CODEWITHSUNDEEP
filterldapjndildap-query
Vladimir Matveev
Vladimir Matveev

Reputation: 127791

Writing LDAP query filter

I have trouble writing a filter for LDAP query.

I have two object classes - Person and Service. Database consists of a number of Persons, each having zero or more services as children. Each person has an identifier, personNumber attribute. I want to select several persons and all their services given person numbers. Is it possible to do so in one query?

For example, if we have the following set of objects:

                personNumber=1,ou=root,o=org
serviceNumber=1,personNumber=1,ou=root,o=org
serviceNumber=2,personNumber=1,ou=root,o=org
                personNumber=2,ou=root,o=org
serviceNumber=3,personNumber=2,ou=root,o=org
                personNumber=3,ou=root,o=org
serviceNumber=4,personNumber=3,ou=root,o=org

, is it possible, given person numbers 1 and 2, to retrieve these objects:

                personNumber=1,ou=root,o=org
serviceNumber=1,personNumber=1,ou=root,o=org
serviceNumber=2,personNumber=1,ou=root,o=org
                personNumber=2,ou=root,o=org
serviceNumber=3,personNumber=2,ou=root,o=org

but not these:

                personNumber=3,ou=root,o=org
serviceNumber=4,personNumber=3,ou=root,o=org

, using one query only? It is an example; it is possible to have more than two identifiers to load. They are not known a priori.

Also, is there a way to specify that attribute value should be in some collection of values, like IN (..) clause in SQL, other than generating big (|(a=..)(a=..)(a=..)..) filter?

Upvotes: 2

Views: 2123

Answers (2)

rene
rene

Reputation: 42444

If person doesn't have a multivalued attribute holding the service there is no way this can be returned in one ldapsearch. You'll need at least a two stage rocket: first select person, for each person check on childnodes.

AFAIK there is no IN operator in LDAP filters. The RFC is clear about that. So you're stuck with your tedious (|(a=s1)(a=s2)(a=s3)...) construct.

Upvotes: 1

Ted Shaw
Ted Shaw

Reputation: 2306

The answer is No, per RFC https://www.rfc-editor.org/rfc/rfc2254, there is NO such filter.If the IN list is very large and you have lots of people in ldap, you need write a simple paged query to get all results using (objectClass=Person) filter, and filter the result after retrial. if your code is written in Java, you can checkout unboundid LDAP SDK

Upvotes: 2

Related Questions