# Fetch rootdse from LDAP server

**URL:** <https://forum.ansible.com/t/fetch-rootdse-from-ldap-server/35644>\
**Category:** Ansible Project\
**Created:** [August 19, 2021, 7:22pm UTC](https://forum.ansible.com/t/fetch-rootdse-from-ldap-server/35644 "2021-08-19T19:22:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mark.tovey](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mark.tovey](https://forum.ansible.com/u/mark.tovey)\
**Post date:** [August 19, 2021, 7:22pm UTC](https://forum.ansible.com/t/fetch-rootdse-from-ldap-server/35644/1 "2021-08-19T19:22:41Z")

</div>

I am trying to use community.general.ldap\_search to return the RootDSE from a LDAP server (RedHat Directory Server). The LDAP server is configured to allow anonymous access to the RootDSE (nsslapd-allow-anonymous-access: rootdse) and I can retrieve it with ldapsearch:

ldapsearch -LLL -x -H ldap://myldapserver.example.com -b ‘’ -s base defaultnamingContext  
dn:  
defaultnamingContext: dc=mysrv,dc=example,dc=com

But I am unable to duplicate that with the ldap\_search module:

ansible localhost -m community.general.ldap\_search -a "server\_uri=‘ldap://myldapserver.example.com’ validate\_certs=false bind\_dn=‘’ dn=‘dn:’ scope=base "

localhost | FAILED! =\> {  
“changed”: false,  
“details”: “{‘info’: ‘Anonymous access is not allowed.’, ‘desc’: ‘Inappropriate authentication’}”,  
“invocation”: {  
“module\_args”: {  
“attrs”: null,  
“bind\_dn”: “”,  
“bind\_pw”: “”,  
“dn”: “dn:”,  
“filter”: “(objectClass=\*)”,  
“referrals\_chasing”: “anonymous”,  
“sasl\_class”: “external”,  
“schema”: false,  
“scope”: “base”,  
“server\_uri”: “ldap://myldapserver.example.com”,  
“start\_tls”: false,  
“validate\_certs”: false  
}  
},  
“msg”: “Attribute action failed.”  
}

So how can I retrieve the RootDSE with ldap\_search? Has anyone else had success with this or am I going to be forced to shell out to ldapsearch?

---

<div class="post-metadata">

**Author:** ![Melvin\_Satheesan](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Melvin\_Satheesan](https://forum.ansible.com/u/Melvin_Satheesan)\
**Post date:** [August 19, 2021, 7:25pm UTC](https://forum.ansible.com/t/fetch-rootdse-from-ldap-server/35644/2 "2021-08-19T19:25:32Z")

</div>

Whether your service account has sufficient privilege? What does it say while triggering in debug mode?

---

<div class="post-metadata">

**Author:** ![mark.tovey](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@mark.tovey](https://forum.ansible.com/u/mark.tovey)\
**Post date:** [August 20, 2021, 2:07pm UTC](https://forum.ansible.com/t/fetch-rootdse-from-ldap-server/35644/3 "2021-08-20T14:07:31Z")

</div>

I found the answer:

ansible localhost -m community.general.ldap\_search -a “server\_uri=‘ldap://myldapserver.example.com’ validate\_certs=false bind\_dn=‘’ dn=‘’ scope=base attrs=defaultnamingcontext”

localhost | SUCCESS =\> {  
“changed”: false,  
“results”: [  
{  
“defaultnamingcontext”: “dc=mysrv,dc=example,dc=com”,  
“dn”: “”  
}  
]  
}

Leave the bind\_dn null and the ldap\_search module converts that to anonymous. And leave dn null to specify the RootDSE.