Greetings,

I'm having some confusion trying to integrate an Oracle product with our
AD infrastructure, and I think it's coming down to allowable characters.

When I do something like this:

ldapsearch -x -D cn=nobody,ou=Users-IT,dc=domain,dc=com -w password -h
dc.domain.com -s sub -b 'ou=Users-Active,dc=domain,dc=com'
"(objectClass=group)"

I get a list of groups in that OU and the attributes of those groups,
including members.  Because the cn of our users are Last, First - that
is how they are listed, but with a backslash presumably escaping the
comma, like this:

member: CN=Sturgis\, Grant,OU=Users-Active,DC=domain,DC=com

What I really want to do, is an AND query for group and member, and I
would guess it should be like this:

ldapsearch -x -D cn=nobody,ou=Users-IT,dc=domain,dc=com -w password -h
dc.domain.com -s sub -b 'ou=Users-Active,dc=domain,dc=com'
"(&(objectclass=group)(member=CN=Sturgis\,
Grant,OU=Users-Active,DC=domain,DC=com))"

The result is:

ldapsearch: ldap_search_ext: Bad search filter (-7)

I've noticed that if I change the cn by removing the comma, then
changing the query to:

ldapsearch -x -D cn=nobody,ou=Users-IT,dc=domain,dc=com -w password -h
dc.domain.com -s sub -b 'ou=Users-Active,dc=domain,dc=com'
"(&(objectclass=group)(member=CN=Sturgis
Grant,OU=Users-Active,DC=domain,DC=com))"

It works fine.

Any comments on commas and backslash escaped commas?  Are these illegal
LDAP characters or known problems?  Any other words of advice?


Many thanks,

Grant
-------------




Pardon this rubbish:





This electronic message transmission is a PRIVATE communication which
contains information which may be confidential or privileged. The
information is intended to be for the use of the individual or entity
named above. If you are not the intended recipient, please be aware that
any disclosure, copying, distribution or use of the contents of this
information is prohibited. Please notify the sender  of the delivery
error by replying to this message, or notify us by telephone
(877-633-2436, ext. 0), and then delete it from your system.

Reply via email to