Enterprise Administration Guide › Administering CA ControlMinder Enterprise Management › Users, Groups, and Administrative Roles › Types of Groups › LDAP Filter Query—Define Dynamic Group Query Parameters

LDAP Filter Query—Define Dynamic Group Query Parameters

You create a dynamic group by defining an LDAP filter query using the CA ControlMinder Enterprise Management to determine group membership at runtime.

This filter query has the following format:

LDAP:///search_base_DN??search_scope?searchfilter

search_base_DN

Defines the point from where you begin the search in the LDAP directory. If you do not specify the base DN in the query, then the group organization is the default base DN.

search_scope

Specifies the extent of the search and includes:

• sub—Returns entries at the base DN level and below.
• one—Returns entries one level below the base DN you specify in the URL.
• base—Uses one instead, ignoring base as a search option.

Using one or base obtains only the users in the Base DN organization.

Using sub obtains all users under the Base DN organization and all sub- organizations in the tree.

searchfilter

Defines the filter that you want to apply to entries within the scope of the search. When you enter a search filter, use the standard LDAP query syntax as follows:

([logical_operator]Comparison)

logical operator

Defines a logical operator. Can be one of:

• |—Logical OR
• &—Logical AND
• !—Logical NOT

Comparison

Defines AttributeOperatorValue

• Attribute—Defines the name of the LDAP attribute.
• Operator—Specifies the comparison operator. Can be one of: = (equals), <= (less than or equals), >= (greater than or equals), or ~= (approximately equals).
• Value—Defines the value for the attribute data.

Example: (&(city=Boston)(state=Massachusetts))

Default: (objectclass=*)

Note the following when creating a dynamic query:

• The "LDAP" prefix must be lowercase, for example:

  ldap:///o=MyCorporation??sub?(title=Manger)
  

• You cannot specify the LDAP server host name or port number. All searches occur within the LDAP directory that you configured for your environment.

Example: Sample LDAP Queries

The following are sample LDAP queries:

Note: The > and < (greater than and less than) comparisons are lexicographic, not arithmetic. For details on their use, see the documentation for your LDAP directory server.