14.4. LDAP Search Filters
ldapsearch
command-line utility. When using ldapsearch
, there can be multiple search filters in a file, with each filter on a separate line in the file, or a search filter can be specified directly on the command line.
attribute operator value
buildingname>=alpha
buildingname
is the attribute, >=
is the operator, and alpha
is the value. Filters can also be defined that use different attributes combined together with Boolean operators.
Note
l
and ends with the letter n
, enter a l*n
in the value portion of the search filter. Similarly, to search for all attribute values beginning with the letter u
, enter a value of u*
in the value portion of the search filter.
\5c2a
. For example, to search for all employees with businessCategory
attribute values of Example*Net product line
, enter the following value in the search filter:
Example\5c2a*Net product line
Note
uid=bjensen,ou=People,dc=example,dc=com
, then a search for dc=example
does not match that entry unless dc:example
has explicitly been added as an attribute in that entry.
14.4.1. Using Attributes in Search Filters
manager
attribute:
"(manager=*)"
"(cn=babs jensen)"
"(cn=babs jensen)"
filter:
cn: babs jensen cn;lang-fr: babs jensen
"(description=*X.500*)" "(sn=*nderson)" "(givenname=car*)"
14.4.2. Using Operators in Search Filters
"(employeeNumber>=500)" "(sn~=suret)" "(salary<=150000)"
Table 14.1. Search Filter Operators
Search Type | Operator | Description |
---|---|---|
Equality | = | Returns entries containing attribute values that exactly match the specified value. For example, cn=Bob Johnson |
Substring | =string* string | Returns entries containing attributes containing the specified substring. For example, cn=Bob* cn=*Johnson cn=*John* cn=B*John . The asterisk (*) indicates zero (0) or more characters. |
Greater than or equal to | >= | Returns entries containing attributes that are greater than or equal to the specified value. For example, buildingname >= alpha . |
Less than or equal to | <= | Returns entries containing attributes that are less than or equal to the specified value. For example, buildingname <= alpha . |
Presence | =* | Returns entries containing one or more values for the specified attribute. For example, cn=* telephoneNumber=* manager=* . |
Approximate | ~= | Returns entries containing the specified attribute with a value that is approximately equal to the value specified in the search filter. For example, cn~=suret l~=san fransico could return cn=sarette l=san francisco . |
14.4.3. Using Compound Search Filters
(Boolean-operator(filter)(filter)(filter)...)
(!(cn=Ray Kultgen)) (!(objectClass=person))
(Boolean-operator(filter)((Boolean-operator(filter)(filter)))
Marketing
and whose description field does not contain the substring X.500
:
(&(ou=Marketing)(!(description=*X.500*)))
Marketing
, that do not have the substring X.500
, and that have Julie Fulmer or Cindy Zwaska as a manager:
(&(ou=Marketing)(!(description=*X.500*))(|(manager=cn=Julie Fulmer,ou=Marketing,dc=example,dc=com)(manager=cn=Cindy Zwaska,ou=Marketing,dc=example,dc=com)))
printer3b
:
(&(!(objectClass=person))(cn~=printer3b))
Table 14.2. Search Filter Boolean Operators
Operator | Symbol | Description |
---|---|---|
AND | & | All specified filters must be true for the statement to be true. For example, (&(filter)(filter)(filter)...). |
OR | | | At least one specified filter must be true for the statement to be true. For example, (|(filter)(filter)(filter)...) |
NOT | ! | The specified statement must not be true for the statement to be true. Only one filter is affected by the NOT operator. For example, (!(filter)). |
- Innermost to outermost parenthetical expressions first.
- All expressions from left to right.
14.4.4. Using Matching Rules
- EQUALITY specifies how to compare two values for an equal match. For example, how to handle strings like "Fred" and "FRED". Search filters that test for equality (for example, attribute=value) use the EQUALITY rule. Equality (eq) indexes use the EQUALITY rule to generate the index keys. Update operations use the EQUALITY rule to compare values to be updated with values already in an entry.
- ORDERING specifies how to compare two values to see if one value is greater or less than another value. Search filters that set a range (for example, attribute<=value or attribute>=value) use the ORDERING rule. An index for an attribute with an ORDERING rule orders the equality values.
- SUBSTR specifies how to do substring matching. Substring search filters (for example, attribute=*partial_string* or attribute=*end_string) use the SUBSTR rule. Substring (sub) indexes use the SUBSTR rule to generate the index keys.
Important
Example 14.1. Matching Rules and Custom Attributes
MyFirstName
with IA5 String (7-bit ASCII) syntax and an EQUALITY matching rule of caseExactIA5Match. An entry with a MyFirstName
value of Fred
is returned in a search with a filter of (MyFirstName=Fred)
, but it is not returned for filters like (MyFirstName=FRED)
and (MyFirstName=fred)
Fred
, FRED
, and fred
are all valid IA5 String values, but they do not match using the caseExactIA5Match rule.
