[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Practices : DN filtering alternatives
On Fri, 2009-06-05 at 12:28 +0200, Hallvard B Furuseth wrote:
> Lorenzo Pastrana writes:
> > I've been reading (and actually experienced) that DN, not being a full
> > class attribute, is not filterable (read : with wildcards / patterns).
>
> It's not an attribute at all. Written the same way as attributes
> in LDIF format and maybe some other stuff, that's all.
Ok.. thanks
> Wildcard matching wouldn't work too well with DN syntax,
Well, no rocket science here.. I guess it would work in our case..
> but OpenLDAP does support scope-based matching rules:
> distinguishedNameMatch (the usual EQUALITY matching rule, like scope=base),
> dnOneLevelMatch, dnSubtreeMatch, dnSubordinateMatch (other scopes),
> dnSuperiorMatch (inverse of dnSubordinateMatch).
I'm trying to filter out multiple sub-branches so scope based is not
enough here.
> > I've been thinking about 'duplicating' the DN in an attribute since the
> > hidden 'entryDN' attribute is not accessible either but that sounds ugly
> > and redundant to me.
>
> It's not hidden. It's an operational attribute, which means it's only
> returned if you explicitly ask for it in the list of attributes to
> return from a search.
Ah, great ... I'll try this, but your pattern below seems ok for the
filter I need and it works also with (uid:dn:=...) even if it's not
strictly the same.
> > If there is a commonly used alternative to filtering DNs I'd be glad
> to
> > hear.
>
> Use filters like '(entryDN:dnOneLevelMatch:=dc=example,dc=com)'.
Thanks a lot.
Lorenzo Pastrana
R&D Head @ Happy End
--------------------------
Web Shop
Multimédia Design
Visual Communication & Publishing
--------------------------
Tél.: +33 1 42 47 83 09
Fax.: +33 1 47 70 70 19
E-mail : lorenzo.pastrana@happyend.fr