Novell EDIRECTORY 8.8 - GUIDE, Manual

Page: 331 / 574

332 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
• A flag to indicate if the dn attributes should be considered a part of the entry
• The value to be used for the match
The following is the string representation of the extensible match search filter:
extensible = attr [":dn"] [":" matchingrule] ":=" value /
[:dn"] ":" matchingrule ":=" value
The following table lists the Extensible Match search filter parameters:
The extensibleMatch is a new filter provided in LDAP 3. If the matchingRule field is absent, the
attribute field MUST be present, and the equality match is performed for that attribute. If the
attribute field is absent and matchingRule is present, the matchValue is compared against all
attributes in an entry that supports that matchingRule, and the matchingRule determines the syntax
for the assertion value.
The filter item evaluates as
• TRUE if it matches with at least one attribute in the entry.
• FALSE if it does not match any attribute in the entry.
• Undefined if the matchingRule is not recognized or the assertionValue cannot be parsed.
If the type field along with the matchingRule is present, the matchingRule must be one permitted for
use with that type, otherwise the filter item is undefined. If the :dn is specified in the search filter, the
match is applied against all the attributes in an entry’s distinguished name as well, and also evaluates
to TRUE if there is at least one attribute in the distinguished name for which the filter item evaluates
to TRUE. The dnAttributes field is present so that there does not need to be multiple versions of
generic matching rules such as for word matching, one to apply to entries and another to apply to
entries and dn attributes as well.
Essentially, an extensible match filter allows an LDAP client to achieve two objectives:
• Support multiple matching rules for same type of data
• Include DN elements in the search criteria
The DN specification allows matching on specific elements of the DN.
Novell eDirectory 8.7.3 onwards supports the extensible match filter for matching on the DN
attributes. The other elements of the extensible match search filter, namely the matching rule, are
treated as undefined and ignored. The DN matching allows an LDAP client to drastically reduce the
searches required to locate an object in an eDirectory tree. For example, a complex LDAP search
filter such as
Parameter Description
attr Specifies the attribute to match on.
[":dn"] Indicates that the matching rule should be included in the
comparison match.
[":" matchingrule] Designates the matching rule to be used.
":=" Without a matching rule results in an equality match.
value Comparison value