LDAPPASSWD(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 NAME 💖

ldappasswd — the one and only girlboss whose whole job is changing the password of an LDAP entry. That's it. That's the assignment. And in case you were wondering which manual she lives in, it's the General Commands Manual (hi, LDAPPASSWD(1), we stan a section 1 icon 🫶).

✨ SYNOPSIS ✨

ldappasswd [-V[V]] [-d debuglevel] [-n] [-v] [-A] [-a oldPasswd]
[-t oldpasswdfile] [-S] [-s newPasswd] [-T newpasswdfile] [-x]
[-D binddn] [-W] [-w passwd] [-y passwdfile] [-H ldapuri]
[-e [!]ext[=extparam]] [-E [!]ext[=extparam]] [-o opt[=optparam]]
[-O security-properties] [-I] [-Q] [-N] [-U authcid] [-R realm]
[-X authzid] [-Y mech] [-Z[Z]] [user]

🌸 DESCRIPTION 🌸

okay so bestie, ldappasswd is the tool that sets the password of an LDAP user. No cap. And the way she does it is chef's kiss — she uses the LDAPv3 Password Modify (RFC 3062) extended operation 🔥.

ldappasswd sets the password of associated with the user [or an optionally specified user]. Iconic phrasing, we respect it. And here's the tea: if you don't specify the new password on the command line and the user doesn't enable prompting, then the server gets asked to generate a password for the user. The server is doing the homework. Slay 💅.

🚨 okay real talk for one sec: ldappasswd is neither designed nor intended to be a replacement for passwd(1), and it should not be installed as such. Do not do the thing. Do not make her something she's not. Periodt 💀

👑 OPTIONS 👑

  • -V[V] — print version info. If you hit it with -VV, then it's only the version information, nothing else. Just vibes, just facts.
  • -d debuglevel — set the LDAP debugging level to debuglevel. ⚠️ heads up though: ldappasswd must be compiled with LDAP_DEBUG defined for this option to do literally anything. If it wasn't, this flag is giving decorative 🎀.
  • -n — do not set password. (Can be useful when used in conjunction with -v or -d.) A little spectral girl, haunting your output, touching nothing.
  • -v — increase the verbosity of output. Can be specified multiple times. Spam it, she loves to talk 💬.
  • -A — prompt for the old password. Use this instead of putting the password on the command line.
  • -a oldPasswd — set the old password to oldPasswd.
  • -t oldPasswdFile — set the old password to the contents of oldPasswdFile.
  • -S — prompt for the new password. Use this instead of putting the password on the command line.
  • -s newPasswd — set the new password to newPasswd.
  • -T newPasswdFile — set the new password to the contents of newPasswdFile.
  • -x — use simple authentication instead of SASL. Old-school, but make it fashion.
  • -D binddn — use the Distinguished Name binddn to bind to the LDAP directory. For SASL binds though, the server is expected to ignore this value. She said "thanks bestie, I'll take it from here" 🙈.
  • -W — prompt for the bind password. Use this instead of putting the password on the command line.
  • -w passwd — use passwd as the password to bind with.
  • -y passwdfile — use the complete contents of passwdfile as the password for simple authentication.
  • -H ldapuri — specify URI(s) pointing at the ldap server(s). Only the protocol/host/port fields are allowed. A list of URI, separated by whitespace or commas, is expected.
  • -e [!]ext[=extparam] — specify general extensions. (Her sister -E is right below 👇)
  • -E [!]ext[=extparam] — specify passwd modify extensions. General extensions go to -e, passwd modify extensions go to -E. A ! indicates criticality. Full menu below, babes:
General extensions:
  [!]assert=<filter>    (an RFC 4515 Filter)
  !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
  [!]bauthzid           (RFC 3829 authzid control)
  [!]chaining[=<resolve>[/<cont>]]
  [!]manageDSAit
  [!]noop
  ppolicy
  [!]postread[=<attrs>] (a comma-separated attribute list)
  [!]preread[=<attrs>]  (a comma-separated attribute list)
  [!]relax
  sessiontracking[=<username>]
  abandon,cancel,ignore (SIGINT sends abandon/cancel,
  or ignores response; if critical, doesn't wait for SIGINT.
  not really controls)

Passwd Modify extensions:
  (none)

(yes, the passwd modify extensions list is literally (none). she's lowkey empty inside. still iconic.)

  • -o opt[=optparam]] — specify any ldap.conf(5) option, or one of these two extra specials:
nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)
  • -O security-properties — specify SASL security properties. Get specific. Get safe. 💜
  • -I — enable SASL Interactive mode. Always prompt. The default is to prompt only as needed, so this is her clingy setting. She wants to talk to you every time.
  • -Q — enable SASL Quiet mode. Never prompt. The polar opposite of -I. She's giving mysterious 🦋.
  • -N — do not use reverse DNS to canonicalize the SASL host name. Skip the whole lookup arc.
  • -U authcid — specify the authentication ID for a SASL bind. The form of the ID depends on the actual SASL mechanism used. So like… read the room (and your mechanism) first.
  • -R realm — specify the realm of the authentication ID for a SASL bind. Again, the form depends on the actual SASL mechanism used. No universal format bestie, sorry 😭.
  • -X authzid — specify the requested authorization ID for a SASL bind. authzid must be one of the following formats: dn:<distinguished name> or u:<username>. Those are the only two fits she'll wear.
  • -Y mech — specify the SASL mechanism to be used for authentication. If you don't specify it, the program will choose the best mechanism the server knows. Let her pick, she has taste 🔥.
  • -Z[Z] — issue the StartTLS (Transport Layer Security) extended operation. And if you use -ZZ, the command will require the operation to be successful. -Z is "would be nice", -ZZ is "if this doesn't work we're leaving" 💅.

And last but never least: [user] — the optional user argument. If you skip it, she works on whoever you're bound as. Main character energy only.

🦋 SEE ALSO 🦋

ldap_sasl_bind(3), ldap_extended_operation(3), ldap_start_tls_s(3)

Go read those too. Iykyk. 📚

🎀 AUTHOR 🎀

The OpenLDAP Project <http://www.openldap.org/>

🌈 ACKNOWLEDGEMENTS 🌈

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. History! Lore! The ancestry! 🌸

and that's the whole page, bestie 💖 this was OpenLDAP 2.7.2, dated 2026/10/21, from the LDAPPASSWD(1) manual — now go change a password responsibly, protect your creds, and never put the password directly on the command line unless you truly have to 🫶✨

📦 where this page comes from