2. LDAP Search Filter Definition

An LDAP search filter is defined in Section 4.5.1 of [RFC4511] as follows:

    Filter ::= CHOICE {
        and                [0] SET SIZE (1..MAX) OF filter Filter,
        or                 [1] SET SIZE (1..MAX) OF filter Filter,
        not                [2] Filter,
        equalityMatch      [3] AttributeValueAssertion,
        substrings         [4] SubstringFilter,
        greaterOrEqual     [5] AttributeValueAssertion,
        lessOrEqual        [6] AttributeValueAssertion,
        present            [7] AttributeDescription,
        approxMatch        [8] AttributeValueAssertion,
        extensibleMatch    [9] MatchingRuleAssertion }

    SubstringFilter ::= SEQUENCE {
        type    AttributeDescription,
        -- initial and final can occur at most once
        substrings    SEQUENCE SIZE (1..MAX) OF substring CHOICE {
         initial        [0] AssertionValue,
         any            [1] AssertionValue,
         final          [2] AssertionValue } }








    AttributeValueAssertion ::= SEQUENCE {
        attributeDesc   AttributeDescription,
        assertionValue  AssertionValue }

    MatchingRuleAssertion ::= SEQUENCE {
        matchingRule    [1] MatchingRuleId OPTIONAL,
        type            [2] AttributeDescription OPTIONAL,
        matchValue      [3] AssertionValue,
        dnAttributes    [4] BOOLEAN DEFAULT FALSE }

    AttributeDescription ::= LDAPString
                    -- Constrained to <attributedescription>
                    -- [RFC4512]

    AttributeValue ::= OCTET STRING

    MatchingRuleId ::= LDAPString

    AssertionValue ::= OCTET STRING

    LDAPString ::= OCTET STRING -- UTF-8 encoded,
                                -- [Unicode] characters

The AttributeDescription, as defined in [RFC4511], is a string representation of the attribute description that is discussed in [RFC4512]. The AttributeValue and AssertionValue OCTET STRING have the form defined in [RFC4517]. The Filter is encoded for transmission over a network using the Basic Encoding Rules (BER) defined in [X.690], with simplifications described in [RFC4511].