Man pages › Compared with Linux and the BSDs

`ldapsearch(1)` on Solnix vs Linux and the BSDs

On Solnix, ldapsearch is the illumos tool at /usr/bin/ldapsearch. Many single-letter options differ from the NetBSD (OpenLDAP-style) page. The ones most likely to break scripts are -H, which prints usage on Solnix but takes an LDAP URI on NetBSD, and -c, -P and -V, which also mean different things.

The manual pages

Solnix: ldapsearch(1) from pkgs.solnix.illumos-world-man · illumos.org
NetBSD: ldapsearch(1) 11.0

What Solnix runs

A default Solnix system runs the illumos ldapsearch at /usr/bin/ldapsearch; the page is published by pkgs.solnix.illumos-world-man and no other variants are shipped. The bundle contains a counterpart page only for NetBSD, so there are no Linux, FreeBSD or OpenBSD statements below. The Solnix text in the bundle is trimmed partway through the options, so options after -r are not compared.

Differences

Compared with	Topic	What differs
NetBSD	`-H` meaning	Solnix `-H` displays the usage help, the same as `-?`. NetBSD `-H` ldapuri takes the URI(s) of the LDAP server(s). A script that passes `-H` ldap://host to Solnix ldapsearch will not connect as intended. Source: Solnix ldapsearch(1) -H, -?; NetBSD ldapsearch(1) -H
NetBSD	server selection	The Solnix page documents only `-h` ldaphost and `-p` ldapport for choosing the server, and describes them as the secure LDAP server. NetBSD adds `-H` ldapuri (one or more URIs) alongside `-h` and `-p`. Source: Solnix ldapsearch(1) SYNOPSIS, -h, -p; NetBSD ldapsearch(1) SYNOPSIS, -H
NetBSD	`-c` meaning	Solnix `-c` authzid sets the getEffectiveRights control authzid. NetBSD `-c` is continuous operation: it reports errors and carries on with the next search, which is useful with `-f`. A script using `-c` for that on Solnix will fail. Source: Solnix ldapsearch(1) -c; NetBSD ldapsearch(1) -c
NetBSD	`-V` and `-P` meaning	Solnix `-V` takes a version argument, and `-P` path names the client certificate database. NetBSD `-V`[V] prints version information, and `-P` {2\|3} selects the protocol version. Source: Solnix ldapsearch(1) SYNOPSIS (-V version), -P; NetBSD ldapsearch(1) -V, -P
NetBSD	output format: `-L`, `-B`, `-F`	On Solnix, LDIF output (`-L`) is the default. `-B` selects the old non-LDIF format. `-F` sep replaces the : separator and makes `-L` ignored. NetBSD has no `-B`, `-F` sets a URL prefix for temporary files, and `-L`, `-LL` and `-LLL` trim the extended LDIF. Source: Solnix ldapsearch(1) Output Format, -B, -F, -L; NetBSD ldapsearch(1) -F, -L
NetBSD	password file option	Solnix reads the bind password from a file with `-j` filename, which is mutually exclusive with `-w` and `-W`. NetBSD uses `-y` passwdfile for this. The NetBSD page also lists `-x` for simple authentication, and the visible Solnix text does not explain `-x`. Source: Solnix ldapsearch(1) -j; NetBSD ldapsearch(1) -y, -x
NetBSD	SASL and TLS option letters	Option letters for SASL and extensions differ. Solnix `-R` means do not follow referrals, `-O` is the referral hop limit, `-N` takes a certificate name, and SASL settings go in `-o` attributename=value. NetBSD `-R` is the SASL realm, `-O` is security properties, `-N` takes no argument, and `-o` is opt[=optparam]. Source: Solnix ldapsearch(1) -R, -O, -N, -o; NetBSD ldapsearch(1) SYNOPSIS, -R, -O, -N, -o
NetBSD	`-e` and `-E` meaning	Solnix `-e` minimizes base-64 encoding of values, and `-E` asks the server to report the bind identity. NetBSD `-e` and `-E` each take an [!]ext[=extparam] argument for search or general extensions. Source: Solnix ldapsearch(1) -e, -E; NetBSD ldapsearch(1) SYNOPSIS, -e, -E
NetBSD	filter default and attrs	The Solnix synopsis shows filter as required, and with no attrs all attributes are returned. NetBSD defaults the filter to (objectClass=) and returns all user attributes. It also documents for user attributes, + for operational attributes and 1.1 for none. The visible Solnix text does not mention these. Source: Solnix ldapsearch(1) SYNOPSIS, DESCRIPTION; NetBSD ldapsearch(1) DESCRIPTION
NetBSD	search scope default	NetBSD documents `-s` {base\|one\|sub\|children} with a default of sub. The Solnix synopsis has `-s` scope, but the visible Solnix text does not state a default or the allowed values, so check before relying on one. Source: NetBSD ldapsearch(1) -s; Solnix ldapsearch(1) SYNOPSIS
NetBSD	debug levels	Solnix lists numeric `-d` levels that add together (1 trace, 2 packets, 4 arguments, 32 filters, 128 access control), for example 33 for trace and filters. NetBSD says `-d` has no effect unless ldapsearch was compiled with LDAP_DEBUG defined. Source: Solnix ldapsearch(1) -d; NetBSD ldapsearch(1) -d

Standards

POSIX: ldapsearch is not a POSIX.1-2024 utility.
NetBSD: The filter should conform to the string representation for search filters defined in RFC 4515.
Solnix: The visible Solnix page text states no standard or interface stability level.

Writing portable scripts

Do not rely on -H, -c, -P, -V, -L or -F in scripts that must run on both Solnix and NetBSD: each means something different on the two systems.
Stick to options with matching meanings: -b searchbase, -s scope, -a deref, -D bindDN, -w passwd, -h host, -p port, -l timelimit, -z sizelimit, -f file, -A and -n. Always pass the filter explicitly.

Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.