SLAPAUTH(8C)

📦
version 2.7.2 · 25 versions
, in arch rolling

💖 SLAPAUTH(8C) — the slapauth manual page, bestie edition 💖

okay so this is slapauth, and it lives in section 8C of the manual (that's the admin/commands section, iykyk). It's the little tool that checks a list of string-represented IDs for LDAP authc/authz. It's giving "identity bouncer" energy and honestly? iconic.

✨ NAME ✨

slapauth — check a list of string-represented IDs for LDAP authc/authz 🫶

🌸 SYNOPSIS 🌸

/usr/bin/slapauth [-d debug-level] [-f slapd.conf] [-F confdir]
[-M mech] [-o option[=value]] [-R realm] [-U authcID] [-v] [-X authzID]
ID [...]

💅 DESCRIPTION 💅

So slapauth is the vibe-check tool for slapd's identity mapping. Like, it checks how the behavior of slapd maps identities for authentication and authorization purposes — exactly as specified in slapd.conf(5).

Here's the tea: it opens the slapd.conf(5) configuration file or the slapd-config(5) backend, reads in the authz-policy/olcAuthzPolicy and authz-regexp/olcAuthzRegexp directives, and then it parses the ID list you handed it on the command line. That's it. That's the whole job. Lowkey elegant. 💜

🎀 OPTIONS 🎀

  • -d debug-level — turn on debugging messages, as defined by the specified debug-level; peep slapd(8) for the deets. 🔍
  • -f slapd.conf — point it at an alternative slapd.conf(5) file, if you're feeling spicy.
  • -F confdir — specify a config directory. And listen, this one has layers: if you pass both -f and -F, the config file gets read, converted into config-directory format, and written straight into the directory you specified. If you pass neither option, it'll first attempt to read the default config directory before it even tries the default config file. And if a valid config directory exists? The default config file gets ignored. Periodt. 💅
  • -M mech — specify a mechanism.
  • -o option[=value] — specify an option with a(n optional) value. The possible generic options/values are:
syslog=<subsystems>  (see `-s' in slapd(8))
syslog-level=<level> (see `-S' in slapd(8))
syslog-user=<user>   (see `-l' in slapd(8))
  • -R realm — specify a realm.
  • -U authcID — specify an ID to be used as authcID throughout the whole test session. Heads up bestie: if it's present, and if no authzID is given, then the IDs in the ID list get treated as authzID.
  • -X authzID — specify an ID to be used as authzID throughout the test session. If it's present, and if no authcID is given, the IDs in the ID list get treated as authcID. And if both authcID and authzID are given via command line switch? The ID list cannot be present. no cap. 🙈
  • -v — enable verbose mode. she's chatty and we love that for her ✨

🌈 EXAMPLES 🌈

okay so this command:

/usr/bin/slapauth -f //etc/openldap/slapd.conf -v \
       -U bjorn -X u:bjensen

tests whether the user bjorn can assume the identity of the user bjensen — provided the directives

authz-policy from
authz-regexp "^uid=([^,]+).*,cn=auth$"
     "ldap:///dc=example,dc=net??sub?uid=$1"

are defined in slapd.conf(5). chef's kiss, main character behavior 👑

🦋 SEE ALSO 🦋

👑 ACKNOWLEDGEMENTS 👑

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

and that's the whole page fr fr 🫶 this was OpenLDAP 2.7.2, dated 2026/10/21, section SLAPAUTH(8C) — stan a reliable little utility, periodt 💖✨🎀

📦 where this page comes from