Re: syntax of searchfilters

[Chris R. <chr...@me...>]

"Klunder, JAA (Hans)" <J.A...@rf...> wrote:
> Dear all,
> 
> It might be a bit of topic, but anyway:
> 
> I'm having a discussion with a collegue on LDAP searchfilters, do AND and
> OR work on 2 filtercomponents or on N filtercomponents. 
> 
> so is:
> 
> (|(cn=a)(cn=b)(cn=c)) 
> 
> allowed, or need I specify:
> 
> (|(|(cn=a)(cn=b))(cn=c))
> 
> Our server (messagingDirect) supports both, but I'm wondering if this is
> intentional.
> 
> Thanks for any help,
> 
> Hans

LDAP clients only send filters encoded in ASN.1 to the server, and in ASN.1
filters are allowed to have multiple terms in and/or expressions. RFC 2251:

        Filter ::= CHOICE {
                 and                [0] SET OF Filter,
                 or                 [1] SET OF Filter,
                 ...
        }

The SET OF above is unbounded, so you can have one, two, or more elements
in the SET OF.

The string form of filters appears to also allow multiple items in a simple
filter expression. RFC 2254:

         filter     = "(" filtercomp ")"
         filtercomp = and / or / not / item
         and        = "&" filterlist
         or         = "|" filterlist
         not        = "!" filter
         filterlist = 1*filter

(etc)

According to the ABNF defined in RFC 822, 1*filter means 'at least one and
at most infinite occurrences of filter'.

So both filters are, I think, legal.

Cheers,

Chris