LEMONLD...SESSIONS(1)

💖 NAME 💖

lemonldap-ng-sessions — it's the scripting CLI for LemonLDAP::NG sessions, and bestie it eats 💅

---

✨ SYNOPSIS ✨

lemonldap-ng-sessions [<options>] <command> [<arguments> ...]

---

🌸 DESCRIPTION 🌸

okay so listen, here's the whole roster of commands you can throw at this thing:

• get — grab one or several sessions from IDs you already know
• search — go hunt for sessions
• count — literally just an alias for search --count
• delete — yeet existing sessions into the void
• setKey — add or change a key inside a session that already exists
• delKey — delete a key from an existing session
• secondfactors — manage second factors
• consents — manage OIDC user consents
• backup — dump ALL the sessions
• restore — put sessions back from a dump file
• history — manage login history

and here are the options, the little knobs and dials:

• --help — show the full help
• --select — pick which fields get printed
• --backend — specify which session backend to use
• --persistent — search in persistent sessions
• --refresh-tokens — search into refresh_tokens only
• --where — set the search filter (search/delete only)
• --id-only — only return IDs (search only)
• --user — change the user running the script
• --group — change the group running the script
• --hash — when "hashed session storage" is in use, this says that the session ID you handed over is the original value (the cookie value)
• --count (only with search) — display the number of matching sessions instead of their content
• --out — write the result into the given file

---

🎀 COMMANDS 🎀

get

lemonldap-ng-sessions get <id> [<id> ...]

this one lets you read what's actually inside a session 🫶

you have to pass one or several session IDs as parameters, no skipping.

Examples

lemonldap-ng-sessions get 9684dd2a6489bf2be2fbdd799a8028e3

lemonldap-ng-sessions get --persistent dwho

---

search

lemonldap-ng-sessions search [<options>]

this command lets you search for sessions ✨

it's your little scout — use it to find the session IDs that all the other commands are gonna need.

you can narrow the search down with options. see OPTIONS.

Examples

lemonldap-ng-sessions search

lemonldap-ng-sessions search --backend persistent

lemonldap-ng-sessions search --where uid=dwho

lemonldap-ng-sessions search --where uid=dwho \
        --id-only

lemonldap-ng-sessions search --backend persistent \
        --where _session_uid=dwho

lemonldap-ng-sessions search --where uid=dwho \
        --select authenticationLevel

lemonldap-ng-sessions search --where '_startTime>20240410063538'
lemonldap-ng-sessions search --where '_startTime<20240410063538'

and if you just want the number of results, no drama, no content:

lemonldap-ng-sessions search --count

---

delete

lemonldap-ng-sessions delete <id> [<id> ...]
lemonldap-ng-sessions delete --where <filter>

this command lets you delete sessions. it's giving cleanup era 🧹

you can hand it one or several session IDs to remove.

Examples:

lemonldap-ng-sessions delete 9684dd2a6489bf2be2fbdd799a8028e3

lemonldap-ng-sessions delete --persistent dwho

or you can give it a search expression instead.

Examples:

lemonldap-ng-sessions delete --where uid=dwho

lemonldap-ng-sessions delete --persistent --where _session_uid=dwho

---

setKey

lemonldap-ng-sessions setKey <id> <key> <value> [<key> <value> ...]

this command lets you modify one or several keys inside an existing session 🎀

Examples:

lemonldap-ng-sessions setKey 9684dd2a6489bf2be2fbdd799a8028e3 \
        authenticationLevel 1

---

delKey

lemonldap-ng-sessions delKey <id> <key> [<key> ...]

this command lets you remove a key from an existing session 💅

you must specify a session ID, and one or several session keys to remove.

