however, when I search with "cn=foo*", and entry has multiple "cn" values, like "cn=foo", "cn=joe", "cn=foobar", "cn=foobarX", "cn=bob", "cn=nofoobar"
- is it possible to have "cn" returned, but only these values,
which actually matched the filter ?
Yes. Use RFC 3876 control. E.g. $ ldapsearch -E mv="(cn=foo*)"
Very cool.