---
name: "ldapd"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/ldapd"
---

# ldapd(8)

Lightweight Directory Access Protocol (LDAP) daemon

## NAME

**ldapd** – Lightweight Directory Access Protocol (LDAP) daemon

## SYNOPSIS

**ldapd** \[**-dnv**\]\[ **-D** *macro*=*value*\] \[**-f** *file*\] \[**-r** *directory*\] \[**-s** *file*\]

## DESCRIPTION

**ldapd** is a daemon which implements version 3 of the LDAP protocol.

A running **ldapd** process can be controlled using the [ldapctl(8)](/ldapctl/8.md) utility.

The options are as follows:

- **-D** *macro*=*value*

  Define *macro* to be set to *value* on the command line. Overrides the definition of *macro* in the configuration file.

- **-d**

  Do not daemonize and log to *stderr*.

- **-f** *file*

  Use *file* as the configuration file, instead of the default */etc/ldapd.conf*.

- **-n**

  Configtest mode. Only check the configuration file for validity.

- **-r** *directory*

  Store and read database files in *directory*, instead of the default */var/db/ldap*.

- **-s** *file*

  Specify an alternative location for the socket file.

- **-v**

  Produce more verbose output. A second **-v** together with the **-d** flag produces debug traces of decoded BER messages on stderr.

## AUTHENTICATION

**ldapd** can authenticate users via simple binds or SASL with the PLAIN mechanism.

When using simple binds, the bind DN entry must exist in a namespace and have a **userPassword** attribute. The following formats of the **userPassword** attribute are recognized:

- **{SHA}digest**

  Verify the password against the SHA-1 digest.

- **{SSHA}digest**

  Verify the password against the salted SHA-1 digest.

- **{CRYPT}hash**

  Verify the password against the [crypt(3)](/crypt/3.md) hash.

- **{BSDAUTH}username**

  Use BSD Authentication with the given username and authentication style “auth-ldap”. This is similar to using SASL PLAIN authentication with *username* as the authentication ID.

- **{BSDAUTH}username#class**

  Same as above, but overrides the login class.

Without a prefix, the **userPassword** attribute is compared literally with the provided plain text password.

When using SASL binds, the authentication ID should be a valid username for BSD Authentication.

For plain text passwords to be accepted, the connection must be considered secure, either by using an encrypted connection, or by using the **secure** keyword in the configuration file.

## FILES

- */etc/ldapd.conf*

  default **ldapd** configuration file

- */var/run/ldapd.sock*

  default **ldapd** control socket

- */var/db/ldap/\*.db*

  **ldapd** database files

## SEE ALSO

[ldap(1)](/ldap/1.md), [ldapd.conf(5)](/ldapd.conf/5.md), [login.conf(5)](/login.conf/5.md), [ldapctl(8)](/ldapctl/8.md)

## STANDARDS

J. Sermersheim, *Lightweight Directory Access Protocol (LDAP): The Protocol*, RFC 4511, June 2006.

K. Zeilenga, *Lightweight Directory Access Protocol (LDAP): Directory Information Models*, RFC 4512, June 2006.

## HISTORY

The **ldapd** program first appeared in OpenBSD 4.8.

## CAVEATS

**ldapd** is not yet fully LDAPv3 compliant.

Database files are not expected to work across architectures and may not work across versions.