Hi Benjamin, looks like you've messed up with the use of the backslashes (\) and unintentionally escaped some of the command switches for ldapsearch:
root@FreeRadius:~# LDAPTLS_CERT=/etc/freeradius/3.0/certs/ldap-client.crt LDAPTLS_KEY=/etc/freeradius/3.0/certs/ldap-client.key \ldapsearch -H ldaps://ldap.google.com:636 \ -b dc=foundationacademy,dc=net '(mail='benjamin.diehl@foundationacademy.net')'
You probably wanted to use "dc=foundationacademy,dc=net" as the search base (-b) '(mail='benjamin.diehl@foundationacademy.net')' as the search filter no special attritbute list What the server acutally received is: # extended LDIF # LDAPv3 # base <> (default) with scope subtree ^an empty search base (so the RootDSE is used as the default) because you've escaped the -b option # filter: (objectclass=*) ^ no specific search filter so the default of any object class is used # requesting: -b dc=foundationacademy,dc=net (mail=benjamin.diehl@foundationacademy.net) ^ a maleformed attribute list due to the messed up escapes, so the server is looking up the attributes: "-b" "dc=foundationacademy,dc=net" "(mail=benjamin.diehl@foundationacademy.net)" which do not exist and therefore the server only responds with the dn of the rootDSE node which is what your ldapsearch actually asked for: dn: (it might look a bit confusing and as if the search didn't return anything) # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 ^actually the search for 3 attributes (search: 3) was successful (result: 0 Success) and returned 1 entry (numEntries: 1) - the rootDSE "dn: " Even LDAP is nice sometimes and may tell you what happened (not to the extend of freeradius of course ;-)), but as always it takes time to see the information is actually there and even more experience to understand it. Sorry for the lengthy explanation which might be a bit off-topic for this list. I still hope it may help you and others with similar problems. To the concrete problem: eliminate all the backslashes from your ldapsearch and try this in one line: LDAPTLS_CERT=/etc/freeradius/3.0/certs/ldap-client.crt LDAPTLS_KEY=/etc/freeradius/3.0/certs/ldap-client.key ldapsearch -H ldaps://ldap.google.com:636 -b 'dc=foundationacademy,dc=net' '(mail=benjamin.diehl@foundationacademy.net)' and you might get a step further. You will also notice the change in the commented output of the search the server will have performed.