|
ISO-8859.1. This option is implied by -L (see below).
|
|
.TP
|
|
.B \-L
|
|
Display search results in
|
|
.BR ldif (5)
|
|
format. This option also turns on the -B option, and causes the -F option
|
|
to be ignored.
|
|
.TP
|
|
.B \-M[M]
|
|
Enable manage DSA IT control.
|
|
.B \-MM
|
|
makes control critical.
|
|
.TP
|
|
.B \-R
|
|
Do not automatically follow referrals returned while searching.
|
|
.B ldapsearch
|
|
must be compiled with LDAP_REFERRALS defined for referrals to be
|
|
automatically followed by default, and for this option to have any effect.
|
|
.TP
|
|
.BI \-F \ sep
|
|
Use \fIsep\fP as the field separator between attribute names and values.
|
|
The default separator is `=', unless the -L flag has been specified, in
|
|
which case this option is ignored.
|
|
.TP
|
|
.BI \-S \ attribute
|
|
Sort the entries returned based on \fIattribute\fP. The default is not
|
|
to sort entries returned. If \fIattribute\fP is a zero-length string (""),
|
|
the entries are sorted by the components of their Distingished Name. See
|
|
.BR ldap_sort (3)
|
|
for more details. Note that
|
|
.B ldapsearch
|
|
normally prints out entries as it receives them. The use of the
|
|
.B \-S
|
|
option defeats this behavior, causing all entries to be retrieved,
|
|
then sorted, then printed.
|
|
.TP
|
|
.BI \-d \ debuglevel
|
|
Set the LDAP debugging level to \fIdebuglevel\fP.
|
|
.B ldapsearch
|
|
must be compiled with LDAP_DEBUG defined for this option to have any effect.
|
|
.TP
|
|
.BI \-f \ file
|
|
Read a series of lines from \fIfile\fP, performing one LDAP search for
|
|
each line. In this case, the \fIfilter\fP given on the command line
|
|
is treated as a pattern where the first occurrence of \fB%s\fP is
|
|
replaced with a line from \fIfile\fP. If \fIfile\fP is a single \fI-\fP
|
|
character, then the lines are read from standard input.
|
|
.TP
|
|
.BI \-D \ binddn
|
|
Use \fIbinddn\fP to bind to the LDAP directory. \fIbinddn\fP should be
|
|
a string-represented DN as defined in RFC 1779.
|
|
.TP
|
|
.B \-W
|
|
Prompt for simple authentication.
|
|
This is used instead of specifying the password on the command line.
|
|
.TP
|
|
.BI \-w \ bindpasswd
|
|
Use \fIbindpasswd\fP as the password for simple authentication.
|
|
.TP
|
|
.BI \-h \ ldaphost
|
|
Specify an alternate host on which the ldap server is running.
|
|
.TP
|
|
.BI \-p \ ldapport
|
|
Specify an alternate TCP port where the ldap server is listening.
|
|
.TP
|
|
.BI \-b \ searchbase
|
|
Use \fIsearchbase\fP as the starting point for the search instead of
|
|
the default.
|
|
.TP
|
|
.BI \-s \ base\fR\||\|\fIone\fR\||\|\fIsub
|
|
Specify the scope of the search to be one of
|
|
.IR base ,
|
|
.IR one ,
|
|
or
|
|
.I sub
|
|
to specify a base object, one-level, or subtree search. The default
|
|
is
|
|
.IR sub .
|
|
.TP
|
|
.BI \-a \ never\fR\||\|\fIalways\fR\||\|\fIsearch\fR\||\|\fIfind
|
|
Specify how aliases dereferencing is done. Should be one of
|
|
.IR never ,
|
|
.IR always ,
|
|
.IR search ,
|
|
or
|
|
.I find
|
|
to specify that aliases are never dereferenced, always dereferenced,
|
|
dereferenced when searching, or dereferenced only when locating the
|
|
base object for the search. The default is to never dereference aliases.
|
|
.TP
|
|
.BI \-P \ 2\fR\||\|\fI3
|
|
Specify the LDAP protocol version to use.
|
|
.TP
|
|
.BI \-l \ timelimit
|
|
wait at most \fItimelimit\fP seconds for a search to complete. A
|
|
timelimit of
|
|
.I 0
|
|
(zero) removes the
|
|
.B ldap.conf
|
|
limit.
|
|
.TP
|
|
.BI \-z \ sizelimit
|
|
retrieve at most \fIsizelimit\fP entries for a search. A sizelimit
|
|
of
|
|
.I 0
|
|
(zero) removes the
|
|
.B ldap.conf
|
|
limit.
|
|
.SH OUTPUT FORMAT
|
|
If one or more entries are found, each entry is written to standard output
|
|
in the form:
|
|
.LP
|
|
.nf
|
|
Distinguished Name (DN)
|
|
User Friendly Name (this line present only if the -u option is used)
|
|
attributename=value
|
|
attributename=value
|
|
attributename=value
|
|
...
