This document outlines how to go about constructing a more sophisticated filter for the userSearchFilter and groupSearchFilter attributes in your AtlassianUser LDAP config file.
How do I match more than one attribute?
For example, if my users are distinguished by having two objectClass attributes (one equal to 'person' and another to 'user'), this is how I would match for it:
(&(objectClass=person)(objectClass=user)) |
Notice the
ampersand symbol '&'
symbol at the start. Translated this means: search for objectClass=person AND object=user.
Alternatively,
(|(objectClass=person)(objectClass=user)) |
Translated this means: search for objectClass=person OR object=user.
The
pipe symbol '|'
denotes 'OR'. As this is not a special XML character, then it should not need escaping.Wildcards
(&(objectClass=user)(cn=*Marketing*)) |
This means: search for all entries that have objectClass=user AND cn that contains the word 'Marketing'.
How do I match 3 attributes?
This gets a little tricky:
(&(&(objectClass=user)(objectClass=top))(objectClass=person))
Notice how we weave one query into another. For 4 attributes, this would be:
(&(&(&(objectClass=top)(objectClass=person))(objectClass=organizationalPerson))(objectClass=user))
And so on.
Matching Components of Distinguished Names
You may want to match part of a DN, for instance when you need to look for your groups in two subtrees of your server.
(&(objectClass=group)(|(ou:dn:=Chicago)(ou:dn:=Miami))) |
will find groups with an OU component of their DN which is either 'Chicago' or 'Miami'.
Using 'not'
To exclude entities which match an expression, use '!'. Note that this must be represented as the entity '!' in your XML file.
So
(&(objectClass=group)(&(ou:dn:=Chicago)(!(ou:dn:=Wrigleyville)))) |
will find all Chicago groups except those with a Wrigleyville OU component.
Note the extra parentheses: (!(<expression>))
Read more!