---
name: "lemonldap-ng-sessions"
section: "1p"
platform: "linux"
package: "liblemonldap-ng-common-perl"
version: "2.21.2+ds-1+deb13u3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/lemonldap-ng-sessions"
---

# lemonldap-ng-sessions(1p)

Scripting CLI for LemonLDAP::NG sessions

## NAME

lemonldap-ng-sessions - Scripting CLI for LemonLDAP::NG sessions

## SYNOPSIS

```
  lemonldap-ng-sessions [<options>] <command> [<arguments> ...]
```

## DESCRIPTION

**Commands**:

- **"get"**: get one or several session from known IDs

  - **"search"**: search for sessions

  - **count**: alias for **search --count**

  - **"delete"**: delete existing sessions

  - **"setKey"**: add/change key in existing session

  - **"delKey"**: delete key from existing session

  - **"secondfactors"**: manage second factors

  - **"consents"**: manage OIDC user consents

  - **"backup"**: dump all sessions

  - **"restore"**: restore sessions from a dump file

  **Options**:

- **--help**: Show full help

  - **--select**: Select which fields to print

  - **--backend**: Specify session backend

  - **--persistent**: Search in persistent sessions

  - **--refresh-tokens**: Search into refresh\_tokens only

  - **--where**: Set search filter (search/delete only)

  - **--id-only**: Only return IDs (search only)

  - **--user**: Change user running the script

  - **--group**: Change group running the script

  - **--hash**: When "hashed session storage" is in use, indicates that the given session ID is the original value (cookie value)

  - **--count** *(only with* ***"search"****)*: display the number of matching sessions instead of their content

  - **--out**: write result into given file

  ### COMMANDS

*get*

```
    lemonldap-ng-sessions get <id> [<id> ...]
```

This command lets you read the content of a session.

You must pass one or several session IDs as parameters.

Examples

```
        lemonldap-ng-sessions get 9684dd2a6489bf2be2fbdd799a8028e3
        lemonldap-ng-sessions get --persistent dwho
```

*search*

```
    lemonldap-ng-sessions search [<options>]
```

This command lets you search for sessions.

It can be used to find the session IDs that other commands need.

You can restrict the search with options. See "OPTIONS"

Examples

```
        lemonldap-ng-sessions search
        lemonldap-ng-sessions search --backend persistent
        lemonldap-ng-sessions search --where uid=dwho
        lemonldap-ng-sessions search --where uid=dwho \
                --id-only
        lemonldap-ng-sessions search --backend persistent \
                --where _session_uid=dwho
        lemonldap-ng-sessions search --where uid=dwho \
                --select authenticationLevel
    lemonldap-ng-sessions search --where '_startTime>20240410063538'
    lemonldap-ng-sessions search --where '_startTime<20240410063538'
```

And you can just display the number of result using **lemonldap-ng-sessions search --count**

*delete*

```
    lemonldap-ng-sessions delete <id> [<id> ...]
    lemonldap-ng-sessions delete --where <filter>
```

This command lets you delete sessions.

You may give it one or several session IDs to remove.

Examples:

```
        lemonldap-ng-sessions delete 9684dd2a6489bf2be2fbdd799a8028e3
        lemonldap-ng-sessions delete --persistent dwho
```

Or you can give it a search expression.

Examples:

```
        lemonldap-ng-sessions delete --where uid=dwho
        lemonldap-ng-sessions delete --persistent --where _session_uid=dwho
```

*setKey*

```
    lemonldap-ng-sessions setKey <id> <key> <value> [<key> <value> ...]
```

This command allows you to modify one or several keys from an existing session.

Examples:

```
        lemonldap-ng-sessions setKey 9684dd2a6489bf2be2fbdd799a8028e3 \
                authenticationLevel 1
```

*delKey*

```
    lemonldap-ng-sessions delKey <id> <key> [<key> ...]
```

This command lets you remove a key from an existing session.

