Chapter 4. Searching Identity Management entries from the command line The following sections describe how to use IPA commands, which helps you to find or show objects. 4.1. Overview of listing IdM entries You can use the ipa *-find commands to help you to search for particular types of IdM entries. To list all the find commands, use the following ipa help command: You may need to check if a particular user is included in the IdM database. You can then list all users with the following command: To list user groups whose specified attributes contain a keyword: For example the ipa group-find admin command lists all groups whose names or descriptions include string admin : When searching user groups, you can also limit the search results to groups that contain a particular user: To search for groups that do not contain a particular user: 4.2. Showing details for a particular entry Use the ipa *-show command to display details about a particular IdM entry. Procedure To display details about a host named server.example.com : 4.3. Adjusting the search size and time limit Some queries, such as requesting a list of IdM users, can return a very large number of entries. By tuning these search operations, you can improve the overall server performance when running the ipa *-find commands, such as ipa user-find , and when displaying corresponding lists in the Web UI. Search size limit Defines the maximum number of entries returned for a request sent to the server from a client's CLI or from a browser accessing the IdM Web UI. Default: 100 entries. Search time limit Defines the maximum time (in seconds) that the server waits for searches to run. Once the search reaches this limit, the server stops the search and returns the entries discovered in that time. Default: 2 seconds. If you set the values to -1 , IdM will not apply any limits when searching. Important Setting search size or time limits too high can negatively affect server performance. 4.3.1. Adjusting the search size and time limit in the command line The following procedure describes adjusting search size and time limits in the command line: Globally For a specific entry Procedure To display current search time and size limits in CLI, use the ipa config-show command: To adjust the limits globally for all queries, use the ipa config-mod command and add the --searchrecordslimit and --searchtimelimit options. For example: To temporarily adjust the limits only for a specific query, add the --sizelimit or --timelimit options to the command. For example: 4.3.2. Adjusting the search size and time limit in the Web UI The following procedure describes adjusting global search size and time limits in the IdM Web UI. Procedure Log in to the IdM Web UI. Click IPA Server . On the IPA Server tab, click Configuration . Set the required values in the Search Options area. Default values are: Search size limit: 100 entries Search time limit: 2 seconds Click Save at the top of the page.

Commands:
ipa help commands | grep find
ipa user-find
ipa group-find keyword
---------------- 3 groups matched ---------------- Group name: admins Description: Account administrators group GID: 427200002 Group name: editors Description: Limited admins who can edit other users GID: 427200002 Group name: trust admins Description: Trusts administrators group
ipa group-find --user= user_name
ipa group-find --no-user= user_name
ipa host-show server.example.com Host name: server.example.com Principal name: host/server.example.com@EXAMPLE.COM
ipa config-show Search time limit: 2 Search size limit: 100
ipa config-mod --searchrecordslimit=500 --searchtimelimit=5
ipa user-find --sizelimit=200 --timelimit=120