Software >> Services >> LDAP >> tools >> ldapsearch >>  Examples of ldapsearch from oracle.com

To Return All Entries

You can return all entries below a specified branch DN using the presence search filter (objectclass=*). The search filter looks for all entries that have one or more object classes with any value. Because all entries have several object class definitions, the filter guarantees that all entries will be returned.

  • Run the ldapsearch command with the filter (objectclass=*).
    $ ldapsearch --hostname localhost --port 1389 --baseDN "dc=example,dc=com" \
      "(objectclass=*)"
    dn: dc=example,dc=com
    objectClass: domain
    objectClass: top
    dc: example
    
    dn: ou=Groups,dc=example,dc=com
    objectClass: organizationalunit
    objectClass: top
    ou: Groups
    
    dn: cn=Directory Administrators,ou=Groups,dc=example,dc=com
    objectClass: groupofuniquenames
    objectClass: top
    ou: Groups
    cn: Directory Administrators
    uniquemember: uid=kvaughan, ou=People, dc=example,dc=com
    uniquemember: uid=rdaugherty, ou=People, dc=example,dc=com
    uniquemember: uid=hmiller, ou=People, dc=example,dc=com
    ...

To Search For a Specific User

You can use an equality filter to locate a specific user in the directory. This example locates an employee with the common name of "Frank Albers".

  • Run the ldapsearch command with the filter "(cn=Frank Albers)".
    $ ldapsearch --port 1389 --baseDN dc=example,dc=com  "(cn=Frank Albers)" 
    
    dn: uid=falbers,ou=People,dc=example,dc=com
    objectClass: person
    objectClass: organizationalPerson
    objectClass: inetOrgPerson
    objectClass: top
    givenName: Frank
    uid: falbers
    cn: Frank Albers
    sn: Albers
    telephoneNumber: +1 408 555 3094
    userPassword: {SSHA}nDTQJ9DDiMUrBwR0WNKq0tgS4iB2A9QJFgpZiA==
    roomNumber: 1439
    ou: Accounting
    ou: People
    l: Sunnyvale
    mail: falbers@example.com
    facsimileTelephoneNumber: +1 408 555 9751

 

To Search for Specific User Attributes

You can use an equality filter to locate an entry's attribute(s) in the directory. Specify one or more attributes by placing them after the search filter. This example locates the telephoneNumber and mail attributes from the user entry for Frank Albers.

  • Run the ldapsearch command with the filter "(cn=Frank Albers)" and the corresponding attributes.
    $ ldapsearch --port 1389 --baseDN dc=example,dc=com \
     "(cn=Frank Albers)" telephoneNumber mail
    dn: uid=falbers,ou=People,dc=example,dc=com
    telephoneNumber: +1 408 555 3094
    mail: falbers@example.com

 

To Perform a Search With Base Scope

Together with the search base DN, the scope determines what part of the directory information tree (DIT) is examined. A base scope examines only the level specified by the base DN (and none of its child entries). You specify a base scope by using the --searchScope base option or its short form equivalent -s base.

  • Run the ldapsearch command with the --searchScope base option.
    $ ldapsearch --hostname localhost --port 1389 --baseDN "dc=example,dc=com" \
      --searchScope base "(objectclass=*)"
    dn: dc=example,dc=com
    objectClass: domain
    objectClass: top
    dc: example

 

To Perform a Search With One-Level Scope

A one-level scope examines only the level immediately below the base DN. You specify a one-level scope by using the --searchScope one option or its short form equivalent -s one. This example displays the entries immediately below the base DN.

  • Run the ldapsearch command with the --searchScope one option.
    $ ldapsearch --hostname localhost --port 1389 --baseDN "dc=example,dc=com" \
      --searchScope one "(objectclass=*)"
    dn: ou=Groups,dc=example,dc=com
    objectClass: top
    objectClass: organizationalunit
    ou: Groups
    dn: ou=People,dc=example,dc=com
    objectClass: top
    objectClass: organizationalunit
    ou: People
    dn: ou=Special Users,dc=example,dc=com
    objectClass: top
    objectClass: organizationalUnit
    ou: Special Users
    description: Special Administrative Accounts
    dn: ou=Company Servers,dc=example,dc=com
    objectClass: top
    objectClass: organizationalUnit
    ou: Company Servers
    description: Standard branch for Company Server registration

 

To Perform a Search With Subtree Scope

The subtree scope examines the subtree below the base DN and includes the base DN level. You specify a subtree scope using the --searchScope sub option, or its short form equivalent -s sub. If you do not specify the --searchScope, ldapsearch assumes a subtree scope.

