Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How am I supposed to pass a password to ldapsearch using the -y <password file> option?
If I write the password in the password file in plain text, I get this error:

ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1772

The same happens if I use the -w <password> option.

EDIT:
The command I'm running is

ldapsearch -x -D <my dn> -y .pass.txt -h server.x.x -b "dc=x,dc=y" "cn=*"

Where the file .pass.txt contains my password, in plain text. Both the DN and the password are correct. If I run the command with the -W option and type the password on the prompt the command runs successfully, but I would like to store the password somehow to make a script.

share|improve this question
add comment

5 Answers 5

up vote 0 down vote accepted

One thing to keep in mind is that the password file WILL include a terminating carriage-return if one exists.

echo thisisabadpassword > .pass.txt

That'll create the file without any confusing characters at the end.

share|improve this answer
    
I just tried that, but I get exactly the same error... –  Paolo Tedesco May 11 '10 at 16:49
2  
No, it won't. You need echo -n or printf in order to avoid the newline. –  grawity May 11 '10 at 19:23
    
The echo -n did the trick! Thank you all for your help. –  Paolo Tedesco May 12 '10 at 7:14
    
In followup to grawity's comment, echo -n works perfectly, e.g.: echo -n "secretpassword" > /etc/ldapscripts/ldapscripts.passwd –  Ned W. Oct 9 '13 at 20:16
add comment

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass.txt -H ldap://ldap.domain.com -b dc=domain,dc=com

You might have to chmod 600 pass.txt

share|improve this answer
add comment

What kind of "password file" are you using? You may want to show us the complete command you are typing.

Are you using correct bind credentials?

share|improve this answer
add comment

Assuming it is the newline/carriage reuturn try the following:

cat .pass.txt | tr -d '\n\r' > .pass2.txt

Then use the .pass2.txt file. You can always check for new lines and carriage returns with cat -vE and they will show up as $ and ^M respectively.

You could also probably do -y <(cat .pass.txt | tr -d '\n\r') directly in the ldapsearch command.

share|improve this answer
add comment

There's no need to dump the password into an actual file. Just echo it with the -n flag to prevent the newline, then read it in from the STDIN file descriptor (/dev/fd/0) as follows:

echo -n 'mypassword' | ldapsearch -x -D <my dn> -y /dev/fd/0 -h server.x.x -b "dc=x,dc=y" "cn=*"
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.