LDAP filter to search for a DN

LDAP filters are powerful but I can't figure out how to search an object based on DN. Already I have many filter that search for objects but searching for DN does not seem to be supported.

So for example I have

&(objectclass=top)(uid=myspecialuser)(aci=*)

This will return an object with uid equal myspecialuser that has one or more aci attributes.

For reasons that I can't fully understand LDAP does allow one to search for an object using DN for example

&(objectclass=top)(dn=cn=myspecialuser,o=special,c=NL)

In fact it doesn't seem possible to select objects at all using a filter without having an unique attribute to search for it. Youi cannot search for DN at all.

Is this correct? That there are not filters that select based on DN?

1 Answer

The LDAP 'search' operation allows this – just not through the filter parameter, but through the base DN parameter (usually together with 'base' as the search scope). For example, instead of your typical "subtree" search...

base: o=Special,c=NL
scope: sub
filter: (&(uid=myspecialuser)(aci=*))

...you would select a specific entry like this:

base: cn=My special user,o=Special,c=NL
scope: basefilter: (objectClass=*)

The 'base' scope prevents the search from returning any unwanted child entries, so you only get exactly the DN that you asked for.

(However, it doesn't add any magic besides that – you can specify any base with any scope.)

It is true that in standard LDAP you cannot write filters matching specific DNs, so if you wanted to retrieve multiple entries, you'd need to issue multiple 'base' search queries, one for each DN. (This isn't generally a problem because you can send a bunch of requests asynchronously, then await for all of them at once.)

However, some implementations have custom operational attributes containing the entry's DN, which can be matched against.

• For example, Active Directory has the distinguishedName operational attribute:

  filter: (|(distinguishedName=cn=My special user,o=Special,c=NL) (distinguishedName=cn=Other special user,o=Special,c=NL))

• Similarly, OpenLDAP has the entryDN opreational attribute.

• 389 Directory Server seems to have entryDN but I haven't actually checked whether it can be searched against.

To see all operational attributes of an entry, just make a regular search but specify the + wildcard in the "wanted attributes" parameter (instead of the usual *).

As a side note, there is a filter syntax which allows matching against individual DN attributes, but it isn't universally supported; in particular you cannot use it with Active Directory (but you can in OpenLDAP). For example, (o:dn:=Special) would match all entries which have o=Special anywhere in their DN, even if it's not present in the entry itself; in other words it would match all children of o=Special.