OpenLDAP Cheat Sheet

LDAP Queries, LDIF Changes, TLS, and Directory Operations

A command-line reference for everyday OpenLDAP administration on Linux, from searching directory entries to safely updating data and diagnosing the LDAP service.

Example values: LDAP host ldap.example.com, base DN dc=example,dc=com, and bind DN cn=Directory Manager,dc=example,dc=com. Replace these with your directory's real names and access model.

Safety first: Start with read-only searches. Export or back up data before changing production entries. Use encrypted LDAP connections, least-privilege bind accounts, and -W rather than placing passwords in command history.

1. Test connectivity and authentication

Check LDAP identity and server response

ldapwhoami -x -H ldaps://ldap.example.com:636
ldapwhoami -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W
ldapsearch -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" -s base "(objectClass=*)"

-x selects simple authentication. Without bind credentials, a query may run anonymously if the server permits it. Do not assume anonymous access is enabled or appropriate.

Use StartTLS on the LDAP port

ldapwhoami -x -ZZ -H ldap://ldap.example.com:389
ldapsearch -x -ZZ -H ldap://ldap.example.com:389 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" "(objectClass=*)"

-ZZ requires StartTLS to succeed. For LDAPS, use ldaps:// (commonly port 636); for StartTLS, use ldap:// and request TLS. Configure trusted CA certificates rather than disabling certificate checks.

2. ldapsearch patterns

Search entries and selected attributes

# All entries below the base DN
ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" "(objectClass=*)"

# Find a user by uid
ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" "(uid=alice)" dn uid cn mail

# Find groups containing a member DN (schema dependent)
ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" "(member=uid=alice,ou=People,dc=example,dc=com)" dn cn

# Inspect only the base entry
ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -b "dc=example,dc=com" -s base "(objectClass=*)" "+" "*"

-LLL removes comments and version lines; -b sets the search base; -s base searches only that entry. Filter attributes and group membership attributes depend on your schema.

LDAP filter quick reference

Filter	Meaning
`(uid=alice)`	Exact value match.
`(objectClass=person)`	Entry has this object class.
`(mail=*)`	Attribute exists.
`(\|(uid=alice)(uid=bob))`	OR: either filter can match.
`(&(objectClass=posixAccount)(uid=alice))`	AND: both conditions must match.
`(!(loginShell=/sbin/nologin))`	NOT: negates the nested condition.

Escape special characters in LDAP filter assertion values according to RFC 4515 when constructing filters from user-supplied input. DN escaping and filter escaping are different.

3. LDIF changes: add, modify, delete

Add an entry

# user.ldif
dn: uid=alice,ou=People,dc=example,dc=com
objectClass: top
objectClass: inetOrgPerson
cn: Alice Example
sn: Example
uid: alice
mail: alice@example.com

ldapadd -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W -f user.ldif

Modify an attribute

# update-mail.ldif
dn: uid=alice,ou=People,dc=example,dc=com
changetype: modify
replace: mail
mail: alice@new.example.com

ldapmodify -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W -f update-mail.ldif

Add or delete one attribute value

dn: uid=alice,ou=People,dc=example,dc=com
changetype: modify
add: description
description: Managed by IT

dn: uid=alice,ou=People,dc=example,dc=com
changetype: modify
delete: description
description: Managed by IT

Delete an entry — destructive

ldapdelete -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  "uid=alice,ou=People,dc=example,dc=com"

LDAP modifications are immediate. Validate the DN and LDIF first, confirm backups, and consider a test entry or staging directory before production changes.

4. Passwords and account attributes

Change a user's password

ldappasswd -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -S "uid=alice,ou=People,dc=example,dc=com"

-S prompts for the new password. Server policy, permissions, password overlays, and schema determine whether the operation is allowed. Avoid manually writing password hashes unless your directory's policy explicitly calls for it.

POSIX identity fields

ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -D "cn=Directory Manager,dc=example,dc=com" -W \
  -b "dc=example,dc=com" "(uid=alice)" \
  dn uid uidNumber gidNumber homeDirectory loginShell

POSIX accounts typically use posixAccount and require attributes such as uidNumber, gidNumber, and homeDirectory. Group schemas vary: common patterns include posixGroup with memberUid or groups with DN-valued membership.

5. Configuration and backups

Check service and logs (systemd)

systemctl status slapd
journalctl -u slapd --since today
ss -lntp | grep -E ':(389|636)\b'

Inspect configuration and database

# Dynamic configuration is commonly stored under cn=config
sudo slapcat -n 0

# Dump a data database (choose the correct database number)
sudo slapcat -n 1 -l /root/ldap-data.ldif

# Validate slapd configuration where supported
sudo slaptest -u

slapcat reads the local database backend and is useful for backups and offline inspection. Database numbers depend on your configuration; identify the intended database before dumping or restoring data. Protect LDIF exports because they may contain sensitive user attributes and password hashes.

Configuration differs by deployment. Modern OpenLDAP installations commonly use the dynamic cn=config configuration backend. Older setups may use slapd.conf. Do not edit generated files under the database directory directly; use supported LDAP configuration operations or your distribution's documented workflow.

Query the dynamic configuration locally

sudo ldapsearch -Y EXTERNAL -H ldapi:/// \
  -b "cn=config" "(objectClass=*)" dn
sudo ldapsearch -Y EXTERNAL -H ldapi:/// \
  -b "olcDatabase={1}mdb,cn=config" "(objectClass=*)" dn olcSuffix olcRootDN

The database DN shown is an example. Determine the actual database DN from the first query. SASL EXTERNAL over ldapi:/// commonly uses local peer credentials; authorization depends on the server's ACLs and configuration.

6. TLS and client configuration

Typical client settings

# /etc/openldap/ldap.conf on many RHEL-family systems
URI ldaps://ldap.example.com:636
BASE dc=example,dc=com
TLS_CACERT /etc/openldap/certs/ca-bundle.crt

Client configuration paths vary by distribution. Verify the CA bundle path on your system. Keep certificate validation enabled and ensure the certificate SAN matches the hostname clients use.

Inspect a TLS certificate chain

openssl s_client -connect ldap.example.com:636 \
  -servername ldap.example.com -showcerts

Review the verification result, certificate validity dates, hostname, and issuer chain. A successful TCP connection alone does not prove that LDAP authentication or authorization works.

7. Replication quick checks

OpenLDAP replication is commonly configured with Syncrepl. Exact attributes and status mechanisms depend on the configuration and version.

# Search configuration for replication-related settings
sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config \
  '(|(objectClass=olcSyncrepl)(olcMirrorMode=TRUE))' dn olcSyncrepl olcMirrorMode

# Inspect contextCSN on a replicated database
ldapsearch -LLL -x -H ldaps://ldap.example.com:636 \
  -b "dc=example,dc=com" -s base "(objectClass=*)" contextCSN

Compare replication configuration and context CSNs across providers/consumers, then inspect logs and connectivity. Matching context CSNs alone is not a complete health check; verify representative entries and the direction/topology of replication.

8. Fast troubleshooting

Symptom	Check first
`Can't contact LDAP server`	DNS, routing, port 389/636, service status, TLS negotiation, and firewall rules.
`Invalid credentials (49)`	Bind DN, password, account state, and whether the client is binding to the intended server.
`No such object (32)`	Base DN, entry DN, search scope, and whether the parent entry exists.
`Insufficient access (50)`	ACLs, bind identity, and write permissions for the target attribute/entry.
`Object class violation (65)`	Required attributes, allowed attributes, object-class inheritance, and schema.
`Already exists (68)`	Search the DN and decide whether to modify the existing entry instead of adding it.
TLS certificate error	Trusted CA, certificate dates, SAN/hostname, and client CA bundle path.

9. Command quick reference

Command	Purpose
`ldapsearch`	Search directory entries.
`ldapwhoami`	Show the authenticated LDAP identity.
`ldapadd`	Add entries from LDIF.
`ldapmodify`	Apply LDIF modifications.
`ldapdelete`	Delete an entry.
`ldappasswd`	Request a password change.
`slapcat`	Export local database contents as LDIF.
`slaptest`	Test slapd configuration where supported.

Zwiegnet Consultants work with Linux and UNIX identity services, including OpenLDAP and MIT Kerberos integrations. For help with directory design, TLS, replication, or authentication troubleshooting, contact Zwiegnet.