2. LDAP 搜索过滤器定义 (LDAP Search Filter Definition)

LDAP 搜索过滤器在 [RFC4511] 第 4.5.1 节中定义如下:

Filter ::= CHOICE {
    and                [0] SET SIZE (1..MAX) OF filter Filter,
    or                 [1] SET SIZE (1..MAX) OF filter Filter,
    not                [2] Filter,
    equalityMatch      [3] AttributeValueAssertion,
    substrings         [4] SubstringFilter,
    greaterOrEqual     [5] AttributeValueAssertion,
    lessOrEqual        [6] AttributeValueAssertion,
    present            [7] AttributeDescription,
    approxMatch        [8] AttributeValueAssertion,
    extensibleMatch    [9] MatchingRuleAssertion }

SubstringFilter ::= SEQUENCE {
    type    AttributeDescription,
    -- initial and final can occur at most once
    substrings    SEQUENCE SIZE (1..MAX) OF substring CHOICE {
     initial        [0] AssertionValue,
     any            [1] AssertionValue,
     final          [2] AssertionValue } }

AttributeValueAssertion ::= SEQUENCE {
    attributeDesc   AttributeDescription,
    assertionValue  AssertionValue }

MatchingRuleAssertion ::= SEQUENCE {
    matchingRule    [1] MatchingRuleId OPTIONAL,
    type            [2] AttributeDescription OPTIONAL,
    matchValue      [3] AssertionValue,
    dnAttributes    [4] BOOLEAN DEFAULT FALSE }

AttributeDescription ::= LDAPString
                -- Constrained to <attributedescription>
                -- [RFC4512]

AttributeValue ::= OCTET STRING

MatchingRuleId ::= LDAPString

AssertionValue ::= OCTET STRING

LDAPString ::= OCTET STRING -- UTF-8 encoded,
                            -- [Unicode] characters

[RFC4511] 所定义的 AttributeDescription 是 [RFC4512] 所讨论属性描述的字符串表示. AttributeValue 和 AssertionValue 这两个 OCTET STRING 采用 [RFC4517] 中定义的形式. Filter 使用 [X.690] 定义的基本编码规则 (Basic Encoding Rules, BER) 编码后通过网络传输, 并采用 [RFC4511] 所述的简化规则.