Using ldapsearch to find things in the active directory

I'm trying to use SLES 9's ldapsearch command to access a Windows 2003 Active
Directory system. I have not disabled anonymous LDAP operations, so want to
provide credentials in the ldapsearch command. I also have not (yet) enabled
SSL on the AD system.

I've tried various incantations of:

ldapsearch -vvv -h {AD system} -x -s base

but keep getting the dreaded, "In order to perform this operation a
successful bind must be completed on the connection" message.

I've stared at the ldapsearch man page, but I'm not seeing qualifiers that
do what I need.

What am I missing?

Thanks
tl

tl wrote:
> I'm trying to use SLES 9's ldapsearch command

So this is OpenLDAP. You can find out the version of OpenLDAP with this
command:

rpm -qf `which ldapsearch`

> to access a Windows 2003 Active
> Directory system. I have not disabled anonymous LDAP operations, so want to
> provide credentials in the ldapsearch command.
>
> I've tried various incantations of:
>
> ldapsearch -vvv -h {AD system} -x -s base

This is anonymous access. Try -D and together with -w or -W. Ask the AD
admin for an account with bind-DN and password.

> but keep getting the dreaded, "In order to perform this operation a
> successful bind must be completed on the connection" message.

AD does not allow anonymous access.

> I've stared at the ldapsearch man page, but I'm not seeing qualifiers that
> do what I need.

From the ldapsearch man page:

-D binddn
Use the Distinguished Name binddn to bind to the LDAP
directory.

-W Prompt for simple authentication. This is used instead of
specifying
the password on the command line.

-w passwd
Use passwd as the password for simple authentication.

Note that with OpenLDAP's ldapsearch option -D requires a real
distinguished name (not only a UPN). For simple bind you have to find it
out prior of binding.

You could also use SASL with DIGEST-MD5 and then use options -Y and -U.
Check out the man page.

Something like this (haven't tried it):

ldapsearch -h {AD system} -s base -Y DIGEST-MD5 -U {user's UPN}

Ciao, Michael.