Date: 11-04-2022

ldapsearch

ldapsearch Man Page

Syntax: ldapsearch <opts> [search filter] [return attributes]

The ldapsearch command allows a user to query an LDAP directory. Entries matching the search are returned in LDIF format. In addition to the common options, ldapsearch requires (in bold) or uses the following:

Search Scope

A very important part of efficient searches is to set the scope of the search The search scope tells the server how deep to perform a search (-s base|one|sub):

The default search scope is sub (tree). While it's useful when you want a full, unrestricted search, it also increases search times/overhead since it checks for subentries on every entry

• If you're searching for one entry only and you know the full DN or at least know the search base and an attribute of the entry, use -s base for your search scope. Anything more is just wasting CPU cycles
• If you want to limit your scope to one level, for example getting all of the OU entries (but not their children) in the example database, use -s one (-b dc=example,dc=com -s one )
• If you want all entries below the search base, use -s sub (or exclude -s since sub is the default). Take note of any non-useful entries returned in the search result and adjust future searches to exclude those entries

Search Filters

Search filters are used to refine searches by attribute values so only necessary entries are returned

• Filters use one or more attribute/value pairs contained within parentheses "( )" to match items in the directory
• Search filters also use parentheses for grouping criteria together in conjunction with search operators
• Search filters work more efficiently when attributes that are commonly searched are indexed in the database. Indexes will be covered in a later part of the class

Filter Operators

Note 1: Greater/lesser than without equality operators (>, <) are not used in LDAP. Negation of the "greater/less or equal" operator is necessary to implement this operation. See examples below.

Note 2: Search results and performance depend on how the attributes are indexed. Unindexed attributes will cause excessive search time and improperly indexed attributes or improperly used operators may cause incomplete search results.

Example Search Filters

# Simple filter looking for entries that use the "person" objectClass:
(objectClass=person)

# Filter that looks for entries that don't have the last name (sn) "Smith":
(!(sn=Smith))

# Search for entries in the "Accounting" organizational unit with the last name "Smith":
(&(ou=Accounting)(sn=Smith))

# Search for entries in the "Accounting" organizational unit without the last name "Smith":
(&(ou=Accounting)(!(sn=Smith))

# Search for entries with UIDNumber greater or equal to 50:
(UIDNumber>=50)

# Search for entries with UIDNumber greater than 50 (add negation and reverse GT/LT operator):
(!(UID<=50))

Search Tips

• If you know the exact DN of an entry, you can use the DN as the searchbase in the "-b searchbase" and allows you to forego the search filter
• Search filters are evaluated by the server from left to right. Efficient search filters work from general to specific
• Use the search filter builder in Apache Directory Studio for building complicated search filters

Return Attributes

At the end of the ldapsearch command, you may provide a list of attributes you want returned with the entry. Here are your options: