Unmasking the LDAP Search Filter - Page 3

LDAP attributes values may include special characters. These include \ (backslash), * (asterisk), and several others depending on the LDAP flavor. To include these characters in your search you must preface the desired character with the escape sequence. For example, (sn=hodges\5cSmith) will search on the string hodge\smith. For more detailed information on how to incorporate special characters in a search, review the Microsoft search filter reference listed below.

LDAP version 3 provides you the capability of building your match operators and rules for a particular attribute or object. Once these are created, they can be referred to in your search string. (sn:2.4.6.8.444:=foutley) for example compares entries with a surname of foutley using the matching rule designated by (in this case fictional) OID 2.4.6.8.444. These matching rules typically relate to syntax and text case of matching entries. There is an LDAP draft — draft-ietf-ldapbis-syntaxes specifically for syntaxes and matching rules. An optional (:dn) argument can be used to search the distinguished name attribute as well. (sn:dn:2.4.6.8.444:=foutley)searches surname and distinguished name for records containing foutley.

Error Codes
In addition to the operators and syntax rules listed above, there are also a large number of error messages and result codes to help you refine and debug your searches. For a complete list of the error messages and their meanings, see the Netscape reference below. Here are just a few of the most useful ones:

• A result code of 0 means a successful operation.
• A result code of 18 means that you used a matching rule that does not exist for a particular attribute.
• A result code of 50 means you do not have the rights to perform an operation.

Next Time on LDAP Searches
So far, in these two articles, we have presented a high-level overview of LDAP searches. As you can see, LDAP searches are not all that complicated. You do not need to be a full-time coding geek to employ this useful tool. Next time, in part 3, we'll discuss how to use LDAP searches in URLs, e-mail and in the command line. We will conclude the series with an introduction to LDAP browsers. Until next time, happy searching!

Additional Resources
Overviews
www.hawaii.edu/brownbags/ldap/ldap2.pdf — Good presentation on LDAP and LDAP search.
http://www.hawaii.edu/ldap/details.html — Good overview of LDAP URL syntax with examples.
http://java.sun.com/products/jndi/tutorial/basics/directory/filter.html — Sun overview on search filters.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/search_filter_syntax.asp — Overview of search filters including special characters.
http://developer.netscape.com/docs/manuals/dirsdk/csdk30/error.htm — Netscape list of LDAP v3 compliant and custom error codes.

LDAP Public Directories
http://www.emailman.com/ldap/public.html — List of public directories that you can use for testing queries.

OIDs
http://www.alvestrand.no//objectid/ — Great overview on registering OIDs and listing those already defined.

RFCs
http://perl-ldap.sourceforge.net/rfc.html — One location (of many) to find LDAP

RFCs
http://www.ietf.org/ids.by.wg/ldapbis — One of the IETF standard groups that are revising the LDAP v3 protocol. Also has an active mailing list you can join.