MyFirstName
should be defined to use the caseIgnoreIA5Match matching rule.
(MyFirstName:caseIgnoreIA5Match:
=fred)
Note
Note
nsMatchingRule
attribute, as in Section 13.2.2, “Creating Indexes from the Command Line”.
attr:matchingRule:=value
- attr is an attribute belonging to entries being searched, such as
cn
ormail
. - matchingRule is a string that contains the name or OID of the rule to use to match attribute values according to the required syntax.
- value is either the attribute value to search for or a relational operator plus the attribute value to search for. The syntax of the value of the filter depends on the matching rule format used.
2.16.840.1.113730.3.3.2.17.1
identifies the Finnish collation order.
Note
- Bitwise AND match
- Performs bitwise
AND
matches.OID: 1.2.840.113556.1.4.803Compatible syntaxes: Typically used withInteger
and numeric strings. Directory Server converts numeric strings automatically to integer. - Bitwise OR match
- Performs bitwise
OR
matches.OID: 1.2.840.113556.1.4.804Compatible syntaxes: Typically used withInteger
and numeric strings. Directory Server converts numeric strings automatically to integer. - booleanMatch
- Evaluates whether the values to match are
TRUE
orFALSE
OID: 2.5.13.13Compatible syntaxes: Boolean - caseExactIA5Match
- Makes a case-sensitive comparison of values.OID: 1.3.6.1.4.1.1466.109.114.1Compatible syntaxes:
IA5
Syntax, URI - caseExactMatch
- Makes a case-sensitive comparison of values.OID: 2.5.13.5Compatible syntaxes: Directory String, Printable String, OID
- caseExactOrderingMatch
- Allows case-sensitive ranged searches (less than and greater than).OID: 2.5.13.6Compatible syntaxes: Directory String, Printable String, OID
- caseExactSubstringsMatch
- Performs case-sensitive substring and index searches.OID: 2.5.13.7Compatible syntaxes: Directory String, Printable String, OID
- caseIgnoreIA5Match
- Performs case-insensitive comparisons of values.OID: 1.3.6.1.4.1.1466.109.114.2Compatible syntaxes:
IA5
Syntax, URI - caseIgnoreIA5SubstringsMatch
- Performs case-insensitive searches on substrings and indexes.OID: 1.3.6.1.4.1.1466.109.114.3Compatible syntaxes:
IA5
Syntax, URI - caseIgnoreListMatch
- Performs case-insensitive comparisons of values.OID: 2.5.13.11Compatible syntaxes: Postal address
- caseIgnoreListSubstringsMatch
- Performs case-insensitive searches on substrings and indexes.OID: 2.5.13.12Compatible syntaxes: Postal address
- caseIgnoreMatch
- Performs case-insensitive comparisons of values.OID: 2.5.13.2Compatible syntaxes: Directory String, Printable String, OID
- caseIgnoreOrderingMatch
- Allows case-insensitive ranged searches (less than and greater than).OID: 2.5.13.3Compatible syntaxes: Directory String, Printable String, OID
- caseIgnoreSubstringsMatch
- Performs case-insensitive searches on substrings and indexes.OID: 2.5.13.4Compatible syntaxes: Directory String, Printable String, OID
- distinguishedNameMatch
- Compares distinguished name values.OID: 2.5.13.1Compatible syntaxes: Distinguished name (DN)
- generalizedTimeMatch
- Compares values that are in a Generalized Time format.OID: 2.5.13.27Compatible syntaxes: Generalized Time
- generalizedTimeOrderingMatch
- Allows ranged searches (less than and greater than) on values that are in a Generalized Time format.OID: 2.5.13.28Compatible syntaxes: Generalized Time
- integerMatch
- Evaluates integer values.OID: 2.5.13.14Compatible syntaxes: Integer
- integerOrderingMatch
- Allows ranged searches (less than and greater than) on integer values.OID: 2.5.13.15Compatible syntaxes: Integer
- keywordMatch
- Compares the given search value to a string in an attribute value.OID: 2.5.13.33Compatible syntaxes: Directory String
- numericStringMatch
- Compares more general numeric values.OID: 2.5.13.8Compatible syntaxes: Numeric String
- numericStringOrderingMatch
- Allows ranged searches (less than and greater than) on more general numeric values.OID: 2.5.13.9Compatible syntaxes: Numeric String
- numericStringSubstringMatch
- Compares more general numeric values.OID: 2.5.13.10Compatible syntaxes: Numeric String
- objectIdentifierMatch
- Compares object identifier (OID) values.OID: 2.5.13.0Compatible syntaxes: OID
- octetStringMatch
- Evaluates octet string values.OID: 2.5.13.17Compatible syntaxes: Octet String
- octetStringOrderingMatch
- Supports ranged searches (less than and greater than) on a series of octet string values.OID: 2.5.13.18Compatible syntaxes: Octet String
- telephoneNumberMatch
- Evaluates telephone number values.OID: 2.5.13.20Compatible syntaxes: Telephone Number
- telephoneNumberSubstringsMatch
- Performs substring and index searches on telephone number values.OID: 2.5.13.21Compatible syntaxes: Telephone Number
- uniqueMemberMatch
- Compares both name and UID values.OID: 2.5.13.23Compatible syntaxes: Name and Optional UID
- wordMatch
- Compares the given search value to a string in an attribute value. This matching rule is case-insensitive.OID: 2.5.13.32Compatible syntaxes: Directory String
Table 14.3. Language Ordering Matching Rules
Matching Rule | Object Identifiers (OIDs) |
---|---|
English (Case Exact Ordering Match) | 2.16.840.1.113730.3.3.2.11.3 |
Albanian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.44.1 |
Arabic (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.1.1 |
Belorussian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.2.1 |
Bulgarian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.3.1 |
Catalan (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.4.1 |
Chinese - Simplified (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.49.1 |
Chinese - Traditional (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.50.1 |
Croatian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.22.1 |
Czech (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.5.1 |
Danish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.6.1 |
Dutch (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.33.1 |
Dutch - Belgian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.34.1 |
English - US (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.11.1 |
English - Canadian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.12.1 |
English - Irish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.14.1 |
