Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I retrieve the entire output of an OpenLDAP directory to which I have administrative privileges?

Specifically, I need dn, objectClass, and (if exists for the object) uidNumber or gidNumber.

share|improve this question
I ran ldapsearch -x -LLL -b dc=mydomain,dc=tld and received two results: the default admin and the top,dcObject,organization object. Is this everything in the directory? I see no option for recursing, so I am inclined to think so, but have nothing to compare it to. – Tohuw Jun 2 '13 at 16:14
up vote 2 down vote accepted

You should bind to the server using the root DN while performing the search. That is, use the -D and -W options to ldapsearch. Otherwise, it is possible that ACLs can cause certain entries or attributes to be suppressed from the results. Also, use -s sub to search recursively.

Alternatively, you could dump the database contents directly, bypassing slapd, by running slapcat on the server machine.

share|improve this answer
Thank you! I tried ldapsearch -LLL -D cn=admin,dc=mydomain,dc=tld -W -s sub -b dc=tohuw,dc=net and got the same results, except it also included a hash of the admin user's password. Is it therefore safe to assume this constitutes everything in the DIT? – Tohuw Jun 2 '13 at 22:49
I did some further reading and found that it is, indeed, everything in the DIT. Thanks for your help! – Tohuw Jun 2 '13 at 23:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.