Net::LDAP problem with wildcard on applied filter

[mellin]

I have a strange behaviour of applied filter on my program. It uses Net::LDAP to fetch object information from Microsoft Active Directory. Group and Computer objects can have "managedBy" attribute set on them, this attribute, if set, uses object distinguished name (DN) as its syntax. When i try to search all computer objects with managedBy attribute against string *Administrator*, i don't get any returned objects, altough i can verify otherwise that this user is found on managedBy attribute on several computer objects. Same thing when trying to search group objects where Administrator is found in managedBy

Note that i use wildcards, as they are supported on LDAP filters, far as i know. I'm also using user Administrator just as an example here. If i replace *Administrator* string with the complete user DN, i get the expected results, but i'm aiming to simplify things here.

Administrator DN:

CN=Administrator,CN=Users,DC=domain,DC=ad,DC=local

Applied filter:

(&(objectClass=computer)(managedBy=*Administrator*))

[g0n]

I've come across this kind of behaviour in AD before. It looks like there may be some sort of 'undocumented' feature, examining search filters, and returning a null record set on anything with too broad a scope. managedBy probably doesn't have a medial index, so your search would be insanely slow, so AD returns nothing. There is some information on efficient filtering here

Just to verify that this behaviour originates in AD, you could try doing the same search with ldapsearch from the command line.

You might get better behaviour with (managedBy=cn=Administrator*)

[mellin]

Sure, didn't think of that. I'll try with ldapsearch if it returns the same.

[mellin]

I'm getting similar results with other ldap tools as well, Microsoft AD returns nothing when trying to search by managedBy attribute. Too bad, because i would really need this functionality.

Now i need to come up with some other ldap filter, if this doesn't work.