Quiz Entry - updated: 2026.10.22
How do the compare and search operations differ, and when is compare the better choice?
Search returns matching entries and their attributes; compare only answers whether one specific entry holds one specific attribute value (compareTrue or compareFalse), without returning any data.
A compare request names a DN and an assertion, for example "does cn=Admins,ou=groups,dc=example have member: uid=juser,...?". The server answers yes or no.
Why that is useful:
- Least privilege: an access-control rule can allow an application to compare an attribute without allowing it to read it. The application learns "this value matches" but never sees the full list of values.
- Efficiency: a single yes/no instead of transferring a possibly huge multi-valued attribute such as a group's member list.
Search is the general tool: it takes a base DN, a scope, a filter and the list of attributes to return, and can find any number of entries.
Go deeper:
LDAP.com: The LDAP compare operation — request elements, result codes and when to prefer compare.
RFC 4511, Section 4.10: Compare Operation — the normative definition.