ldapsearch - Overview & Examples

Overview: Being Technical professionals (especially ADMINS), now and then, we often face the challenge specifically when it comes to LDAP Authentication. If my Application is LDAP Authenticated, I feel a firm need to always confirm the User Based Attributes and User specific System Attribute fields (Last Password Changed time, last UID Authorized time) with the expert counterpart LDAP Consultant/professional. Well, this creates a lot of dependency and delay the ongoing Investigation. It won’t hurt to have some self-troubleshooting skills related to LDAP Authentication. Below are few parameters along with the Usage scenarios:

Before you step onto below examples make sure you have the utility available. Type and enter ldapsearch on Command Prompt, make sure you don’t get something like below:

C:\Users\s-siebelqlf>ldapsearch

'ldapsearch' is not recognized as an internal or external command,

operable program or batch file.

EXAMPLES:

1.        In case you want to see if a User credential works directly against LDAP, also when you want to confirm the attributes marked  against the UserID:

Command: ldapsearch -h testoracle.ldap.com -p 389 -D "uid=<BIND_USER>,ou=system,ou=people,dc=company,dc=com" -w XXXXXX -b "ou=people,dc=company,dc=com" -s sub -K $PATH\ldapkey.kdb -P kdbpass "(uid=YYYYY)"

All the options Explained:

-h: LDAP Server

-p: Port

-D: Bind DN (this will contain the Binding User)

-W: Password of Binding User (If you don't know, try kdbpass as default)

-b: BaseDN for search

-s: Scope (base, one, or sub)

-K: Location of Key to use the Utility

-P: Password to the above Key

uid: UserID for which you want to query the records

o/p as below:

uid=YYYYY,ou=people,dc=company,dc=com

pwdLastAuthTime=20180309100057Z

userPassword={SSHA512}<Unique_Random_Key_Set>

activeItem=true

mail=admin@system.com

uid=YYYYY

objectClass=rpeople

objectClass=inetorgperson

objectClass=person

objectClass=person

objectClass=top

givenName=YYYYY

sn=YYYYY

cn=YYYYY YYYYY

2.        To determine the Last Password Update time of the UID over ldap (Only allowed  for Admin Accounts):

Command: ldapsearch -h  testoracle.ldap.com -p 389 -D "uid=<BIND_USER>,ou=system,ou=people,dc=company,dc=com" -w XXXXX -b "ou=people,dc=company,dc=com" -s sub -K $PATH\ldapkey.kdb -P kdbpass "(uid=YYYYY)" pwdUpdateTime

o/p as below:

uid=YYYYY,ou=people,dc=company,dc=com

pwdUpdateTime=20180309093102Z (format is in: Homework ;))

3.        Last time User pwd was authenticated:
  

Command: ldapsearch -h testoracle.ldap.com -p 389 -D "uid=<BIND_USER>,ou=system,ou=people,dc=company,dc=com" -w XXXXX -b "ou=people,dc=company,dc=com" -s sub -K $PATH\ldapkey.kdb -P kdbpass "(uid=YYYYY)" pwdLastAuthTime

o/p as below:

uid=YYYYY,ou=findme,ou=people,dc=company,dc=com

pwdLastAuthTime=20180131070124Z