I was perusing the source for OpenLDAP and I saw where the root DSE supports something called absolute filters. It looks like it's specified in RFC4526 It looks like the author that originally drafted it was working on the OpenLDAP project so I don't know if this is something useful to that specific implementation or what.
At any rate the RFC gives this definition:
An 'and' filter consisting of an empty set of filters SHALL evaluate to True. This filter is represented by the string "(&)". An 'or' filter consisting of an empty set of filters SHALL evaluate to False. This filter is represented by the string "(|)"
My question is: What the usefulness of this? I can't think of any examples where this provides the ability to do something you couldn't do before. If you want an absolute
AND then can't you do an
(objectClass=*) filter since all entries must have at least one object class?
The only one I can kind of think of a use for is the Absolute False. It may be that you just want to do a noop on the server to make sure communication is still functioning normally. That's still sort of redundant since I would think querying the root DSE and discarding the results would do the same thing and couldn't be all that computationally expensive.
Using the filter in an
ldapsearch produces the results I guess I should expect given the above:
[root@hypervisor openldap]# ldapsearch -x -H ldap://policyServer.trunkator.com -b '' -s base "(|)" + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (|) # requesting: + # # search result search: 2 result: 0 Success # numResponses: 1 [root@hypervisor openldap]#
Using the absolute true filter returns the same thing as if I had done an
(objectClass=*) (which is the default filter for OpenLDAP's
ldapsearch client if you don't specify one on the command line).
According to the RFC they removed these from the original LDAPv3 RFC and so the author went through the trouble of getting them added back in and I'm just curious as to why (I'm sure there's a reason).
Bit of poor phrasing up top: When I say "root DSE supports" a clearer way of saying it is that the root DSE in OpenLDAP is hard coded to report back that it supports absolute filters.