I am using ldapsearch on a debian 9 Linux box to query a MS Active Directory. I would like to query/find all users in my group "mygroupname". The command

ldapsearch -o ldif-wrap=no -xWLLL -D "myaccount" -h mydomain -b "ou=user,dc=mydc,dc=com" "cn=mygroupname" member

has the following output:

dn: CN=mygroupname,OU=user,DC=mydc,DC=com
member: CN=Paula Normal,OU=whatever,OU=...,OU=...,OU=...,DC=mydc,DC=com
member:: Q049QmV0dGluYSBUw7Zs...................9nbmUsT1U9RGV1dHNjwdGEsREM9Y29t
member: CN=Peter Testman,OU=whatever2,OU=...,OU=...,OU=...,DC=mydc,DC=com

I compared the output with the AD-GUI. The the second entry should be another valid user, but the output is unexpected and unreadable. The CN,OU,DC information is missing. I found out that the strange entries are valid, but are base64-encoded.

Where is the fault? Is there any corruption in the AD? Is my query command wrong? Why are some entries base64-encoded. How to get the right output?

  • 1
    Could be a legacy member. Try comparing the output of repadmin /showobmeta DCNAME "DNOfGroup" – Greg Askew Mar 21 at 19:11
  • With repadmin /showobjmeta localhost "cn=mygroupname,ou....." I see entries with legacy, "present" and with "not present" marked. (showobjmeta not showobmeta). However I cannot follow you yet. What does it mean? – Norbert Weuster Mar 21 at 20:00
  • Is the unreadable member a legacy member? Legacy means it was a member before Windows Server 2003 when Linked Value Replication was introduced. Removing/readding the member converts it from a legacy member to a normal member. – Greg Askew Mar 21 at 20:06
  • 1
    BTW: You should edit your question and trim the base64-encoded value, what you call strange member entry, because it's a privacy violation. – Michael Ströder Mar 21 at 20:21

Your command-line

ldapsearch -o ldif-wrap=no -xWLLL -D "myaccount" -h mydomain -b "ou=user,dc=mydc,dc=com" "cn=mygroupname" member

explicitly limits the attributes requested in the search to member.

Simply try add the wanted attribute names as additional command-line args:

ldapsearch -o ldif-wrap=no -xWLLL -D "myaccount" -h mydomain -b "ou=user,dc=mydc,dc=com" "cn=mygroupname" cn ou o member

See also: ldapsearch(1)

Furthermore you should learn about LDIF syntax (see RFC 2849) which is supposed to be ASCII-clean. The two double-colons after the attribute type name means that the value was base-encoded, e.g. because of NON-ASCII char in a name. Use a decent LDIF module to decode ldapsearch output or better use an LDAP module for your favourite scripting language.

  • no, it doesn`t change the strange member entries. I guess it must be related to Gregs comment. – Norbert Weuster Mar 21 at 20:05
  • You have two problems. I've edited my answer to also address the 2nd one. – Michael Ströder Mar 21 at 20:18
  • The first point is not an issue. The output is correct, but the second point explains the strange output and points to a solution. – Norbert Weuster Mar 21 at 21:02
  • stackoverflow.com/questions/38710483/… was a constructive hint. Would you like to edit your answer? – Norbert Weuster Mar 21 at 21:30
  • My strong recommendation is to use a decent LDAP module for your favourite scripting language instead of weird and unmaintainable perl/awk/sed/whatever constructs seen in the wild. => No, I deliberately won't edit my answer. – Michael Ströder Mar 21 at 22:14

The reason for the unexpected output is a NON-ASCII char in the cn-name. The line starting with "member:: " indicates a base64-encoded value, which can be decoded (by e.g. echo "$value" | base64 -d -)

The search results of ldapsearch are displayed using an extended version of LDIF.

LDIF syntax (see RFC 2849) is supposed to be ASCII-clean.

A quick workaround to receive a readable output could be made by using a wrapper like

myldapsearch() { ldapsearch $* | perl -MMIME::Base64 -n -00 -e 's/\n +//g;s/(?<=:: )(\S+)/decode_base64($1)/eg;print'; }  

Seen in this question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.