| blob | d048e4da3638516bee57ed5bb064f69a6c6b7890 |
1 '\" te
2 .\" Copyright (C) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH LDAPLIST 1 "May 13, 2017"
7 .SH NAME
8 ldaplist \- search and list naming information from an LDAP directory using the
9 configured profile
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fB/usr/bin/ldaplist\fR [\fB-dlv\fR] [\fB-h\fR \fILDAP_server\fR[\fB:\fR\fIserverPort\fR] [\fB-M\fR \fIdomainName\fR]
14 [\fB-N\fR \fIprofileName\fR] [\fB-a\fR \fIauthenticationMethod\fR] [\fB-P\fR \fIcertifPath\fR]
15 [\fB-D\fR \fIbindDN\fR] [\fB-w\fR \fIbindPassword\fR] [\fB-j\fR \fIpasswdFile\fR]]
16 [\fIdatabase\fR [\fIkey\fR]...]
17 .fi
19 .LP
20 .nf
21 \fB/usr/bin/ldaplist\fR \fB-g\fR
22 .fi
24 .LP
25 .nf
26 \fB/usr/bin/ldaplist\fR \fB-h\fR
27 .fi
29 .SH DESCRIPTION
30 .LP
31 If the \fB-h\fR \fILDAP_server\fR\fB[:\fR\fIserverPort\fR\fB]\fR option is
32 specified, \fBldaplist\fR establishes a connection to the server pointed to by
33 the option to obtain a \fIDUAProfile\fR specified by the \fB-N\fR option. Then
34 \fBldaplist\fR lists the information from the directory described by the
35 configuration obtained.
36 .sp
37 .LP
38 By default (if the \fB-h\fR \fILDAP_server\fR\fB[:\fR\fIserverPort\fR\fB]\fR
39 option is not specified), the utility searches for and lists the naming
40 information from the LDAP directory service defined in the LDAP configuration
41 files generated by \fBldapclient\fR(8) during the client initialization phase.
42 To use the utility in the default mode, the Solaris LDAP client must be set up
43 in advance.
44 .sp
45 .LP
46 The database is either a container name or a database name as defined in
47 \fBnsswitch.conf\fR(4). A container is a non-leaf entry in the Directory
48 Information Tree (DIT) that contains naming service information. The container
49 name is the LDAP Relative Distinguished Name (RDN) of the container relative to
50 the \fBdefaultSearchBase\fR as defined in the configuration files. For example,
51 for a container named \fBou=people\fR, the database name is the database
52 specified in \fBnsswitch.conf\fR. This database is mapped to a container, for
53 example, \fBpasswd\fR maps to \fBou=people\fR. If an invalid database is
54 specified, it is mapped to a generic container, for example,
55 \fBnisMapName=name\fR).
56 .sp
57 .LP
58 The key is the attribute value to be searched in the database. You can specify
59 more than one key to be searched in the same database. The key can be specified
60 in either of two forms: \fIattribute\fR=\fIvalue\fR or \fIvalue\fR. In the
61 first case, \fBldaplist\fR passes the search key to the server. In the latter
62 case, an attribute is assigned depending on how the database is specified. If
63 the database is a container name, then the "\fBcn\fR" attribute type is used.
64 If the database is a valid database name as defined in the \fBnsswitch.conf\fR,
65 then a predefined attribute type is used (see table below). If the database is
66 an invalid database name, then \fBcn\fR is used as the attribute type.
67 .sp
68 .LP
69 The \fBldaplist\fR utility relies on the Schema defined in the \fIRFC
70 2307bis\fR, currently an IETF draft. The data stored on the LDAP server must be
71 stored based on this Schema, unless the profile contains schema mapping
72 definitions. For more information on schema mapping see \fBldapclient\fR(8).
73 The following table lists the default mapping from the database names to the
74 container, the LDAP object class, and the attribute type used if not defined in
75 the key.
