In my company's ldap we got two attributes, one is called cryptodata and the other cryptodata;binary

When I do an ldapsearch command and put cryptodata ending the command in order to filter by this attribute only, it brings me both cryptodata and cryptodata;binary attributes. I want it to return only cryptodata and not cryptodata;binary . How can I do this ? Both of these attributes are many lines long, so grep would be cumbersome to use.

Example of the command I use that returns both fields:

ldapsearch -h -p 389 -D "cn=sysname,ou=whatever,o=ca,c=country" -b "CN=SOMEONE,OU=AUTHORITHY,OU=COMPANY,OU=TYPE,O=CA,C=COUNTRY" -w "password" dn cryptodata

please note that both fields are not the same. So I can't just filter by cryptodata;binary

Also this is a large company ldap, so I don't have management over the ldap field structure.


In LDAP you can add so-called descriptions to attribute names separated by semicolon. The interpretation of these descriptions can vary depending on the description.

Thus cryptodata and cryptodata;binary are not different attributes!

Actually ;binary is just a transfer type to alter the encoding used when transferring the attribute over-the-wire. Today it is of very limited use (see RFC 4522) and mainly used when requesting PKI certificate attributes.

If your LDAP server really returns different attribute values for cryptodata and cryptodata;binary you have to examine which one has the right encoding for your client and deal with at the client side. Do not write simple shell scripts. It's better to use a scripting language like Python/Perl/Ruby whatever and a decent LDAP module for that.

  • I see. Will deal with that in a different form. Thanks. Jun 26 '19 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.