Examples:

lemonldap-ng-sessions delKey --persistent dwho _oidcConsents

---

secondfactors

lemonldap-ng-sessions secondfactors <command> <user> [<id> ... ]

Commands:

• get <user> — show all second factors for a user
• delete <user> <id> [<id> ...] — delete second factors for a user. the ID has to match one of the IDs returned by the show command.
• delType [<user>|--all] <type> [<type> ...] — delete all second factors of a given type for a user
• migrateu2f [<user>|--all] — migrate U2F device registrations over to WebAuthn device registrations

---

consents

lemonldap-ng-sessions consents <command> <user> [<id> ... ]

Commands:

• get <user> — show all OIDC consents for a user
• delete <user> <id> [<id> ...] — delete OIDC consents for a user

---

backup

lemonldap-ng-sessions backup > file
# or
lemonldap-ng-sessions backup --out file
# or limited to persistent sessions
lemonldap-ng-sessions backup --persistent --out file
# or limited to OIDC refresh_tokens
lemonldap-ng-sessions backup --refresh-tokens --out file

a simple little command that dumps all sessions — or only persistent ones, or only refresh_tokens 🌈

---

restore

lemonldap-ng-sessions restore < file
# or
lemonldap-ng-sessions restore file

the command that brings sessions back to life using a file generated by the backup command 🦋

---

history

lemonldap-ng-sessions history <command> <user>

Commands:

• lastsuccessdate <user> — display the last successful login time for a user
• lastfailuredate <user> — display the last failed login time for a user, along with the error message if it's available
• get <user> — display the full login history for a user in JSON format, including both successful and failed logins with timestamps and IP addresses

every single history command requires the History plugin to be enabled. no plugin, no history, that's the rule 😭

Examples:

lemonldap-ng-sessions history lastsuccessdate dwho
lemonldap-ng-sessions history lastfailuredate dwho
lemonldap-ng-sessions history get dwho

Output example for lastsuccessdate:

Thu Mar 12 10:30:45 2026

Output example for lastfailuredate:

Thu Mar 12 09:15:22 2026 (5)

---

👑 OPTIONS 👑

--select,-s

lets you pick which fields show up in the JSON result 💅

this option can be set multiple times, stack it up.

--where,-w

this option lets you filter your session search according to a filter.

for now, only one filter can be set. one. that's it. periodt.

Examples:

--search uid=dwho
--search _sessionType=OIDC
--search '_startTime>20240410063538'
--search '_startTime<20240410063538'

--backend,-b

this option lets you specify which session backend to use.

you only need it when you've configured multiple session backends in your LemonLDAP::NG installation (for Persistent, SAML, CAS or OIDC sessions).

Examples:

--backend persistent
--backend saml
--backend oidc
--backend cas

--persistent,-p

this option is a shortcut for specifying --backend persistent and using the UID hash as a session ID ✨

Example:

lemonldap-ng-sessions --backend persistent \
        get 5efe8af397fc3577e05b483aca964f1b

is the same as

lemonldap-ng-sessions get --persistent dwho

--id-only,-i

this option swaps the standard JSON output format for a simpler one: one session ID per line.

which means you get some very fun combos with xargs 🔥 for example, if you wanna remove every session started by dwho:

lemonldap-ng-sessions search --where uid=dwho --id-only | \
        xargs lemonldap-ng-sessions delete

--user,-u

this option forces the system user that runs the script.

--group,-g

this option forces the system group that runs the script.

--hash, -c

when the session storage is protected by hashed session storage https://lemonldap-ng.org/documentation/latest/security.html#configure-security-settings, this option indicates that the given session is the original value (cookie value) 🔐

---

🌟 SEE ALSO 🌟

http://lemonldap-ng.org/

---

🫶 AUTHORS 🫶

Maxime Besson, <maxime.besson@worteks.com>

---

💀 BUG REPORT 💀

use the OW2 system to report a bug or ask for features:

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues

---

💜 COPYRIGHT AND LICENSE 💜

Copyright (C) 2016 by Xavier Guimard, <x.guimard@free.fr>

Copyright (C) 2016 by Clément Oudot, <clem.oudot@gmail.com>

this library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. slay, but like, legally.

this program is distributed in the hope that it'll be useful, but WITHOUT ANY WARRANTY — not even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 😭 see the GNU General Public License for more details.

you should have received a copy of the GNU General Public License along with this program. if not, see http://www.gnu.org/licenses/.

---

and that's the whole page bestie, no cap — this one was perl v5.42.3, dated 2026-09-24, and yes it's giving documentation that actually understood the assignment 👑💖