LDAPVC - Online Linux Manual PageSection : 1 Updated : RELEASEDATE Source : OpenLDAP LDVERSION NAMEldapvc − LDAP verify credentials tool SYNOPSISldapvc [−V[V]][−d debuglevel][−a][−b][−n][−v][−x][−D binddn][−W][−w passwd][−y passwdfile][−H ldapuri][−e[!]ext[=extparam]][−E[!]ext[=extparam]][−o opt[=optparam]][−O security-properties][−I][−Q][−N][−U authcid][−R realm][−X authzid][−Y mech][−Z[Z]]Distinguished Name [Credentials]DESCRIPTIONldapvc implements the LDAP "Verify Credentials" extended operation. Verify Credentials operation behaves like LDAP Bind but has no impact upon the underlying LDAP session. OPTIONS−V[V]Print version info. If −VV is given, only the version information is printed. −d debuglevelSet the LDAP debugging level to debuglevel. ldapvc must be compiled with LDAP_DEBUG defined for this option to have any effect. −a Print the authzID resulting from a successful verification of credentials. −b Print the results from the ppolicy control after verification of credentials. −n Show what would be done, but don't actually perform the operation. Useful for debugging in conjunction with −v. −v Run in verbose mode, with many diagnostics written to standard output. −x Use simple authentication instead of SASL. −D binddnUse the Distinguished Name binddn to bind to the LDAP directory. For SASL binds, the server is expected to ignore this value. −W Prompt for simple authentication. This is used instead of specifying the password on the command line. −w passwdUse passwd as the password for simple authentication. −y passwdfileUse complete contents of passwdfile as the password for simple authentication. −H ldapuriSpecify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas is expected. −e[!]ext[=extparam]−E[!]ext[=extparam]Specify general extensions with −e and Verify Credentials extensions with −E. ´!´ indicates criticality. General extensions: [!]assert=<filter>(an RFC 4515 Filter)[!]bauthzid (RFC 3829 authzid control)[!]chaining[=<resolve>[/<cont>]][!]manageDSAit
[!]noop
ppolicy
[!]postread[=<attrs>](a comma-separated attribute list)[!]preread[=<attrs>](a comma-separated attribute list)[!]relax
sessiontracking[=<username>]
abandon,cancel,ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)Verify Credentials extensions: The following options set SASL params on the Verify Credentials request: authcid=<authcid>(SASL Authentication Identity "dn:<dn>" or "u:<user>")
authzid=<authzid>(SASL Authorization Identity "dn:<dn>" or "u:<user>")
mech=<mech>(SASL mechanism default e.g. Simple)
realm=<realm>(SASL Realm, defaults to none)
sasl=a[utomatic]|i[nteractive]|q[uiet](SASL mode defaults to automatic if any other -E option provided, otherwise none)
secprops=<secprops>(SASL Security Properties)−o opt[=optparam]Specify any ldap.conf(5) option or one of the following: nettimeout=<timeout>(in seconds, or "none" or "max")
ldif_wrap=<width>(in columns, or "no" for no wrapping)-o option that can be passed here, check ldap.conf(5) for details. −O security-propertiesSpecify SASL security properties. −I Enable SASL Interactive mode. Always prompt. Default is to prompt only as needed. −Q Enable SASL Quiet mode. Never prompt. −N Do not use reverse DNS to canonicalize SASL host name. −U authcidSpecify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used. −R realmSpecify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used. −X authzidSpecify the requested authorization ID for SASL bind. authzid must be one of the following formats: dn:<distinguished name> or u:<username>−Y mechSpecify the SASL mechanism to be used for authentication. If it's not specified, the program will choose the best mechanism the server knows. −Z[Z]Issue StartTLS (Transport Layer Security) extended operation. If you use −ZZ, the command will require the operation to be successful. EXAMPLE ldapvc −x "uid=Alice,ou=People,dc=example,dc=com"SEE ALSOldap.conf(5),ldap(3),ldap_extended_operation(3)AUTHORThe OpenLDAP Project <http://www.openldap.org/>ACKNOWLEDGEMENTS