using wildcards in LDAP search filters/queries

Question

I have very limited knowledge in AD and LDAP queries so I have a simple question on how to use wildcards.

Supposed there is object with a displayName of "ITSM - Problem Management"

My current implementation of the filter with a wildcard is as such:

(displayName=SEARCHKEYWORD*)

If a user would enter a keyword of "Problem", he wouldn't be able to find the object since it needs the first part of the name, that is "ITSM - "

I would like to implement the wildcard on both ends like below:

(displayName=*SEARCHKEYWORD*)

Ideally, this would allow the entry of "Problem" and have it search for "ITSM - Problem Management". But the wildcard doesn't seem to work when you put it at the start. When I tried it, it just seems to hang-up and not return any results.

Any ideas or thoughts on how I can resolve this? Any input would be highly appreciated. Thanks!

Solution 1

A filter argument with a trailing * can be evaluated almost instantaneously via an index lookup. A leading * implies a sequential search through the index, so it is O(N). It will take ages.

I suggest you reconsider the requirement.

Solution 2

Your best bet would be to anticipate prefixes, so:

"(|(displayName=SEARCHKEY*)(displayName=ITSM - SEARCHKEY*)(displayName=alt prefix - SEARCHKEY*))"

Clunky, but I'm doing a similar thing within my organization.

Solution 3

This should work, at least according to the Search Filter Syntax article on MSDN network.

The "hang-up" you have noticed is probably just a delay. Try running the same query with narrower scope (for example the specific OU where the test object is located), as it may take very long time for processing if you run it against all AD objects.

You may also try separating the filter into two parts:

(|(displayName=*searchstring)(displayName=searchstring*))

Solution 4

The @user207421's answer is partially correct: by default, median search of the displayName attribute will cause full directory scan and thus will be slow and resource-intensive.

However, the AD Schema Admins can change that by implementing tuple index - specifically designed to improve performance of searches with the leading *. They need to modify the searchFlags attribute of the schema object - ref. https://docs.microsoft.com/en-us/windows/win32/adschema/a-searchflags

View more solutions