This topic deals with the syntax and rules for an LDAP filter, which is a normal string which expresses the criteria for the filter.
Basic LDAP Filter Syntax and Operators
LDAP filters consist of one or more criteria. If one than more criterion exist in one filter definition, they can be concatenated by logical AND or OR operators. The logical operators are always placed in front of the operands (i.e. the criteria). This is the so-called ‘Polish Notation‘.
The search criteria have to be put in parentheses and then the whole term has to be bracketed one more time.
AND Operation:
(& (…K1…) (…K2…)) or with more than two criteria: (& (…K1…) (…K2…) (…K3…) (…K4…))
OR Operation:
(| (…K1…) (…K2…)) or with more than two criteria: (| (…K1…) (…K2…) (…K3…) (…K4…))
Nested Operation:
Every AND/OR operation can also be understood as a single criterion:
(|(& (…K1…) (…K2…))(& (…K3…) (…K4…))) means: (K1 AND K2) OR (K3 AND K4)
The search criteria consist of a requirement for an LDAP attribute, e.g. (givenName=Sandra). Following rules should be considered:
| Equality: | (attribute=abc) , e.g. (&(objectclass=user)(displayName=Foeckeler) |
| Negation: | (!(attribute=abc)) , e.g. (!objectClass=group) |
| Presence: | (attribute=*) , e.g. (mailNickName=*) |
| Absence: | (!(attribute=*)) , e.g. (!proxyAddresses=*) |
| Greater than: | (attribute>=abc) , e.g. (mdbStorageQuota>=100000) |
| Less than: | (attribute<=abc) , e.g. (mdbStorageQuota<=100000) |
| Proximity: | (attribute~=abc) , e.g. (displayName~=Foeckeler) Caution: ~= is treated as = in ADS environments !! |
| Wildcards: | e.g. (sn=F*) or (mail=*@cerrotorre.de) or (givenName=*Paul*) |