~/iqbwl>_
Cheatsheets
Index
>_cat ldap.md|Mail & Directory
Index

LDAP Cheatsheet

SPEC: MDX·/ldap·Mail transfer agents, spam filtering, sync, and directory services.

LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral protocol for querying and maintaining distributed directory information services over IP networks.

Querying with ldapsearch

ldapsearch is the primary CLI tool used to search LDAP directory trees (OpenLDAP, Active Directory, 389 Directory Server, FreeIPA).

Basic & Anonymous Search

# Anonymous search on base DN
ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com"
 
# Bind with StartTLS (-ZZ)
ldapsearch -x -ZZ -H ldap://ldap.example.com -b "dc=example,dc=com"
 
# Query over secure LDAPS (port 636)
ldapsearch -x -H ldaps://ldap.example.com:636 -b "dc=example,dc=com"
# Simple bind with DN and password prompt (-W)
ldapsearch -x -H ldaps://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" -W \
  -b "ou=users,dc=example,dc=com" "(objectClass=person)"
 
# Bind with password passed directly (avoid in history)
ldapsearch -x -H ldap://127.0.0.1 \
  -D "cn=admin,dc=example,dc=com" -w "SecretPass" \
  -b "dc=example,dc=com"

Advanced Search Filters & Attributes

# Search specific user by UID and return only specified attributes
ldapsearch -x -H ldaps://ldap.example.com \
  -b "dc=example,dc=com" "(uid=jdoe)" mail cn memberOf
 
# Boolean AND search (&)
ldapsearch -x -b "dc=example,dc=com" \
  "(&(objectClass=inetOrgPerson)(mail=*@example.com))"
 
# Boolean OR search (|)
ldapsearch -x -b "dc=example,dc=com" \
  "(|(department=DevOps)(department=SysAdmin))"
 
# Boolean NOT search (!)
ldapsearch -x -b "dc=example,dc=com" \
  "(&(objectClass=person)(!(employeeType=Contractor)))"
 
# Limit scope to single level (one) or subtree (sub - default)
ldapsearch -x -s one -b "ou=users,dc=example,dc=com" "(objectClass=*)"

Adding Entries (ldapadd)

ldapadd takes standard LDIF (LDAP Data Interchange Format) files.

Sample LDIF (user.ldif)

dn: uid=jdoe,ou=users,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: jdoe
cn: John Doe
sn: Doe
givenName: John
mail: [email protected]
userPassword: {SSHA}secretpasswordhash

Execute Import

ldapadd -x -H ldaps://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" -W -f user.ldif

Modifying Entries (ldapmodify)

Modify Attribute Values (modify.ldif)

dn: uid=jdoe,ou=users,dc=example,dc=com
changetype: modify
replace: mail
mail: [email protected]
-
add: telephoneNumber
telephoneNumber: +1234567890
-
delete: description

Execute Modification

ldapmodify -x -H ldaps://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" -W -f modify.ldif

Password & Deletion Utilities

# Change / set user password via ldappasswd
ldappasswd -x -H ldaps://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" -W \
  -S "uid=jdoe,ou=users,dc=example,dc=com"
 
# Delete a directory entry
ldapdelete -x -H ldaps://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" -W \
  "uid=jdoe,ou=users,dc=example,dc=com"

OpenLDAP Server Management (slapd)

Commands executed locally on an OpenLDAP server host:

# Validate slapd configuration files without starting service
sudo slaptest -u
 
# Dump entire LDAP database to LDIF file (backup)
sudo slapcat -n 1 -l /backup/ldap-backup.ldif
 
# Import raw database dump directly (slapd service must be stopped)
sudo slapadd -n 1 -l /backup/ldap-backup.ldif

Client Resolution & SSSD Debugging

# Check SSSD daemon status on Linux client
sudo systemctl status sssd
 
# Force purge local SSSD identity cache
sudo sss_cache -E
 
# Test NSS user/group resolution against LDAP
id jdoe
getent passwd jdoe
getent group devops

Quick Reference

CommandPurpose
ldapsearch -x -b <base>Query LDAP anonymously
ldapsearch -x -D <bindDN> -WAuthenticated query with password prompt
ldapadd -x -D <bindDN> -W -f <file.ldif>Create entry from LDIF file
ldapmodify -x -D <bindDN> -W -f <file.ldif>Update existing entry attributes
ldapdelete -x -D <bindDN> -W <DN>Delete entry by Distinguished Name
ldappasswd -x -D <bindDN> -W -S <DN>Interactively update password
sudo sss_cache -EInvalidate client cache
Previous CheatsheetKubernetes (kubectl) Cheatsheet/kubernetesNext CheatsheetLinux Disk & Storage Management Cheatsheet/linux-disk-management
Cheatsheets Directory