LDAP Command Examples

This section explains how to use the ldapdelete, ldapmodify, and ldapsearch utilities to configure the server.

Searching for Records

Searching for Records

You can use the ldapsearch command to extract information from the LDAP tree. The ldapsearch command can be used to find sessions either by a specific NAS or NAS and session start time combination. The command shown in Figure 201 lets you extract information about all RADIUS Native Users.

Figure 201: ldapsearch Command

Make sure to include a blank space between each option (for example, -p) and its value (for example, 354). Command syntax is case-sensitive. See Table 61.

Executing the ldapsearch command shown in Figure 201 against a Steel-Belted Radius Carrier server containing two Native User definitions produces an LDIF file similar to the output shown in Figure 202.

Figure 202: Search Results

Modifying Records

Modifying Records

You can use the ldapmodify utility to update the Steel-Belted Radius Carrier configuration.

Be sure to include a blank space between each option (for example, -p) and its value (for example, 354). Command syntax is case-sensitive. See Table 62.

The LDIF files generated by ldapsearch differ from those required for input to ldapmodify. The ldapmodify input files must contain a changetype entry immediately after each dn entry. The changetype entry specifies how to use the data to change the LDAP database.

The full syntax for changetype within each transaction is as follows:

Where:

• keyword can be add, modify, or delete.

• subkeyword can be (respectively): add, replace, or delete.

• attribute can be any LDAP attribute in the entry.

• value is the value to assign to the attribute.

Repeated changetype: keyword entries are not required within a transaction unless you change the keyword. From top to bottom within the transaction, the latest keyword applies until another changetype: keyword entry is provided. The following syntax is valid if the same keyword applies throughout the transaction:

subkeyword: attribute entries are optional and indicate that you want to apply the change to a specific attribute within the entry. If no subkeyword: attribute entries in the transaction are found, the change applies to the entire entry. For example, it is faster to delete an entire entry:

but if you want to delete only a few attributes from the entry, you can do so:

If the subkeyword is add or replace, an attribute: value entry must appear immediately following the subkeyword: attribute entry. If the subkeyword is delete, the attribute: value entry does not apply and should be omitted.

The following LDIF file can be used with an ldapmodify command.

Figure 203: Sample LDIF File

Importing Records from Another LDAP Database

Importing Records from Another LDAP Database

To import entries from one LDAP database into another, run the ldapsearch command on the first database. Request only the attributes you want for the new database. When ldapsearch completes processing, edit the output LDIF file. After each line that begins with dn:, add a single line containing the text changetype: add. Once your editing is complete, run an ldapmodify -f command that references the new LDIF file. After the ldapmodify command is executed, your new database is populated with the records you extracted from the old database.

The LDIF file shown in Figure 204 is derived from the output of the ldapsearch command. When specified as the input to an ldapmodify -f command, the contents of the file are added to the target database.

Figure 204: Adding Records with an LDIF File

Deleting Records

Deleting Records

The ldapdelete command removes records from the LDAP database. The ldapdelete command can be used to delete records either by a specific NAS or NAS and session start time combination. For example, to delete entries names USER1 through USER5, add the information shown in Figure 205 to a file called deletedemo.ldf.

Figure 205: Deleting Records with an LDIF File

Now, pass the deletedemo.ldf file to the ldapdelete command.

You can use ldapdelete to remove records from the LDAP database without having to supply a file. For example, to delete the native user record identified as USER1, enter the following:

You can cause records to be deleted by means of the ldapmodify command, if the entries in the text file contain the line changetype: delete. Consider the sample LDIF file named deletemodify.ldf shown in Figure 206.

Figure 206: deletemodify.ldf Example

The deletemodify.ldf file can be passed to the ldapmodify command as follows:

Searching for Active Sessions

Searching for Active Sessions

You can use the ldapsearch command to search for an active session and display custom CST attributes, as shown in the following example:

The following is a sample output:

Sample Output