Using ldapcompare

Learn how to efficiently use ldapcompare for comparing LDAP directory attributes and values to manage user identities effectively.

Updated at October 21st, 2025

+ More

Table of Contents

Basic Syntax Common Options Example Commands Compare a user’s attribute Compare multiple attributes from file Troubleshooting

Date: 11-04-2022

The ldapcompare command-line tool lets you test whether a specific attribute in an LDAP entry matches a given value.
It’s ideal for verifying user attributes, group memberships, or password hashes without modifying data.

The result code of the compare is provided as the exit code and, unless run with -z, the program prints TRUE, FALSE, or UNDEFINED on standard output.

Basic Syntax

ldapcompare [options] DN attribute:value

Or from a file of comparisons:

ldapcompare [options] -f comparisons.txt

Common Options

Option	Description
`-x`	Use simple bind instead of SASL
`-H ldap://host`	LDAP URI
`-D "cn=admin,dc=example,dc=com"`	Bind DN
`-W`	Prompt for password
`-w password`	Supply password directly (not recommended)
`-ZZ`	Use StartTLS
`-v`	Verbose output
`-f file`	Read DN/attribute:value pairs from file

Example Commands

Compare a user’s attribute

ldapcompare -x -H ldap://localhost \
 -D "cn=admin,dc=example,dc=com" -W \
 "uid=jdoe,ou=People,dc=example,dc=com" mail:jdoe@example.com

Compare multiple attributes from file

File: compare-list.txt

uid=jdoe,ou=People,dc=example,dc=com mail:jdoe@example.com
uid=jdoe,ou=People,dc=example,dc=com sn:Doe
uid=jdoe,ou=People,dc=example,dc=com departmentNumber:IT

Command:

ldapcompare -x -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f compare-list.txt

Troubleshooting

Error	Meaning	Fix
`ldap_compare: No such object (32)`	DN doesn’t exist	Check the full DN
`ldap_compare: Insufficient access (50)`	ACL denies read/compare	Update ACLs or bind as rootDN
`ldap_compare: Invalid syntax (21)`	Attribute value doesn’t match schema	Use correct syntax
`ldap_compare: Constraint violation (19)`	Value fails schema or operational constraint	Check attribute definition
`ldap_compare: Server is unwilling to perform (53)`	Operation blocked (referral, policy)	Check logs for more information

ldapcompare Man Page

LDAP Result Codes RFC

ldapcompare utility cli