0

I am trying to query LDAP from Java, to get all users reporting to the same manager.

When I query using the searchFilter as - String searchFilter = "(&(objectClass=user)(sAMAccountName=" + search + "))";

I get the the output as manager=CN=Eve\, Adam,OU=something,OU=something,OU=StandardUser,OU=User,DC=something,DC=something,DC=something

However when my search query is String searchFilter = "(&(objectClass=user)(manager=CN=Eve*,OU=StandardUser,OU=User,DC=something,DC=something,DC=something))";

OR

with String searchFilter = "(&(objectClass=user)(manager=CN=Eve*))";

I do not get an output.

Following is the way I am trying to fetch the data.

String searchBase = "DC=something,DC=something,DC=something";
String returnedAtts[] = {"*"};
SearchControls searchCtls = new SearchControls();
searchCtls.setReturningAttributes(returnedAtts);
NamingEnumeration answer = ctxGC.search(searchBase, searchFilter, searchCtls);

Please note - DC=something definitely has some value.

JHS
  • 7,761
  • 2
  • 29
  • 53

1 Answers1

3

The client is attempting to use a substring filter with a DN ((manager=CN=Eve*)). There is no substring matching rule for DN, therefore, substring filters cannot be used with DNs. When specifying a DN in a search filter or as the base object in a search request, the LDAP client must use the full DN, for example, cn=user,ou=people,dc=example,dc=com.

see also

Terry Gardner
  • 10,957
  • 2
  • 28
  • 38
  • Thank you, however, even with `String searchFilter = "(&(objectClass=user)(manager=CN=Eve\\, Adam))";` I do not get any output. – JHS Oct 01 '13 at 11:17
  • `manager` has DN syntax, therefore, the client must use the full DN, not just a portion of it. – Terry Gardner Oct 01 '13 at 11:26
  • I tried `String searchFilter = "(&(objectClass=user)(manager=CN=Eve\\, Adam,OU=StandardUser,OU=User,DC=something,DC=something,DC=something))";` and still no output. – JHS Oct 01 '13 at 11:41
  • 1
    Check that the `cn=eve\\, Adam` part is correct (spaces, etc). – Terry Gardner Oct 01 '13 at 12:31
  • The full DN in the search filter did not work for me until I escaped special characters (in my case parenthesis) - see https://stackoverflow.com/questions/4827263/active-directory-search-filter-by-manager – Peter Thoeny Jul 24 '20 at 19:28