LDAP search query

In this dialog, you have the option of an LDAP search query to determine the content of specific data fields. For example, you could only import all AD users that are members of a specific Windows group. The syntax in this case is as follows:

(&(objectClass=organizationalPerson)(memberOf=CN=HomeOffice,OU=Gruppen,DC=firma,DC=local))

In LDAP, attributes are enclosed in parentheses. The above example contains two attribute specifications, both of which should be met simultaneously for the search to score. Therefore, at the beginning of the search query, the & symbol appears as a logical "AND" - everything must be true at the same time. Finally, another pair of parentheses is given, to which the & refers - here the whole expression, which is therefore bracketed.

  • organizationalPerson: A standard object class, which contains the user and more.
  • memberOf: In the example, specifies the required membership in the Windows 'HomeOffice' group, including the LDAP path.

Of course, search criteria can not be linked only with AND. There is also the logical OR indicated by the pipe symbol (|) and the NOT indicated by the exclamation mark (!).

LDAP also accepts Wildcard. For this, the asterisk * can be used anywhere in the search string.

Further examples

  • (&(objectClass=organizationalPerson)(|(l=Berlin)(l=Potsdam)))
    • All users whose AD attribute "Location" (LDAP object "location") has the entry "Berlin" or "Potsdam" are determined.
  • (&(objectClass=organizationalPerson)(!(sn=Meier)))
    • All users whose surname is NOT "Meier" are determined.
  • (&(objectClass=organizationalPerson)(mail=*@firma.local))
    • All users who have the mail domain "company.local" in the field "E-Mail" are found.
  • (&(objectClass=organizationalPerson)(mail=*))
    • All users with a non-empty "E-mail" field will be found.