You must specify a session ID, and one of several session keys to remove.

Examples:

```
        lemonldap-ng-sessions delKey --persistent dwho _oidcConsents
```

*secondfactors*

```
    lemonldap-ng-sessions secondfactors <command> <user> [<id> ... ]
```

**Commands**:

- **get** \<user\>

  show all second factors for a user

- **delete** \<user\> \<id\> \[\<id\> ...\]

  delete second factors for a user. The ID must match one of the IDs returned by the "show" command.

- **delType** \[\<user\>\|--all\] \<type\> \[\<type\> ...\]

  delete all second factors of a given type for a user

- **migrateu2f** \[\<user\>\|--all\]

  migrate U2F device registrations to WebAuthn device registrations

*consents*

```
    lemonldap-ng-sessions consents <command> <user> [<id> ... ]
```

Commands:

```
    get <user>
        show all OIDC consents for a user
    delete <user> <id> [<id> ...]
        delete OIDC consents for a user
```

*backup*

```
    lemonldap-ng-sessions backup > file
    # or
    lemonldap-ng-sessions backup --out file
    # or limited to persistent sessions
    lemonldap-ng-sessions backup --persistent --out file
    # or limited to OIDC refresh_tokens
    lemonldap-ng-sessions backup --refresh-tokens --out file
```

Simple command to dump all sessions or only persistent or refresh\_tokens.

*restore*

```
    lemonldap-ng-sessions restore < file
    # or
    lemonldap-ng-sessions restore file
```

Command to restore sessions using a file generated by "backup" command

### OPTIONS

- **--select**,**-s**

  Lets you select which fields to output in the JSON result.

  This option can be set multiple times

- **--where**,**-w**

  This option lets you filter your session search according to a filter.

  For now, only one filter can be set.

  Examples:

  ```
          --search uid=dwho
          --search _sessionType=OIDC
          --search '_startTime>20240410063538'
          --search '_startTime<20240410063538'
  ```

- **--backend**,**-b**

  This option lets you specify which session backend to use.

  You only need it when you configured multiple session backends in your LemonLDAP::NG installation (for Persistent, SAML, CAS or OIDC sessions)

  Examples:

  ```
          --backend persistent
          --backend saml
          --backend oidc
          --backend cas
  ```

- **--persistent**,**-p**

  This option is a shortcut for specifying --backend persistent and using the UID hash as a session ID

  Example:

  ```
          lemonldap-ng-sessions --backend persistent \
                  get 5efe8af397fc3577e05b483aca964f1b
  ```

  is the same as

  ```
          lemonldap-ng-sessions get --persistent dwho
  ```

- **--id-only**,**-i**

  This option replaces the standard JSON output format with a simpler format of one session ID per line.

  This allows some interesting combos using xargs. For example, if you want to remove all sessions started by "dwho"

  ```
          lemonldap-ng-sessions search --where uid=dwho --id-only | \
                  xargs lemonldap-ng-sessions delete
  ```

- **--user**,**-u**

  This option forces the system user that runs the script.

- **--group**,**-g**

  This option forces the system group that runs the script.

- **--hash**, **-c**

  When the session storage is protected by hashed session storage \<https://lemonldap-ng.org/documentation/latest/security.html#configure-security-settings\>, this option indicates that the given session is the original value *(cookie value)*

## SEE ALSO

\<http://lemonldap-ng.org/\>

## AUTHORS

- Maxime Besson, \<maxime.besson@worteks.com\>

  ## BUG REPORT

Use OW2 system to report bug or ask for features: \<https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues\>

## COPYRIGHT AND LICENSE

- Copyright (C) 2016 by Xavier Guimard, \<x.guimard@free.fr\>

  - Copyright (C) 2016 by Clément Oudot, \<clem.oudot@gmail.com\>

  This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program.  If not, see \<http://www.gnu.org/licenses/\>.