Using a bitwise filter

[W***@t-systems.com]

Hello,

I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets.
Some attributes on Active Directory objects are composed of bitwise flags. Using a bitwise operator is necessary to return only objects that match a particular bit being set.
To query Active Directory for user class objects that are disabled: (UserAccountControl:1.2.840.113556.1.4.803:=2)

I'm trying to create a filter that selects entries for which the object class is a user but not a computer, and for which the account is not flagged as disabled:

(&(objectclass=user)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

If I connect AD server directly, all is OK, I get a search result. But sending this search to Meta, does not work.

Log:
slapd[22461]: conn=1004 op=3 SRCH base="dc=meta,dc=pov" scope=2 deref=2 filter="(&(?objectClass=user)(!(?objectClass=Computer))(?=error))"
slapd[22461]: conn=1004 op=3 meta_back_search: base="dc=meta,dc=pov" scope=2: no candidate could be selected
slapd[22461]: conn=1004 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text=
slapd[22461]: conn=1004 op=4 UNBIND


My OpenLDAP version: 2.4.26

my config:

database meta
lastmod off
suffix "dc=meta,dc=pov"
rootdn "cn=metaguru,dc=meta,dc=pov"
rootpw xxxxxxxx

uri "ldap://w3kvm.adwal.corporate.net:389/dc=meta,dc=pov"
suffixmassage "dc=meta,dc=pov" "dc=adwal,dc=corporate,dc=net"

[Michael Ströder]

(&(objectclass=user)(!(objectclass=Computer))(!(*UserAccountControl:1.2.840.113556.1.4.803:=2*)))
If I connect AD server directly, all is OK, I get a search result. But sending
this search to Meta, does not work.
*Log:*
slapd[22461]: conn=1004 op=3 SRCH base="dc=meta,dc=pov" scope=2 deref=2
filter="(&(?objectClass=user)(!(?objectClass=Computer))( *?=error* ))"

First I'd try to add the object classes 'user' and 'computer' and the
attribute type userAccountControl to the local OpenLDAP schema. See
slapd-ldap(5) for a note about schema and filters.

Not sure whether the non-existing matching rule 1.2.840.113556.1.4.803 can be
used though. You cannot just declare matching rules in OpenLDAP's schema files.

Ciao, Michael.

[Pierangelo Masarati]

Post by Michael Ströder

(&(objectclass=user)(!(objectclass=Computer))(!(*UserAccountControl:1.2.840.113556.1.4.803:=2*)))
If I connect AD server directly, all is OK, I get a search result. But sending
this search to Meta, does not work.
*Log:*
slapd[22461]: conn=1004 op=3 SRCH base="dc=meta,dc=pov" scope=2 deref=2
filter="(&(?objectClass=user)(!(?objectClass=Computer))( *?=error* ))"

First I'd try to add the object classes 'user' and 'computer' and the
attribute type userAccountControl to the local OpenLDAP schema. See
slapd-ldap(5) for a note about schema and filters.
Not sure whether the non-existing matching rule 1.2.840.113556.1.4.803 can be
used though. You cannot just declare matching rules in OpenLDAP's schema files.

Grepping the code, I see that integerBitAndMatch and integerBitOrMatch
are implemented. Perhaps the issue is that UserAccountControl is not
defined; in any case, enumeration (its syntax, 2.5.5.9, according to
<http://msdn.microsoft.com/en-us/library/windows/desktop/ms680832%28v=vs.85%29.aspx>)
is not defined. Adding a syntax (or a matching rule) requires the
corresponding pieces of code for validation and normalization, if
required. It's not a big deal as soon as the specification is available
(and doable), but that's another business.

p.