LDAPCOMPARE(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 LDAPCOMPARE(1) 💖

okay bestie, so we're doing a General Commands Manual page today, and it's literally ldapcompare — the LDAP compare tool. sit down, grab a boba, we're gonna slay this 🫶

✨ NAME ✨

ldapcompare — the LDAP compare tool, periodt 💅

🌸 SYNOPSIS 🌸

ldapcompare [-V[V]] [-d debuglevel] [-n] [-v] [-z] [-M[M]] [-x]
[-D binddn] [-W] [-w passwd] [-y passwdfile] [-H ldapuri] [-P {2|3}]
[-e [!]ext[=extparam]] [-E [!]ext[=extparam]] [-o opt[=optparam]]
[-O security-properties] [-I] [-Q] [-N] [-U authcid] [-R realm]
[-X authzid] [-Y mech] [-Z[Z]] DN {attr:value | attr::b64value}

like yes it's a whole wall of brackets, breathe, we'll get through all of it 🌈

🦋 DESCRIPTION 🦋

so ldapcompare is a shell-accessible interface to the ldap_compare_ext(3) library call. that's the whole vibe.

here's the tea 🍓: ldapcompare opens a connection to an LDAP server, binds, and performs a compare using the parameters you gave it. the DN should be a distinguished name in the directory. Attr should be a known attribute.

and now the part that gets people every single time, no cap — the colons:

  • if the attr is followed by one colon, the assertion value should be provided as a string.
  • if it's followed by two colons, you're providing the base64 encoding of the value.

the result code of the compare is provided as the exit code and, unless you ran it with -z, the program prints TRUE, FALSE, or UNDEFINED on standard output. iconic behavior honestly ✨

👑 OPTIONS 👑

  • -V[V] — Print version info. If you use -VV, only the version information is printed. (double V = version-only mode, iykyk 💅)
  • -d debuglevel — Set the LDAP debugging level to debuglevel. heads up bestie: ldapcompare must be compiled with LDAP_DEBUG defined for this option to have any effect. so if it does nothing, that's why 😭
  • -n — Show what would be done, but don't actually perform the compare. super useful for debugging when you pair it with -v. the "window shopping" of flags essentially 🎀
  • -v — Run in verbose mode, with many diagnostics written to standard output. it WILL yap. that's the point 💜
  • -z — Run in quiet mode, no output is written. You must check the return status. Useful in shell scripts. (silent but deadly, main character energy fr fr)
  • -M[M] — Enable manage DSA IT control. -MM makes control critical.
  • -x — Use simple authentication instead of SASL.
  • -D binddn — Use the Distinguished Name binddn to bind to the LDAP directory. For SASL binds, the server is expected to ignore this value.
  • -W — Prompt for simple authentication. This is used instead of specifying the password on the command line. much safer vibe, we love to see it 🫶
  • -w passwd — Use passwd as the password for simple authentication.
  • -y passwdfile — Use complete contents of passwdfile as the password for simple authentication. now READ THIS PART CAREFULLY because it's the #1 gotcha 🚨: note that complete means that any leading or trailing whitespaces, including newlines, will be considered part of the password and, unlike other software, they will not be stripped. as a consequence, passwords stored in files by commands like echo(1) will not behave as expected, since echo(1) by default appends a trailing newline to the echoed string. the recommended portable way to store a cleartext password in a file for use with this option is to use slappasswd(8) with {CLEARTEXT} as hash and the option -n. yeah. sneaky newline. we've all been there 💀
  • -H ldapuri — Specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas is expected.
  • -P {2|3} — Specify the LDAP protocol version to use.
  • -e [!]ext[=extparam]
  • -E [!]ext[=extparam]

Specify general extensions with -e and compare extensions with -E. ´!´ indicates criticality.

General extensions:

  • [!]assert=<filter> — (an RFC 4515 Filter)
  • !authzid=<authzid> — ("dn:<dn>" or "u:<user>")
  • [!]bauthzid — (RFC 3829 authzid control)
  • [!]chaining[=<resolve>[/<cont>]]
  • [!]manageDSAit
  • [!]noop
  • ppolicy
  • [!]postread[=<attrs>] — (a comma-separated attribute list)
  • [!]preread[=<attrs>] — (a comma-separated attribute list)
  • [!]relax
  • sessiontracking[=<username>]
  • abandon,cancel,ignore — (SIGINT sends abandon/cancel, or ignores response; if critical, doesn't wait for SIGINT. not really controls)

Compare extensions:

  • !dontUseCopy
  • -o opt[=optparam] — Specify any ldap.conf(5) option or one of the following:
    • nettimeout=<timeout> — (in seconds, or "none" or "max")
    • ldif_wrap=<width> — (in columns, or "no" for no wrapping)
  • -O security-properties — Specify SASL security properties.
  • -I — Enable SASL Interactive mode. Always prompt. Default is to prompt only as needed.
  • -Q — Enable SASL Quiet mode. Never prompt. 🤫
  • -N — Do not use reverse DNS to canonicalize SASL host name.
  • -U authcid — Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.
  • -R realm — Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.
  • -X authzid — Specify the requested authorization ID for SASL bind. authzid must be one of the following formats: dn:<distinguished name> or u:<username>
  • -Y mech — Specify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows. it picks for you, king behavior 👑
  • -Z[Z] — Issue StartTLS (Transport Layer Security) extended operation. If you use -ZZ, the command will require the operation to be successful. (double Z = no take-backsies 🔥)

🌈 EXAMPLES 🌈

ldapcompare "uid=babs,dc=example,dc=com"  sn:Jensen
ldapcompare "uid=babs,dc=example,dc=com"  sn::SmVuc2Vu

are all equivalent. yes bestie, one colon string version and two colon base64 version, same energy, same result ✨

💀 LIMITATIONS 💀

Requiring the value be passed on the command line is limiting and introduces some security concerns. The command should support a mechanism to specify the location (file name or URL) to read the value from.

so yeah, that's a known thing, not me hating. it says it right there in the manual. no cap 🫠

🎀 SEE ALSO 🎀

💜 AUTHOR 💜

The OpenLDAP Project <http://www.openldap.org/>

🧚 ACKNOWLEDGEMENTS 🧚

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

okay that's the whole page, you ate it, go compare some attributes 💅✨

this masterpiece of an LDAP situation is OpenLDAP 2.7.2, dated 2026/10/21, and it's literally the LDAPCOMPARE(1) moment. slay, bye 🦋🎀💖

📦 where this page comes from