Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 10. Searching IdM entries using the ldapsearch command

You can use the ipa find command to search through the Identity Management entries. For more information about ipa command see Structure of IPA commands section in the Accessing Identity Management services documentation.

This section introduces the basics of an alternative search option using ldapsearch command line command through the Identity Management entries.

10.1. Using the ldapsearch command
Copiar o link

The ldapsearch command has the following format: 

# ldapsearch [-x | -Y mechanism] [options] [search_filter] [list_of_attributes]
Copy to Clipboard Toggle word wrap
  • To configure the authentication method, specify the -x option to use simple binds or the -Y option to set the Simple Authentication and Security Layer (SASL) mechanism. Note that you need to obtain a Kerberos ticket if you are using the -Y GSSAPI option.
  • The options are the ldapsearch command options described in a table below.
  • The search_filter is an LDAP search filter.
  • The list_of_attributes is a list of the attributes that the search results return.

For example, you want to search all the entries of a base LDAP tree for the user name user01: 

# ldapsearch -x -H ldap://ldap.example.com -s sub "(uid=user01)"
Copy to Clipboard Toggle word wrap
  • The -x option tells the ldapsearch command to authenticate with the simple bind. Note that if you do not provide the Distinguish Name (DN) with the -D option, the authentication is anonymous.
  • The -H option connects you to the ldap://ldap.example.com.
  • The -s sub option tells the ldapsearch command to search all the entries, starting from the base DN, for the user with the name user01. The "(uid=user01)" is a filter.

Note that if you do not provide the starting point for the search with the -b option, the command searches in the default tree. It is specified in the BASE parameter of the etc/openldap/ldap.conf file.

Expand
Table 10.1. The ldapsearch command options
OptionDescription

-b

The starting point for the search. If your search parameters contain an asterisk (*) or other character, that the command line can interpret into a code, you must wrap the value in single or double quotation marks. For example, -b cn=user,ou=Product Development,dc=example,dc=com.

-D

The Distinguished Name (DN) with which you want to authenticate.

-H

An LDAP URL to connect to the server. The -H option replaces the -h and -p options.

-l

The time limit in seconds to wait for a search request to complete.

-s scope

The scope of the search. You can choose one of the following for the scope:

  • base searches only the entry from the -b option or defined by the LDAP_BASEDN environment variable.
  • one searches only the children of the entry from the -b option.
  • sub a subtree search from the -b option starting point.

-W

Requests for the password.

-x

Disables the default SASL connection to allow simple binds.

-Y SASL_mechanism

Sets the SASL mechanism for the authentication.

-z number

The maximum number of entries in the search result.

Note, you must specify one of the authentication mechanisms with the -x or -Y option with the ldapsearch command.

10.2. Using the ldapsearch filters
Copiar o link

The ldapsearch filters allow you to narrow down the search results.

For example, you want the search result to contain all the entries with a common names set to example: 

"(cn=example)"
Copy to Clipboard Toggle word wrap

In this case, the equal sign (=) is the operator, and example is the value.

Expand
Table 10.2. The ldapsearch filter operators
Search typeOperatorDescription

Equality

=

Returns the entries with the exact match to the value. For example, cn=example.

Substring

=string* string

Returns all entries with the substring match. For example, cn=exa*l. The asterisk (*) indicates zero (0) or more characters.

Greater than or equal to

>=

Returns all entries with attributes that are greater than or equal to the value. For example, uidNumber >= 5000.

Less than or equal to

<=

Returns all entries with attributes that are less than or equal to the value. For example, uidNumber <= 5000.

Presence

=*

Returns all entries with one or more attributes. For example, cn=*.

Approximate

~=

Returns all entries with the similar to the value attributes. For example, l~=san fransico can return l=san francisco.

You can use boolean operators to combine multiple filters to the ldapsearch command.

Expand
Table 10.3. The ldapsearch filter boolean operators
Search typeOperatorDescription

AND

&

Returns all entries where all statements in the filters are true. For example, (&(filter)(filter)(filter)…​).

OR

|

Returns all entries where at least one statement in the filters is true. For example, (|(filter)(filter)(filter)…​).

NOT

!

Returns all entries where the statement in the filter is not true. For example, (!(filter)).

Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat