A String Representation of LDAP Search Filters
obsoleted by
- rfc-2254 — The String Representation of LDAP Search Filters
obsoletes
- rfc-1558 — A String Representation of LDAP Search Filters
Extracted elements (14)
A human-readable string format is defined separately from the BER wire encoding so that applications can represent LDAP search filters in a form usable outside the protocol context, such as in configuration files or user interfaces.
The string representation uses a prefix format with mandatory parenthesized grouping for every filter. This eliminates operator precedence ambiguity in nested boolean expressions without requiring a precedence table.
Although both the <substring> and <present> grammar productions can produce the 'attr=*' string, this construct is used only to denote a presence filter; parsers must not treat it as a degenerate substring filter.
This document obsoletes RFC 1558, the previous definition of the string representation of LDAP search filters. Implementations should migrate to the grammar defined here.
If a <value> must contain the characters '*', '(', or ')', these characters should be escaped by preceding them with the backslash '\' character.
And filters are represented as '(&<filterlist>)' and or filters as '(|<filterlist>)' where filterlist is one or more parenthesized filters. Not filters use '(!<filter>)'.
LDAP search filters are defined as an ASN.1 CHOICE type with nine alternatives: and, or, not, equalityMatch, substrings, greaterOrEqual, lessOrEqual, present, and approxMatch. This type is BER-encoded for network transmission per CCITT X.209.
Simple item filters have the form '<attr><filtertype><value>' where filtertype is '=' (equality), '~=' (approximate match), '>=' (greater or equal), or '<=' (less or equal).
Substring filters use '<attr>=<initial><any><final>' where <any> is '*' followed by '<starval>', which recursively allows '<value>*<starval>'. Initial and final components are optional (NULL).
SubstringFilter is an ASN.1 SEQUENCE of an AttributeType and a SEQUENCE OF CHOICE containing initial [0], any [1], and final [2] LDAPString components, enabling partial-string matching with wildcard positions.
The presence filter is represented as '(<attr>=*)' asserting that the named attribute is present regardless of value.
Security considerations are explicitly not discussed in this memo. Implementors must consult the base LDAP specification (RFC 1777) and related documents for security guidance.
LDAPString is an OCTET STRING restricted to the IA5 character set. AttributeType is a string representation of the attribute type name per RFC 1777; AttributeValue has the form defined in RFC 1778.
The complete string filter grammar uses prefix notation: '<filter> ::= '(' <filtercomp> ')'' where filtercomp is one of and, or, not, or item. Compound filters use '&', '|', and '!' prefix operators respectively.