76 .sp
77 .in +2
78 .nf
79 Database Object Class Attribute Type Container
81 aliases mailGroup cn ou=Aliases
82 automount nisObject cn automountMapName=auto_*
83 bootparams bootableDevice cn ou=Ethers
84 ethers ieee802Device cn ou=Ethers
85 group posixgroup cn ou=Group
86 hosts ipHost cn ou=Hosts
87 ipnodes ipHost cn ou=Hosts
88 netgroup ipNetgroup cn ou=Netgroup
89 netmasks ipNetwork ipnetworknumber ou=Networks
90 networks ipNetwork ipnetworknumber ou=Networks
91 passwd posixAccount uid ou=People
92 protocols ipProtocol cn ou=Protocols
93 publickey nisKeyObject uidnumber ou=People
94 cn ou=Hosts
95 rpc oncRpc cn ou=Rpc
96 services ipService cn ou=Services
97 printers printerService printer-uri ou=printers
98 auth_attr SolarisAuthAttr nameT ou=SolarisAuthAttr
99 prof_attr SolarisProfAttr nameT ou=SolarisProfAttr
100 exec_attr SolarisExecAttr nameT ou=SolarisProfAttr
101 user_attr SolarisUserAttr uidT ou=people
102 projects SolarisProject SolarisProjectID ou=projects
103 .fi
104 .in -2
105 .sp
107 .RS +4
108 .TP
109 .ie t \(bu
110 .el o
111 For the \fBautomount\fR database, \fBauto_*\fR, in the container column,
112 represents \fBauto_home\fR, \fBauto_direct\fR, \&.\|.\|.
113 .RE
114 .RS +4
115 .TP
116 .ie t \(bu
117 .el o
118 For the \fBpublickey\fR database, if the key starts with a digit, it is
119 interpreted as an uid number. If the key starts with a non-digit, it is
120 interpreted as a host name.
121 .RE
122 .sp
123 .LP
124 The \fBldaplist\fR utility supports substring search by using the wildcard
125 "\fB*\fR" in the key. For example, "\fBmy*\fR" matches any strings that starts
126 with "\fBmy\fR". In some shell environments, keys containing the wildcard might
127 need to be quoted.
128 .sp
129 .LP
130 If the key is not specified, all the containers in the current search
131 \fBbaseDN\fR is listed.
132 .SH OPTIONS
133 .LP
134 The following options are supported:
135 .sp
136 .ne 2
137 .na
138 \fB\fB-a\fR \fIauthenticationMethod\fR\fR
139 .ad
140 .sp .6
141 .RS 4n
142 Specifies the authentication method. The default value is what has been
143 configured in the profile. The supported authentication methods are:
144 .sp
145 .in +2
146 .nf
147 simple
148 sasl/CRAM-MD5
149 sasl/DIGEST-MD5
150 tls:simple
151 tls:sasl/CRAM-MD5
152 tls:sasl/DIGEST-MD5
153 .fi
154 .in -2
155 .sp
157 Selecting \fBsimple\fR causes passwords to be sent over the network in clear
158 text. Its use is strongly discouraged.
159 .sp
160 Additionally, if the client is configured with a profile which uses no
161 authentication, that is, either the \fIcredentialLevel\fR attribute is set to
162 \fBanonymous\fR or \fIauthenticationMethod\fR is set to \fBnone\fR, the user
163 must use this option to provide an authentication method.
164 .RE
166 .sp
167 .ne 2
168 .na
169 \fB\fB-d\fR\fR
170 .ad
171 .sp .6
172 .RS 4n
173 Lists the attributes for the specified database, rather than the entries. By
174 default, the entries are listed.
175 .RE
177 .sp
178 .ne 2
179 .na
180 \fB\fB-D\fR \fIbindDN\fR\fR
181 .ad
182 .sp .6
183 .RS 4n
184 Specifies an entry which has read permission to the requested database.
185 .RE
187 .sp
188 .ne 2
189 .na
190 \fB\fB-g\fR\fR
191 .ad
192 .sp .6
193 .RS 4n
194 Lists the database mapping.
195 .RE
197 .sp
198 .ne 2
199 .na
200 \fB\fB-h\fR\fR
201 .ad
202 .sp .6
203 .RS 4n
204 Lists the database mapping.
205 .sp
206 This option has been deprecated.
207 .RE
209 .sp
210 .ne 2
211 .na
212 \fB\fB-h\fR \fILDAP_server[:serverPort]\fR\fR
213 .ad
214 .sp .6
215 .RS 4n
216 Specifies an address (or a name) and a port of the LDAP server from which the
217 entries are read. The current naming service specified in the
218 \fBnsswitch.conf\fR file is used. The default value for the port is \fB389\fR,
219 unless when TLS is specified in the authentication method. In this case, the
220 default LDAP server port number is \fB636\fR.
