<?xml version="1.0" encoding="windows-1252"?>
<node id="601252" title="Re: how to handle comparison of binary type attributes in LDAP" created="2007-02-20 22:00:22" updated="2007-02-20 17:00:22">
<type id="11">
note</type>
<author id="195379">
idsfa</author>
<data>
<field name="doctext">
&lt;p&gt;This sounds very much like an [id://542341|XY Problem]. What are you actually trying to accomplish? Which said, I'm game to try and answer the question you asked ...&lt;/p&gt;

&lt;p&gt;The allowed content of an LDAP (v3) attribute is defined in the [wp://Lightweight_Directory_Access_Protocol#Schema|LDAP Schema].  You can use [mod://Net::LDAP::Schema] to retrieve this from the server.  &lt;/p&gt;

&lt;p&gt;Unfortunately, this may or may not help you, as there are several "kinds" of binary data which can exist even in the [http://www.ietf.org/rfc/rfc2252.txt|Standard Types], let alone any custom extensions which you may have.  For example, the RFC mentions the &lt;c&gt;Audio&lt;/c&gt;, &lt;c&gt;Binary&lt;/c&gt;,  &lt;c&gt;JEPG&lt;/c&gt; and &lt;c&gt;Octet String&lt;/c&gt; syntaxes.  You could probably implement a lookup table to specify which comparison method should be used, based upon the [wp://Object_identifier|OID] of the syntax for each attribute's value.  This would be the route to take if you are (for example) trying to compare two different LDAP directories.&lt;/p&gt;

&lt;p&gt;If, OTOH, you are trying to find partially matching entries in a single LDAP, you might be able to make the server do the work and just use a [mod://Net::LDAP::Filter|filter] to pull out entries which match your desired attribute/value pairs.  Since you don't seem to be to rigorous about comparing the binary values, this may be "good enough".&lt;/p&gt;


&lt;code&gt; 
  my $filter = "(&amp;";
  foreach my $attr (keys %lookingfor)
  { 
    $filter .= "($attr=\"
            .  escape_filter_value($lookingfor{$attr}) 
            .  "\")";
  }
  $filter .= ")";

  $ldap = Net::LDAP-&gt;new($server);
  $mesg = $ldap-&gt;bind;

  $mesg = $ldap-&gt;search(
                         base   =&gt; $base,
                         filter =&gt; $filter
                       );

  $mesg-&gt;code &amp;&amp; die $mesg-&gt;error;
  foreach $entry ($mesg-&gt;entries) { $entry-&gt;dump; }
  $mesg = $ldap-&gt;unbind;
&lt;/code&gt;


&lt;!-- Node text goes above. Div tags should contain sig only --&gt;
&lt;div class="pmsig"&gt;&lt;div class="pmsig-195379"&gt;
&lt;hr/&gt;
&lt;I&gt;The intelligent reader will judge for himself. Without examining the facts fully and fairly, there is no way of knowing whether vox populi is really vox dei, or merely vox asinorum. &amp;mdash; Cyrus H. Gordon&lt;/I&gt;
&lt;/div&gt;&lt;/div&gt;</field>
<field name="root_node">
601242</field>
<field name="parent_node">
601242</field>
</data>
</node>