  • Run the ldapsearch command with the --searchScope sub option.
    $ ldapsearch --hostname localhost --port 1389 \ 
      --baseDN "cn=Directory Administrators,ou=Groups,dc=example,dc=com" \ 
      --searchScope sub "(objectclass=*)"
    dn: cn=HR Managers,ou=groups,dc=example,dc=com
    objectClass: groupOfUniqueNames
    objectClass: top
    ou: groups
    description: People who can manage HR entries
    cn: HR Managers
    uniqueMember: uid=kvaughan, ou=People, dc=example,dc=com
    uniqueMember: uid=cschmith, ou=People, dc=example,dc=com

 

To Return Attribute Names Only

The ldapsearch command provides a convenient option to check if an attribute is present in the directory. Use the --typesOnly option or its short form equivalent -A to instruct the directory server to display the attribute names but not their values.

  • Run the ldapsearch command with the --typesOnly option.
    $ ldapsearch --hostname localhost --port 1389 \
      --baseDN "dc=example,dc=com" --typesOnly "(objectclass=*)"
    dn: dc=example,dc=com
    objectClass
    dc
    dn: ou=Groups,dc=example,dc=com
    objectClass
    ou ...

 

To Return User Attributes Only

You can use ldapsearch to return only user attributes for entries that match the search filter, by including an asterisk *. User attributes (as opposed to operational attributes) store user information in the directory. If you do not specify the asterisk, the user attributes are returned by default. You must escape the asterisk appropriately for your shell.

  • Run the ldapsearch command, specifying '*' after the search filter.
    $ ldapsearch --hostname localhost --port 1389 --baseDN "dc=example,dc=com" \
      "(objectclass=*)" '*'
    dn: cn=Aggie Aguirre,ou=People,dc=example,dc=com
    objectClass: person
    objectClass: inetorgperson
    objectClass: organizationalperson
    objectClass: top
    postalAddress: Aggie Aguirre172 Jackson Street$Salt Lake City, MI  49843
    postalCode: 49843
    uid: user.99
    description: This is the description for Aggie Aguirre.
    employeeNumber: 99
    initials: AGA
    givenName: Aggie
    pager: +1 514 297 1830
    mobile: +1 030 300 0720
    cn: Aggie Aguirre
    telephoneNumber: +1 730 027 2062
    sn: Aguirre
    street: 15172 Jackson Street
    homePhone: +1 229 128 3072
    mail: user.99@maildomain.net
    l: Salt Lake City
    st: MI 

 

To Return Base DNs Only

You can use ldapsearch to return only the base DNs for entries that match the search filter by including a 1.1 string after the search filter.

  • Run the ldapsearch command, specifying 1.1 after the search filter.
    $ ldapsearch --hostname localhost --port 1389 --baseDN "dc=example,dc=com" \
      "(objectclass=*)" 1.1
    version: 1
    dn: cn=Richard Arnold,ou=people,dc=example,dc=com
    
    dn: cn=Kevin Booysen,ou=people,dc=example,dc=com
    
    dn: cn=Steven Morris,ou=people,dc=example,dc=com
    
    dn: cn=Leila Shakir,ou=people,dc=example,dc=com
    
    dn: cn=Emily Smith,ou=people,dc=example,dc=com
    ...

 

To Search For Specific Object Classes

You can search all entries where the attributes are referenced by a specific object class by prepending a @ character to the object class name. For example, to view all entries that have an object class of groupOfUniqueNames, include @groupOfUniqueNames after the search filter.

  • Run the ldapsearch command, specifying @ and the object class after the search filter.
    $ ldapsearch --hostname localhost --port 1389 \
      --baseDN "ou=Groups,dc=example,dc=com" "(objectclass=*)" @groupOfUniqueNames
    dn: ou=Groups,dc=example,dc=com
    ou: Groups
    objectClass: organizationalunit
    objectClass: top
    dn: cn=Directory Administrators,ou=Groups,dc=example,dc=com
    ou: Groups
    objectClass: groupofuniquenames
    objectClass: top
    cn: Directory Administrators
    uniqueMember: uid=kvaughan, ou=People, dc=example,dc=com
    uniqueMember: uid=rdaugherty, ou=People, dc=example,dc=com
    uniqueMember: uid=hmiller, ou=People, dc=example,dc=com ...

