LDAP: Using Matching Rules to Compare Attribute Values


Programmers should use LDAP matching rules to compare attribute values, for example, when matching candidate entries in search requests. Avoid comparing values that were retrieved from a directory on a character by character basis. The directory server uses matching rules to match values and distinguished names, and application code must do likewise, or unexpected results may occur. APIs that do not support matching rules when interacting with LDAP servers should be avoided.

An example of where software can get it wrong is the case of space significance in a distinguished name. Some directory servers preserve spaces in distinguished names, others do not. By way of example, consider the following DN:

uid=user.0,ou=people,dc=example,dc=com

and

uid=user.0, ou=people, DC=example, DC=com

These two DNs are equivalent, differing outwardly by case and spaces, but an application executing a character-by-character comparison would not consider the two to refer to the same DN. The use of the distinguishedNameMatch matching rule would prevent this error.

MatchingRuleDemo.java uses the UnboundID LDAP SDK to demonstrate how to use matching rules to compare the values of an attribute in two entries.

References

About Terry Gardner

Terry Gardner was a leading directory services architect with experience with many large scale directory services installations and messaging server installations, and was a Subject Matter Expert in the field of Directory Services and Solaris (operating system) performance. Mr. Gardner also participated in the open-source software community. Mr. Gardner passed away in December, 2013.
This entry was posted in computing, Java, LDAP, UnboundID and tagged , , , , , . Bookmark the permalink.

2 Responses to LDAP: Using Matching Rules to Compare Attribute Values

  1. Pingback: LDAP: Programming Practices « Diaries, Triumphs, Failures, and Rants

  2. Pingback: LDAP: Using ldapsearch « Diaries, Triumphs, Failures, and Rants

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s