Choose a matching rule explicitly
05Extensible matching can name a rule and include attributes from an entry's distinguished name.
(:caseExactMatch:=Mira) omits the attribute and applies to supporting attributes. Omitting both attribute and rule would not fit the string grammar.
Source for this drawing: RFC 4515 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Simple comparisons use =, ~=, >= or <=. Approximate and ordering behavior comes from the server's matching rules, not JavaScript lexical order or a universal fuzzy-search algorithm.
- Simple comparisons use =, ~=, >= or <=. Approximate and ordering behavior comes from the server's matching rules, not JavaScript lexical order or a universal fuzzy-search algorithm.
- In (cn:caseExactMatch:=Mira), cn is the attribute, caseExactMatch names a matching rule, and := introduces the assertion. The server must support an appropriate rule; the name is not a promise that every server supports it.
- Adding :dn asks the match to consider suitable attributes from the entry's distinguished name (DN), its structured directory name. It does not select a different search subtree.
- If the attribute is omitted, a matching rule is required and the match applies to attributes that support it. With an attribute present the matching rule may be omitted, as in (cn:=Mira). DN-attribute matching defaults to false. Unknown or inappropriate rules can evaluate to Undefined.
RFC4515 §4 and RFC4511 §4.5.1.7.7 describe extensible matching. The :dn marker is case insensitive, so :DN is also valid. This guide does not emulate schema discovery, authentication, access control or an arbitrary directory matching engine.
Read the RFC section ↗