LDAP: How to bind via system ID/Password and then user ID/password for Authorization?

Question

This command works and give me back a large response with all sorts of information about user with user ID XXXXXXX.

ldapsearch -D 'uid=<system ID>,ou=system,ou=users,dc=<domain>,dc=com' -x -H '<ldap server address>' -w '<system ID password> -b 'ou=users,dc=<domain>,dc=com' 'uid=XXXXXXX'

However I was told to first bind with the system ID, and then "rebind" with the user's UID/password to check if that user can be authorized.

Is this possible with the ldapsearch command? Maybe it's possible to just use the user's ID/password to bind instead of the initial bind with System ID/password?

EDIT: I think section 2.4.3.3 is what I am trying to convey.

Answer 1

There is no built-in ldapsearch feature to do this in one step. What you're describing is application-specific logic; it's very commonly implemented in various LDAP-using software, but would require two ldapsearch invocations if you're trying to do the same via CLI, just as it requires creating two LDAP sessions through the API.

If you already know the user's full LDAP DN, then yes, you can just use it in the -D parameter.

However, if you only know the uid but not the entire DN, then you will need to search for it first (as you're doing right now), then manually copy the 'dn' from the search output and call ldapsearch a second time, with the user's DN specified as -D.

---

(One exception: If the LDAP server runs Active Directory, then it'll accept "user@domain" UPNs as well as "DOMAIN\user" in place of the DN, so you can use -D 'XXXXXXX@<domain>.com'. This is not a general LDAP feature, however, and I wouldn't rely on it.)