# ldapexop

## NAME



           ldapexop - issue LDAP extended operations
    


## SYNOPSIS



           ldapexop [**-V**[**V**]] [**-d** _debuglevel_] [**-n**] [**-v**] [**-f** _file_] [**-x**]
           [**-D** _binddn_] [**-W**] [**-w** _passwd_] [**-y** _passwdfile_] [**-H** _URI_]
           [**-e**[**!**]_ext_[**=**_extparam_]] [**-o** _opt_[=_optparam_]] [**-O** _security-_
           _properties_] [**-I**] [**-Q**] [**-N**] [**-U** _authcid_] [**-R** _realm_] [**-X** _authzid_]
           [**-Y** _mech_] [**-Z**[**Z**]] {_oid_ | **oid:**_data_ | **oid::**_b64data_ | **whoami** |
           **cancel** _cancel-id_ | **refresh** _DN_ [_ttl_]}
    


## DESCRIPTION



           ldapexop issues the LDAP extended operation specified by **oid** or
           one of the special keywords **whoami** , **cancel** , or **refresh**.
    
           Additional data for the extended operation can be passed to the
           server using _data_ or base-64 encoded as _b64data_ in the case of
           **oid** , or using the additional parameters in the case of the
           specially named extended operations above.
    
           Please note that ldapexop behaves differently for the same
           extended operation when it was given as an OID or as a specially
           named operation:
    
           Calling ldapexop with the OID of the **whoami**(RFC 4532) extended
           operation
    
             ldapexop [<options>] 1.3.6.1.4.1.4203.1.11.3
    
           yields
    
             # extended operation response
             data:: <base64 encoded response data>
    
           while calling it with the keyword **whoami**
    
             ldapexop [<options>] whoami
    
           results in
    
             dn:<client's identity>
    


## OPTIONS



           **-V** _[_**V** _]_  Print version info.  If**-VV** is given, only the version
                  information is printed.
    
           **-d** _debuglevel_
                  Set the LDAP debugging level to _debuglevel_.
    
           **-n** Show what would be done but don't actually do it.  Useful
                  for debugging in conjunction with **-v**.
    
           **-v** Run in verbose mode, with many diagnostics written to
                  standard output.
    
           **-f** _file_
                  Read operations from _file_.
    
           **-x** Use simple authentication instead of SASL.
    
           **-D** _binddn_
                  Use the Distinguished Name _binddn_ to bind to the LDAP
                  directory.
    
           **-W** Prompt for simple authentication.  This is used instead of
                  specifying the password on the command line.
    
           **-w** _passwd_
                  Use _passwd_ as the password for simple authentication.
    
           **-y** _passwdfile_
                  Use complete contents of _passwdfile_ as the password for
                  simple authentication.
    
           **-H** _URI_ Specify URI(s) referring to the ldap server(s); only the
                  protocol/host/port fields are allowed; a list of URI,
                  separated by whitespace or commas is expected.
    
           **-e**[**!**]_ext_[**=**_extparam_]
                  Specify general extensions.  ´!´ indicates criticality.
                    [!]assert=<filter>    (an RFC 4515 Filter)
                    !authzid=<authzid>    ("dn:<dn>" or "u:<user>")
                    [!]bauthzid           (RFC 3829 authzid control)
                    [!]chaining[=<resolve>[/<cont>]]
                    [!]manageDSAit
                    [!]noop
                    ppolicy
                    [!]postread[=<attrs>] (a comma-separated attribute list)
                    [!]preread[=<attrs>]  (a comma-separated attribute list)
                    [!]relax
                    sessiontracking[=<username>]
                    abandon,cancel,ignore (SIGINT sends abandon/cancel,
                    or ignores response; if critical, doesn't wait for SIGINT.
                    not really controls)
    
           **-o** _opt_[=_optparam_]
    
                  Specify any ldap.conf(5) option or one of the following:
                    nettimeout=<timeout>  (in seconds, or "none" or "max")
                    ldif_wrap=<width>     (in columns, or "no" for no wrapping)
    
           **-O** _security-properties_
                  Specify SASL security properties.
    
           **-I** Enable SASL Interactive mode.  Always prompt.  Default is
                  to prompt only as needed.
    
           **-Q** Enable SASL Quiet mode.  Never prompt.
    
           **-N** Do not use reverse DNS to canonicalize SASL host name.
    
           **-U** _authcid_
                  Specify the authentication ID for SASL bind. The form of
                  the ID depends on the actual SASL mechanism used.
    
           **-R** _realm_
                  Specify the realm of authentication ID for SASL bind. The
                  form of the realm depends on the actual SASL mechanism
                  used.
    
           **-X** _authzid_
                  Specify the requested authorization ID for SASL bind.
                  _authzid_ must be one of the following formats:
                  **dn:**_< distinguished name>_ or **u:**_< username>_
    
           **-Y** _mech_
                  Specify the SASL mechanism to be used for authentication.
                  Without this option, the program will choose the best
                  mechanism the server knows.
    
           **-Z**[**Z**]  Issue StartTLS (Transport Layer Security) extended
                  operation.  Giving it twice (**-ZZ**) will require the
                  operation to be successful.
    


## DIAGNOSTICS



           Exit status is zero if no errors occur.  Errors result in a non-
           zero exit status and a diagnostic message being written to
           standard error.
    


## ACKNOWLEDGEMENTS



           **OpenLDAP Software** is developed and maintained by The OpenLDAP
           Project <http://www.openldap.org/>.  **OpenLDAP Software** is derived
           from the University of Michigan LDAP 3.3 Release.
    


* * *