51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! CCPL HEADER START
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! This work is licensed under the Creative Commons
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! Attribution-NonCommercial-NoDerivs 3.0 Unported License.
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! To view a copy of this license, visit
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! or send a letter to Creative Commons, 444 Castro Street,
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! Suite 900, Mountain View, California, 94041, USA.
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! You can also obtain a copy of the license at
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! See the License for the specific language governing permissions
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! and limitations under the License.
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! If applicable, add the following below this CCPL HEADER, with the fields
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! enclosed by brackets "[]" replaced with your own identifying information:
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! Portions Copyright [yyyy] [name of copyright owner]
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! CCPL HEADER END
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark ! Copyright 2012 ForgeRock AS
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark xsi:schemaLocation='http://docbook.org/ns/docbook http://docbook.org/xml/5.0/xsd/docbook.xsd'
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Equality comparison, as in <literal>(sn=Jensen)</literal>.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>This can also be used with substring matches. For example, to match
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark last names starting with <literal>Jen</literal>, use the filter
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <literal>(sn=Jen*)</literal>. Substrings are more expensive for the
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark directory server to index. Substring searches therefore might not be
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark permitted for many attributes.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(cn=My App)"</literal> matches entries with common name
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(sn=Jen*)"</literal> matches entries with surname starting
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Less than or equal to comparison, which works
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark alphanumerically.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(cn<=App)"</literal> matches entries with
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <literal>commonName</literal> up to those starting with App
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark (case-insensitive) in alphabetical order.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Greater than or equal to comparison, which works
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark alphanumerically.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(uidNumber>=1151)"</literal> matches entries with
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Presence comparison. For example, to match all entries having a
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(member=*)"</literal> matches entries with a
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Approximate comparison, matching attribute values similar to the
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark value you specify.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(sn~=jansen)"</literal> matches entries with a surname
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark that sounds similar to <literal>Jansen</literal> (Johnson, Jensen, and
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark so forth).</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <entry><literal>[:dn][:<replaceable>oid</replaceable>]:=</literal></entry>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <itemizedlist>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>At the end of the OID or language subtype, you further specify the
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark matching rule as follows:</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Add <literal>.2</literal> for less than or equal to</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Add <literal>.3</literal> for equal to (default)</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Add <literal>.4</literal> for greater than or equal to</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Add <literal>.5</literal> for greater than</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </listitem>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark </itemizedlist>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>(uid:dn:=bjensen)</literal> matches entries where
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <literal>uid</literal> having the value <literal>bjensen</literal> is
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark a component of the entry DN.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>(lastLoginTime: 1.3.6.1.4.1.26027.1.4.5:=-13w)</literal>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark matches entries with a last login time more recent than 13 weeks.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>You also use extensible match filters with localized values.
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark Directory servers like OpenDJ support a variety of internationalized
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark locales, each of which has an OID for collation order, such as
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <literal>1.3.6.1.4.1.42.2.27.9.4.76.1</literal> for French. OpenDJ also
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark lets you use the language subtype, such as <literal>fr</literal>, instead
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark of the OID.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"(cn:dn:=My App)"</literal> matches entries who have
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <literal>My App</literal> as the common name and also as the value of a
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark DN component.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>NOT operator, to find entries that do not match the specified filter
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark component.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>Take care to limit your search when using <literal>!</literal> to
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark avoid matching so many entries that the server treats your search as
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark unindexed.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>'!(objectclass=person)'</literal> matches non-person
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark entries.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>AND operator, to find entries that match all specified filter
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark components.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>'(&(l=Cupertino)(!(uid=bjensen)))'</literal> matches
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark entries for users in Cupertino other than the user with ID
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para>OR operator, to find entries that match one of the specified filter
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark components.</para>
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark <para><literal>"|(sn=Jensen)(sn=Johnson)"</literal> matches entries with
51607ea01068c9047391e4c8b46bc9dbd0edb7fdmark surname Jensen or surname Johnson.</para>