LOGBOOK

HELP

Quiz Entry - updated: 2026.10.22

How do the compare and search operations differ, and when is compare the better choice?

Search returns matching entries and their attributes; compare only answers whether one specific entry holds one specific attribute value (compareTrue or compareFalse), without returning any data.

A compare request names a DN and an assertion, for example "does cn=Admins,ou=groups,dc=example have member: uid=juser,...?". The server answers yes or no.

Why that is useful:

  • Least privilege: an access-control rule can allow an application to compare an attribute without allowing it to read it. The application learns "this value matches" but never sees the full list of values.
  • Efficiency: a single yes/no instead of transferring a possibly huge multi-valued attribute such as a group's member list.

Search is the general tool: it takes a base DN, a scope, a filter and the list of attributes to return, and can find any number of entries.

Go deeper:

From Quiz: IAM / Network Protocols for IAM: LDAP and Kerberos | Updated: Oct 22, 2026