Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Why does this ldapsearch command shows nothing:

/usr/bin/ldapsearch -x -LLL -h ldapmaster.corpintra.net -b ou=people,ou=Mars,ou=Eng,dc=corpintra,dc=net '(ifxAccStatus=unlocked)' uid ifxAccStatus

The following command returns a bunch of results showing that I have people with the field ifxAccStatus=unlocked or ifxAccStatus=locked:

/usr/bin/ldapsearch -x -LLL -h ldapmaster.corpintra.net -b ou=people,ou=Mars,ou=Eng,dc=corpintra,dc=net '(ifxAccStatus=*)' uid ifxAccStatus

How can only list users with ifxAccStatus=unlocked?

Thanks, Oz

share|improve this question
    
Could you please show us the output of second command and the logs on the LDAP server when running the first command? –  quanta Aug 3 '12 at 15:13
    
@quanta, I would do it gladly, however the first command shows no output. –  Oz123 Aug 3 '12 at 15:14
1  
Have you tried to filter with different attribute? –  quanta Aug 4 '12 at 3:09

1 Answer 1

up vote 0 down vote accepted

You probably have an incomplete schema definition -- it's not sufficient to just define your attribute SYNTAX (e.g. directoryString or IA5String OID), this does not define any implicit matching rules (comparison operations). You need to do that explicitly with EQUALITY and (if appropriate) SUBSTR, for example:

attributetype ( 1.3.6.1.4.1.xxxxx.1.2.3
    NAME     'ifxAccStatus'
    DESC     'account lock status'
    SYNTAX   1.3.6.1.4.1.1466.115.121.1.26    
    SINGLE-VALUE
    EQUALITY caseIgnoreIA5Match
    SUBSTR   caseIgnoreIA5SubstringsMatch
    USAGE    userApplications
)

Similarly, there will be no implicit ordering rules, this would need to be specified too if you need to order the results (e.g. caseIgnoreOrderingMatch), though this usually doesn't cause as many problems as missing equality and substring operations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.