Home | History | Annotate | Line # | Download | only in man1 
 LDAPVC 1 "RELEASEDATE" "OpenLDAP LDVERSION"
 $OpenLDAP$
 Copyright 1998-2024 The OpenLDAP Foundation All Rights Reserved.
 Copying restrictions apply. See COPYRIGHT/LICENSE.
 NAME
ldapvc - LDAP verify credentials tool

 SYNOPSIS
 ldapvc [\c
 -V [ V ]] [\c
 -d  debuglevel] [\c
 -a ] [\c
 -b ] [\c
 -n ] [\c
 -v ] [\c
 -x ] [\c
 -D  binddn] [\c
 -W ] [\c
 -w  passwd] [\c
 -y  passwdfile] [\c
 -H  ldapuri] [\c
 -e  [ ! ] ext [ =extparam ]] [\c
 -E  [ ! ] ext [ =extparam ]] [\c
 -o  opt [= optparam ]] [\c
 -O  security-properties] [\c
 -I ] [\c
 -Q ] [\c
 -N ] [\c
 -U  authcid] [\c
 -R  realm] [\c
 -X  authzid] [\c
 -Y  mech] [\c
 -Z [ Z ]] \c
 Distinguished Name \ \c
 [Credentials] 
 DESCRIPTION
 ldapvc implements the LDAP "Verify Credentials" extended operation.


 Verify Credentials operation behaves like LDAP Bind but has no impact upon the underlying LDAP session.

 OPTIONS

 -V [ V ] Print version info.
If -VV is given, only the version information is printed.


 -d  debuglevel Set the LDAP debugging level to debuglevel.
 ldapvc must be compiled with LDAP_DEBUG defined for this option to have any effect.


 -a Print the authzID resulting from a successful verification of credentials.


 -b Print the results from the ppolicy control after verification of credentials.


 -n Show what would be done, but don't actually perform the operation.
Useful for
debugging in conjunction with -v.


 -v Run in verbose mode, with many diagnostics written to standard output.


 -x  Use simple authentication instead of SASL.


 -D  binddn Use the Distinguished Name binddn to bind to the LDAP directory.
For SASL binds, the server is expected to ignore this value.


 -W Prompt for simple authentication.
This is used instead of specifying the password on the command line.


 -w  passwd Use passwd as the password for simple authentication.


 -y  passwdfile Use complete contents of passwdfile as the password for
simple authentication.


 -H  ldapuri Specify URI(s) referring to the ldap server(s); only the protocol/host/port
fields are allowed; a list of URI, separated by whitespace or commas
is expected.


 -e  [ ! ] ext [ =extparam ] 

 -E  [ ! ] ext [ =extparam ] 
Specify general extensions with -e and Verify Credentials extensions with -E.
\'!\' indicates criticality.

General extensions:

 [!]assert=<filter> (an RFC 4515 Filter)
 [!]bauthzid (RFC 3829 authzid control)
 [!]chaining[=<resolve>[/<cont>]]
 [!]manageDSAit
 [!]noop
 ppolicy
 [!]postread[=<attrs>] (a comma-separated attribute list)
 [!]preread[=<attrs>] (a comma-separated attribute list)
 [!]relax
 sessiontracking[=<username>]
 abandon,cancel,ignore (SIGINT sends abandon/cancel,
 or ignores response; if critical, doesn't wait for SIGINT.
 not really controls)


Verify Credentials extensions:
The following options set SASL params on the Verify Credentials request:

 authcid=<authcid> (SASL Authentication Identity "dn:<dn>" or "u:<user>")
 authzid=<authzid> (SASL Authorization Identity "dn:<dn>" or "u:<user>")
 mech=<mech> (SASL mechanism default e.g. Simple)
 realm=<realm> (SASL Realm, defaults to none)
 sasl=a[utomatic]|i[nteractive]|q[uiet] (SASL mode defaults to automatic if any other -E option provided, otherwise none)
 secprops=<secprops> (SASL Security Properties)




 -o  opt [= optparam ] 
Specify any
 ldap.conf (5) option or one of the following:

 nettimeout=<timeout> (in seconds, or "none" or "max")
 ldif_wrap=<width> (in columns, or "no" for no wrapping)



 -o option that can be passed here, check
 ldap.conf (5) for details.


 -O  security-properties Specify SASL security properties.


 -I Enable SASL Interactive mode. Always prompt. Default is to prompt
only as needed.


 -Q Enable SASL Quiet mode. Never prompt.


 -N Do not use reverse DNS to canonicalize SASL host name.


 -U  authcid Specify the authentication ID for SASL bind. The form of the ID
depends on the actual SASL mechanism used.


 -R  realm Specify the realm of authentication ID for SASL bind. The form of the realm
depends on the actual SASL mechanism used.


 -X  authzid Specify the requested authorization ID for SASL bind.
 authzid must be one of the following formats:
 dn: "<distinguished name>" or
 u: <username> 

 -Y  mech Specify the SASL mechanism to be used for authentication. If it's not
specified, the program will choose the best mechanism the server knows.


 -Z [ Z ] Issue StartTLS (Transport Layer Security) extended operation. If you use
-ZZ, the command will require the operation to be successful.

 EXAMPLE
 ldapvc -x "uid=Alice,ou=People,dc=example,dc=com"



 "SEE ALSO"
 ldap.conf (5),  ldap (3),  ldap_extended_operation (3) 
 AUTHOR
The OpenLDAP Project <http://www.openldap.org/>

 ACKNOWLEDGEMENTS
.so  ../Project