LDAPEXOP(1)

👑 LDAPEXOP — issue LDAP extended operations 💅

okay bestie, so this is ldapexop from the General Commands Manual, section 1 — it lives in your shell, not your C code, and it is the moment for sending extended operations at an LDAP server. no cap. 🦋

---

✨ SYNOPSIS ✨

ldapexop [-V[V]] [-d debuglevel] [-n] [-v] [-f file] [-x] [-D binddn]
[-W] [-w passwd] [-y passwdfile] [-H URI] [-e [!]ext[=extparam]]
[-o opt[=optparam]] [-O security-properties] [-I] [-Q] [-N] [-U authcid]
[-R realm] [-X authzid] [-Y mech] [-Z[Z]] {oid | oid:data | oid::b64data
| whoami | cancel cancel-id | refresh DN [ttl]}

like, look at her. so many flags. she contains multitudes. 🌈

---

🌸 DESCRIPTION 🌸

ldapexop issues the LDAP extended operation specified by oid, or by one of the special keywords whoami, cancel, or refresh. she's basically the extended-operations girlie and she knows it. 🔥

Extra data for the extended operation can be handed to the server with data, or base-64 encoded as b64data in the case of oid, or via the additional parameters in the case of those specially named extended operations up there. ✨

⚠️ bestie listen — ldapexop behaves differently for the same extended operation depending on whether you gave it as an OID or as a specially named operation. this is not a drill. 💀

sooo, calling ldapexop with the OID of the whoami (RFC 4532) extended operation:

ldapexop [<options>] 1.3.6.1.4.1.4203.1.11.3

yields

# extended operation response
data:: <base64 encoded response data>

while calling it with the keyword whoami:

ldapexop [<options>] whoami

results in

dn:<client's identity>

same operation, two whole different energies. it's giving ✨main character✨ vs ✨cryptic bestie✨. 🙈

---

🎀 OPTIONS 🎀

okay so here's every single one, no skips, we don't gatekeep. 💖

• -V[V] — print version info. if you give -VV, only the version information gets printed. (double the V, double the drama. ✌️)
• -d debuglevel — set the LDAP debugging level to debuglevel. turn it up and watch her spill everything. 🔍
• -n — show what would be done but don't actually do it. lowkey iconic for debugging when you pair it with -v. ✨
• -v — run in verbose mode, with so many diagnostics written to standard output. she will not stop talking and honestly? we love that. 💬
• -f file — read operations from file.
• -x — use simple authentication instead of SASL.
• -D binddn — use the Distinguished Name binddn to bind to the LDAP directory.
• -W — prompt for simple authentication. this is used instead of putting the password right there on the command line. (security bestie behaviour. 🫶)
• -w passwd — use passwd as the password for simple authentication.
• -y passwdfile — use the complete contents of passwdfile as the password for simple authentication.
• -H URI — specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas, is expected.
• -e [!]ext[=extparam] — specify general extensions. ! indicates criticality. here's the whole menu:

[!]assert=<filter>    (an RFC 4515 Filter)
!authzid=<authzid>    ("dn:<dn>" or "u:<user>")
[!]bauthzid           (RFC 3829 authzid control)
[!]chaining[=<resolve>[/<cont>]]
[!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>] (a comma-separated attribute list)
[!]preread[=<attrs>]  (a comma-separated attribute list)
[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)

• -o opt[=optparam] — specify any ldap.conf(5) option, or one of these cuties:

nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)

• -O security-properties — specify SASL security properties. 🔐
• -I — enable SASL Interactive mode. always prompt. the default is to prompt only as needed. she's a little extra, respect it. 💅
• -Q — enable SASL Quiet mode. never prompt. the strong silent type. 🤫
• -N — do not use reverse DNS to canonicalize the SASL host name.
• -U authcid — specify the authentication ID for SASL bind. the form of the ID depends on the actual SASL mechanism used.
• -R realm — specify the realm of authentication ID for SASL bind. the form of the realm depends on the actual SASL mechanism used.
• -X authzid — specify the requested authorization ID for SASL bind. authzid must be one of these formats: dn:<distinguished name> or u:<username>.
• -Y mech — specify the SASL mechanism to be used for authentication. without this option, the program will choose the best mechanism the server knows. she picks for you, trust her taste. 👑
• -Z[Z] — issue StartTLS (Transport Layer Security) extended operation. giving it twice (-ZZ) will require the operation to be successful. no takebacks, no maybe. 🚨

---

🩺 DIAGNOSTICS 🩺

Exit status is zero if no errors occur. Errors result in a non-zero exit status and a diagnostic message being written to standard error. so if she's mad, she'll tell you, and she'll say it on stderr. 😭

---

👀 SEE ALSO 👀

• ldap_extended_operation_s(3)

go read that one too, iykyk. 📚

---

💜 AUTHOR 💜

This manual page was written by Peter Marschall based on ldapexop's usage message and a few tests with ldapexop. Do not expect it to be complete or absolutely correct. (he said it, not me — honesty is so attractive. 🫶)

---

🌟 ACKNOWLEDGEMENTS 🌟

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

---

and that's the whole page bestie — signed, sealed, delivered from the General Commands Manual, section 1, no version number and no date on this one, just pure LDAPEXOP(1) energy. slay, periodt. 💖✨🎀🦋