# slapauth

## NAME



           slapauth - Check a list of string-represented IDs for LDAP
           authc/authz
    


## SYNOPSIS



           **SBINDIR/slapauth**[**-d** _debug-level_] [**-f** _slapd.conf_] [**-F** _confdir_]
           [**-M** _mech_] [**-o** _option_[**=**_value_]] [**-R** _realm_] [**-U** _authcID_] [**-v**]
           [**-X** _authzID_] _ID_ [_..._]
    


## DESCRIPTION



           **Slapauth** is used to check the behavior of the slapd in mapping
           identities for authentication and authorization purposes, as
           specified in slapd.conf(5).  It opens the slapd.conf(5)
           configuration file or the slapd-config(5) backend, reads in the
           **authz-policy** /**olcAuthzPolicy** and **authz-regexp** /**olcAuthzRegexp**
           directives, and then parses the _ID_ list given on the command-line.
    


## OPTIONS



           **-d** _debug-level_
                  enable debugging messages as defined by the specified
                  _debug-level_ ; see slapd(8) for details.
    
           **-f** _slapd.conf_
                  specify an alternative slapd.conf(5) file.
    
           **-F** _confdir_
                  specify a config directory.  If both **-f** and **-F** are
                  specified, the config file will be read and converted to
                  config directory format and written to the specified
                  directory.  If neither option is specified, an attempt to
                  read the default config directory will be made before
                  trying to use the default config file. If a valid config
                  directory exists then the default config file is ignored.
    
           **-M** _mech_
                  specify a mechanism.
    
           **-o** _option_[**=**_value_]
                  Specify an _option_ with a(n optional) _value_.  Possible
                  generic options/values are:
    
                         syslog=<subsystems>  (see `-s' in slapd(8))
                         syslog-level=<level> (see `-S' in slapd(8))
                         syslog-user=<user>   (see `-l' in slapd(8))
    
           **-R** _realm_
                  specify a realm.
    
           **-U** _authcID_
                  specify an ID to be used as _authcID_ throughout the test
                  session.  If present, and if no _authzID_ is given, the IDs
                  in the ID list are treated as _authzID_.
    
           **-X** _authzID_
                  specify an ID to be used as _authzID_ throughout the test
                  session.  If present, and if no _authcID_ is given, the IDs
                  in the ID list are treated as _authcID_.  If both _authcID_ and
                  _authzID_ are given via command line switch, the ID list
                  cannot be present.
    
           **-v** enable verbose mode.
    


## EXAMPLES



           The command
    
                SBINDIR/slapauth -f /ETCDIR/slapd.conf -v \
                       -U bjorn -X u:bjensen
    
           tests whether the user _bjorn_ can assume the identity of the user
           _bjensen_ provided the directives
    
                authz-policy from
                authz-regexp "^uid=([^,]+).*,cn=auth$"
                     "ldap:///dc=example,dc=net??sub?uid=$1"
    
           are defined in slapd.conf(5).
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *