Quiz Entry - updated: 2026.10.22
How is an LDAP search filter written, and which operators does it support?
A filter is a parenthesised prefix expression: a simple filter is (attribute operator value) with =, >=, <= or ~= (and * as a wildcard with =), and filters are combined with (&...) for AND, (|...) for OR and (!...) for NOT.
Simple filters, defined in RFC 4515:
| Filter | Meaning |
|---|---|
(sn=Meier) |
Equality: surname is Meier |
(mail=joe*) |
Substring: mail starts with "joe" |
(mail=*) |
Presence: the entry has any mail value |
(uidNumber>=1000) |
Greater or equal |
(uidNumber<=999) |
Less or equal |
(sn~=Meyer) |
Approximate match ("sounds like"), server-defined |
Combining filters puts the operator first (prefix notation), followed by the operands, each in its own parentheses:
(&(sn=Meier)(c=CH)): all filters must match.(|(sn=Meier)(sn=Meyer)): at least one must match.(!(mail=*)): the negated filter must match, here "has no mail address".
Tip: There is no < or > operator. "Strictly greater than 999" is written as (!(uidNumber<=999)) or (uidNumber>=1000).
Go deeper:
LDAP.com: LDAP filters — every filter type with examples, including escaping rules.- RFC 4515: String Representation of Search Filters — the grammar of the filter string.