On 2016-08-11 14:13, Emmanuel Dreyfus wrote:
I would like to test if an attribute is set without disclosing it. Using an ACL that grants the search right does it: I can do ldapsearch -b dn attr=*' dn and see if I get a result.
Problem: it is still possible to brute force the atribute value, by searching x* with x being the first lette,r, then xy* and so on.
Is there a way to address this?
I don't know your schema, attribute values and requirements. If it's a custom attribute type disabled the SUBSTR matching rule is the only solution in case of DirectoryString or IA5String syntax.
And same issue if attribute type declaration in the schema allows ORDERING searches...
Ciao, Michael.