Lion Cipher Lab
Search and authenticate against LDAP with ldapsearch
- Identity & Access Management
- Intermediate
- ~40 min
- Free · no account required
Why it matters
ldapsearch is the multimeter of enterprise identity. When an application 'authenticates against LDAP' and users cannot log in, you reach for ldapsearch to prove whether the bind DN, the password, the search base and the filter the app is configured with actually return that user — before you blame the app. When you are about to integrate a new tool with the directory, you enumerate first with ldapsearch so you know the exact DNs and attribute names it must be pointed at. When a SOC analyst enriches an alert with a username, when an auditor asks 'who is in the domain-admins group', when a…
What you'll learn
- querying a directory with ldapsearch
- anonymous vs authenticated (simple) binds
- writing LDAP search filters (RFC 4515)
- choosing search scope (base / one / sub)
- selecting attributes to return
- looking up group membership
- reading the Invalid credentials (49) bind failure
- LDAP over TLS: LDAPS vs StartTLS
Steps in this lab
- When you reach for ldapsearch — and getting the directory in front of you
- Anonymous bind vs authenticated bind: the two ways to ask
- Write the sentence: LDAP search filters (RFC 4515)
- Scope the search and pick only the attributes you need
- Look up a user's group memberships (the part beginners get backwards)
- Prove an authentication check: right password vs wrong password
- The security angle: cleartext binds, LDAPS/StartTLS, and dual use
- When to reach for ldapsearch, why filters and scope matter, and the better way