'\" t
|
.\" Title: ldapsearch
|
.\" Author:
|
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
.\" Date: 10/22/2014
|
.\" Manual: Tools Reference
|
.\" Source: OpenDJ 3.0.0
|
.\" Language: English
|
.\"
|
.TH "LDAPSEARCH" "1" "10/22/2014" "OpenDJ 3\&.0\&.0" "Tools Reference"
|
.\" -----------------------------------------------------------------
|
.\" * Define some portability stuff
|
.\" -----------------------------------------------------------------
|
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
.\" http://bugs.debian.org/507673
|
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
.ie \n(.g .ds Aq \(aq
|
.el .ds Aq '
|
.\" -----------------------------------------------------------------
|
.\" * set default formatting
|
.\" -----------------------------------------------------------------
|
.\" disable hyphenation
|
.nh
|
.\" disable justification (adjust text to left margin only)
|
.ad l
|
.\" -----------------------------------------------------------------
|
.\" * MAIN CONTENT STARTS HERE *
|
.\" -----------------------------------------------------------------
|
.SH "NAME"
|
ldapsearch \- perform LDAP search operations
|
.SH "SYNOPSIS"
|
.HP \w'\fBldapsearch\fR\ 'u
|
\fBldapsearch\fR {options} [filter] [attributes...]
|
.SH "DESCRIPTION"
|
.PP
|
This utility can be used to perform LDAP search operations in the directory\&.
|
.SH "OPTIONS"
|
.PP
|
The following options are supported\&.
|
.PP
|
\fB\-a, \-\-dereferencePolicy {dereferencePolicy}\fR
|
.RS 4
|
Alias dereference policy (\*(Aqnever\*(Aq, \*(Aqalways\*(Aq, \*(Aqsearch\*(Aq, or \*(Aqfind\*(Aq)
|
.sp
|
Default value: never
|
.RE
|
.PP
|
\fB\-A, \-\-typesOnly\fR
|
.RS 4
|
Only retrieve attribute names but not their values
|
.RE
|
.PP
|
\fB\-\-assertionFilter {filter}\fR
|
.RS 4
|
Use the LDAP assertion control with the provided filter
|
.RE
|
.PP
|
\fB\-b, \-\-baseDN {baseDN}\fR
|
.RS 4
|
Base DN format string
|
.RE
|
.PP
|
\fB\-c, \-\-continueOnError\fR
|
.RS 4
|
Continue processing even if there are errors
|
.RE
|
.PP
|
\fB\-C, \-\-persistentSearch ps[:changetype[:changesonly[:entrychgcontrols]]]\fR
|
.RS 4
|
Use the persistent search control
|
.RE
|
.PP
|
\fB\-\-countEntries\fR
|
.RS 4
|
Count the number of entries returned by the server
|
.RE
|
.PP
|
\fB\-e, \-\-getEffectiveRightsAttribute {attribute}\fR
|
.RS 4
|
Specifies geteffectiverights control specific attribute list
|
.RE
|
.PP
|
\fB\-f, \-\-filename {file}\fR
|
.RS 4
|
LDIF file containing the changes to apply
|
.RE
|
.PP
|
\fB\-g, \-\-getEffectiveRightsAuthzid {authzID}\fR
|
.RS 4
|
Use geteffectiverights control with the provided authzid
|
.RE
|
.PP
|
\fB\-G, \-\-virtualListView {before:after:index:count | before:after:value}\fR
|
.RS 4
|
Use the virtual list view control to retrieve the specified results page
|
.RE
|
.PP
|
\fB\-J, \-\-control {controloid[:criticality[:value|::b64value|:<filePath]]}\fR
|
.RS 4
|
Use a request control with the provided information
|
.sp
|
For some
|
\fIcontroloid\fR
|
values, you can replace object identifiers with user\-friendly strings\&. The strings are listed here in lower case, but the case is not important\&. You can use camelCase if you prefer, for example\&.
|
.PP
|
accountusable, accountusability
|
.RS 4
|
Account Usability Control, Object Identifier: 1\&.3\&.6\&.1\&.4\&.1\&.42\&.2\&.27\&.9\&.5\&.8
|
.RE
|
.PP
|
authzid, authorizationidentity
|
.RS 4
|
Authorization Identity Request Control, Object Identifier: 2\&.16\&.840\&.1\&.113730\&.3\&.4\&.16
|
.RE
|
.PP
|
effectiverights, geteffectiverights
|
.RS 4
|
Get Effective Rights Request Control, Object Identifier: 1\&.3\&.6\&.1\&.4\&.1\&.42\&.2\&.27\&.9\&.5\&.2
|
.RE
|
.PP
|
managedsait
|
.RS 4
|
Manage DSAIT Request Control, Object Identifier: 2\&.16\&.840\&.1\&.113730\&.3\&.4\&.2
|
.RE
|
.PP
|
noop, no\-op
|
.RS 4
|
No\-Op Control, Object Identifier: 1\&.3\&.6\&.1\&.4\&.1\&.4203\&.1\&.10\&.2
|
.RE
|
.PP
|
pwpolicy, passwordpolicy
|
.RS 4
|
Password Policy Control, Object Identifier: 1\&.3\&.6\&.1\&.4\&.1\&.42\&.2\&.27\&.8\&.5\&.1
|
.RE
|
.PP
|
realattrsonly, realattributesonly
|
.RS 4
|
Real Attributes Only Request Control, Object Identifier: 2\&.16\&.840\&.1\&.113730\&.3\&.4\&.17
|
.RE
|
.PP
|
subtreedelete, treedelete
|
.RS 4
|
Subtree Delete Request Control, Object Identifier: 1\&.2\&.840\&.113556\&.1\&.4\&.805
|
.RE
|
.PP
|
virtualattrsonly, virtualattributesonly
|
.RS 4
|
Virtual Attributes Only Request Control, Object Identifier: 2\&.16\&.840\&.1\&.113730\&.3\&.4\&.19
|
.RE
|
.RE
|
.PP
|
\fB\-l, \-\-timeLimit {timeLimit}\fR
|
.RS 4
|
Maximum length of time in seconds to allow for the search
|
.sp
|
Default value: 0
|
.RE
|
.PP
|
\fB\-\-matchedValuesFilter {filter}\fR
|
.RS 4
|
Use the LDAP matched values control with the provided filter
|
.RE
|
.PP
|
\fB\-n, \-\-dry\-run\fR
|
.RS 4
|
Show what would be done but do not perform any operation
|
.RE
|
.PP
|
\fB\-s, \-\-searchScope {searchScope}\fR
|
.RS 4
|
Search scope (\*(Aqbase\*(Aq, \*(Aqone\*(Aq, \*(Aqsub\*(Aq, or \*(Aqsubordinate\*(Aq)
|
.sp
|
Default value: sub
|
.sp
|
subordinate
|
is an LDAP extension that might not work with all LDAP servers\&.
|
.RE
|
.PP
|
\fB\-S, \-\-sortOrder {sortOrder}\fR
|
.RS 4
|
Sort the results using the provided sort order
|
.RE
|
.PP
|
\fB\-\-simplePageSize {numEntries}\fR
|
.RS 4
|
Use the simple paged results control with the given page size
|
.sp
|
Default value: 1000
|
.RE
|
.PP
|
\fB\-\-subEntries\fR
|
.RS 4
|
Use subentries control to specify that subentries are visible and normal entries are not
|
.RE
|
.PP
|
\fB\-Y, \-\-proxyAs {authzID}\fR
|
.RS 4
|
Use the proxied authorization control with the given authorization ID
|
.RE
|
.PP
|
\fB\-z, \-\-sizeLimit {sizeLimit}\fR
|
.RS 4
|
Maximum number of entries to return from the search
|
.sp
|
Default value: 0
|
.RE
|
.SS "LDAP Connection Options"
|
.PP
|
\fB\-\-connectTimeout {timeout}\fR
|
.RS 4
|
Maximum length of time (in milliseconds) that can be taken to establish a connection\&. Use \*(Aq0\*(Aq to specify no time out\&.
