Network Working Group Tim Howes
INTERNET DRAFT University of Michigan
19 December, 1995
A String Representation of LDAP Search Filters
<draft-ietf-asid-string-filter-00.txt>
1. Status of this Memo
This document is an Internet-Draft. Internet-Drafts are working docu-
ments of the Internet Engineering Task Force (IETF), its areas, and its
working groups. Note that other groups may also distribute working
documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet- Drafts as reference material
or to cite them other than as ``work in progress.''
To learn the current status of any Internet-Draft, please check the
``1id-abstracts.txt'' listing contained in the Internet- Drafts Shadow
Directories on ds.internic.net (US East Coast), nic.nordu.net (Europe),
ftp.isi.edu (US West Coast), or munnari.oz.au (Pacific Rim).
2. Abstract
The Lightweight Directory Access Protocol (LDAP) [1] defines a network
representation of a search filter transmitted to an LDAP server. Some
applications may find it useful to have a common way of representing
these search filters in a human-readable form. This document defines a
human-readable string format for representing LDAP search filters.
3. LDAP Search Filter Definition
An LDAP search filter is defined in [1] as follows:
Filter ::= CHOICE {
and [0] SET OF Filter,
or [1] SET OF Filter,
not [2] Filter,
equalityMatch [3] AttributeValueAssertion,
substrings [4] SubstringFilter,
greaterOrEqual [5] AttributeValueAssertion,
lessOrEqual [6] AttributeValueAssertion,
present [7] AttributeType,
approxMatch [8] AttributeValueAssertion
Howes [Page 1]
RFC DRAFT December 1995
}
SubstringFilter ::= SEQUENCE {
type AttributeType,
SEQUENCE OF CHOICE {
initial [0] LDAPString,
any [1] LDAPString,
final [2] LDAPString
}
}
AttributeValueAssertion ::= SEQUENCE {
attributeType AttributeType,
attributeValue AttributeValue
}
AttributeType ::= LDAPString
AttributeValue ::= OCTET STRING
LDAPString ::= OCTET STRING
where the LDAPString above is limited to the IA5 character set. The
AttributeType is a string representation of the attribute type name and
is defined in [1]. The AttributeValue OCTET STRING has the form defined
in [2]. The Filter is encoded for transmission over a network using the
Basic Encoding Rules defined in [3], with simplifications described in
[1].
4. String Search Filter Definition
The string representation of an LDAP search filter is defined by the
following grammar. It uses a prefix format.
<filter> ::= '(' <filtercomp> ')'
<filtercomp> ::= <and> | <or> | <not> | <item>
<and> ::= '&' <filterlist>
<or> ::= '|' <filterlist>
<not> ::= '!' <filter>
<filterlist> ::= <filter> | <filter> <filterlist>
<item> ::= <simple> | <present> | <substring>
<simple> ::= <attr> <filtertype> <value>
<filtertype> ::= <equal> | <approx> | <greater> | <less>
<equal> ::= '='
<approx> ::= '~='
<greater> ::= '>='
<less> ::= '<='
<present> ::= <attr> '=*'
Howes [Page 2]
RFC DRAFT December 1995
<substring> ::= <attr> '=' <initial> <any> <final>
<initial> ::= NULL | <value>
<any> ::= '*' <starval>
<starval> ::= NULL | <value> '*' <starval>
<final> ::= NULL | <value>
<attr> is a string representing an AttributeType, and has the format
defined in [1]. <value> is a string representing an AttributeValue, or
part of one, and has the form defined in [2]. If a <value> must contain
one of the characters '*' or '(' or ')', these characters should be
escaped by preceding them with the backslash '\' character. Note that
although both the <substring> and <present> productions can produce the
'attr=*' construct, this construct is used only to denote a presence
filter.
5. Examples
This section gives a few examples of search filters written using this
notation.
(cn=Babs Jensen)
(!(cn=Tim Howes))
(&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*)))
(o=univ*of*mich*)
6. Security Considerations
Security considerations are not discussed in this document.
7. Bibliography
[1] Lightweight Directory Access Protocol. Wengyik Yeong, Tim Howes,
Steve Kille, Request for Comment (RFC) 1777, March 1995
[2] The String Representation of Standard Attribute Syntaxes. T.
Howes, S. Kille, W. Yeong, C.J. Robbins; Request for Comment (RFC)
1778, March 1995
[3] Specification of Basic Encoding Rules for Abstract Syntax Notation
One (ASN.1). CCITT Recommendation X.209, 1988.
8. Author's Address
Tim Howes
University of Michigan
ITD Research Systems
535 W William St.
Ann Arbor, MI 48103-4943
Howes [Page 3]
RFC DRAFT December 1995
USA
+1 313 747-4454
tim@umich.edu
Howes [Page 4]