Linux Networking Cookbook

12.8. Finding Things in Your OpenLDAP Directory

Problem

Your directory is growing, and you want to know how to fine-tune your searches so you can pluck out just the information you want, and not have to wade through a bunch of irrelevant stuff.

Solution

The ldapsearch command comes with a host of options for searching on every imaginable attribute. This command searches for a specific user by common name (CN):

	$ ldapsearch -xtb 'dc=alrac,dc=net' 'cn=carla'

If you're not quite sure what to look for, you can use wildcards. This example searches for UIDs that end in schroder:

	$ ldapsearch -xtb 'dc=alrac,dc=net' 'uid=*schroder'

Maybe you want all the entries with a certain phone prefix:

	$ ldapsearch -xtb 'ou=people,dc=alrac,dc=net' '(telephoneNumber=333*)'

You might want a list of attributes only, without the values:

	$ ldapsearch -xtb 'dc=alrac,dc=net' 'cn=carla' -A

You can start from a different level in your DIT:

	$ ldapsearch -xtb 'ou=people,dc=alrac,dc=net' 'cn=carla'

You can limit the size of your search, like this example that searches for entries with photos, and limits the results to 10 entries:

	$ ldapsearch -z 10 -xtb 'ou=people,dc=alrac,dc=net' '(jpegPhoto=*)'

This command makes a list of objectClasses used in your directory:

	$ ldapsearch -xb 'dc=alrac,dc=net' '(objectclass=*)' dcObject

Or, search for entries with specific objectClasses:

	$ ldapsearch -xb 'dc=alrac,dc=net' '(objectclass=simpleSecurityObject)'

Combine attributes to narrow searches, such as users with a certain phone prefix ...