Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 10. Searching IdM entries using the ldapsearch command

Search Identity Management entries using the ldapsearch command as an alternative to the ipa find command. The ldapsearch command provides direct LDAP-level queries with flexible filtering options.

10.1. Using the ldapsearch command
Copy link

Use the ldapsearch command to query LDAP directories in Identity Management (IdM), returning specific attributes and entries based on search filters and authentication options.

The ldapsearch command has the following format: 

# ldapsearch [-x | -Y mechanism] [options] [search_filter] [list_of_attributes]
  • To configure the authentication method, specify the -x option to use simple binds or the -Y option to set the Simple Authentication and Security Layer (SASL) mechanism. Note that you need to obtain a Kerberos ticket if you are using the -Y GSSAPI option.
  • The options are the ldapsearch command options described in a table below.
  • The search_filter is an LDAP search filter.
  • The list_of_attributes is a list of the attributes that the search results return.

For example, you want to search all the entries of a base LDAP tree for the user name user01: 

# ldapsearch -x -H ldap://ldap.example.com -s sub "(uid=user01)"
  • The -x option tells the ldapsearch command to authenticate with the simple bind. Note that if you do not provide the Distinguish Name (DN) with the -D option, the authentication is anonymous.
  • The -H option connects you to the ldap://ldap.example.com.
  • The -s sub option tells the ldapsearch command to search all the entries, starting from the base DN, for the user with the name user01. The "(uid=user01)" is a filter.

Note that if you do not provide the starting point for the search with the -b option, the command searches in the default tree. It is specified in the BASE parameter of the etc/openldap/ldap.conf file.

Expand
Table 10.1. The ldapsearch command options
OptionDescription

-b

The starting point for the search. If your search parameters contain an asterisk (*) or other character, that the command line can interpret into a code, you must wrap the value in single or double quotation marks. For example, -b cn=user,ou=Product Development,dc=example,dc=com.

-D

The Distinguished Name (DN) with which you want to authenticate.

-H

An LDAP URL to connect to the server. The -H option replaces the -h and -p options.

-l

The time limit in seconds to wait for a search request to complete.

-s scope

The scope of the search. You can choose one of the following for the scope:

  • base searches only the entry from the -b option or defined by the LDAP_BASEDN environment variable.
  • one searches only the children of the entry from the -b option.
  • sub a subtree search from the -b option starting point.

-W

Requests for the password.

-x

Disables the default SASL connection to allow simple binds.

-Y SASL_mechanism

Sets the SASL mechanism for the authentication.

-z number

The maximum number of entries in the search result.

Note, you must specify one of the authentication mechanisms with the -x or -Y option with the ldapsearch command.

10.2. Using the ldapsearch filters
Copy link

Narrow ldapsearch results in Identity Management (IdM) using filter operators and boolean expressions to match specific LDAP attributes or combinations of attributes.

For example, you want the search result to contain all the entries with a common names set to example: 

"(cn=example)"

In this case, the equal sign (=) is the operator, and example is the value.

Expand
Table 10.2. The ldapsearch filter operators
Search typeOperatorDescription

Equality

=

Returns the entries with the exact match to the value. For example, cn=example.

Substring

=string* string

Returns all entries with the substring match. For example, cn=exa*l. The asterisk (*) indicates zero (0) or more characters.

Greater than or equal to

>=

Returns all entries with attributes that are greater than or equal to the value. For example, uidNumber >= 5000.

Less than or equal to

<=

Returns all entries with attributes that are less than or equal to the value. For example, uidNumber <= 5000.

Presence

=*

Returns all entries with one or more attributes. For example, cn=*.

Approximate

~=

Returns all entries with the similar to the value attributes. For example, l~=san fransico can return l=san francisco.

You can use boolean operators to combine multiple filters to the ldapsearch command.

Expand
Table 10.3. The ldapsearch filter boolean operators
Search typeOperatorDescription

AND

&

Returns all entries where all statements in the filters are true. For example, (&(filter)(filter)(filter)…​).

OR

|

Returns all entries where at least one statement in the filters is true. For example, (|(filter)(filter)(filter)…​).

NOT

!

Returns all entries where the statement in the filter is not true. For example, (!(filter)).

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top