Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The LDAP server is hosted on Solaris. The client is CentOS. OpenLDAP/NSLCD/SSH authentication via LDAP work fine, but I am not able to use the ldapsearch commands to debug LDAP issues.

[root@tst-01 ~]# ldapsearch
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
        additional info: SASL(-4): no mechanism available:
[root@tst-01 ~]# cat /etc/openldap/ldap.conf
TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap1.tst.domain.tld ldap://ldap2.tst.domain.tld
BASE dc=tst,dc=domain,dc=tld
[root@tst-01 ~]# ls -al /etc/openldap/cacerts
total 12
drwxr-xr-x. 2 root root 4096 Jun  6 10:31 .
drwxr-xr-x. 3 root root 4096 Jun 10 10:12 ..
-rw-r--r--. 1 root root  895 Jun  6 10:01 cacert.pem
lrwxrwxrwx. 1 root root   10 Jun  6 10:31 cf848aa4.0 -> cacert.pem
[root@tst-01 ~]#

I have tried authentication with a certificate via ldapsearch giving /etc/openldap/cacerts/cacert.pem as a parameter, but it didn't accept this certificate for authentication.

share|improve this question
up vote 17 down vote accepted

You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user

ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" \
           -W -H ldap:// -b "ou=People,dc=example,dc=com" \
           -s sub 'uid=test-user'

Will find "test-user" by

  • -D - Use bind user "search-user"
  • -W - Prompt for password
  • -H - URL of LDAP server. Non-SSL in this case; use "ldaps://" for SSL
  • -b - The search base
  • -s - Search scope - i.e. base for base of tree, one for on level down and sub for recursively searching down the tree (can take a while)
  • Finally the search filter as a non-option argument. In this case we will search for the uid of "test-user"
share|improve this answer
Fred has it right, except that you don't need to specify the search base or host if you are happy with the ones specified in /etc/openldap/ldap.conf i.e. the following should probably work: ldapsearch -x -D "<bind dn>" -W <query> – Jason Tan Jun 11 '13 at 18:26

Seems that I ask same question at:

See to :

  • Get a connection to the LDAP server.
  • Bind as the application user.
  • Search for the DN (distinguished name) of the user to be authenticated.
  • Bind as user to be authenticated using DN from step 3.

That may be summarized as (experiment in command line):

$ ldapsearch -x -h -s sub -b 'dc=europe,dc=com' "uid=XYZ"
dn: uid=XYZ,dc=sales,dc=europe,dc=com
$ ldapsearch -W -h -D 'uid=XYZ,dc=sales,dc=europe,dc=com' \
    -s sub -b 'dc=europe,dc=com' "uid=XYZ"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.