This topic contains 4 replies, has 3 voices, and was last updated by 
Ludo 10 months, 1 week ago.
-
Posts
-
Hi
I want to do certain searches including operational attributes. These searches will be manual and just few times a month.
If I run a test search similar to this as Directory Manager…
‘(&(cn=*)(objectclass=inetorgperson)(ismemberof=*test*))’ cn givenname sn ismemberof
I don’t get any users…If I remove the ismemberof part in the *and* filter I get the user objects to pic attributes from. The purpose was to only return the user objects that is member of groups that has “test” in the dn.
Is it not possible to include ismemberof in search filters?
Testing on OpenDJ 2.6
Tnx
/PeoForgeRock had some bugs in OpenDJ 2.6 pertaining to searches involving virtual attributes (i.e. ismemberof). I am not saying this is the one you are running into, but check out OPENDJ-4557 and look for other possible bugs that may be related.
Keep in mind that ismemberof is a virtual attribute that is dynamically created upon group membership. It is not not persisted in the database. Searching on virtual attributes can be an expensive operation at times so use with care.
Now, having said that, have you tried various combinations of search filters, such as:
(ismemberof=cn=my group,ou=groups,dc=example,dc=com) – focus on one group to see how that behaves
or
(ismemberof=*group*) – without any of the additional “and” filters?
It is possible to use isMemberOf in the filter, but isMemberOf has a syntax of a Distinguished Name (DN) and in the LDAP Specifications, there is no such thing as a DN subStringMatching rule.
So the search is undefined as will return no entry.Ahhh
Should I interpret you as it is not possible to use any type of wildcard match with this then? Any other ideas around this?
It will not suite my needs if I have to specify a complete DN in the ismemberof value in the filter. Then I have to do an export a wider search and mangle it with sed or perl…
/Peo
Yes, it is not possible to match DN with wild cards (in fact Substring match).
The isMemberOf is a DN to avoid ambiguity with 2 groups having the same “common name” but stored in different suffixes.
You must be logged in to reply to this topic.