221 .RE
223 .sp
224 .ne 2
225 .na
226 \fB\fB-j\fR \fIpasswdFile\fR\fR
227 .ad
228 .sp .6
229 .RS 4n
230 Specifies a file containing the password for the bind DN or the password for
231 the SSL client's key database. To protect the password, use this option in
232 scripts and place the password in a secure file.
233 .sp
234 This option is mutually exclusive of the \fB-w\fR option.
235 .RE
237 .sp
238 .ne 2
239 .na
240 \fB\fB-l\fR\fR
241 .ad
242 .sp .6
243 .RS 4n
244 Lists all the attributes for each entry matching the search criteria. By
245 default, \fBldaplist\fR lists only the Distinguished Name of the entries found.
246 .RE
248 .sp
249 .ne 2
250 .na
251 \fB\fB-M\fR \fIdomainName\fR\fR
252 .ad
253 .sp .6
254 .RS 4n
255 Specifies the name of a domain served by the specified server. If this option
256 is not specified, the default domain name is used.
257 .RE
259 .sp
260 .ne 2
261 .na
262 \fB\fB-N\fR \fIprofileName\fR\fR
263 .ad
264 .sp .6
265 .RS 4n
266 Specifies a DUAProfile name. A profile with such a name is supposed to exist on
267 the server specified by \fB-H\fR option. The default value is default.
268 .RE
270 .sp
271 .ne 2
272 .na
273 \fB\fB-p\fR \fIcertifPath\fR\fR
274 .ad
275 .sp .6
276 .RS 4n
277 Specifies the certificate path to the location of the certificate database. The
278 value is the path where security database files reside. This is used for TLS
279 support, which is specified in the \fIauthenticationMethod\fR and
280 \fIserviceAuthenticationMethod\fR attributes. The default is \fB/var/ldap\fR.
281 .RE
283 .sp
284 .ne 2
285 .na
286 \fB\fB-w\fR \fIbindPassword\fR\fR
287 .ad
288 .sp .6
289 .RS 4n
290 Password to be used for authenticating the \fIbindDN\fR. If this parameter is
291 missing, the command prompts for a password. NULL passwords are not supported
292 in LDAP.
293 .sp
294 When you use \fB-w\fR \fIbind_password\fR to specify the password to be used
295 for authentication, the password is visible to other users of the system by
296 means of the \fBps\fR command, in script files or in shell history.
297 .sp
298 If the value of \fB-\fR is supplied as a password, the command prompts for a
299 password.
300 .RE
302 .sp
303 .ne 2
304 .na
305 \fB\fB-v\fR\fR
306 .ad
307 .sp .6
308 .RS 4n
309 Sets verbose mode. The \fBldaplist\fR utility also prints the filter used to
310 search for the entry. The filter is prefixed with "\fB+++\fR".
