Identity Manager: Differences Between ldapsearch and etautil Tools

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article clarifies the architectural and functional differences between the ldapsearch and etautil utilities within the Identity Manager environment. Understanding these differences ensures appropriate tool selection and prevents potential data corruption within the Provisioning Directory.

Environment

Identity Manager 14.5

Cause

Users often inquire about the overlapping utility of LDAP-based tools versus the native etautil wrapper when managing the Provisioning Server.

Resolution

1. Understand Tool Architecture:
   • etautil: Functions as a proprietary wrapper around standard LDAP utilities (ldapsearch, ldapadd, ldapmodify, ldapdelete). It is designed specifically to interface with the Provisioning Server (default port: 20389).
   • ldapsearch: A generic LDAP client utility. It can connect to both the Provisioning Server (port 20389) and the Provisioning Directory (port 20391).
2. Operational Guidelines:
   • Performance: Accessing the Provisioning Directory directly via ldapsearch is faster than querying the Provisioning Server, as it avoids the abstraction layer.
   • Safety Warning: Never attempt to use standard LDAP utilities to modify data directly within the Provisioning Directory (port 20391). Doing so bypasses the Provisioning Server’s logic and may result in permanent data corruption.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.