Basic LDAP Syntax
The following table outlines basic operators for use with LDAP:
Operator | Operator Definition | Definition | Example |
---|---|---|---|
|
Equal to |
This argument means an attribute must be equal to a certain value to be true. |
(givenName=Kate)
This will return all objects that have the first name of "Kate." Note: Because there is only one argument in this example, it is surrounded with parentheses for illustration. |
&
|
And |
Use |
(&(givenName=Kate)(l=Austin))
|
!
|
Not |
The |
(!givenName=Kate)
Note: Because there is only one argument in this example, it is surrounded with parentheses for illustration. |
*
|
Wildcard |
Use the * operator to represent a value that could be equal to anything. If you wanted to find all objects that have a value for title, you would then use the example in the right-hand column. This would return all objects that have the title attribute populated with any value. |
(title=*)
|
*
|
Wildcard |
This would apply to all objects whose first name starts with "Ka." |
(givenName=Ka*)
|
Advanced Examples of LDAP Syntax:
-
You need a filter to find all objects that are in NYC or Austin, and that have the first name of "Kate." This would be:
(&(givenName=Kate)(|(l=NYC)(l=Austin)))
-
You have received 9,360 events in the Application log and you need to find all of the objects that are causing this logging event. In this case, you need to find all of the disabled users
(msExchUserAccountControl=2)
that do not have a value formsExchMasterAccountSID
. This would be:(&(msExchUserAccountControl=2)(!msExchMasterAccountSID=*))
Using the !
operator with the *
operator will look for objects where that attribute is not set to anything.