|
|
.fi
|
|
.LP
|
|
Multiple entries are separated with a single blank line. If the -F option
|
|
is used to specify a separator character, it will be used instead of the
|
|
`=' character. If the -t option is used, the name of a temporary file
|
|
is used in place of the actual value. If the -A option
|
|
is given, only the "attributename" part is written.
|
|
.SH EXAMPLE
|
|
The following command:
|
|
.LP
|
|
.nf
|
|
ldapsearch "cn=mark smith" cn telephoneNumber
|
|
.fi
|
|
.LP
|
|
will perform a subtree search (using the default search base) for entries
|
|
with a commonName of "mark smith". The commonName and telephoneNumber
|
|
values will be retrieved and printed to standard output.
|
|
The output might look something like this if two entries are found:
|
|
.LP
|
|
.nf
|
|
cn=Mark D Smith, ou="College of Literature, Science, and the Arts", ou=Students, ou=People, o=University of Michigan, c=US
|
|
cn=Mark Smith
|
|
cn=Mark David Smith
|
|
cn=Mark D Smith 1
|
|
cn=Mark D Smith
|
|
telephoneNumber=+1 313 930-9489
|
|
|
|
cn=Mark C Smith, ou=Information Technology Division, ou=Faculty and Staff, ou=People, o=University of Michigan, c=US
|
|
cn=Mark Smith
|
|
cn=Mark C Smith 1
|
|
cn=Mark C Smith
|
|
telephoneNumber=+1 313 764-2277
|
|
.fi
|
|
.LP
|
|
The command:
|
|
.LP
|
|
.nf
|
|
ldapsearch -u -t "uid=mcs" jpegPhoto audio
|
|
.fi
|
|
.LP
|
|
will perform a subtree search using the default search base for entries
|
|
with user id of "mcs". The user friendly form of the entry's DN will be
|
|
output after the line that contains the DN itself, and the jpegPhoto
|
|
and audio values will be retrieved and written to temporary files. The
|
|
output might look like this if one entry with one value for each of the
|
|
requested attributes is found:
|
|
.LP
|
|
.nf
|
|
cn=Mark C Smith, ou=Information Technology Division, ou=Faculty and Staff, ou=People, o=University of Michigan, c=US
|
|
Mark C Smith, Information Technology Division, Faculty and Staff, People, University of Michigan, US
|
|
audio=/tmp/ldapsearch-audio-a19924
|
|
jpegPhoto=/tmp/ldapsearch-jpegPhoto-a19924
|
|
.fi
|
|
.LP
|
|
This command:
|
|
.LP
|
|
.nf
|
|
ldapsearch -L -s one -b "c=US" "o=university*" o description
|
|
.fi
|
|
.LP
|
|
will perform a one-level search at the c=US level for all organizations
|
|
whose organizationName begins with \fBuniversity\fP. Search results
|
|
will be displayed in the LDIF format.
|
|
The organizationName and description attribute values will be retrieved
|
|
and printed to standard output, resulting in output similar to this:
|
|
.LP
|
|
.nf
|
|
dn: o=University of Alaska Fairbanks, c=US
|
|
o: University of Alaska Fairbanks
|
|
description: Preparing Alaska for a brave new yesterday
|
|
description: leaf node only
|
|
|
|
dn: o=University of Colorado at Boulder, c=US
|
|
o: University of Colorado at Boulder
|
|
description: No personnel information
|
|
description: Institution of education and research
|
|
|
|
dn: o=University of Colorado at Denver, c=US
|
|
o: University of Colorado at Denver
|
|
o: UCD
|
|
o: CU/Denver
|
|
o: CU-Denver
|
|
description: Institute for Higher Learning and Research
|
|
|
|
dn: o=University of Florida, c=US
|
|
o: University of Florida
|
|
o: UFl
|
|
description: Warper of young minds
|
|
|
|
etc....
|
|
.fi
|
|
.SH DIAGNOSTICS
|
|
Exit status is 0 if no errors occur. Errors result in a non-zero exit
|
|
status and a diagnostic message being written to standard error.
|
|
.SH "SEE ALSO"
|
|
.BR ldapadd (1),
|
|
.BR ldapdelete (1),
|
|
.BR ldapmodify (1),
|
|
.BR ldapmodrdn (1),
|
|
.BR ldap.conf (5),
|
|
.BR ldap (3),
|
|
.BR ldap_search (3)
|
|
.LP
|
|
Kille, S.,
|
|
.IR "A String Representation of Distinguished Names",
|
|
.SM RFC
|
|
1779,
|
|
ISODE Consortium, March 1995.
|
|
.LP
|
|
Howes, T.,
|
|
.IR "A String Representation of LDAP Search Filters",
|
|
.SM RFC
|
|
1558,
|
|
University of Michigan, December 1993.
|
|
.SH ACKNOWLEDGEMENTS
|
|
.B OpenLDAP
|
|
is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
|
|
.B OpenLDAP
|
|
is derived from University of Michigan LDAP 3.3 Release.
|