Filtering imported users¶
You can use LDAP Data Interchange Format (LDIF) syntax to limit which users are imported from the LDAP server. The search filter syntax is basically a logical expression in prefix notation (that is, the logical operator appears before its arguments).
Each criterion in the filter is composed of an attribute identifier and either an attribute value or symbols denoting the attribute value. For example, the criterion (sn=Geisel) means that the sn attribute must have the attribute value Geisel and the criterion (mail=*) indicates that the mail attribute must be present.
Each criterion must be enclosed within a set of parentheses.
Criteria use logical operators to create logical expressions. Each logical expression can be further composed of other items that themselves are logical expressions, such as:
(| (& (sn=Geisel) (mail=*)) (sn=L*))
This example requests entries that have both a sn attribute of Geisel and a mail attribute of any value – or entries whose sn attribute begins with the letter L.
Active Directory does not support wild cards (*) in filter criteria for attributes of type Distinguished Name (DN) (such as memberOf, member, and distinguishedName). Do not use wild cards in filter criteria for such attributes; reference the fully-qualified DN name instead.
The following table lists the logical operators that can be used to create filter criteria.
| Logical operator | Description |
|---|---|
| & | Conjunction (and). All the items in the list must be true. |
| | | Disjunction (or). One or more alternatives must be true. |
| ! | Negation (not). The item being negated must not be true. |
| = | Equality according to the matching rule of the attribute. |
| ~= | Approximate equality according to the matching rule of the attribute. |
| >= | Greater than (according to the matching rule of the attribute). |
| <= | Less than (according to the matching rule of the attribute). |
| =* | Presence. The item must have the attribute, but the value of the attribute is irrelevant. |
| * | Wildcard. Zero or more characters can occur in that position. Used when specifying an attribute value to match. |
| \ | Escape. For escaping characters such as *, (, or ) when they occur inside an attribute value. |