ldapwhoami is an OpenLDAP command-line utility used to determine the identity that the LDAP server sees after authentication.

It is commonly used to:

• verify authentication credentials
• test LDAP bind operations
• confirm SASL identity mappings
• troubleshoot authentication issues

The command performs a Who Am I? extended operation against the LDAP server and returns the authorization identity.

Basic Syntax

ldapwhoami [options]

ldapwhoami -x -H ldap://ldap.example.com -D "cn=admin,dc=example,dc=com" -W

Example Using LDAP

This example authenticates using a standard LDAP connection.

ldapwhoami -x -H ldap://ldap.example.com -D "uid=jdoe,ou=people,dc=example,dc=com" -W

dn:uid=jdoe,ou=people,dc=example,dc=com

Example Using LDAPS (Secure LDAP)

If your LDAP server requires TLS encryption, use ldaps. ldaps typically uses port 636

ldapwhoami -x -H ldaps://ldap.example.com -D "uid=jdoe,ou=people,dc=example,dc=com" -W

Administrators often use ldapwhoami to verify local administrative access using the ldapi socket and SASL EXTERNAL authentication.

ldapwhoami -Y EXTERNAL -H ldapi:///

dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

Testing Authentication Without a Bind DN

ldapwhoami can also test anonymous authentication.

ldapwhoami -x -H ldap://ldap.example.com

anonymous

If anonymous binds are disabled, you may see:

ldap_bind: Inappropriate authentication (48)
additional info: anonymous bind disallowed

Verbose Output

To display additional diagnostic information, use the -v option.

ldapwhoami -v -x -H ldap://ldap.example.com -D "uid=jdoe,ou=people,dc=example,dc=com" -W

Using SASL Authentication

If your LDAP environment uses SASL mechanisms such as GSSAPI (Kerberos), ldapwhoami can confirm the authenticated identity.

Example:

ldapwhoami -Y GSSAPI -H ldap://ldap.example.com

dn:uid=jdoe,ou=people,dc=example,dc=com

This confirms the Kerberos-authenticated identity.

Troubleshooting Authentication

ldapwhoami is frequently used to diagnose authentication issues.

Common checks include:

• verifying credentials
• confirming SASL mappings
• validating TLS connections
• confirming authorization identity

Example troubleshooting command:

ldapwhoami -v -x -H ldaps://ldap.example.com -D "uid=jdoe,ou=people,dc=example,dc=com" -W

Common Errors

Invalid credentials

ldap_bind: Invalid credentials (49)

The password or bind DN is incorrect.

Anonymous bind disallowed

ldap_bind: Inappropriate authentication (48)
additional info: anonymous bind disallowed

Cannot contact server

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Possible causes include:

• network issues
• incorrect hostname
• TLS certificate problems

More information on using ldapwhoami can be found here.