LDAP 比较属性
我想过滤 CN 不等于 sAMAccountName 的所有 LDAP 对象。因此，我编写了以下查询，不幸的是，该查询既不起作用也不符合 RFC：
(!(cn=sAMAccountName))
有人知道如何实现所需的功能吗？
此致 托马斯
I would like to filter for all LDAP objects where the CN does not equal the sAMAccountName. Therefore I wrote the following query, which unfortunately neither works nor seems to be RFC compliant:
(!(cn=sAMAccountName))
Does anybody know how to acheive the desired functionality?
Best regards
Thomas
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
LDAP 过滤器不允许使用另一个属性的值进行过滤器比较。您必须获取条目并比较两个值。
LDAP filters do not allow using value of another attribute for filter comparison. You have to fetch the entry and compare both values.
(!(cn=sAMAccountName))是“符合 RFC”的，因为断言的右侧被视为cn属性的值。使用此过滤器将导致搜索响应中返回所有存在
cn属性值的条目，并且cn的匹配规则返回false 为不区分大小写的值samaccountname（假设cn属性匹配规则尚未从已发布的标准中更改）。结果将受到以下因素的影响：也许您打算使用
(!(cn=sAMAccountName))is "RFC compliant", because the right-hand side of the assertion is taken to be a value of thecnattribute.Using this filter will result in all entries being returned in a search response where value of the
cnattribute is present, and the matching rule forcnreturnsfalsefor the case-insensitive valuesamaccountname(assuming thecnattribute matching rule has not been changed from the published standard). The results will be subject to:Perhaps you meant to use
cn=value-of-samaccount-name如果您在 Windows 环境中，则可以使用 PowerShell 表达式语言来执行此操作。
这是一个相当昂贵的查询，因为它返回 PowerShell 进行处理的每个用户对象，但它确实有效。
If you're in a Windows environment, you can use PowerShell Expression Language for this.
This is a fairly expensive query because it returns every single user object for PowerShell to do processing on, but it does work.