13

How am I supposed to pass a password to ldapsearch using the -y <password file> option?
If I write the password in the password file in plain text, I get this error:

ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1772

The same happens if I use the -w <password> option.

EDIT:
The command I'm running is

ldapsearch -x -D <my dn> -y .pass.txt -h server.x.x -b "dc=x,dc=y" "cn=*"

Where the file .pass.txt contains my password, in plain text. Both the DN and the password are correct. If I run the command with the -W option and type the password on the prompt the command runs successfully, but I would like to store the password somehow to make a script.

  • What kind of "password file" are you using? You may want to show us the complete command you are typing. Are you using correct bind credentials? – solefald May 11 '10 at 16:27
14

Keep in mind that ldapsearch will use the entire contents of the file for the password--which means it WILL include a terminating newline character if one exists. To verify if this is in fact your problem, try creating a file without one:

echo -n ThisIsaBadPassword > .pass.txt

(UPDATE: Included '-n')

  • 1
    I just tried that, but I get exactly the same error... – Paolo Tedesco May 11 '10 at 16:49
  • 2
    No, it won't. You need echo -n or printf in order to avoid the newline. – grawity May 11 '10 at 19:23
  • The echo -n did the trick! Thank you all for your help. – Paolo Tedesco May 12 '10 at 7:14
  • In followup to grawity's comment, echo -n works perfectly, e.g.: echo -n "secretpassword" > /etc/ldapscripts/ldapscripts.passwd – Ned W. Oct 9 '13 at 20:16
  • Annoying problem solved due to this, thanks. I just used sed to strip the end of an existing file, though. – wirefox May 4 '18 at 19:06
1

Assuming it is the newline/carriage reuturn try the following:

cat .pass.txt | tr -d '\n\r' > .pass2.txt

Then use the .pass2.txt file. You can always check for new lines and carriage returns with cat -vE and they will show up as $ and ^M respectively.

You could also probably do -y <(cat .pass.txt | tr -d '\n\r') directly in the ldapsearch command.

0

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass.txt -H ldap://ldap.domain.com -b dc=domain,dc=com

You might have to chmod 600 pass.txt

-2

There's no need to dump the password into an actual file. Just echo it with the -n flag to prevent the newline, then read it in from the STDIN file descriptor (/dev/fd/0) as follows:

echo -n 'mypassword' | ldapsearch -x -D <my dn> -y /dev/fd/0 -h server.x.x -b "dc=x,dc=y" "cn=*"
  • the problem with this approach is it leaves you subject to shell history and PS to discover your password. – cgseller May 2 '18 at 15:53
  • 1
    Point taken. It's mid-2018 now. I've learned from my mistakes. Don't take my 2014 blathering seriously. Thank you. :) – Brian Showalter Jun 6 '18 at 2:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.