Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How am I supposed to pass a password to ldapsearch using the -y <password file> option?
If I write the password in the password file in plain text, I get this error:

ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1772

The same happens if I use the -w <password> option.

The command I'm running is

ldapsearch -x -D <my dn> -y .pass.txt -h server.x.x -b "dc=x,dc=y" "cn=*"

Where the file .pass.txt contains my password, in plain text. Both the DN and the password are correct. If I run the command with the -W option and type the password on the prompt the command runs successfully, but I would like to store the password somehow to make a script.

share|improve this question
up vote 4 down vote accepted

Keep in mind that ldapsearch will use the entire contents of the file for the password--which means it WILL include a terminating newline character if one exists. To verify if this is in fact your problem, try creating a file without one:

echo -n ThisIsaBadPassword > .pass.txt

(UPDATE: Included '-n')

share|improve this answer
I just tried that, but I get exactly the same error... – Paolo Tedesco May 11 '10 at 16:49
No, it won't. You need echo -n or printf in order to avoid the newline. – grawity May 11 '10 at 19:23
The echo -n did the trick! Thank you all for your help. – Paolo Tedesco May 12 '10 at 7:14
In followup to grawity's comment, echo -n works perfectly, e.g.: echo -n "secretpassword" > /etc/ldapscripts/ldapscripts.passwd – Ned W. Oct 9 '13 at 20:16

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass.txt -H ldap:// -b dc=domain,dc=com

You might have to chmod 600 pass.txt

share|improve this answer

What kind of "password file" are you using? You may want to show us the complete command you are typing.

Are you using correct bind credentials?

share|improve this answer

Assuming it is the newline/carriage reuturn try the following:

cat .pass.txt | tr -d '\n\r' > .pass2.txt

Then use the .pass2.txt file. You can always check for new lines and carriage returns with cat -vE and they will show up as $ and ^M respectively.

You could also probably do -y <(cat .pass.txt | tr -d '\n\r') directly in the ldapsearch command.

share|improve this answer

There's no need to dump the password into an actual file. Just echo it with the -n flag to prevent the newline, then read it in from the STDIN file descriptor (/dev/fd/0) as follows:

echo -n 'mypassword' | ldapsearch -x -D <my dn> -y /dev/fd/0 -h server.x.x -b "dc=x,dc=y" "cn=*"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.