---
name: "ldapvc"
section: "1"
platform: "linux"
package: "openldap"
version: "2.7.2-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ldapvc"
---

# ldapvc(1)

LDAP verify credentials tool

## NAME

ldapvc - LDAP verify credentials tool

## SYNOPSIS

**ldapvc** \[**-V**\[**V**\]\] \[**-d** *debuglevel\]* \[**-a**\] \[**-b**\] \[**-n**\] \[**-v**\] \[**-x**\] \[**-D** *binddn\]* \[**-W**\] \[**-w** *passwd\]* \[**-y** *passwdfile\]* \[**-H** *ldapuri\]* \[**-e** \[**!**\]***ext***\[**=*extparam***\]\] \[**-E** \[**!**\]***ext***\[**=*extparam***\]\] \[**-o** *opt***\[=***optparam***\]\]** \[**-O** *security-properties\]* \[**-I**\] \[**-Q**\] \[**-N**\] \[**-U** *authcid\]* \[**-R** *realm\]* \[**-X** *authzid\]* \[**-Y** *mech\]* \[**-Z**\[**Z**\]\]*Distinguished Name*  *\[Credentials\]*

## DESCRIPTION

*ldapvc* implements the LDAP "Verify Credentials" extended operation.

**Verify Credentials** operation behaves like LDAP Bind but has no impact upon the underlying LDAP session.

## OPTIONS

- **-V**\[**V**\]

  Print version info. If **-VV** is given, only the version information is printed.

- **-d** *debuglevel*

  Set the LDAP debugging level to *debuglevel*. **ldapvc** must be compiled with LDAP\_DEBUG defined for this option to have any effect.

- **-a**

  Print the authzID resulting from a successful verification of credentials.

- **-b**

  Print the results from the ppolicy control after verification of credentials.

- **-n**

  Show what would be done, but don't actually perform the operation. Useful for debugging in conjunction with **-v**.

- **-v**

  Run in verbose mode, with many diagnostics written to standard output.

- **-x**

  Use simple authentication instead of SASL.

- **-D** *binddn*

  Use the Distinguished Name *binddn* to bind to the LDAP directory. For SASL binds, the server is expected to ignore this value.

- **-W**

  Prompt for simple authentication. This is used instead of specifying the password on the command line.

- **-w** *passwd*

  Use *passwd* as the password for simple authentication.

- **-y** *passwdfile*

  Use complete contents of *passwdfile* as the password for simple authentication.

- **-H** *ldapuri*

  Specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas is expected.

- **-e** \[**!**\]***ext***\[**=*extparam***\]

  - **-E** \[**!**\]***ext***\[**=*extparam***\]

  Specify general extensions with **-e** and Verify Credentials extensions with **-E**. ´**!**´ indicates criticality.

  General extensions:

  ```
    [!]assert=<filter>    (an RFC 4515 Filter)
    [!]bauthzid           (RFC 3829 authzid control)
    [!]chaining[=<resolve>[/<cont>]]
    [!]manageDSAit
    [!]noop
    ppolicy
    [!]postread[=<attrs>] (a comma-separated attribute list)
    [!]preread[=<attrs>]  (a comma-separated attribute list)
    [!]relax
    sessiontracking[=<username>]
    abandon,cancel,ignore (SIGINT sends abandon/cancel,
    or ignores response; if critical, doesn't wait for SIGINT.
    not really controls)
  ```

  Verify Credentials extensions:

  The following options set SASL params on the Verify Credentials request:

  ```
    authcid=<authcid>    (SASL Authentication Identity "dn:<dn>" or "u:<user>")
    authzid=<authzid>    (SASL Authorization Identity "dn:<dn>" or "u:<user>")
    mech=<mech>          (SASL mechanism default e.g. Simple)
    realm=<realm>        (SASL Realm, defaults to none)
    sasl=a[utomatic]|i[nteractive]|q[uiet]  (SASL mode defaults to automatic if any other -E option provided, otherwise none)
    secprops=<secprops>  (SASL Security Properties)
  ```

- **-o** *opt***\[=***optparam***\]**

  Specify any [**ldap.conf**(5)](/ldap.conf/5.md) option or one of the following:

  ```
    nettimeout=<timeout>  (in seconds, or "none" or "max")
    ldif_wrap=<width>     (in columns, or "no" for no wrapping)
  ```

  **-o** option that can be passed here, check [**ldap.conf**(5)](/ldap.conf/5.md) for details.

- **-O** *security-properties*

  Specify SASL security properties.

- **-I**

  Enable SASL Interactive mode.  Always prompt.  Default is to prompt only as needed.

- **-Q**

  Enable SASL Quiet mode.  Never prompt.

- **-N**

  Do not use reverse DNS to canonicalize SASL host name.

- **-U** *authcid*

  Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.

- **-R** *realm*

  Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.

- **-X** *authzid*

  Specify the requested authorization ID for SASL bind. *authzid* must be one of the following formats: **dn:***\<distinguished name\>* or **u:***\<username\>*

- **-Y** *mech*

  Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows.

- **-Z**\[**Z**\]

  Issue StartTLS (Transport Layer Security) extended operation. If you use **-ZZ**, the command will require the operation to be successful.

## EXAMPLE

```
    ldapvc -x "uid=Alice,ou=People,dc=example,dc=com"
```

## SEE ALSO

[**ldap.conf**(5)](/ldap.conf/5.md), [**ldap**(3)](/ldap/3.md), [**ldap\_extended\_operation**(3)](/ldap_extended_operation/3.md)

## AUTHOR

The OpenLDAP Project \<http://www.openldap.org/\>

## ACKNOWLEDGEMENTS

**OpenLDAP Software** is developed and maintained by The OpenLDAP Project \<http://www.openldap.org/\>. **OpenLDAP Software** is derived from the University of Michigan LDAP 3.3 Release.