-d level
Set the LDAP debugging level to level.
-D binddn
Use the Distinguished Name binddn to bind to the LDAP directory.
-e [!]ext[=extparam]
Specify general extensions. ́!́ indicates criticality.
[!]assert=<filter> (RFC 4528; a RFC 4515 Filter string)
[!]authzid=<authzid> (RFC 4370; "dn:<dn>" or "u:<user>")
[!]chaining[=<resolveBehavior>[/<continuationBehavior>]]
one of "chainingPreferred", "chainingRequired",
"referralsPreferred", "referralsRequired"
[!]manageDSAit (RFC 3296)
[!]noop
ppolicy
[!]postread[=<attrs>] (RFC 4527; comma-separated attr list)
[!]preread[=<attrs>] (RFC 4527; comma-separated attr list)
[!]relax
abandon, cancel, ignore (SIGINT sends abandon/cancel,
or ignores response; if critical, doesn't wait for SIGINT.
not really controls)
-f file
Read operations from file.
-h host
Specify the host on which the ldap server is running. Deprecated in favor of -H.
-H URI
Specify URI(s) referring to the ldap server(s); only the protocol/host/port fields are allowed; a list of URI, separated by whitespace or commas is expected.
-I
Enable SASL Interactive mode. Always prompt. Default is to prompt only as needed.
-n
Show what would be done but don't actually do it. Useful for debugging in conjunction with -v.
-N
Do not use reverse DNS to canonicalize SASL host name.
-O security-properties
Specify SASL security properties.
-o opt[=optparam]
Specify general options:
nettimeout=<timeout> (in seconds, or "none" or "max")
-p port
Specify the TCP port where the ldap server is listening. Deprecated in favor of -H.
-Q
Enable SASL Quiet mode. Never prompt.
-R realm
Specify the realm of authentication ID for SASL bind. The form of the realm depends on the actual SASL mechanism used.
-U authcid
Specify the authentication ID for SASL bind. The form of the ID depends on the actual SASL mechanism used.
-v
Run in verbose mode, with many diagnostics written to standard output.
-V
Print version info and usage message. If -VV is given, only the version information is printed.
-w passwd
Use passwd as the password for simple authentication.
-W
Prompt for simple authentication. This is used instead of specifying the password on the command line.
-x
Use simple authentication instead of SASL.
-X authzid
Specify the requested authorization ID for SASL bind. authzid must be one of the following formats: dn:<distinguished name> or u:<username>
-y file
Use complete contents of file as the password for simple authentication.
-Y mech
Specify the SASL mechanism to be used for authentication. Without this option, the program will choose the best mechanism the server knows.
-Z[Z]
Issue StartTLS (Transport Layer Security) extended operation. Giving it twice ( -ZZ) will require the operation to be successful.