|
.sp
|
Default value: 30000
|
.RE
|
.PP
|
\fB\-D, \-\-bindDN {bindDN}\fR
|
.RS 4
|
DN to use to bind to the server
|
.sp
|
Default value: cn=Directory Manager
|
.RE
|
.PP
|
\fB\-E, \-\-reportAuthzID\fR
|
.RS 4
|
Use the authorization identity control
|
.RE
|
.PP
|
\fB\-h, \-\-hostname {host}\fR
|
.RS 4
|
Directory server hostname or IP address
|
.sp
|
Default value: localhost\&.localdomain
|
.RE
|
.PP
|
\fB\-j, \-\-bindPasswordFile {bindPasswordFile}\fR
|
.RS 4
|
Bind password file
|
.RE
|
.PP
|
\fB\-K, \-\-keyStorePath {keyStorePath}\fR
|
.RS 4
|
Certificate key store path
|
.RE
|
.PP
|
\fB\-N, \-\-certNickname {nickname}\fR
|
.RS 4
|
Nickname of certificate for SSL client authentication
|
.RE
|
.PP
|
\fB\-o, \-\-saslOption {name=value}\fR
|
.RS 4
|
SASL bind options
|
.RE
|
.PP
|
\fB\-p, \-\-port {port}\fR
|
.RS 4
|
Directory server port number
|
.sp
|
Default value: 389
|
.RE
|
.PP
|
\fB\-P, \-\-trustStorePath {trustStorePath}\fR
|
.RS 4
|
Certificate trust store path
|
.RE
|
.PP
|
\fB\-q, \-\-useStartTLS\fR
|
.RS 4
|
Use StartTLS to secure communication with the server
|
.RE
|
.PP
|
\fB\-r, \-\-useSASLExternal\fR
|
.RS 4
|
Use the SASL EXTERNAL authentication mechanism
|
.RE
|
.PP
|
\fB\-\-trustStorePassword {trustStorePassword}\fR
|
.RS 4
|
Certificate trust store PIN
|
.RE
|
.PP
|
\fB\-u, \-\-keyStorePasswordFile {keyStorePasswordFile}\fR
|
.RS 4
|
Certificate key store PIN file
|
.RE
|
.PP
|
\fB\-U, \-\-trustStorePasswordFile {path}\fR
|
.RS 4
|
Certificate trust store PIN file
|
.RE
|
.PP
|
\fB\-\-usePasswordPolicyControl\fR
|
.RS 4
|
Use the password policy request control
|
.RE
|
.PP
|
\fB\-V, \-\-ldapVersion {version}\fR
|
.RS 4
|
LDAP protocol version number
|
.sp
|
Default value: 3
|
.RE
|
.PP
|
\fB\-w, \-\-bindPassword {bindPassword}\fR
|
.RS 4
|
Password to use to bind to the server
|
.RE
|
.PP
|
\fB\-W, \-\-keyStorePassword {keyStorePassword}\fR
|
.RS 4
|
Certificate key store PIN
|
.RE
|
.PP
|
\fB\-X, \-\-trustAll\fR
|
.RS 4
|
Trust all server SSL certificates
|
.RE
|
.PP
|
\fB\-Z, \-\-useSSL\fR
|
.RS 4
|
Use SSL for secure communication with the server
|
.RE
|
.SS "Utility Input/Output Options"
|
.PP
|
\fB\-i, \-\-encoding {encoding}\fR
|
.RS 4
|
Use the specified character set for command\-line input
|
.RE
|
.PP
|
\fB\-\-noPropertiesFile\fR
|
.RS 4
|
No properties file will be used to get default command line argument values
|
.RE
|
.PP
|
\fB\-\-propertiesFilePath {propertiesFilePath}\fR
|
.RS 4
|
Path to the file containing default property values used for command line arguments
|
.RE
|
.PP
|
\fB\-T, \-\-dontWrap\fR
|
.RS 4
|
Do not wrap long lines
|
.RE
|
.PP
|
\fB\-v, \-\-verbose\fR
|
.RS 4
|
Use verbose mode
|
.RE
|
.SS "General Options"
|
.PP
|
\fB\-\-version\fR
|
.RS 4
|
Display version information
|
.RE
|
.PP
|
\fB\-?, \-H, \-\-help\fR
|
.RS 4
|
Display usage information
|
.RE
|
.SH "FILTER"
|
.PP
|
The filter argument is a string representation of an LDAP search filter as in
|
(cn=Babs Jensen),
|
(&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*))), or
|
(cn:caseExactMatch:=Fred Flintstone)\&.
|
.SH "ATTRIBUTE"
|
.PP
|
The optional attribute list specifies the attributes to return in the entries found by the search\&. In addition to identifying attributes by name such as
|
cn sn mail
|
and so forth, you can use the following notations, too\&.
|
.PP
|
*
|
.RS 4
|
Return all user attributes such as
|
cn,
|
sn, and
|
mail\&.
|
.RE
|
.PP
|
+
|
.RS 4
|
Return all operational attributes such as
|
etag
|
and
|
pwdPolicySubentry\&.
|
.RE
|
.PP
|
@\fIobjectclass\fR
|
.RS 4
|
Return all attributes of the specified object class, where
|
\fIobjectclass\fR
|
is one of the object classes on the entries returned by the search\&.
|
.RE
|
.PP
|
1\&.1
|
.RS 4
|
Return no attributes, only the DNs of matching entries\&.
|
.RE
|
.SH "EXIT CODES"
|
.PP
|
0
|
.RS 4
|
The command completed successfully\&.
|
.RE
|
.PP
|
\fIldap\-error\fR
|
.RS 4
|
An LDAP error occurred while processing the operation\&.
|
.sp
|
LDAP result codes are described in
|
\m[blue]\fBRFC 4511\fR\m[]\&. Also see the additional information for details\&.
|
.RE
|
.PP
|
89
|
.RS 4
|
An error occurred while parsing the command\-line arguments\&.
|
.RE
|
.SH "FILES"
|
.PP
|
You can use
|
~/\&.opendj/tools\&.properties
|
to set the defaults for bind DN, host name, and port number as in the following example\&.
|
.sp
|
.if n \{\
|
.RS 4
|
.\}
|
.nf
|
hostname=directory\&.example\&.com
|
port=1389
|
bindDN=uid=kvaughan,ou=People,dc=example,dc=com
|
|
ldapcompare\&.port=1389
|
ldapdelete\&.port=1389
|
ldapmodify\&.port=1389
|
ldappasswordmodify\&.port=1389
|
ldapsearch\&.port=1389
|
|
.fi
|
.if n \{\
|
.RE
|
.\}
|
.SH "EXAMPLES"
|
.PP
|
The following example searches for entries with UID containing
|
jensen, returning only DNs and uid values\&.
|
.sp
|
.if n \{\
|
.RS 4
|
.\}
|
.nf
|
$ \fBldapsearch \-p 1389 \-b dc=example,dc=com "(uid=*jensen*)" uid\fR
|
dn: uid=ajensen,ou=People,dc=example,dc=com
|
uid: ajensen
|
|
dn: uid=bjensen,ou=People,dc=example,dc=com
|
uid: bjensen
|
|
dn: uid=gjensen,ou=People,dc=example,dc=com
|
uid: gjensen
|
|
dn: uid=jjensen,ou=People,dc=example,dc=com
|
uid: jjensen
|
|
dn: uid=kjensen,ou=People,dc=example,dc=com
|
uid: kjensen
|
|
dn: uid=rjensen,ou=People,dc=example,dc=com
|
uid: rjensen
|
|
dn: uid=tjensen,ou=People,dc=example,dc=com
|
uid: tjensen
|
|
|
Result Code: 0 (Success)
|
|
.fi
|
.if n \{\
|
.RE
|
.\}
|
.PP
|
You can also use
|
@\fIobjectclass\fR
|
notation in the attribute list to return the attributes of a particular object class\&. The following example shows how to return attributes of the
|
inetOrgPerson
|
object class\&.
|
.sp
|
.if n \{\
|
.RS 4
|
.\}
|
.nf
|
$ \fBldapsearch \-p 1389 \-b dc=example,dc=com "(uid=bjensen)" @inetorgperson\fR
|
dn: uid=bjensen,ou=People,dc=example,dc=com
|
givenName: Barbara
|
objectClass: person
|
objectClass: organizationalPerson
|
objectClass: inetOrgPerson
|
objectClass: posixAccount
|
objectClass: top
|
uid: bjensen
|
cn: Barbara Jensen
|
cn: Babs Jensen
|
telephoneNumber: +1 408 555 1862
|
sn: Jensen
|
roomNumber: 0209
|
mail: bjensen@example\&.com
|
l: Cupertino
|
ou: Product Development
|
ou: People
|
facsimileTelephoneNumber: +1 408 555 1992
|
|
.fi
|
.if n \{\
|
.RE
|
.\}
|
.PP
|
You can use
|
+
|
in the attribute list to return all operational attributes, as in the following example\&.
|
.sp
|
.if n \{\
|
.RS 4
|
.\}
|
.nf
|
$ \fBldapsearch \-p 1389 \-b dc=example,dc=com "(uid=bjensen)" +\fR
|
dn: uid=bjensen,ou=People,dc=example,dc=com
|
numSubordinates: 0
|
structuralObjectClass: inetOrgPerson
|
etag: 0000000073c29972
|
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config
|
subschemaSubentry: cn=schema
|
hasSubordinates: false
|
entryDN: uid=bjensen,ou=people,dc=example,dc=com
|
entryUUID: fc252fd9\-b982\-3ed6\-b42a\-c76d2546312c
|
|
.fi
|
.if n \{\
|
.RE
|
.\}
|
.SH "COPYRIGHT"
|
.br
|
Copyright \(co 2011-2014 ForgeRock AS
|
.br
|
