Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

第 10 章 Searching IdM entries using the ldapsearch command

You can use the ipa find command to search through the Identity Management entries. For more information about ipa command see Structure of IPA commands section in the Accessing Identity Management services documentation.

This section introduces the basics of an alternative search option using ldapsearch command line command through the Identity Management entries.

10.1. Using the ldapsearch command
复制链接

The ldapsearch command has the following format: 

# ldapsearch [-x | -Y mechanism] [options] [search_filter] [list_of_attributes]
  • To configure the authentication method, specify the -x option to use simple binds or the -Y option to set the Simple Authentication and Security Layer (SASL) mechanism. Note that you need to obtain a Kerberos ticket if you are using the -Y GSSAPI option.
  • The options are the ldapsearch command options described in a table below.
  • The search_filter is an LDAP search filter.
  • The list_of_attributes is a list of the attributes that the search results return.

For example, you want to search all the entries of a base LDAP tree for the user name user01: 

# ldapsearch -x -H ldap://ldap.example.com -s sub "(uid=user01)"
  • The -x option tells the ldapsearch command to authenticate with the simple bind. Note that if you do not provide the Distinguish Name (DN) with the -D option, the authentication is anonymous.
  • The -H option connects you to the ldap://ldap.example.com.
  • The -s sub option tells the ldapsearch command to search all the entries, starting from the base DN, for the user with the name user01. The "(uid=user01)" is a filter.

Note that if you do not provide the starting point for the search with the -b option, the command searches in the default tree. It is specified in the BASE parameter of the etc/openldap/ldap.conf file.

Expand
表 10.1. The ldapsearch command options
OptionDescription

-b

The starting point for the search. If your search parameters contain an asterisk (*) or other character, that the command line can interpret into a code, you must wrap the value in single or double quotation marks. For example, -b cn=user,ou=Product Development,dc=example,dc=com.

-D

The Distinguished Name (DN) with which you want to authenticate.

-H

An LDAP URL to connect to the server. The -H option replaces the -h and -p options.

-l

The time limit in seconds to wait for a search request to complete.

-s scope

The scope of the search. You can choose one of the following for the scope:

  • base searches only the entry from the -b option or defined by the LDAP_BASEDN environment variable.
  • one searches only the children of the entry from the -b option.
  • sub a subtree search from the -b option starting point.

-W

Requests for the password.

-x

Disables the default SASL connection to allow simple binds.

-Y SASL_mechanism

Sets the SASL mechanism for the authentication.

-z number

The maximum number of entries in the search result.

Note, you must specify one of the authentication mechanisms with the -x or -Y option with the ldapsearch command.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部