Estonian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.16.1 |
Finnish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.17.1 |
French (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.18.1 |
French - Belgian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.19.1 |
French - Canadian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.20.1 |
French - Swiss (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.21.1 |
German (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.7.1 |
German - Austrian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.8.1 |
German - Swiss (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.9.1 |
Greek (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.10.1 |
Hebrew (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.27.1 |
Hungarian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.23.1 |
Icelandic (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.24.1 |
Italian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.25.1 |
Italian - Swiss (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.26.1 |
Japanese (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.28.1 |
Korean (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.29.1 |
Latvian, Lettish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.31.1 |
Lithuanian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.30.1 |
Macedonian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.32.1 |
Norwegian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.35.1 |
Norwegian - Bokmul (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.36.1 |
Norwegian - Nynorsk (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.37.1 |
Polish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.38.1 |
Romanian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.39.1 |
Russian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.40.1 |
Serbian - Cyrillic (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.45.1 |
Serbian - Latin (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.41.1 |
Slovak (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.42.1 |
Slovenian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.43.1 |
Spanish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.15.1 |
Swedish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.46.1 |
Turkish (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.47.1 |
Ukrainian (Case Insensitive Ordering Match) | 2.16.840.1.113730.3.3.2.48.1 |
Table 14.4. Language Substring Matching Rules
Matching Rule | Object Identifiers (OIDs) |
---|---|
English (Case Exact Substring Match) | 2.16.840.1.113730.3.3.2.11.3.6 |
Albanian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.44.1.6 |
Arabic (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.1.1.6 |
Belorussian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.2.1.6 |
Bulgarian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.3.1.6 |
Catalan (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.4.1.6 |
Chinese - Simplified (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.49.1.6 |
Chinese - Traditional (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.50.1.6 |
Croatian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.22.1.6 |
Czech (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.5.1.6 |
Danish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.6.1.6 |
Dutch (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.33.1.6 |
Dutch - Belgian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.34.1.6 |
English - US (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.11.1.6 |
English - Canadian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.12.1.6 |
English - Irish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.14.1.6 |
Estonian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.16.1.6 |
Finnish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.17.1.6 |
French (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.18.1.6 |
French - Belgian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.19.1.6 |
French - Canadian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.20.1.6 |
French - Swiss (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.21.1.6 |
German (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.7.1.6 |
German - Austrian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.8.1.6 |
German - Swiss (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.9.1.6 |
Greek (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.10.1.6 |
Hebrew (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.27.1.6 |
Hungarian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.23.1.6 |
Icelandic (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.24.1.6 |
Italian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.25.1.6 |
Italian - Swiss (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.26.1.6 |
Japanese (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.28.1.6 |
Korean (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.29.1.6 |
Latvian, Lettish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.31.1.6 |
Lithuanian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.30.1.6 |
Macedonian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.32.1.6 |
Norwegian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.35.1.6 |
Norwegian - Bokmul (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.36.1.6 |
Norwegian - Nynorsk (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.37.1.6 |
Polish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.38.1.6 |
Romanian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.39.1.6 |
Russian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.40.1.6 |
Serbian - Cyrillic (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.45.1.6 |
Serbian - Latin (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.41.1.6 |
Slovak (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.42.1.6 |
Slovenian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.43.1.6 |
Spanish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.15.1.6 |
Swedish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.46.1.6 |
Turkish (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.47.1.6 |
Ukrainian (Case Insensitive Substring Match) | 2.16.840.1.113730.3.3.2.48.1.6 |