RFC 4515 / START HERE
LDAP filter strings, before the details
LDAP means Lightweight Directory Access Protocol. A filter is a search condition; this RFC defines its readable string form.
A directory stores entries with attributes, such as a person entry with a common name. A filter describes which entries should match a search.
The idea in one picture
Write a condition
Read its parts
Select eligible entries
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Applications need a shared way to write filters in configuration and LDAP URLs. RFC4515 defines this text syntax; LDAP itself transmits a binary representation and applies schema-defined matching rules.
A familiar example
An invented (cn=Mira) filter asks for a common-name equality comparison. Parentheses and stars organize the filter; escaping keeps a literal star inside a value. Even a match is subject to access restrictions.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Read a filter, not a packetA filter describes which directory entries a search should match.→
- Group conditions before matchingPrefix operators join complete filters; LDAP evaluation also has an Undefined result.→
- Distinguish stars and empty valuesA star can mean presence or a substring gap; an escaped star is literal data.→
- Escape octets inside a valueA backslash and two hexadecimal digits encode one octet, not an entire Unicode character.→
- Choose a matching rule explicitlyExtensible matching can name a rule and include attributes from an entry's distinguished name.→
This introduction explains RFC 4515 (2006). Read the original RFC ↗