4

I have a file with a list of users. I would like to query our company's ldap to check if the users on my list are still existing accounts on the company's ldap server.

The bash script would essentially, use the file to use the names to check with ldaps 'cn', then possibly output/print to the results to identify which names no longer exist.

It sounds simple, and I'm familiar with doing basic ldapsearch commands, but not sure how I would begin scripting this out.

Appreciate all the help!

whipper25
  • 41
  • 2
  • Read the user list from your file and call ldapsearch. This post may help you: https://stackoverflow.com/a/41646525/6862601 – codeforester May 09 '18 at 19:13

1 Answers1

1

I have done this exact task and my approach is this: Do the ldapsearch query and get all emails for valid users in ldap. Convert to lower case, sort, remove duplicates and store in a file. Do the same with your list of users you want to check. Then use comm to find any emails that are not in the list from LDAP. This method should be the fastest unless you have a large number of LDAP records. Here is the code:

LDAP_SERVER="ldap://YOUR.LDAP.SERVER:389"
LDAP_USER="QUERY_USER_NAME"
LDAP_PASSWORD="QUERY_PASSWORD"

ldapsearch -E pr=1000/noprompt -LLL -o ldif-wrap=no -x \
    -b 'dc=example,dc=com' \
    -H $LDAP_SERVER -D $LDAP_USER -w $LDAP_PASSWORD \
    '(&(objectCategory=person)(objectClass=user)(Mail=*))' mail |\
    awk '/^mail:/{print $2}' |\
    tr '[:upper:]' '[:lower:]' |\
    sort -u >ldap_emails

cat user_list |\
    tr '[:upper:]' '[:lower:]' |\
    sort -u >user_emails

comm -13 ldap_emails user_emails
Jay
  • 11
  • 1