LDAP query on a OU with * in the title. How?

Question

Hi, I'm having difficults I believe with a * character being in my OU when I'm doing a search. The OU group is called WorldWide Offices.

I have a looping query that returns all the users who are in a given group. So I type in a group name, and this brings me back a group. Then I loop through the group.members.

These members will either be a user or another group. So if it's not a user I would then loop through again to check if it's a group. The members of the group are always the DistinguishedName, and that's all I have to search on.

I'm having a current user with the DistinguishedName as CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=Worldwide Offices,DC=OurDomain,DC=LOCAL.

I'm doing a DirectorySearcher and my filter is

Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=*Worldwide Offices*,DC=OurDomain,DC=LOCAL))

As you can see, I think the fact that our OU has * in it's title is the reason why it doesn't find the user. Any other OU that doesn't have a * in it seems to work. Which is why I believe the * is the problem.

Does anyone have any idea how to get around the * problem, apart from renaming the OU?

Answer 1

Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=\2aWorldwide Offices\2a,DC=OurDomain,DC=LOCAL))

A * must be escaped with a \2a - please see MSDN "Search Filter Syntax":

If any of the following special characters must appear in the search filter as literals, they must be replaced by the listed escape sequence.

* => \2a
( => \28
) => \29
\ => \5c
NUL => \00
/ => \2f

Simply escaping it with a \ should work too:

Searcher.Filter = "(&(&(objectClass=user)(!(objectClass=computers)))(distinguishedName=CN=Smith\, John a.,OU=Laptop,OU=Users,OU=London DC,OU=UK,OU=\*Worldwide Offices\*,DC=OurDomain,DC=LOCAL))

Answer 2

The wild card only work if the attribute type is some string type. (octet string, unicode string). if you use * agains the attribute like givenName, displayName then the wild cards will be honored. But the distinguished name is of type "Distinguished Name", hence the substring match wont be turned on by the server.

if you use * against objectcategory, dn, distinguishedname... you can see the wildcard not working.

Your logic need to be changed.