LDAPVC(1)

📦
version 2.7.2 · 11 versions
, in arch rolling

💅 ldapvc — the LDAP verify credentials tool

okay so bestie, listen. this is the manual page for ldapvc(1), a General Commands Manual situation, and it's literally the tool that goes "hey, are these creds valid???" without, like, committing to anything. no cap. let's get into it. 🦋

✨ NAME ✨

ldapvc — LDAP verify credentials tool. that's it, that's the whole name. iconic.

✨ SYNOPSIS ✨

ldapvc [-V[V]] [-d debuglevel] [-a] [-b] [-n] [-v] [-x] [-D binddn] [-W]
[-w passwd] [-y passwdfile] [-H ldapuri] [-e [!]ext[=extparam]]
[-E [!]ext[=extparam]] [-o opt[=optparam]] [-O security-properties] [-I]
[-Q] [-N] [-U authcid] [-R realm] [-X authzid] [-Y mech] [-Z[Z]]
Distinguished Name [Credentials]

look at all those little flags. it's giving ✨ customizable ✨. give it a Distinguished Name, optionally hand it some Credentials, and it'll vibe check the whole thing for you. 💖

✨ DESCRIPTION ✨

so ldapvc implements the LDAP "Verify Credentials" extended operation. that's the whole personality.

here's the tea: a Verify Credentials operation acts like an LDAP Bind BUT — and this is the important part bestie — it has no impact upon the underlying LDAP session. it checks the creds, says yes or no, and then leaves the session exactly how it found it. it's a respectful little icon like that. 👑

✨ OPTIONS ✨

  • -V[V] — print version info. and if you go full -VV? then it prints only the version information, nothing else. minimal queen energy. 💅
  • -d debuglevel — set the LDAP debugging level to debuglevel. heads up tho: ldapvc has to have been compiled with LDAP_DEBUG defined for this option to do literally anything. no LDAP_DEBUG, no notes. 😭
  • -a — print the authzID that results from a successful verification of credentials. slay, now you know who you are. 🪪
  • -b — print the results from the ppolicy control after verification of credentials.
  • -n — show what would be done, but don't actually perform the operation. it's the dress rehearsal 🎭. super useful for debugging when you pair it with -v.
  • -v — run in verbose mode, with lots of diagnostics written to standard output. it will not stop talking. it's me. 💬
  • -x — use simple authentication instead of SASL.
  • -D binddn — use the Distinguished Name binddn to bind to the LDAP directory. for SASL binds, the server is expected to just ignore this value (rude, but noted).
  • -W — prompt for simple authentication. use this instead of putting the password right there on the command line.
  • -w passwd — use passwd as the password for simple authentication.
  • -y passwdfile — use the complete contents of passwdfile as the password for simple authentication.
  • -H ldapuri — specify URI(s) pointing at the ldap server(s). only the protocol/host/port fields are allowed, and it expects a list of URIs separated by whitespace or commas.
  • -e [!]ext[=extparam]
  • -E [!]ext[=extparam]

specify general extensions with -e, and Verify Credentials extensions with -E. the ! indicates criticality — put it in there and you mean business. ⚠️

General extensions:

[!]assert=<filter>    (an RFC 4515 Filter)
[!]bauthzid           (RFC 3829 authzid control)
[!]chaining[=<resolve>[/<cont>]]
[!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>] (a comma-separated attribute list)
[!]preread[=<attrs>]  (a comma-separated attribute list)
[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)

Verify Credentials extensions:

the following options set SASL params on the Verify Credentials request:

authcid=<authcid>    (SASL Authentication Identity "dn:<dn>" or "u:<user>")
authzid=<authzid>    (SASL Authorization Identity "dn:<dn>" or "u:<user>")
mech=<mech>          (SASL mechanism default e.g. Simple)
realm=<realm>        (SASL Realm, defaults to none)
sasl=a[utomatic]|i[nteractive]|q[uiet]  (SASL mode defaults to automatic if any other -E option provided, otherwise none)
secprops=<secprops>  (SASL Security Properties)
  • -o opt[=optparam] — specify any ldap.conf(5) option, or one of these cuties:
nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)

for whatever -o option you can pass here, go check ldap.conf(5) for the deets. 📖

  • -O security-properties — specify SASL security properties.
  • -I — enable SASL Interactive mode. always prompt. default is to only prompt as needed.
  • -Q — enable SASL Quiet mode. never prompt. shhh. 🤫
  • -N — don't use reverse DNS to canonicalize the SASL host name.
  • -U authcid — specify the authentication ID for the SASL bind. the form of the ID depends on the actual SASL mechanism being used (iykyk).
  • -R realm — specify the realm of the authentication ID for the SASL bind. again, form depends on the actual SASL mechanism in play.
  • -X authzid — specify the requested authorization ID for the SASL bind. authzid must be one of these two formats: dn:<distinguished name> or u:<username>. no other shapes accepted bestie. 🚫
  • -Y mech — specify the SASL mechanism to use for authentication. if you don't say, the program picks the best mechanism the server knows. it's got taste. ✨
  • -Z[Z] — issue a StartTLS (Transport Layer Security) extended operation. and if you use -ZZ? then the command requires the operation to be successful. no TLS, no service. 🔒

✨ EXAMPLE ✨

ldapvc -x "uid=Alice,ou=People,dc=example,dc=com"

look at her. simple auth, one DN, done. ate. 💖

✨ SEE ALSO ✨

ldap.conf(5), ldap(3), ldap_extended_operation(3)

✨ AUTHOR ✨

The OpenLDAP Project <http://www.openldap.org/> 🫶

✨ ACKNOWLEDGEMENTS ✨

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

and that's the whole page bestie, every last detail intact 💜 — this was OpenLDAP 2.7.2, dated 2026/10/21. go verify some credentials responsibly, mwah 🎀✨

📦 where this page comes from