---
name: "ldapwhoami"
section: "1"
platform: "macos"
package: "OpenLDAP"
version: "561"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/ldapwhoami"
---

# ldapwhoami(1)

LDAP who am i? tool

## NAME

ldapwhoami - LDAP who am i? tool

## SYNOPSIS

**ldapwhoami** \[**-n**\] \[**-v**\] \[**-z**\] \[**-d** *debuglevel\]* \[**-D** *binddn\]* \[**-W**\] \[**-w** *passwd\]* \[**-y** *passwdfile\]* \[**-H** *ldapuri\]* \[**-h** *ldaphost\]* \[**-p** *ldapport\]* \[**-e** \[**!**\]***ext***\[**=*extparam***\]\] \[**-E** \[**!**\]***ext***\[**=*extparam***\]\] \[**-O** *security-properties\]* \[**-I**\] \[**-Q**\] \[**-U** *authcid\]* \[**-R** *realm\]* \[**-x**\] \[**-X** *authzid\]* \[**-Y** *mech\]* \[**-Z**\[**Z**\]\]

## DESCRIPTION

*ldapwhoami* implements the LDAP "Who Am I?" extended operation.

**ldapwhoami** opens a connection to an LDAP server, binds, and performs a whoami operation.

## OPTIONS

- **-n**

  Show what would be done, but don't actually perform the whoami operation. Useful for debugging in conjunction with **-v**.

- **-v**

  Run in verbose mode, with many diagnostics written to standard output.

- **-d** *debuglevel*

  Set the LDAP debugging level to *debuglevel*. **ldapwhoami** must be compiled with LDAP\_DEBUG defined for this option to have any effect.

- **-x**

  Use simple authentication instead of SASL.

- **-D** *binddn*

  Use the Distinguished Name *binddn* to bind to the LDAP directory. For SASL binds, the server is expected to ignore this value.

- **-W**

  Prompt for simple authentication. This is used instead of specifying the password on the command line.

- **-w** *passwd*

  Use *passwd* as the password for simple authentication.

- **-y** *passwdfile*

  Use complete contents of *passwdfile* as the password for simple authentication.

- **-H** *ldapuri*

  Specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas is expected.

- **-h** *ldaphost*

  Specify an alternate host on which the ldap server is running. Deprecated in favor of **-H**.

- **-p** *ldapport*

  Specify an alternate TCP port where the ldap server is listening. Deprecated in favor of **-H**.

- **-O** *security-properties*

  Specify SASL security properties.

- **-e** \[**!**\]***ext***\[**=*extparam***\]

  - **-E** \[**!**\]***ext***\[**=*extparam***\]

  Specify general extensions with **-e** and search extensions with **-E**. ´**!**´ indicates criticality.

  General extensions:

  ```
    [!]assert=<filter>   (an RFC 4515 Filter)
    [!]authzid=<authzid> ("dn:<dn>" or "u:<user>")
    [!]manageDSAit
    [!]noop
    ppolicy
    [!]postread[=<attrs>]        (a comma-separated attribute list)
    [!]preread[=<attrs>] (a comma-separated attribute list)
    abandon, cancel (SIGINT sends abandon/cancel; not really controls)
  ```

  Search extensions:

  ```
    [!]domainScope                               (domain scope)
    [!]mv=<filter>                               (matched values filter)
    [!]pr=<size>[/prompt|noprompt]       (paged results/prompt)
    [!]sss=[-]<attr[:OID]>[/[-]<attr[:OID]>...]  (server side sorting)
    [!]subentries[=true|false]           (subentries)
    [!]sync=ro[/<cookie>]                        (LDAP Sync refreshOnly)
            rp[/<cookie>][/<slimit>]     (LDAP Sync refreshAndPersist)
  ```

- **-I**

  Enable SASL Interactive mode.  Always prompt.  Default is to prompt only as needed.

- **-Q**

  Enable SASL Quiet mode.  Never prompt.

- **-U** *authcid*

  Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.

- **-R** *realm*

  Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.

- **-X** *authzid*

  Specify the requested authorization ID for SASL bind. *authzid* must be one of the following formats: **dn:***\<distinguished name\>* or **u:***\<username\>*

- **-Y** *mech*

  Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows.

- **-Z**\[**Z**\]

  Issue StartTLS (Transport Layer Security) extended operation. If you use **-ZZ**, the command will require the operation to be successful.

## EXAMPLE

```
    ldapwhoami -x -D "cn=Manager,dc=example,dc=com" -W
```

## SEE ALSO

[**ldap.conf**(5)](/ldap.conf/5.md), [**ldap**(3)](/ldap/3.md), [**ldap\_extended\_operation**(3)](/ldap_extended_operation/3.md)

## AUTHOR

The OpenLDAP Project \<http://www.openldap.org/\>

## ACKNOWLEDGEMENTS