Reference

Using ldapcompare

Tags: cli, ldapcompare, utility

Date: 11-04-2022

The ldapcompare command-line tool lets you test whether a specific attribute in an LDAP entry matches a given value.
It’s ideal for verifying user attributes, group memberships, or password hashes without modifying data.

The result code of the compare is provided as the exit code and, unless run with -z, the program prints TRUE, FALSE, or UNDEFINED on standard output.

Basic Syntax

ldapcompare [options] DN attribute:value

Or from a file of comparisons:

ldapcompare [options] -f comparisons.txt

Common Options

Option	Description
`-x`	Use simple bind instead of SASL
`-H ldap://host`	LDAP URI
`-D "cn=admin,dc=example,dc=com"`	Bind DN
`-W`	Prompt for password
`-w password`	Supply password directly (not recommended)
`-ZZ`	Use StartTLS
`-v`	Verbose output
`-f file`	Read DN/attribute:value pairs from file

Example Commands

Compare a user’s attribute

ldapcompare -x -H ldap://localhost \
 -D "cn=admin,dc=example,dc=com" -W \
 "uid=jdoe,ou=People,dc=example,dc=com" mail:jdoe@example.com

Compare multiple attributes from file

File: compare-list.txt

uid=jdoe,ou=People,dc=example,dc=com mail:jdoe@example.com
uid=jdoe,ou=People,dc=example,dc=com sn:Doe
uid=jdoe,ou=People,dc=example,dc=com departmentNumber:IT

Command:

ldapcompare -x -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f compare-list.txt

Troubleshooting

Error	Meaning	Fix
`ldap_compare: No such object (32)`	DN doesn’t exist	Check the full DN
`ldap_compare: Insufficient access (50)`	ACL denies read/compare	Update ACLs or bind as rootDN
`ldap_compare: Invalid syntax (21)`	Attribute value doesn’t match schema	Use correct syntax
`ldap_compare: Constraint violation (19)`	Value fails schema or operational constraint	Check attribute definition
`ldap_compare: Server is unwilling to perform (53)`	Operation blocked (referral, policy)	Check logs for more information

ldapcompare Man Page

LDAP Result Codes RFC