LDAP request to OU with * in header. How?
I am having difficulty, I believe the * character is present in my subdivision when I do a search. The OU group is called WorldWide Offices.
I have a circular query that returns all users that are in a given group. So I type in the name of the group and this returns the group to me. Then I loop through the .members group.
These members will be either a user or another group. So if it's not a user, I'll loop through it again to check if it's a group. Group members are always DistinguishedName and that's all I have to look for.
I have a current user with DistinguishedName as CN = Smith \, John a., OU = Laptop, OU = Users, OU = London DC, OU = UK, OU = World Offices, DC = OurDomain, DC = LOCAL.
I am doing DirectorySearcher and my filter is
Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=*Worldwide Offices*,DC=OurDomain,DC=LOCAL))
As you can see, I think the fact that our OU has a * in its name is the reason it doesn't find the user. Any other unit that doesn't have * in it seems to work. This is why I believe the problem is *.
Does anyone know how to get around the * issue other than renaming the OU?
a source to share
Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=\2aWorldwide Offices\2a,DC=OurDomain,DC=LOCAL))
A *
must be escaped with \2a
- see MSDN "Search Filter Syntax" :
If any of the following special characters are to appear in the filter search as literals, they must be replaced by the specified Sequence output.
* => \2a ( => \28 ) => \29 \ => \5c NUL => \00 / => \2f
Simple escaping with \
should work as well:
Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=\*Worldwide Offices\*,DC=OurDomain,DC=LOCAL))
a source to share
Wildcard only works if the attribute type is some string type. (octet string, Unicode string). if you use * attribute like givenName, displayName again then wild cards will be executed. But the distinguished name is of type "Distinguished Name", so the substring match will not be included by the server.
if you use * for objectcategory, dn, distinguished name ... you can see that the template is not working.
Your logic needs to be changed.
a source to share