Comments (3)
In general, you should not create search filters by constructing their string representations. Instead, you should programmatically construct them from their individual components. In the case of the filter you have listed, instead of trying to construct its string representation, you should build it like:
Filter filter = Filter.createANDFilter(
Filter.createEqualityFilter("objectClass", "group"),
Filter.createEqualityFilter("member", userEntry.getDN()));
Using this approach instead of concatenating strings provides several benefits, including:
- The LDAP SDK will automatically escape any special characters that might require it (commas, asterisks, parentheses, etc.).
- Related to the above, constructing filters programmatically rather than using string concatenation protects you against LDAP injection attacks. LDAP is more resistant than SQL in this regard, but there are still some use cases in which a malicious user might be able to create custom input that tricks the application into requesting more information than you intend to allow. Using the programmatic methods for constructing filters ensures that this can't happen because all of the special characters required by these kinds of exploits will be properly excaped.
- LDAP filters aren't sent as strings over the wire, but use a binary encoding that more closely matches what you get from the programmatic construction methods. If you provide a filter as a string representation, the LDAP SDK has to do more work to parse that string into the binary representation.
from ldapsdk.
And for the record, the correct way to escape a comma in a search filter is with "\5c,". That is, you escape the backslash as "\5c" and leave the comma alone. So the correct string representation of the filter you're trying to use is:
(&(objectClass=group)(member=cn=Smith\5c, James K.,ou=West,dc=MyDomain,dc=com))
The syntax for escaping filters is different from the syntax for escaping DNs. I didn't write the specs, but that's the way it is.
And although it's not applicable in this case, if you're not sure how to properly escape a DN, you can also programmatically construct a DN and have the LDAP SDK do all of the escaping for you. The code to create the DN listed above would be:
DN dn = new DN(
new RDN("cn", "Smith, James K."),
new RDN("ou", "West"),
new RDN("dc", "MyDomain"),
new RDN("dc", "com"));
from ldapsdk.
Thank you Neil! That worked.
from ldapsdk.
Related Issues (20)
- Unable to add entries to LDAP server HOT 1
- Is there way to use objectGuid instead of dn in API ? HOT 1
- What is the best option to remove object by objectGuid ? HOT 2
- Is there way to add user to multiple groups using single ldap request ? HOT 5
- How to get group by primaryGroupId ? How to convert primaryGroupId to groupDn? HOT 8
- How to search entry by operational attribute (PrimaryGroupToken)? HOT 2
- search with ALL_OPERATIONAL_ATTRIBUTES doesn't return any operational attributes HOT 2
- Filter.createSubstringFilter with "subInitial" or "subFinal" set to an empty string HOT 1
- Unable to login with AdditionalBindCredentials when certain OperationTypes are part of AuthenticationRequiredOperationTypes (Supressing Anonymous Connections) HOT 3
- Metric to show potentially available connections HOT 3
- Memory 'leak' in GSSAPIBindRequest HOT 5
- transactions support in unboundid ldap HOT 3
- Is there way to encrypt LDAP password ? (at least Base 64) HOT 1
- Is there way to get page number N during pagination request without iterating over previous pages ? HOT 13
- IdleTimeout parameter for pooled connections HOT 6
- KeyStoreKeyManager doesn't expose alternative KeyStore loading mechanisms. HOT 4
- InMemoryDirectoryServer is single threaded and blocks for searches HOT 1
- Simple bind fails if password contains latin character HOT 2
- multihomed ldap server HOT 3
- Unable to read or decode an LDAP message: Invalid value length of 0 for an ASN.1 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ldapsdk.