I have a need to build an LDAP filter with a very lengthy OR condition, and am wondering if there may be a better way to do this.

Currently, the query string I am using is


There can be up to 200 or so users in this query string. The users in question are not in any particular LDAP group, nor have any other attributes in common; they are randomly distributed throughout the LDAP directory. My only way to identify those users I'm interested in is by their user ID. I also don't have control over the LDAP server, and can't create a user group (it would also not make much sense in this context).

Building this query string is tedious and error-prone, and I'm wondering if there might be a better way to do this.

More background information: the complete LDAP directory is very large, tens of thousands of users. The users in question have been selected to take a training class, and the classroom computers will only allow those selected to log on. The list of users (and therefore my filter) changes every few weeks.

The underlying implementation will be openldap on RedHat 7.

  • That's the LDAP way, use a script if you have to do it too often. Well, the better way would be to kill LDAP with fire, but I suspect most sites won't listen to this particular wisdom. ;) May 31, 2017 at 7:20
  • Well, you can automate generating the query string from a list with one username per line or something like that, but I'm not sure that is what you're asking? May 31, 2017 at 7:32
  • @UlrichSchwarz thank you - you are right, generating the list with a script is an option, but I was hoping that there might be a more direct way. One reason is that I'm concerned about the potential length of the string, I assume there is a limit of what LDAP can handle. Jun 1, 2017 at 12:24
  • I don't see an other way to do that without adding information into the directory. But if performance is an issue, I would try making one search per user (assuming that the userid has an index in equality)
    – Esteban
    Jun 2, 2017 at 7:49

1 Answer 1

#!/usr/bin/env perl
use 5.14.0;
use warnings;
use Net::LDAP::Util qw(escape_filter_value);

# users as arguments or via standard input
chomp(@ARGV = readline *STDIN) unless @ARGV;

print '(|';

for my $user (@ARGV) {
    print '(userid=' . escape_filter_value($user) . ')';

say ')';

And then something like

$ sudo yum -y install perl-LDAP
... yum flails wildly here ...
$ perl whatyoucalledtheabovecode foo bar zot
  • Not really what I was asking about, but that suggestion does help. I was going to use awk instead, to the same effect. Jun 1, 2017 at 12:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .