In addition to the standard options to the ldapsearch command, such as the base (-b), scope (-s), and filter, the following options are required to run an ldapsearch command using SSL:

•-pwith the Directory Server secure port

•-Zto specify to use SSL (or, alternatively, -ZZor -ZZZto specify Start TLS)

•-Pto give certificate database's file name and path

•-Nto give the SSL certificate name

•-Kto specify the private key database's file name and path

•-Wto give the password to the private key database

Table 6-5 Additional SSL ldapsearch options

Option

Description

-3

Specifies that host names should be checked in SSL certificates.

 

 

-I

Specifies the SSL key password file that contains the token:password pair.

 

 

-K

Specifies the absolute path, including the file name, of the private key database of the client.

 

The -Koption must be specified when the key database has a different name than key3.db or when

 

the key database is not under the same directory as the certificate database, the cert8.db file (the

 

path which is specified with the -Poption).

 

 

-m

Specifies the path to the security module database, such as

 

/etc/opt/dirsrv/slapd-instance_name/secmod.db. This option only need to be given if

 

the security module database is in a different directory than the certificate database itself.

 

 

-N

Specifies the certificate name to use for certificate-based client authentication, such as -N

 

"Server-Cert". If this option is specified, then the -Z, -P, and -Woptions are required. Also, if

 

this option is specified, then the -Dand -woptions must not be specified, or certificate-based

 

authentication will not occur, and the bind operation will use the authentication credentials specified

 

on -Dand -w.

 

 

-P

Specifies the absolute path, including the option, of the certificate database of the client. This option

 

is used only with the -Zoption.

 

When used on a machine where an SSL-enabled web browser is configured, the path specified on

 

this option can be that of the certificate database for the browser. For example:

 

-P /security/cert.db

 

The client security files can also be stored on the Directory Server in the

 

/etc/opt/dirsrv/slapd-instance_namedirectory. In this case, the -Poption would call out

 

a path and file name similar to the following:

 

-P /etc/opt/dirsrv/slapd-instance_name/client-cert.db

 

 

-Q

Specifies the token and certificate name, which is separated by a semi-colon (:) for PKCS11.

 

 

-W

Specifies the password for the private key database identified in the -Poption. For example:

 

-W secret

 

If a dash (-) is used as the password value, the utility promptes for the password after the command

 

is entered. This avoids having the password on the command line.

 

 

-Z

Specifies that SSL is to be used for the search request.

 

 

-ZZ

Specifies the Start TLS request. Use this option to make a cleartext connection into a secure one. If

 

the server does not support Start TLS, the command does not have to be aborted; it will continue

 

in cleartext.

 

 

-ZZZ

Enforces the Start TLS request. The server must respond that the request was successful. If the server

 

does not support Start TLS, such as Start TLS is not enabled or the certificate information is incorrect,

 

the command is aborted immediately.

 

 

6.4.5 ldapsearch SASL options

SASL mechanisms can be used to authenticate a user, using the -othe required SASL information.

6.4 ldapsearch 193