LDAP

Most important commands to remember

• ldapsearch -b BASE -s base — inspect one directory entry.
• ldapsearch -ZZ — require StartTLS before performing the search.

Commands and flags

Command or option	Meaning
-x	Use simple authentication; without credentials here, bind anonymously.
-LLL	Print compact LDIF without comments or version information.
-H ldap://localhost:389	Select the existing local LDAP server.
-ZZ	Require successful StartTLS; certificate trust must already be configured.
-b '' / -b 'dc=example,dc=test'	Search the root DSE / the named lab entry.
-s base	Search only the base entry, not its descendants.
'(objectClass=*)'	Match an entry having an objectClass attribute.
Trailing attribute names	Request only the listed attributes; dn identifies an entry.

Quotes preserve the empty base and prevent the shell from interpreting the filter’s parentheses and wildcard.

The concepts that matter

1. LDAP addresses a directory

LDAP is a protocol for accessing a directory: structured entries with attributes such as names, groups, or service information. A directory is often optimized for many lookups and relatively fewer changes.

LDAP is not itself a complete identity system. A product such as Active Directory combines directory access with other protocols and services. Being able to search an LDAP endpoint does not imply that every authentication or policy feature uses LDAP.

2. A distinguished name locates an entry

A distinguished name, or DN, identifies an entry in the directory tree. In dc=example,dc=test, the components describe a position in that hierarchy; they are not an HTTP URL.

Entries carry attributes, and object classes describe required and permitted attributes under the schema. The special root DSE exposes server information such as available naming contexts. It is not the parent entry containing every user’s attributes.

3. A search has a starting point and a boundary

A search combines a base DN, scope, filter, and requested attributes. Base scope examines one entry; broader scopes can include descendants. Choosing these deliberately keeps a lookup understandable and avoids unnecessary data retrieval.

A filter selects matching entries. It is not a shell wildcard expression or SQL. Applications must escape untrusted filter input according to LDAP rules instead of inserting it directly into a filter string.

4. Binding establishes identity, access controls decide visibility

A bind establishes the connection’s authentication state. The server then applies access controls to searches and changes. Anonymous access can reveal some metadata while hiding most entries.

Simple username/password authentication needs protected transport. StartTLS upgrades an LDAP connection to TLS; requiring the upgrade avoids continuing after its failure. TLS protects the connection but does not grant directory permissions or make an anonymous search authenticated as a user.

One small example

Optional: use the stated existing local directory. Its certificate must validate for localhost, and its CA must already be trusted by the LDAP client. These commands neither install nor configure a directory.

ldapsearch -x -LLL -H ldap://localhost:389 -ZZ -b '' -s base '(objectClass=*)' namingContexts supportedLDAPVersion
ldapsearch -x -LLL -H ldap://localhost:389 -ZZ -b 'dc=example,dc=test' -s base '(objectClass=*)' dn objectClass

The first search should show naming contexts and supported protocol versions permitted by server policy. The second asks only for the lab base entry and its object classes. Compare its DN with a naming context from the first response.

A TLS error is a transport or trust problem. No such object means the requested base was not found or exposed; an access error indicates a policy boundary. Empty results alone do not prove the directory contains no users. Both searches are read-only and require no cleanup.

Keep this idea: An LDAP lookup asks for particular attributes within a defined part of a directory, under the connection’s access rights.