Re: Antw: Re: [Q] amendments to schemes existent

[Andrew Findlay <andrew.findlay@skills-1st.co.uk>]

On Fri, Oct 20, 2017 at 01:08:01PM +0300, Zeus Panchenko wrote:

> 1. search works with filter: (authorizedService=mail@hh001.umidb)
>    (and without index it returns empty result)

That is odd. Th eindex should only be a performance thing - it should
not change the results at all. You need to be very careful about using
slapindex whenever you change the list of indexes.

> 4. search (unexpectedly) does not work at all with filter: (authorizedService:caseIgnoreSubstringsMatch:=mail@hh001.umi*)
> 
>    # base <ou=People,dc=umidb> with scope subtree
>    # filter: (authorizedService:caseIgnoreSubstringsMatch:=mail@hh001.umi*)
>    # requesting: authorizedService uid
>    #
>    
>    ldap_search_ext: Bad search filter (-7)

That surprised me, so I asked around at LDAPCon today. Howard points
out that '*' is not encoded on the wire: it just triggers a specific
search form - in this case sub-initial. It may be that you cannot
request sub-initial or sub-final with this syntax :-(

Try this:

 (authorizedService:caseIgnoreSubstringsMatch:=mail@hh001.umi)

The idea is that it should trigger an 'any substring' (i.e. 'contains')
search.

Andrew
-- 
-----------------------------------------------------------------------
|                 From Andrew Findlay, Skills 1st Ltd                 |
| Consultant in large-scale systems, networks, and directory services |
|     http://www.skills-1st.co.uk/                +44 1628 782565     |
-----------------------------------------------------------------------