Read a filter, not a packet
01A filter describes which directory entries a search should match.
A matching entry is still subject to scope and access restrictions. The filter does not authorize disclosure.
Source for this drawing: RFC 4515 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
LDAP means Lightweight Directory Access Protocol. A directory holds entries with named attributes; cn commonly names a common-name attribute. An assertion is a value to compare, not a command to execute.
- LDAP means Lightweight Directory Access Protocol. A directory holds entries with named attributes; cn commonly names a common-name attribute. An assertion is a value to compare, not a command to execute.
- RFC4515 defines the UTF-8 text form. LDAP sends a binary BER representation of the filter in a SearchRequest; it does not put these parentheses directly on the wire.
- A schema defines the directory’s attribute types and matching rules. It supplies the equality matching rule. A TRUE result selects an entry subject to search scope, other search controls and access restrictions; a filter grants no permission.
Examples are fictional. BER means Basic Encoding Rules. This guide explains string filters, not an LDAP client, server, wire encoder or access-control implementation.
Read the RFC section ↗