I have a need to build an LDAP filter with a very lengthy OR condition, and am wondering if there may be a better way to do this.

Currently, the query string I am using is


There can be up to 200 or so users in this query string. The users in question are not in any particular LDAP group, nor have any other attributes in common; they are randomly distributed throughout the LDAP directory. My only way to identify those users I'm interested in is by their user ID. I also don't have control over the LDAP server, and can't create a user group (it would also not make much sense in this context).

Building this query string is tedious and error-prone, and I'm wondering if there might be a better way to do this.

More background information: the complete LDAP directory is very large, tens of thousands of users. The users in question have been selected to take a training class, and the classroom computers will only allow those selected to log on. The list of users (and therefore my filter) changes every few weeks.

The underlying implementation will be openldap on RedHat 7.

  • That's the LDAP way, use a script if you have to do it too often. Well, the better way would be to kill LDAP with fire, but I suspect most sites won't listen to this particular wisdom. ;) – Satō Katsura May 31 '17 at 7:20
  • Well, you can automate generating the query string from a list with one username per line or something like that, but I'm not sure that is what you're asking? – Ulrich Schwarz May 31 '17 at 7:32
  • @UlrichSchwarz thank you - you are right, generating the list with a script is an option, but I was hoping that there might be a more direct way. One reason is that I'm concerned about the potential length of the string, I assume there is a limit of what LDAP can handle. – Kevin Keane Jun 1 '17 at 12:24
  • I don't see an other way to do that without adding information into the directory. But if performance is an issue, I would try making one search per user (assuming that the userid has an index in equality) – Esteban Jun 2 '17 at 7:49
#!/usr/bin/env perl
use 5.14.0;
use warnings;
use Net::LDAP::Util qw(escape_filter_value);

# users as arguments or via standard input
chomp(@ARGV = readline *STDIN) unless @ARGV;

print '(|';

for my $user (@ARGV) {
    print '(userid=' . escape_filter_value($user) . ')';

say ')';

And then something like

$ sudo yum -y install perl-LDAP
... yum flails wildly here ...
$ perl whatyoucalledtheabovecode foo bar zot
  • Not really what I was asking about, but that suggestion does help. I was going to use awk instead, to the same effect. – Kevin Keane Jun 1 '17 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.