LDAP

Endpoint Privilege Management for Unix and Linux LDAP support is based on the LDAP version 2 API, as defined in RFC 1823. Specific parts of the LDAP API are mapped to a series of Endpoint Privilege Management for Unix and Linux functions.

Run an LDAP search

The general process for performing an LDAP search is outlined below.

1. Use the ldap_open() function to establish an LDAP server connection.
2. Bind the LDAP server connection to the user by using the ldap_bind() function.
3. Use the function ldap_search() to search an LDAP directory.
4. Use the ldap_entry_count() function to determine the number of entries that were found by the query.
5. Loop through the entries that were found by the query by using the ldap_firstentry() and ldap_ nextentry() functions.
6. Use the function ldap_attributes() to obtain a list of attributes that are available for an entry.
7. Use the ldap_getvalues() function to retrieve the actual attribute values that are associated with an entry.
8. Process the next entry. Repeat steps 5 through 7 until all entries are processed.
9. Use the function ldap_unbind() to unbind and close the LDAP Server connection.

ℹ️

Note

For more information on using LDAP, refer to your LDAP documentation.

ldap_attributes

Description

The ldap_attributes() function returns a list that contains all of the attributes that are associated with the specified LDAP entry. Each element in result contains an attribute name.

Syntax

result = ldap_attributes (LDAPEntry);

Arguments

Return values

A list in which each element contains an attribute name. On error, it returns an empty list.

Example

result = ldap_attributes (LDAPEntry);

In this example, result might look like the following:

{"firstname", "lastname", "department", "jobcode"}

ℹ️

Note

For more information, see ldap-firstentry, ldap-nextentry, and ldap-search.

ldap_bind

Description

The ldap_bind() function binds an existing LDAP server connection using the specified DN and password If the DN is not specified, an anonymous bind is attempted.

Syntax

result = ldap_bind (ConnectionId, dn [,Password]);

Arguments

Return values

Example

In this example, an anonymous bind is performed using the LDAP server connection that is specified in ldapConnection.

result = ldap_bind (ldapConnection, "");

ℹ️

Note

For more information, see ldap_open and ldap-unbind.

ldap_dn2ufn

Description

The ldap_dn2ufn() function converts the supplied DN into a more user-friendly form by stripping off the type names. The resulting character string is returned in result.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_dn2ufn (dn);

Arguments

Return values

Example

In this example, result contains the specified DN name without type names.

result = ldap_dn2ufn (dn);

ℹ️

Note

For more information, see ldap_explodedn.

ldap_entry_count

Description

The ldap_entry_count() function returns the number of entries that exist in a specific LDAP message. The ldap_search() function generates LDAPEntry.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_entry_count (LDAPEntry);

Arguments

Return values

Example

In this example, result contains the number of entries in the LDAP message that is identified by LDAPEntry.

result = ldap_entry_count (LDAPEntry);

ldap_explodedn

Description

The ldap_explodedn() function splits the supplied DN into its separate subcomponents. Each subcomponent is called a relative distinguished name (RDN).

The notypes argument specifies whether the RDNs are returned with only values or both values and attributes. Setting notypes to false returns both values and attributes. Setting notypes to true returns only values.

The RDNs are returned in a list. If only values were requested, then each list element contains one value. If both values and attributes have been requested, each result list element has the format "attribute=value".

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_explodedn (dn, notypes);

Arguments

Return values

result is a list containing the DN subcomponents (that is, the RDNs). If only values are requested, then the list has the following format:

{"value", "value", …}

If both values and attributes are requested, then the list has the following format:

{"attribute=value", "attribute=value", …}.

Example

In this example, result is a list containing DN subcomponents. Both values and attributes are returned in this case.

result = ldap_explodedn (dn, false);

ldap_firstentry

Description

The ldap_firstentry() function returns the first entry in the specified LDAP message that is returned from ldap_search().

The first entry message is needed to retrieve successive entries from the specified LDAP message by using the ldap_nextentry() function.

The ldap_firstentry() function does not retrieve values. It returns a unique entry. The result can be used in a function such as ldap_getvalues() to actually retrieve attribute values.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_firstentry (LDAPEntry);

Arguments

Return values

Example

result = ldap_firstentry (LDM);

ldap_getdn

Description

The ldap_getdn() function returns the DN for the specified LDAP entry.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_getdn (LDAPEntry);

Arguments

Return values

Example

result = ldap_getdn (LDAPEntry);

ldap_getvalues

Description

The ldap_getvalues() function returns the values that are associated with the specified attribute. The values are returned in a list where each list element represents a value.

The length() function can be used to determine the number of elements that are returned in result. If ldap_getvalues() is successful, result has the format {"value", "value", …}.

The ldap_getvalues() function is typically used after a call to ldap_search(), ldap_firstentry(), or ldap_nextentry() to retrieve attribute values for the entry that is currently being processed.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_getvalues (LDAPEntry, attributeName);

Arguments

Return values

Example

result = ldap_getvalues (LDAPEntry, "uid");

ldap_init

• Version 4.0 and later: ldap_init() function deprecated.

Description

Initializes a connection to an LDAP database. This function supersedes ldap_open() and ldap_init().

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

ldap_initialize (ldap_url [, 2 | 3])

Arguments

Return values

On success, an LDAP connection is returned. On failure, null is returned.

Example

connection = ldap_initialize("ldap://ldaphost");

ldap_nextentry

Description

The ldap_nextentry() function returns the next LDAP entry in the specified LDAP message.

The ldap_nextentry() function does not retrieve values. It returns a unique entry. The result can be used in a function like ldap_getvalues() to actually retrieve attribute values.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_nextentry (LDAPEntry);

Arguments

Return values

Example

result = ldap_nextentry (LDAPEntry);

ldap_open

Description

The ldap_open() function establishes a connection to the LDAP server that is specified in ServerName. The connection is made through the port number in port (if specified).

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_open (ServerName [,port]);

Arguments

Return values

Example

In this example, if the open operation is successful, result contains an LDAP server connection ID for mycompany.ldap.server1 on port 200. If the connection is not successful, result contains a null string.

result = ldap_open ("mycompany.ldap.server1", 200);

ldap_search

Description

The ldap_search() function searches the LDAP directory below the baseDN, using the search criteria that are specified in the search filter. The scope argument defines the scope, or boundaries, of the search.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_search (ConnectionId, baseDN, scope, searchfilter, attributeList, attributeFlag);

Arguments

Return values

Example

result = ldap_search (ConnectionId, "dc=beyondtrust, "dc=com", subtree", "jobcode=mgr", {}, 0);

ldap_unbind

Description

The ldap_unbind() function unbinds and closes an existing LDAP server connection.

ℹ️

Note

Not supported in Endpoint Privilege Management for Linux (EPM-L).

Syntax

result = ldap_unbind (LDAP_Connection);

Arguments

Return values

Example

In this example, an unbind and close are performed on the LDAP server connection ID specified in ldapConnection.

result = ldap_unbind (ldapConnection);