Questo contenuto non è disponibile nella lingua selezionata.
Chapter 11. Searching IdM entries using the ldapsearch command
You can use the ipa find command to search through the Identity Management entries. For more information about ipa command see Structure of IPA commands section.
This section introduces the basics of an alternative search option using ldapsearch command line command through the Identity Management entries.
11.1. Using the ldapsearch command
The ldapsearch command has the following format:
# ldapsearch [-x | -Y mechanism] [options] [search_filter] [list_of_attributes]-
To configure the authentication method, specify the
-xoption to use simple binds or the-Yoption to set the Simple Authentication and Security Layer (SASL) mechanism. Note that you need to obtain a Kerberos ticket if you are using the-Y GSSAPIoption. -
The options are the
ldapsearchcommand options described in a table below. - The search_filter is an LDAP search filter.
- The list_of_attributes is a list of the attributes that the search results return.
For example, you want to search all the entries of a base LDAP tree for the user name user01:
# ldapsearch -x -H ldap://ldap.example.com -s sub "(uid=user01)"
-
The
-xoption tells theldapsearchcommand to authenticate with the simple bind. Note that if you do not provide the Distinguish Name (DN) with the-Doption, the authentication is anonymous. -
The
-Hoption connects you to the ldap://ldap.example.com. -
The
-s suboption tells theldapsearchcommand to search all the entries, starting from the base DN, for the user with the name user01. The "(uid=user01)" is a filter.
Note that if you do not provide the starting point for the search with the -b option, the command searches in the default tree. It is specified in the BASE parameter of the etc/openldap/ldap.conf file.
| Option | Description |
|---|---|
| -b |
The starting point for the search. If your search parameters contain an asterisk (*) or other character, that the command line can interpret into a code, you must wrap the value in single or double quotation marks. For example, |
| -D | The Distinguished Name (DN) with which you want to authenticate. |
| -H |
An LDAP URL to connect to the server. The |
| -l | The time limit in seconds to wait for a search request to complete. |
| -s scope | The scope of the search. You can choose one of the following for the scope:
|
| -W | Requests for the password. |
| -x | Disables the default SASL connection to allow simple binds. |
| -Y SASL_mechanism | Sets the SASL mechanism for the authentication. |
| -z number | The maximum number of entries in the search result. |
Note, you must specify one of the authentication mechanisms with the -x or -Y option with the ldapsearch command.
Additional resources
-
For details on how to use
ldapsearch, seeldapsearch(1)man page on your system.
11.2. Using the ldapsearch filters
The ldapsearch filters allow you to narrow down the search results.
For example, you want the search result to contain all the entries with a common names set to example:
"(cn=example)"
In this case, the equal sign (=) is the operator, and example is the value.
| Search type | Operator | Description |
|---|---|---|
| Equality | = | Returns the entries with the exact match to the value. For example, cn=example. |
| Substring | =string* string | Returns all entries with the substring match. For example, cn=exa*l. The asterisk (*) indicates zero (0) or more characters. |
| Greater than or equal to | >= | Returns all entries with attributes that are greater than or equal to the value. For example, uidNumber >= 5000. |
| Less than or equal to | <= | Returns all entries with attributes that are less than or equal to the value. For example, uidNumber <= 5000. |
| Presence | =* | Returns all entries with one or more attributes. For example, cn=*. |
| Approximate | ~= | Returns all entries with the similar to the value attributes. For example, l~=san fransico can return l=san francisco. |
You can use boolean operators to combine multiple filters to the ldapsearch command.
| Search type | Operator | Description |
|---|---|---|
| AND | & | Returns all entries where all statements in the filters are true. For example, (&(filter)(filter)(filter)…). |
| OR | | | Returns all entries where at least one statement in the filters is true. For example, (|(filter)(filter)(filter)…). |
| NOT | ! | Returns all entries where the statement in the filter is not true. For example, (!(filter)). |
