LDAP: using a filter to avoid using additional CN in Active Directory

Question

LDAP: using a filter to avoid using additional CN in Active Directory

I am trying to query almost all users in Active Directory. My regular users are in different departments, and I want to restore them. But my system users are stored in CN users, and I do not want to retrieve them.

This seems like another question , but their answer did not help me. I use the tooltip here , but it doesn't help either.

I am querying in Active Directory using JNDI. My request:

(&(objectClass=user)(!(cn:dn:=Users)))

This means all objects of the class userthat are not in the subtree Users. However, this query nonetheless returns something like this:

CN=__vmware__,CN=Users,DC=SIREDRM,DC=com

So why does this filter not work? How else can I make it work?

+3

java active-directory ldap jndi

malaverdiere Feb 19 '10 at 9:11

source share

1 answer

Andrew Strong · Accepted Answer · 2010-02-22T00:51:28+0000

With (! (DistinctName = *, CN = Users = DC = mydomain, DC = com)), you are trying to use an attribute with the DN syntax [Object (DS-DN)], for these LDAP attributes, you cannot use wildcards in LDAP filters.

"DistinctName" attribute: http://msdn.microsoft.com/en-us/library/ms675516%28VS.85%29.aspx

The LDAP syntax is "Object (DS-DN)" http://msdn.microsoft.com/en-us/library/ms684431%28VS.85%29.aspx

In the second link you will find a statement about the forbidden template.

, LDAP ,