RFC 1960

Network Working Group RFC 1960 ✨ (Standards Track, June 1996) 🎀

Okay bestie, let's get into this! 💖 This one is RFC 1960, A String Representation of LDAP Search Filters, written by T. Howes from the University of Michigan. It's a Standards Track document dated June 1996, and it obsoletes RFC 1558. 🦋 It doesn't say anything about updating other RFCs, so nothing to report there. 💅

Status of this Memo 🌸

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. 💜

1. Abstract 🌈

So LDAP (the Lightweight Directory Access Protocol) [1] already has a network format for search filters that get sent to an LDAP server. 🧚 Lowkey though, that format isn't really something a human can read at a glance. This doc gives everyone a common, human-readable string format for writing those same search filters. Iconic. 🔥

2. LDAP Search Filter Definition ⭐

Okay so first, here's how [1] defines an LDAP search filter. Bestie, look at this structure, it's giving full tree energy. 🌳

Filter ::= CHOICE {
        and                [0] SET OF Filter,
        or                 [1] SET OF Filter,
        not                [2] Filter,
        equalityMatch      [3] AttributeValueAssertion,
        substrings         [4] SubstringFilter,
        greaterOrEqual     [5] AttributeValueAssertion,
        lessOrEqual        [6] AttributeValueAssertion,
        present            [7] AttributeType,
        approxMatch        [8] AttributeValueAssertion
}

SubstringFilter ::= SEQUENCE {
        type    AttributeType,
        SEQUENCE OF CHOICE {
                initial        [0] LDAPString,
                any            [1] LDAPString,
                final          [2] LDAPString
        }
}
AttributeValueAssertion ::= SEQUENCE {
        attributeType   AttributeType,
        attributeValue  AttributeValue
}

AttributeType ::= LDAPString

AttributeValue ::= OCTET STRING

LDAPString ::= OCTET STRING

Now the tea 🍓: the LDAPString above is limited to the IA5 character set. The AttributeType is a string representation of the attribute type name and is defined in [1]. The AttributeValue OCTET STRING has the form defined in [2]. The Filter gets encoded for transmission over a network using the Basic Encoding Rules defined in [3], with simplifications described in [1]. Main character energy for sure. 👑

3. String Search Filter Definition 🎀

Here's the part you actually came for, the string version! ✨ It uses a prefix format, so the operator shows up first. The grammar goes like this:

<filter> ::= '(' <filtercomp> ')'
<filtercomp> ::= <and> | <or> | <not> | <item>
<and> ::= '&' <filterlist>
<or> ::= '|' <filterlist>
<not> ::= '!' <filter>
<filterlist> ::= <filter> | <filter> <filterlist>
<item> ::= <simple> | <present> | <substring>
<simple> ::= <attr> <filtertype> <value>
<filtertype> ::= <equal> | <approx> | <greater> | <less>
<equal> ::= '='
<approx> ::= '~='
<greater> ::= '>='
<less> ::= '<='
<present> ::= <attr> '=*'
<substring> ::= <attr> '=' <initial> <any> <final>
<initial> ::= NULL | <value>
<any> ::= '*' <starval>
<starval> ::= NULL | <value> '*' <starval>
<final> ::= NULL | <value>

Okay, the important bits 🫶: <attr> is a string representing an AttributeType, and it has the format defined in [1]. <value> is a string representing an AttributeValue (or part of one), and it has the form defined in [2]. If a <value> has to contain one of the characters '*' or '(' or ')', you SHOULD escape those by putting a backslash '\' in front of them. 🙈

Heads up bestie: that escaping one is a SHOULD, not a MUST, so it's recommended but not strictly required. Don't skip it though, it's the difference between a clean filter and a total mess. 💀

Also, the <substring> and <present> productions can both produce the 'attr=*' construct, but that construct is only used to mean a presence filter. 🦋

4. Examples 💅

Here's a few examples of search filters written in this notation. Literal vibes, no cap. 🌸

(cn=Babs Jensen)
(!(cn=Tim Howes))
(&(objectClass=Person)(|(sn=Jensen)(cn=Babs J*)))
(o=univ*of*mich*)

5. Security Considerations 🔐

Security considerations are not discussed in this memo. 🙈 Yeah, that's the whole section, it's giving minimal. 😭

6. Bibliography 📚

[1] Yeong, W., Howes, T., and S. Kille, "Lightweight
    Directory Access Protocol", RFC 1777, March 1995.

[2] Howes, R., Kille, S., Yeong, W., and C. Robbins, "The String
    Representation of Standard Attribute Syntaxes", RFC 1778,
    March 1995.

[3] Specification of Basic Encoding Rules for Abstract Syntax
    Notation One (ASN.1).  CCITT Recommendation X.209, 1988.

7. Author's Address 🧚‍♀️

Tim Howes University of Michigan ITD Research Systems 535 W William St. Ann Arbor, MI 48103-4943 USA

Phone: +1 313 747-4454 EMail: tim@umich.edu

---

That's the whole RFC, bestie! 🌈💖 Go slay your LDAP filters 💅✨