D.5. Troubleshooting Matching Rules

International collation order matching rules may not behave consistently. Some forms of matching-rule invocation do not work correctly, producing incorrect search results. For example, the following rules do not work:
ldapsearch -x -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:2.16.840.1.113730.3.3.2.7.1:=passin"

ldapsearch -x -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:de:=passin"
However, the rules listed below will work (note the .3 before the passin value):
ldapsearch -x -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:2.16.840.1.113730.3.3.2.7.1.3:=passin"

ldapsearch -x -p 389 -D "uid=userID,ou=people,dc=example,dc=com" -w secret -b "dc=example,dc=com" "sn:de.3:=passin"