Manual Pages for UNIX Darwin command on man ldapcompare

LDAPCOMPARE(1) LDAPCOMPARE(1)

NAME

ldapcompare - LDAP compare tool

SYNOPSIS

llddaappccoommppaarree [-nn] [-vv] [-zz] [-kk] [-KK] [-MM[[MM]]] [-dd debuglevel]

[-DD binddn] [-WW] [-ww passwd] [-yy passwdfile] [-HH ldapuri] [-hh ldaphost]

[-pp ldapport] [-PP 2|3] [-OO security-properties]] [-II] [-QQ] [-UU authcid]

[-RR realm] [-xx] [-XX authzid] [-YY mech] [-ZZ[[ZZ]]] DN < aattttrr::vvaalluuee |

aattttrr::::bb6644vvaalluuee >

DESCRIPTION

ldapcompare is a shell-accessible interface to the llddaappccoommppaarree(3)

library call. llddaappccoommppaarree opens a connection to an LDAP server, binds, and performs a compare using specified parameters. The DN should be a distinguished name in the directory. Attr should be a known attribute. If followed by one colon, the assertion value should be provided as a string. If followed by two colons, the base64 encoding of the value is provided. The result code of the compare is provided as the exit code and, unless

ran with -z, the program prints TRUE, FALSE, or UNDEFINED on standard

output. OOPPTTIIOONNSS

-nn Show what would be done, but don't actually perform the compare.

Useful for debugging in conjunction with -v.

-vv Run in verbose mode, with many diagnostics written to standard

output.

-zz Run in quiet mode, no output is written. You must check the

return status. Useful in shell scripts.

-kk Use Kerberos IV authentication instead of simple authentication.

It is assumed that you already have a valid ticket granting ticket. llddaappccoommppaarree must be compiled with Kerberos support for this option to have any effect.

-KK Same as -k, but only does step 1 of the Kerberos IV bind. This

is useful when connecting to a slapd and there is no x500dsa.hostname principal registered with your Kerberos Domain Controller(s).

-MM[[MM]] Enable manage DSA IT control. -MMMM makes control critical.

-dd debuglevel

Set the LDAP debugging level to debuglevel. llddaappccoommppaarree must be compiled with LDAPDEBUG defined for this option to have any effect.

-xx Use simple authentication instead of SASL.

-DD binddn

Use the Distinguished Name binddn to bind to the LDAP directory.

-WW Prompt for simple authentication. This is used instead of spec-

ifying the password on the command line.

-ww passwd

Use passwd as the password for simple authentication.

-yy passwdfile

Use complete contents of passwdfile as the password for simple authentication.

-HH ldapuri

Specify URI(s) referring to the ldap server(s).

-hh ldaphost

Specify an alternate host on which the ldap server is running.

Deprecated in favor of -H.

-pp ldapport

Specify an alternate TCP port where the ldap server is listen-

ing. Deprecated in favor of -H.

-PP 2|3 Specify the LDAP protocol version to use.

-OO security-properties

Specify SASL security properties.

-II Enable SASL Interactive mode. Always prompt. Default is to

prompt only as needed.

-QQ Enable SASL Quiet mode. Never prompt.

-UU authcid

Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.

-RR realm

Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.

-XX authzid

Specify the requested authorization ID for SASL bind. authzid must be one of the following formats: ddnn:: or uu::

-YY mech

Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows.

-ZZ[[ZZ]] Issue StartTLS (Transport Layer Security) extended operation. If

you use -ZZZZ, the command will require the operation to be suc-

cessful. EEXXAAMMPPLLEESS

ldapcompare "uid=babs,dc=example,dc=com" sn:Jensen

ldapcompare "uid=babs,dc=example,dc=com" sn::SmVuc2Vu

are all equivalent. LLIIMMIITTAATTIIOONNSS Requiring the value be passed on the command line is limiting and

introduces some security concerns. The command should support a mecha-

nism to specify the location (file name or URL) to read the value from.