Distinguish stars and empty values
03A star can mean presence or a substring gap; an escaped star is literal data.
The escaped octet \2a represents a literal star in (cn=\2a). It does not create a substring gap.
Source for this drawing: RFC 4515 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
(cn=*) is presence: it asks whether the attribute is present. Although the grammar overlaps with substring syntax here, this construct denotes presence only.
- (cn=*) is presence: it asks whether the attribute is present. Although the grammar overlaps with substring syntax here, this construct denotes presence only.
- (cn=Mi*ra*) is a substring filter: initial Mi, any ra, and a trailing gap. The attribute's SUBSTR matching rule supplies the comparisons; the drawing is schematic and is not a universal regular expression.
- (cn=) asserts an empty value; it does not mean the attribute is absent. (cn=\2a) is equality with a literal asterisk, whereas (cn=*\2a*) searches for a literal asterisk inside a value.
Substring initial and final can occur at most once; initial is first and final is last when present (RFC4511 §4.5.1.7.2). Case, normalization and comparison semantics come from the schema.
Read the RFC section ↗