Category Archives: OpenLDAP

ldapsearch on a json attribute.

Posted on by
0 Comments

Problem

You have an LDAP entry with an attribute that consists of json entries, and you would like to use ldapsearch to filter on a json item condition.

So having the attribute

mobileIDAuthenticator: {“creationDateTime”:”2023-08-28T14:53:29.061Z”,”state”:”ENABLED”,”mobileNumber”:”+411111111″,”mobileSerialNumber”:”AAAAAAAAAAAAA”}

you would like to filter on the state item.


Solution

you can use the following syntax:

ldapsearch -LLL -H "ldaps://domain.com:1636" -D "cn=Directory Manager" -w $LDP -o ldif_wrap=no -c -vvvv -b "ou=persons,dc=domain,dc=com" -s sub "(mobileIdAuthenticator=state eq 'ENABLED')"  uid mobileIDAuthenticator

Return results from LDAP without a line wrap (attribute)

Posted on by
0 Comments

Problem

You have an attribute in LDAP that might be a long line (ie a json array that contains many records like logins for example)

loginHistory: [{"lastLoginDate":"20250107094531.782Z","loginModule":"1"},{"lastLoginDate":"20241202075005.298Z","loginModule":"1"},{"lastLoginDate":"20241129143412.785Z","loginModule":"1"},{"lastLoginDate":"20241129103347.029Z","loginModule":"1"},{"lastLoginDate":"20240920105718.171Z","loginModule":"2"}]

But you want to return it in one line for further processing (ie counting the number of times in a year).

Solution

You can use the -o ldif_wrap=no option in your ldapsearch like 

ldapsearch -LLL -H "ldaps://ldap.com:1636" -o ldif_wrap=no -D "cn=User" -w $LDP -b "ou=people,dc=domain,dc=com" -s sub "(mail=usernname@domain.com)" uid loginHistory

Suppressing empty output lines when using ldapsearch

Posted on by
0 Comments

Problem

You want to use ldapsearch to search from a file (file contains domains and ldap contains emails), but you want to suppress empty output lines (option -LLL does not seem to suppress them).

Solution

Use grep -v ‘^$’ like

ldapsearch -LLL -H "ldaps://ldap_url:nnnn" -D "cn=Directory Manager" -w $LDP -b "ou=ou_name,dc=domain,dc=com" -s sub -f denyDomains.txt  "(mail=*@%s)" uid mail status | grep -v '^$' > denyDomainsResults.txt