Which entries does the filter (&(objectClass=person)(|(sn=Meier)(sn=Meyer))(!(mail=*))) match?

Person entries whose surname is Meier or Meyer and that have no mail attribute at all.

* Read a filter as a tree: the operator comes first, its operands hang below it. *

Read it from the outside in. The outer & has three operands, and all three must be true:

1. (objectClass=person): the entry is a person.
2. (|(sn=Meier)(sn=Meyer)): an OR, so either spelling of the surname qualifies.
3. (!(mail=*)): (mail=*) is a presence test ("has a mail value"); the ! negates it, so the entry must have no mail address.

A typical use is a data-quality report: "which Meier/Meyer person entries still lack an e-mail address?". Because filters nest freely, any Boolean condition can be expressed this way; matching is case-insensitive for sn because its matching rule ignores case.

Go deeper:

• LDAP.com: LDAP filters — AND, OR and NOT filters and presence filters with worked examples.