When I try to search my OpenLDAP 2.4.42 server for (shadowExpire<=18074), I get no results. However, a search for (shadowExpire=12671) yields several results.

My ultimate goal is to periodically regenerate a Postfix map for check_recipient_access to reject mail to expired accounts.

Looking at the server's /etc/ldap/schema/nis.schema, I see:

attributetype ( NAME 'shadowExpire'
        EQUALITY integerMatch

This agrees with RFC 2307 Section 3, which specifies:

( nisSchema.1.10 NAME 'shadowExpire'
  EQUALITY integerMatch

Both of those suggest that shadowExpire only supports equality searches only.

However, RFC 2307bis has:

( NAME 'shadowExpire'
    EQUALITY integerMatch
    ORDERING integerOrderingMatch

… which has ORDERING integerOrderingMatch, allowing the inequality search to work.

Can I hack my server's nis.schema to include ORDERING integerOrderingMatch? The underlying representation would still be an INTEGER, so it should be harmless, right? (Despite the warning in the OpenLDAP Administrator's Guide that says "you should not modify any of the schema items defined in provided files.)


You correctly analyzed the missing ordering matching rule.

However you should not alter schema files shipped with OpenLDAP like nis.schema. But you could use an alternative schema file rfc2307bis.schema instead. Some Linux distributions already ship this file.

Note that usage of nis.schema and rfc2307bis.schema is mutually exclusive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.