Question:

How to query from the UNIX client for all Zones and machines in those Zones using ldapsearch?

Answer:

#Get all Centrify Zones

/usr/share/centrifydc/bin/ldapsearch -m -QQQ -LLL -H LDAP:// -b "dc=centrify,dc=dt" "(&(|(displayName=\$cimszoneversion*))(objectclass=container))" dn | egrep -v '(\#|^$)'

To search for all computers in a particular zone, add CN=Computers in front of the zone's DN (e.g. -b "CN=Computers,$ZoneDN") and run the command below:

#Get all machines for a given Zone

/usr/share/centrifydc/bin/ldapsearch -m -QQQ -LLL -H LDAP:// -b "CN=Computers,$ZONEDN” "(&(displayName=\$cimscomputerversion*)(objectclass=serviceConnectionPoint))" dn | egrep -v '(\#|^$)'

The script can be easily modified for users and groups, but note that the cimsversion filter will need to be updated from what is shown above.