LDAPWHOAMI(1)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 LDAPWHOAMI(1) — the "who even am I" tool 💖

okay bestie, listen. this is a General Commands Manual page, and it's for the lil binary called ldapwhoami, which is literally just... asking an LDAP server "hey. who am I." no cap. it's giving main character energy, but the main character is you, and you have no idea who you are rn. iconic.

✨ NAME ✨

ldapwhoami — the LDAP who am i? tool 🪞

🌸 SYNOPSIS 🌸

ldapwhoami [-V[V]] [-d debuglevel] [-n] [-v] [-x] [-D binddn] [-W]
[-w passwd] [-y passwdfile] [-H ldapuri] [-e [!]ext[=extparam]]
[-E [!]ext[=extparam]] [-o opt[=optparam]] [-O security-properties] [-I]
[-Q] [-N] [-U authcid] [-R realm] [-X authzid] [-Y mech] [-Z[Z]]

🦋 DESCRIPTION 🦋

ldapwhoami implements the LDAP "Who Am I?" extended operation. and yeah, the name is literally that. it's not deep, it's not subtle, it's just the vibe check of the LDAP world. 💅

so what happens is: ldapwhoami opens a connection to an LDAP server, binds, and performs a whoami operation. that's the whole plot. no twists. periodt.

🎀 OPTIONS 🎀

okay here come the flags, and there are a lot of them, so buckle up babe 🫶

  • -V[V] — print version info. and if you hit it twice, like -VV, then only the version information gets printed. nothing else. just vibes and version numbers. ⭐
  • -d debuglevel — sets the LDAP debugging level to debuglevel. 💀 but listen: ldapwhoami must be compiled with LDAP_DEBUG defined for this option to have literally any effect at all. no compile flag, no debug. sorry bestie.
  • -n — show what would be done, but don't actually perform the whoami operation. it's the dress rehearsal 🎭. super useful for debugging when you pair it with -v.
  • -v — verbose mode. run it and you get ✨many diagnostics✨ written to standard output. girl is chatty.
  • -x — use simple authentication instead of SASL. the "no thoughts, just a password" route 🍓
  • -D binddn — use the Distinguished Name binddn to bind to the LDAP directory. and heads up 🚨: for SASL binds, the server is expected to ignore this value. so don't be shocked when it gets ghosted 👻
  • -W — prompt for simple authentication. use this instead of putting your password right there on the command line, because we do NOT do that 💅
  • -w passwd — use passwd as the password for simple authentication. (yes, on the command line. i said what i said.)
  • -y passwdfile — use the complete contents of passwdfile as the password for simple authentication. every last byte, babes.
  • -H ldapuri — specify the URI(s) pointing at the ldap server(s). only the protocol/host/port fields are allowed, ok? and it expects a list of URIs, separated by whitespace or commas. multiple servers, one flag, we love efficiency 💖
  • -e [!]ext[=extparam] — specify general extensions. ✨
  • -E [!]ext[=extparam] — specify whoami extensions. 🦋
and just so we're clear: a ! in there indicates criticality. so [!] means "you can put a ! here if you want the server to truly care."

General extensions:

[!]assert=<filter>    (an RFC 4515 Filter)
!authzid=<authzid>    ("dn:<dn>" or "u:<user>")
[!]bauthzid           (RFC 3829 authzid control)
[!]chaining[=<resolve>[/<cont>]]
[!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>] (a comma-separated attribute list)
[!]preread[=<attrs>]  (a comma-separated attribute list)
[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)

WhoAmI extensions:

(none)

😭 the whoami extensions list is literally (none). she has no extras. she's a minimalist.

  • -o opt[=optparam] — specify any ldap.conf(5) option, or one of these two cuties:
nettimeout=<timeout>  (in seconds, or "none" or "max")
ldif_wrap=<width>     (in columns, or "no" for no wrapping)

and for any other -o option you can pass here, check ldap.conf(5) for the details. iykyk 📖

  • -O security-properties — specify SASL security properties. 🔐
  • -I — enable SASL Interactive mode. it always prompts. like, always always. the default behavior is to prompt only as needed, so this flag is the "i would like to be asked, thank you" setting 🙋‍♀️
  • -Q — enable SASL Quiet mode. never prompt. not once. 🤫
  • -N — do not use reverse DNS to canonicalize the SASL host name. skip the lookup, save the drama 🧚
  • -U authcid — specify the authentication ID for SASL bind. the form of the ID depends on the actual SASL mechanism being used, so no universal answer, bestie 🌈
  • -R realm — specify the realm of the authentication ID for SASL bind. same deal: the form of the realm depends on the actual SASL mechanism used. 👑
  • -X authzid — specify the requested authorization ID for SASL bind. and authzid has to be one of these two formats exactly: dn:<distinguished name> or u:<username>. those are the only options, no freelancing 🚫
  • -Y mech — specify the SASL mechanism to be used for authentication. if you don't specify it, the program will choose the best mechanism the server knows. she'll pick for you, don't worry 💜
  • -Z[Z] — issue the StartTLS (Transport Layer Security) extended operation. and if you use -ZZ, the command will require the operation to be successful. so -Z is "let's try 🥺" and -ZZ is "this is non-negotiable 🔥"

🌈 EXAMPLE 🌈

go off, queen:

ldapwhoami -x -D "cn=Manager,dc=example,dc=com" -W

👀 SEE ALSO 👀

ldap.conf(5), ldap(3), ldap_extended_operation(3)

💜 AUTHOR 💜

The OpenLDAP Project <http://www.openldap.org/>

🌟 ACKNOWLEDGEMENTS 🌟

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. and for the lore nerds 🤓: OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. slay, Michigan.

okay that's the whole page, you're fully caught up, no notes 💅 this was OpenLDAP 2.7.2, dated 2026/10/21, and this manual page is LDAPWHOAMI(1). byeeee, go ask a server who you are 🦋✨

📦 where this page comes from