Starting the server

Quickly start the server for debugging purpose, all SSL connections and all loopback connections are accepted. Debugging information is printed on the standard output:

Manually starting server in debug mode
slapd -h 'ldaps:/// ldap://127.0.0.1/' -d 768

Branch initialization

The slapadd command allow to directly modify data (without connecting to the server), in this case the LDAP server must not be running.

Using the -w option is necessary if replication is in use, this option manage the contextCSN, without it there is a risk of desynchronisation with replicats from other sites.

Initialising branch
slapadd -v -w -b dc=example,dc=com -l data.ldif

Changing password

The password can be changed (through the extended operation):

Changing password
ldappasswd -x -W -S -D uid=jdoe,ou=People,dc=exemple,dc=com \
           uid=jdoe,ou=People,dc=example,dc=com

Root DSE

The root DSE is not part of a namespace, its purpose is to provide information about the directory:

Retrieve directory information
ldapsearch -x -s base -b "" +

Looking up for a user

Lookup user
ldapsearch -x uid=jdoe

Listing all the users sorted by name

List users sorted by name
ldapsearch -x -LLL -S sn '(objectClass=inetOrgPerson)' cn sn

Deleting an attribut

The pwdAccountLockedTime attribut is deleted from the entry, this example is usefull when using the overlay managing the password policy (ppolicy):

Remove the account locked attribut
ldapmodify -x -D uid=root,ou=Admins,dc=example,dc=com -W
dn: uid=jdoe,ou=People,dc=example,dc=com
changetype: modify
delete: pwdAccountLockedTime
-

Checking the LDAP directory

Display the entries (according to the ACL) for the default branch:

Display the whole branch
ldapsearch -x -H "ldap://127.0.0.1"
ldapsearch -x -H "ldaps://ldap.example.com"

An example using the curl command:

Using curl to query ldap
curl -s  'ldap://127.0.0.1/dc=example,dc=com??sub

Checking synchronization transfer

This commande allow to check that all data are corretly retrieved and that the access rules on the server side don’t hide necessary information (for example the userPassword) attribute:

Checking synchronization transfer
ldapsearch -x -b LDAP branch -H LDAP server  \
              -D LDAP sync user      \
              -W

Date of last synchronization

The contextCSN attribut is available when using the syncprov overlay, its format is as follow GT#COUNT#SID#MOD where GT (generalized time) is defined as YYYYmmddHHMMSS.uuuuuuZ:

Date of last synchronization
ldapsearch -x -s base contextCSN