---
name: "ldap"
section: "1"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/ldap"
---

# ldap(1)

simple LDAP client

## NAME

**ldap** – simple LDAP client

## SYNOPSIS

**ldap** **search** \[**-LvWxZ**\] \[**-b** *basedn*\] \[**-c** *CAfile*\] \[**-D** *binddn*\] \[**-H** *host*\] \[**-l** *timelimit*\] \[**-s** *scope*\] \[**-w** *secret*\] \[**-y** *secretfile*\] \[**-z** *sizelimit*\] \[*filter*\] \[*attributes* *...*\]

## DESCRIPTION

The **ldap** utility is a simple LDAP client. It queries an LDAP server to perform a command and outputs the results in the LDAP Data Interchange Format (LDIF).

- **search** *options* \[*filter*\] \[*attributes* *...*\]

  Perform a directory search request. The optional *filter* argument specifies the LDAP filter for the directory search. The default is *(objectClass=\*)* and the format must comply to the “String Representation of Search Filters” as described in RFC 4515. If one or more *attribute* options are specified, **ldap** restricts the output to the specified attributes.

The options are as follows:

- **-b** *basedn*

  Use the specified distinguished name (dn) as the starting point for directory search requests.

- **-c** *CAfile*

  When TLS is enabled, load the CA bundle for certificate verification from the specified file. The default is */etc/ssl/cert.pem*. If the LDAP server uses a self-signed certificate, use a file that contains the server certificate in PEM format, e.g. */etc/ssl/ldapserver.example.com.crt*.

- **-D** *binddn*

  Use the specified distinguished name to bind to the directory.

- **-H** *host*

  The hostname of the LDAP server or an LDAP URL. The LDAP URL is described in RFC 4516 with the following format:

  \[*protocol*://\] *host*\[:*port*\]\[ /*basedn* ?*attribute*,*...* ?*scope* ?*filter*\]

  The default is *ldap://localhost:389/*. Each of *basedn*, *attribute*, *scope* and *filter* may be omitted, but the preceding ‘/’ or ‘?’ is required if a subsequent field is non-empty.

  The following protocols are supported:

  - ldap

    Connect with TCP in plain text. This is the default.

  - ldaps

    Connect with TLS. The default port is 636.

  - ldap+tls

    Connect with TCP and enable TLS using the StartTLS operation. This is the same as the **-Z** option.

  - ldapi

    Connect to a UNIX-domain socket. The host argument is required to be a URL-encoded path, for example *ldapi://%2fvar%2frun%2fldapi* for */var/run/ldapi*.

- **-L**

  Output the directory search result in a standards-compliant version of the LDAP Data Interchange Format (LDIF). This encodes attribute values that include non-printable or UTF-8 characters in the Base64 format and wraps lines at a 79-character limit. If this option is not specified, **ldap** encodes “unsafe” characters and newlines in a visual format using [vis(3)](/vis/3.md) instead.

- **-l** *timelimit*

  Request the server to abort the search request after *timelimit* seconds. The default value is 0 for no limit.

- **-s** *scope*

  Specify the *scope* to be either **base**, **one**, or **sub**. The default is **sub** for subtree searches.

- **-v**

  Produce more verbose output.

- **-W**

  Prompt for the bind secret with echo turned off.

- **-w** *secret*

  Specify the bind secret on the command line.

- **-x**

  Use simple authentication. This is the default as **ldap** does not support SASL authentication.

- **-y** *secretfile*

  Read the bind secret from the first line of the specified file or from standard input if the *secretfile* argument is ‘-’. The file must not be world-readable if it is a regular file.

- **-Z**

  Enable TLS using the StartTLS operation.

- **-z** *sizelimit*

  Request the server to limit the search result to a maximum number of *sizelimit* entries. The default value is 0 for no limit.

## FILES

- */etc/ssl/cert.pem*

  Default CA file.

## EXAMPLES

The following script can be used with the *AuthorizedKeysCommand* option of [sshd(8)](/sshd/8.md):

```
#!/bin/sh
ldap search -D cn=Reader,dc=example,dc=com -w mypass123 \
	-b ou=People,dc=example,dc=com \
	-H ldapserver -c /etc/ssl/ldapserver.crt -Z \
	"(&(objectClass=bsdAccount)(uid=$1))" sshPublicKey | \
	sed 's/^sshPublicKey: //p;d;'
exit 0
```

And the related configuration in [sshd\_config(5)](/sshd_config/5.md):

```
Match Group ldapusers
	AuthorizedKeysCommand /etc/ssh/ldap-authorized_keys.sh
	AuthorizedKeysCommandUser _ldap
```

## SEE ALSO

[sshd\_config(5)](/sshd_config/5.md), [ldapd(8)](/ldapd/8.md), [sshd(8)](/sshd/8.md)

## STANDARDS

G. Good, *The LDAP Data Interchange Format (LDIF) - Technical Specification*, RFC 2849, June 2000.

M. Smith, Ed. and T. Howes, *Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters*, RFC 4515, June 2006.

M. Smith, Ed. and T. Howes, *Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator*, RFC 4516, June 2006.

## HISTORY

The **ldap** utility first appeared in OpenBSD 6.4.

## AUTHORS

The **ldap** utility was written by Reyk Floeter ⟨*reyk@openbsd.org*⟩.

## CAVEATS

SASL authentication is not supported. Authentication should be performed using simple authentication over a TLS connection.