Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given an LDAP tree (AD in my case), is there a way of searching with a wildcard at a specific level in the tree?

i.e. I'm wondering if there's an equivalent way of searching LDAP in the same way that you might do an ls /opt/*/lib in linux.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I don't think there's a one-liner that can do this. You could script (or code) it, though.

Pretty much any LDAP search you do in AD is going to involve the ldap_search_s() function. One of the things that function absolutely requires is a base from which to start the search. "DC=domain,DC=com" for example. You can use any OU or container as your base from which to start your search. To use your example, it might look like "OU=opt,DC=domain,DC=com". You cannot use wildcards in that string.

So in your hypothetical script, you run you query with the search base stated above, and use the filter (objectclass=container), and specifying the scope (base, one level, or subtree) of the search. That will get you a list of all containers under your search base.

Then, in your script, you could run more queries incorporating each of the elements in your list of containers. ("OU=lib,OU=dallas,OU=opt,DC=domain,DC=com","OU=lib,OU=atlanta,OU=opt,DC=domain,DC=com", etc.)

The bits in bold represent the variable in your script and you'd make a separate query for each container that you found in your first search for containers.

This sounds pretty crazy to me. You'd also have to figure out how to deal with recursion in a subtree search, etc.

Another approach would be to just search for the object(s) you intended to search for, and programmatically checking that each object's immediate parent container is OU=lib, and throwing them out if it's not. That probably slightly less insane.

But the point is, you're gonna have to script or code it. Wildcards can be used for attributes of objects (telephonenumber=*555)* or kinds of objects (objectclass=user), but not for the nodes in a search base.

share|improve this answer
Thanks Ryan. I have control over the design of this structure, and it sounds like my design idea is flawed. I was thinking a hierarchical tree structure made sense for the organization design, but based on what you said it seems like maybe just using attributes would be a better approach.? –  Dan Dec 31 '12 at 17:13
Well you didn't tell us what you're trying to do, so I don't know what would be the best approach for you. But I can tell you that there are an almost infinite number of ways to design your directory structure, and there isn't technically a right way and a wrong way. –  Ryan Ries Dec 31 '12 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.