Chapter 10. Searching IdM entries using the ldapsearch command

You can use the ipa find command to search through the Identity Management entries. For more information about ipa command see Structure of IPA commands section.

This section introduces the basics of an alternative search option using ldapsearch command line command through the Identity Management entries.

10.1. Using the ldapsearch command

The ldapsearch command has the following format:

# ldapsearch [-x | -Y mechanism] [options] [search_filter] [list_of_attributes]
  • To configure the authentication method, specify the -x option to use simple binds or the -Y option to set the Simple Authentication and Security Layer (SASL) mechanism. Note that you need to obtain a Kerberos ticket if you are using the -Y GSSAPI option.
  • The options are the ldapsearch command options described in a table below.
  • The search_filter is an LDAP search filter.
  • The list_of_attributes is a list of the attributes that the search results return.

For example, you want to search all the entries of a base LDAP tree for the user name user01:

# ldapsearch -x -H ldap:// -s sub "(uid=user01)"
  • The -x option tells the ldapsearch command to authenticate with the simple bind. Note that if you do not provide the Distinguish Name (DN) with the -D option, the authentication is anonymous.
  • The -H option connects you to the ldap://
  • The -s sub option tells the ldapsearch command to search all the entries, starting from the base DN, for the user with the name user01. The "(uid=user01)" is a filter.

Note that if you do not provide the starting point for the search with the -b option, the command searches in the default tree. It is specified in the BASE parameter of the etc/openldap/ldap.conf file.

Table 10.1. The ldapsearch command options



The starting point for the search. If your search parameters contain an asterisk (*) or other character, that the command line can interpret into a code, you must wrap the value in single or double quotation marks. For example, -b cn=user,ou=Product Development,dc=example,dc=com.


The Distinguished Name (DN) with which you want to authenticate.


An LDAP URL to connect to the server. The -H option replaces the -h and -p options.


The time limit in seconds to wait for a search request to complete.

-s scope

The scope of the search. You can choose one of the following for the scope:

  • base searches only the entry from the -b option or defined by the LDAP_BASEDN environment variable.
  • one searches only the children of the entry from the -b option.
  • sub a subtree search from the -b option starting point.


Requests for the password.


Disables the default SASL connection to allow simple binds.

-Y SASL_mechanism

Sets the SASL mechanism for the authentication.

-z number

The maximum number of entries in the search result.

Note, you must specify one of the authentication mechanisms with the -x or -Y option with the ldapsearch command.

Additional resources

  • For details on how to use ldapsearch, see ldapsearch(1) man page.

10.2. Using the ldapsearch filters

The ldapsearch filters allow you to narrow down the search results.

For example, you want the search result to contain all the entries with a common names set to example:


In this case, the equal sign (=) is the operator, and example is the value.

Table 10.2. The ldapsearch filter operators

Search typeOperatorDescription



Returns the entries with the exact match to the value. For example, cn=example.


=string* string

Returns all entries with the substring match. For example, cn=exa*l. The asterisk (*) indicates zero (0) or more characters.

Greater than or equal to


Returns all entries with attributes that are greater than or equal to the value. For example, uidNumber >= 5000.

Less than or equal to


Returns all entries with attributes that are less than or equal to the value. For example, uidNumber <= 5000.



Returns all entries with one or more attributes. For example, cn=*.



Returns all entries with the similar to the value attributes. For example, l~=san fransico can return l=san francisco.

You can use boolean operators to combine multiple filters to the ldapsearch command.

Table 10.3. The ldapsearch filter boolean operators

Search typeOperatorDescription



Returns all entries where all statements in the filters are true. For example, (&(filter)(filter)(filter)…​).



Returns all entries where at least one statement in the filters is true. For example, (|(filter)(filter)(filter)…​).



Returns all entries where the statement in the filter is not true. For example, (!(filter)).