Search filter

The search filter syntax has the form attribute operator value. The default filter, objectclass=*, returns all entries in the scope.

The following table lists the filter operators:

Operator	Example	Matches
=*	(mail=*)	All entries that contain a mail attribute.
=	(o=macromedia)	Entries in which the organization name is macromedia.
~=	(sn~=Hansen)	Entries with a surname that approximates Hansen. The matching rules for approximate matches vary among directory vendors, but anything that "sounds like" the search string should be matched. In this example, the directory server might return entries with the surnames Hansen and Hanson.
>=	(st>=ma)	The name "ma" and names appearing after "ma" in an alphabetical state attribute list.
<=	(st<=ma)	The name "ma" and names appearing before "ma" in an alphabetical state attribute list.
*	(o=macro*)	Organization names that start with "macro".
	(o=*media)	Organization names that end with "media".
	(o=mac*ia)	Organization names that start with "mac" and end with "ia". You can use more than one * operator in a string; for example, mrodia.
	(o=med)	Organization names that contain the string "med", including the exact string match "med".
&	(&(o=macromedia) (co=usa))	Entries in which the organization name is "macromedia" and the country is "usa".
\|	(\|(o=macromedia) (sn=macromedia) (cn=macromedia))	Entries in which the organization name is "macromedia" or the surname is "macromedia", or the common name is "macromedia".
!	(!(STREET=*))	Entries that do not contain a StreetAddress attribute.

The Boolean operators & and | can operate on more than two attributes and precede all of the attributes on which they operate. You surround a filter with parentheses and use parentheses to group conditions.

If the pattern that you are matching contains an asterisk, left parenthesis, right parenthesis, backslash, or NUL character, you must use the following three-character escape sequence in place of the character:

Character	Escape sequence
*	\2A
(	\28
)	\29
\	\5C
NUL	\00

For example, to match the common name St*r Industries, use the filter
(cn=St\2Ar Industries).

LDAP v3 supports an extensible match filter that permits server-specific matching rules. For more information on using extensible match filters, see your LDAP server documentation.

Searching and sorting notes

To search for multiple values of a multivalued attribute type, use the & operator to combine expressions for each attribute value. For example, to search for an entry in which cn=Robert Jones and cn=Bobby Jones, specify the following filter:
```
filter="(&(cn=Robert Jones)(cn=Bobby Jones))"
```
You can use object classes as search filter attributes; for example, you can use the following search filter:
```
filter="(objectclass=inetorgperson)"
```
To specify how query results are sorted, use the sort field to identify the attribute(s) to sort. By default, ColdFusion returns sorted results in case-sensitive ascending order. To specify descending order, case-insensitive sorting, or both, use the sortControl attribute.
ColdFusion requests the LDAP server to do the sorting. This can have the following effects:
- The sort order might differ between ColdFusion MX and previous versions.
- If you specify sorting and the LDAP server does not support sorting, ColdFusion generates an error. To sort results from servers that do not support sorting, use a query of queries on the results.
If you use filter operators to construct sophisticated search criteria, performance might degrade if the LDAP server is slow to process the synchronous search routines that cfldap supports. You can use the cfldap tag timeout and maxRows attributes to control the apparent performance of pages that perform queries, by limiting the number of entries and by exiting the query if the server does not respond in a specified time.

View comments in LiveDocs