210.3 LDAP client usage

Introduction

LDAP stores hierarchical directory entries identified by Distinguished Names. Client tools perform searches and changes using a server URI, bind identity, base DN, scope, and filter.

What you should be able to do after this lesson:

• Read a DN and choose a search base.
• Write basic LDAP filters.
• Query selected attributes.
• Add, modify, delete, and rename entries through LDIF.
• Change passwords and use encrypted LDAP transport.

Big Idea: Every LDAP Operation Has Context

An LDAP command is not defined only by its filter or target entry. Track this complete context:

server URI + transport security + bind identity + search base and scope
+ filter or target DN + requested operation and attributes

When two clients return different results, compare that context before assuming the directory data changed.

Directory Names

Example DN:

uid=alice,ou=People,dc=example,dc=test

The leftmost Relative Distinguished Name identifies the entry within its parent. DNs must be unique in a directory tree.

Search

ldapsearch -x -H ldaps://ldap.example.test \
  -D 'cn=admin,dc=example,dc=test' -W \
  -b 'dc=example,dc=test' '(uid=alice)' cn mail uidNumber

Important options:

• -x uses simple authentication instead of SASL
• -H selects the server URI
• -D supplies the bind DN
• -W prompts for the password
• -b sets the search base
• -s base|one|sub selects scope

Useful filters include (uid=alice), (objectClass=posixAccount), (&(objectClass=posixAccount)(uid=a*)), and (|(uid=alice)(uid=bob)).

Add an Entry

LDIF example:

dn: uid=alice,ou=People,dc=example,dc=test
objectClass: inetOrgPerson
cn: Alice Admin
sn: Admin
uid: alice
mail: [email protected]

ldapadd -x -H ldaps://ldap.example.test -D '<admin-dn>' -W -f alice.ldif

Modify or Delete

dn: uid=alice,ou=People,dc=example,dc=test
changetype: modify
replace: mail
mail: [email protected]

ldapmodify -x -H ldaps://ldap.example.test -D '<admin-dn>' -W -f update.ldif
ldapdelete -x -H ldaps://ldap.example.test -D '<admin-dn>' -W '<entry-dn>'

Deletion is not automatically recursive and may fail when child entries exist.

An entry can be renamed or moved with a modify-DN operation, commonly performed by ldapmodrdn or an LDIF changetype: modrdn. Because child DNs depend on their parent path, plan subtree moves carefully and check server capabilities.

Password Changes

ldappasswd -x -H ldaps://ldap.example.test -D '<admin-dn>' -W '<user-dn>'

Use TLS because simple binds and password changes must not expose credentials. ldap:// with StartTLS and ldaps:// are different connection styles.

Guided Practice: Query Before You Modify

Against an authorized lab directory, begin anonymously only if policy permits, then repeat with a normal bind:

ldapsearch -x -H ldaps://ldap.example.test \
  -b 'dc=example,dc=test' -s base '(objectClass=*)' namingContexts
ldapsearch -x -H ldaps://ldap.example.test \
  -D '<bind-dn>' -W -b 'ou=People,dc=example,dc=test' \
  '(&(objectClass=posixAccount)(uid=a*))' dn uid cn uidNumber

Save a known entry, prepare an LDIF that changes one harmless attribute, and review the exact target DN before calling ldapmodify. Search again to verify the result. Test an intentionally unauthorized change and confirm that access control rejects it.

Troubleshooting Scenario

An LDAP search returns no users even though authentication succeeds. The command uses scope base at ou=People,..., so it examines only the organizational-unit entry itself.

Use -s one for immediate children or -s sub for the subtree, verify the base DN and filter, and request the needed attributes. Resetting the bind password would not change search scope.

Exam Focus

• Read DNs from specific entry toward the directory root and distinguish an RDN.
• Know base, one-level, and subtree search scopes plus compound filters.
• Use ldapsearch, ldapadd, ldapmodify, ldapdelete, ldapmodrdn, and ldappasswd for their intended operations.
• Perform credential and password operations only over authenticated encryption.

Recap

• Every operation is scoped by a server, bind, base, and target DN or filter.
• LDIF describes entries and change operations.
• Query the smallest required subtree and attributes.
• Protect credentials and directory changes with TLS and least privilege.