1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
<pre>Network Working Group T. Howes
Request for Comments: 1558 University of Michigan
Category: Informational December 1993
<span class="h1">A String Representation of LDAP Search Filters</span>
Status of this Memo
This memo provides information for the Internet community. This memo
does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.
Abstract
The Lightweight Directory Access Protocol (LDAP) [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>] defines a
network representation of a search filter transmitted to an LDAP
server. Some applications may find it useful to have a common way of
representing these search filters in a human-readable form. This
document defines a human-readable string format for representing LDAP
search filters.
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. LDAP Search Filter Definition</span>
An LDAP search filter is defined in [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>] as follows:
Filter ::= CHOICE {
and [0] SET OF Filter,
or [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>] SET OF Filter,
not [<a href="#ref-2" title=""The String Representation of Standard Attribute Syntaxes"">2</a>] Filter,
equalityMatch [<a href="#ref-3" title=""Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1)"">3</a>] AttributeValueAssertion,
substrings [4] SubstringFilter,
greaterOrEqual [5] AttributeValueAssertion,
lessOrEqual [6] AttributeValueAssertion,
present [7] AttributeType,
approxMatch [8] AttributeValueAssertion
}
SubstringFilter ::= SEQUENCE {
type AttributeType,
SEQUENCE OF CHOICE {
initial [0] LDAPString,
any [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>] LDAPString,
final [<a href="#ref-2" title=""The String Representation of Standard Attribute Syntaxes"">2</a>] LDAPString
}
}
<span class="grey">Howes [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc1558">RFC 1558</a> Representation of LDAP Filters December 1993</span>
AttributeValueAssertion ::= SEQUENCE
attributeType AttributeType,
attributeValue AttributeValue
}
AttributeType ::= LDAPString
AttributeValue ::= OCTET STRING
LDAPString ::= OCTET STRING
where the LDAPString above is limited to the IA5 character set. The
AttributeType is a string representation of the attribute object
identifier in dotted OID format (e.g., "2.5.4.10"), or the shorter
string name of the attribute (e.g., "organizationName", or "o"). The
AttributeValue OCTET STRING has the form defined in [<a href="#ref-2" title=""The String Representation of Standard Attribute Syntaxes"">2</a>]. The Filter
is encoded for transmission over a network using the Basic Encoding
Rules defined in [<a href="#ref-3" title=""Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1)"">3</a>], with simplifications described in [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. String Search Filter Definition</span>
The string representation of an LDAP search filter is defined by the
following BNF. It uses a prefix format.
<filter> ::= '(' <filtercomp> ')'
<filtercomp> ::= <and> | <or> | <not> | <item>
<and> ::= '&' <filterlist>
<or> ::= '|' <filterlist>
<not> ::= '!' <filter>
<filterlist> ::= <filter> | <filter> <filterlist>
<item> ::= <simple> | <present> | <substring>
<simple> ::= <attr> <filtertype> <value>
<filtertype> ::= <equal> | <approx> | <greater> | <less>
<equal> ::= '='
<approx> ::= '~='
<greater> ::= '>='
<less> ::= '<='
<present> ::= <attr> '=*'
<substring> ::= <attr> '=' <initial> <any> <final>
<initial> ::= NULL | <value>
<any> ::= '*' <starval>
<starval> ::= NULL | <value> '*' <starval>
<final> ::= NULL | <value>
<attr> is a string representing an AttributeType, and has the format
defined in [<a href="#ref-1" title=""Lightweight Directory Access Protocol"">1</a>]. <value> is a string representing an AttributeValue,
or part of one, and has the form defined in [<a href="#ref-2" title=""The String Representation of Standard Attribute Syntaxes"">2</a>]. If a <value> must
contain one of the characters '*' or '(' or ')', these characters
<span class="grey">Howes [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc1558">RFC 1558</a> Representation of LDAP Filters December 1993</span>
should be escaped by preceding them with the backslash '\' character.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Examples</span>
This section gives a few examples of search filters written using
this notation.
(cn=Babs Jensen)
(!(cn=Tim Howes))
(&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*)))
(o=univ*of*mich*)
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Security Considerations</span>
Security issues are not discussed in this memo.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. References</span>
[<a id="ref-1">1</a>] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory Access
Protocol", <a href="./rfc1487">RFC 1487</a>, Performance Systems International,
University of Michigan, ISODE Consortium, July 1993.
[<a id="ref-2">2</a>] Howes, T., Kille, S., Yeong, W., and C. Robbins, "The String
Representation of Standard Attribute Syntaxes", <a href="./rfc1488">RFC 1488</a>,
University of Michigan, ISODE Consortium, Performance Systems
International, NeXor Ltd., July 1993.
[<a id="ref-3">3</a>] "Specification of Basic Encoding Rules for Abstract Syntax
Notation One (ASN.1)", CCITT Recommendation X.209, 1988.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. Author's Address</span>
Tim Howes
University of Michigan
ITD Research Systems
535 W William St.
Ann Arbor, MI 48103-4943
USA
Phone: +1 313 747-4454
EMail: tim@umich.edu
Howes [Page 3]
</pre>
|