 

To Return a Count of All Entries in the Directory

The ldapsearch command provides the --countentries to return the total number of entries in the directory. The directory server returns all entries that match the search filter and displays the total number on the last line. This example determines the number of employee entries whose location is Cincinnati.

  • Run the ldapsearch command with the --countentries option.
    $ ldapsearch --hostname localhost --port 1389 --bindDN "cn=Directory Manager" \
      --bindPassword password --baseDN dc=example,dc=com --countentries "l=Cincinnati"
    dn: cn=Adi Adamski,ou=People,dc=example,dc=com
    ...
    l: Cincinnati
    st: OH
    
    dn: Aggi Aguinsky,ou=People,dc=example,dc=com
    objectClass: person
    ...
    l: Cincinnati
    st: OH
    
    # Total number of matching entries: 2

 

To Perform a Search With a Compound Filter

Compound search filters involve multiple tests using the boolean operators AND (&), OR (|), or NOT (!). You can combine and nest boolean operators and filters together to form complex expressions. The following example searches for all entries for employees named Jensen who work in Cupertino. The command returns two results.

  • Run the ldapsearch command with a compound search filter.
    $ ldapsearch --hostname localhost --port 1389 --bindDN "cn=Directory Manager" \
      --bindPassword password --baseDN dc=example,dc=com "(&(sn=jensen)(l=Cupertino))"
    dn: uid=bjensen,ou=People,dc=example,dc=com 
    objectClass: person 
    objectClass: inetOrgPerson 
    objectClass: top 
    objectClass: organizationalPerson 
    ou: Product Development 
    ou: People 
    sn: Jensen 
    ... 
    l: Cupertino
    st: CA
    
    dn: uid=rjensen,ou=People,dc=example,dc=com 
    objectClass: person 
    objectClass: inetOrgPerson 
    objectClass: top 
    objectClass: organizationalPerson 
    ou: Accounting 
    ou: People
    sn: Jensen 
    ... 
    l: Cupertino
    st: CA

 

To Perform a Search Using a Filter File

You can place complex or multiple filters in a file by using the --filename option. If the file contains multiple filters, the file should be structured with one filter per line. Searches are performed using the same connection to the directory server in the order in which they appear in the filter file. If the --filename option is used, any trailing options are treated as separate attributes. Otherwise, the first trailing option must be the search filter.

This example searches all entries for employees named Jensen who work in Cupertino and who do not work in the Accounting department.

  1. Create the filter file.

    For this example, create a file called myfilter.txt with the following content:(&(sn=jensen)(l=Cupertino)(!(ou=Accounting)))

  2. Run the ldapsearch command, specifying the file name as a filter.
    $ ldapsearch --hostname localhost --port 1389 --bindDN "cn=Directory Manager" \
    --bindPassword password --baseDN dc=example,dc=com --filename myfilter.txt
    dn: uid=bjensen,ou=People,dc=example,dc=com 
    objectClass: person 
    objectClass: inetOrgPerson
    objectClass: top
    objectClass: organizationalPerson
    ou: Product Development
    ou: People
    sn: Jensen
    l: Cupertino
    cn: Barbara Jensen
    cn: Babs Jensen
    telephoneNumber: +1 408 555 1862
    givenName: Barbara
    uid: bjensen
    mail: bjensen@example.com

 

To Limit the Number of Entries Returned in a Search

You can limit the number of entries that are returned by using the -z or --sizeLimit option. If the number of entries exceeds the number that is specified, the search returns the specified number of entries, then returns an error stating that the size limit was exceeded. The following example requests a maximum of 5 entries.

  • Run the ldapsearch command with the --sizeLimit option.
    $ ldapsearch --hostname localhost --port 1389 -b "dc=example,dc=com" \
      --sizeLimit 5 "objectclass=*" 1.1
    dn: dc=example,dc=com
    
    dn: ou=People,dc=example,dc=com
    
    dn: uid=user.0,ou=People,dc=example,dc=com
    
    dn: uid=user.1,ou=People,dc=example,dc=com
    
    dn: uid=user.2,ou=People,dc=example,dc=com
    
    SEARCH operation failed
    Result Code:  4 (Size Limit Exceeded)
    Additional Information:  This search operation has sent the maximum of 5 entries 
     to the client
    
    
    
    
    
    
    
    

Deals @yubeshop.com