311 .RE
313 .SH EXAMPLES
314 .LP
315 \fBExample 1 \fRListing All Entries in the Hosts Database
316 .sp
317 .LP
318 The following example lists all entries in the \fBhosts\fR database:
320 .sp
321 .in +2
322 .nf
323 example% \fBldaplist hosts\fR
324 .fi
325 .in -2
326 .sp
328 .LP
329 \fBExample 2 \fRListing All Entries in a Non-Standard Database \fBou=new\fR
330 .sp
331 .LP
332 The following example lists all entries in a non-standard database:
334 .sp
335 .in +2
336 .nf
337 example% \fBldaplist ou=new\fR
338 .fi
339 .in -2
340 .sp
342 .LP
343 \fBExample 3 \fRFinding \fBuser1\fR in the \fBpasswd\fR Database
344 .sp
345 .LP
346 The following example finds \fBuser1\fR in the \fBpasswd\fR database:
348 .sp
349 .in +2
350 .nf
351 example% \fBldaplist passwd user1\fR
352 .fi
353 .in -2
354 .sp
356 .LP
357 \fBExample 4 \fRFinding the Entry With Service Port of \fB4045\fR in the
358 \fBservices\fR Database
359 .sp
360 .LP
361 The following example finds the entry with the service port of \fB4045\fR in
362 the \fBservices\fR database:
364 .sp
365 .in +2
366 .nf
367 example% \fBldaplist services ipServicePort=4045\fR
368 .fi
369 .in -2
370 .sp
372 .LP
373 \fBExample 5 \fRFinding All Users With Username Starting with \fBnew\fR in the
374 \fBpasswd\fR Database
375 .sp
376 .LP
377 The following example finds all users with the username starting with \fBnew\fR
378 in the \fBpasswd\fR database:
380 .sp
381 .in +2
382 .nf
383 example% \fBldaplist passwd 'new*'\fR
384 .fi
385 .in -2
386 .sp
388 .LP
389 \fBExample 6 \fRListing the Attributes for the \fBhosts\fR Database
390 .sp
391 .LP
392 The following example lists the attributes for the \fBhosts\fR database:
394 .sp
395 .in +2
396 .nf
397 example% \fBldaplist -d hosts\fR
398 .fi
399 .in -2
400 .sp
402 .LP
403 \fBExample 7 \fRFinding \fBuser1\fR in the \fBpasswd\fR Database
404 .sp
405 .LP
406 The following example finds \fBuser1\fR in the \fBpasswd\fR database. An LDAP
407 server is specified explicitly.
409 .sp
410 .in +2
411 .nf
412 example% \fBldaplist -H 10.10.10.10:3890 \e
413 -M another.domain.name -N special_duaprofile \e
414 -D "cn=directory manager" -w secret \e
415 user1\fR
416 .fi
417 .in -2
418 .sp
420 .SH EXIT STATUS
421 .LP
422 The following exit values are returned:
423 .sp
424 .ne 2
425 .na
426 \fB\fB0\fR\fR
427 .ad
428 .RS 5n
429 Successfully matched some entries.
430 .RE
432 .sp
433 .ne 2
434 .na
435 \fB\fB1\fR\fR
436 .ad
437 .RS 5n
438 Successfully searched the table and no matches were found.
439 .RE
441 .sp
442 .ne 2
443 .na
444 \fB\fB2\fR\fR
445 .ad
446 .RS 5n
447 An error occurred. An error message is output.
448 .RE
450 .SH FILES
451 .ne 2
452 .na
453 \fB\fB/var/ldap/ldap_client_file\fR\fR
454 .ad
455 .br
456 .na
457 \fB\fB/var/ldap/ldap_client_cred\fR\fR
458 .ad
459 .RS 30n
460 Files that contain the LDAP configuration of the client. Do not manually modify
461 these files. Their content is not guaranteed to be human readable. To update
462 these files, use \fBldapclient\fR(8)
463 .RE
465 .SH ATTRIBUTES
466 .LP
467 See \fBattributes\fR(5) for descriptions of the following attributes:
468 .sp
470 .sp
471 .TS
472 box;
473 c | c
474 l | l .
475 ATTRIBUTE TYPE ATTRIBUTE VALUE
476 _
477 Interface Stability Committed
478 .TE
480 .SH SEE ALSO
481 .LP
482 \fBldap\fR(1), \fBldapadd\fR(1), \fBldapdelete\fR(1), \fBldapmodify\fR(1),
483 \fBldapmodrdn\fR(1), \fBldapsearch\fR(1), \fBidsconfig\fR(8),
484 \fBldap_cachemgr\fR(8), \fBldapaddent\fR(8), \fBldapclient\fR(8),
485 \fBresolv.conf\fR(4), \fBattributes\fR(5)
486 .SH NOTES
487 .LP
488 \fIRFC 2307bis\fR is an IETF informational document in draft stage that defines
489 an approach for using \fBLDAP\fR as a naming service.
490 .sp
491 .LP
492 Currently StartTLS is not supported by \fBlibldap.so.5\fR, therefore the port
493 number provided refers to the port used during a TLS open, versus the port used
494 as part of a StartTLS sequence. For example, \fB-h foo:1000 -a tls:simple\fR,
495 refers to a raw TLS open on host \fBfoo\fR, port 1000, not a open, StartTLS
496 sequence on an unsecured port 1000. If port 1000 is unsecured the connection is
497 not made.