How To Search LDAP using ldapsearch (With Examples)

If you are working in on a Linux OpenLDAP server, the LDAP protocol is very useful to centralize authentication.

However, as your LDAP directory grows, you might get lost in all the entries that you may have to manage.

Luckily, there is a command that will help you search for entries in a LDAP directory tree : ldapsearch.

# 驗證是否有此帳號 (AD)
ldapsearch -x -H "ldap://LDAPSERVER" -b "OU=OU,DC=DOMAIN,DC=LOCAL" -D "CN=BINDUSER,CN=Users,DC=DOMAIN,DC=LOCAL" -w "BINDPASSWORD" "(&(objectclass=user)(sAMAccountName=username))"

# 驗證是否有此帳號 (LDAP)
ldapsearch -x -H "ldap://LDAPSERVER" -b "OU=OU,DC=DOMAIN,DC=LOCAL" -D "uid=BINDUSER,CN=Users,DC=DOMAIN,DC=LOCAL" -w "BINDPASSWORD" "(&(objectClass=person)(uid=username))"

# 驗證是否有此帳號 (Zimbra)
ldapsearch -x -h LDAPSERVER:389 -b "ou=people,DC=DOMAIN,DC=LOCAL" -D "uid=zimbra,cn=admins,cn=zimbra" -w "BINDPASSWORD" "(&(objectClass=zimbraAccount)(uid=username))"

# 以完整格式搜尋使用者並取回帳號名稱 (AD)
ldapsearch -x -H "ldap://LDAPSERVER" -b "OU=OU,DC=DOMAIN,DC=LOCAL" -D "uid=BINDUSER,CN=Users,DC=DOMAIN,DC=LOCAL" -w "BINDPASSWORD" -s sub "(userPrincipalName=This email address is being protected from spambots. You need JavaScript enabled to view it.)" | grep "sAMAccountName"

# 以完整格式搜尋使用者並取回別名 (AD)
ldapsearch -x -H "ldap://LDAPSERVER" -b "OU=OU,DC=DOMAIN,DC=LOCAL" -D "uid=BINDUSER,CN=Users,DC=DOMAIN,DC=LOCAL" -w "BINDPASSWORD" -s sub "(userPrincipalName=This email address is being protected from spambots. You need JavaScript enabled to view it.)" | awk -F ":" -v i="mailNickname" '$1 == "mailNickname" {print $2}'

# 搜尋具有指定屬性及文字的帳號 (LDAP)
ldapsearch -x -H "ldap://LDAPSERVER" -b "CN=Users,DC=DOMAIN,DC=LOCAL" -D "uid=BINDUSER,CN=Users,DC=DOMAIN,DC=LOCAL" -w "BINDPASSWORD" -s base "(&(objectClass=user)(description=*字串*))"

---

Examples:

./ldapsearch -x -b "cn=groups,dc=amiam,dc=com" -H ldap://ldap-2 -D "cn=config" -w mypassword

ldapsearch -x -h ldap-2 -b "ou=people,dc=amiam,dc=com" -D "uid=zimbra,cn=admins,cn=zimbra" -w "mypassword" "(&(objectClass=zimbraAccount)(uid=jack))"

ldapsearch -x -h ldap-2 -b "ou=people,dc=amiam,dc=com" -D "uid=zimbra,cn=admins,cn=zimbra" -w "mypassword" "(&(objectClass=zimbraAccount)(uid=*))"

Reference: http://blog.jason.tools/2022/02/ldapsearch-cli.html