Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 501 / 552

ldapsearch Examples
483
In this example, the default scope of
sub
is used because the
-s
option was not used to specify the
scope.
B.2.4.6. Displaying Subsets of Attributes
The
ldapsearch
command returns all search results in LDIF format. By default,
ldapsearch
returns the entry's distinguished name and all of the attributes that a user is allowed to read. The
directory access control can be set such that users are allowed to read only a subset of the attributes
on any given directory entry. Only operational attributes are not returned. For operational attributes to
be returned as a result of a search operation, explicitly specify them in the search command.
It may not be necessary to have all of the attributes for an entry returned in the search results. The
returned attributes can be limited to just a few specific attributes by specifying the desired ones on the
command line immediately after the search filter. For example, to show the
cn
and
sn
attributes for
every entry in the directory, use the following command-line call:
ldapsearch -h mozilla "objectclass=*" sn cn
This example assumes the search base is set with
LDAP_BASEDN
.
B.2.4.7. Specifying Search Filters Using a File
Search filters can be entered into a file instead of entering them on the command-line. In this case,
specify each search filter on a separate line in the file. The
ldapsearch
command runs each search
in the order in which it appears in the file.
For example:
sn=Francis
givenname=Richard
ldapsearch
first finds all the entries with the surname
Francis
, then all the entries with the
givenname
Richard
. If an entry is found that matches both search criteria, then the entry is returned
twice.
For example, suppose the previous search filters were specified in a file named
searchdb
, and the
search base is set using
LDAP_BASEDN
. Then the following returns all the entries that match either
search filter:
ldapsearch -h mozilla -f searchdb
The set of attributes returned here can be limited by specifying the attribute names at the end of the
search line. For example, the following
ldapsearch
command performs both searches but returns
only the DN and the
givenname
and
sn
attributes of each entry:
ldapsearch -h mozilla -f searchdb sn givenname
B.2.4.8. Specifying DNs That Contain Commas in Search Filters
When a DN within a search filter contains a comma as part of its value, the comma must be escaped
with a backslash (\). For example, to find everyone in the
example.com Bolivia, S.A.
subtree,
use the following command: