On Fri, May 16, 2014 at 7:13 AM, Tuc <ml(a)t-b-o-h.net&gt; wrote: > We're having an issue with a slightly older version of openldap. > (2.4.23-26 > on CentOS). Using Apache Directory Studio I do a search: > > "(objectclass=person)" on a search base of > "ou=People,dc=example,dc=com" > > This should be the easiest and simplest search in the world. > However, I get > entries like : > > dn: uid=PLACEHOLDER_example_agent,ou=People,dc=example,dc=com > objectClass: top > objectClass: posixAccount > objectClass: inetOrgPerson > cn: PLACEHOLDER_example agent > gidNumber: 100 > homeDirectory: /home/example_agent > sn: agent > uid: PLACEHOLDER_example_agent > uidNumber: 621 > givenName: example > loginShell: /bin/bash > userPassword:: DELETED > > and > > dn: uid=BDTestUser,ou=People,dc=example,dc=com > objectClass: top > objectClass: organizationalPerson > objectClass: inetOrgPerson > cn: BD > sn: User > displayName: BD User > givenName: BD > mail: seo(a)example.com > mobile: +1 1111111111 > ou: Sales > telephoneNumber: +1 222222222 > title: BD Sample User > uid: BDTestUser > userPassword:: DELETED > > Where am I going wrong? organizationalPerson is a subclass of person, and inetOrgPerson is a subclass of organizationalPerson, so the entries above implicitly have the person objectClass. Have a look through the schema files.

On Fri, May 16, 2014 at 8:59 AM, Tuc <ml(a)t-b-o-h.net&gt; wrote: > Is there some way I can modify the query to only get ones that would > look > like : > > dn: uid=tuc,ou=People,dc=example,dc=com > objectClass: radiusprofile > objectClass: pwmUser > objectClass: top > VVVVVVVVVVVVVVVVVVV > objectClass: person > ^^^^^^^^^^^^^^^^^^^ > objectClass: posixAccount > objectClass: organizationalPerson > objectClass: inetOrgPerson An entry matching (objectClass=organizationalPerson) also satisfies (objectClass=person) whether or not you write it explicitly. You can ask for (&(objectClass=organizationalPerson)(!(objectClass=person))) but there won't be any results. Can you back up a few steps and explain the underlying problem you're trying to solve?

Is there some way I can modify the query to only get ones that would look like : dn: uid=tuc,ou=People,dc=example,dc=com objectClass: radiusprofile objectClass: pwmUser objectClass: top VVVVVVVVVVVVVVVVVVV objectClass: person ^^^^^^^^^^^^^^^^^^^ objectClass: posixAccount objectClass: organizationalPerson objectClass: inetOrgPerson

Michael Ströder wrote: > Tuc wrote: >> Is there some way I can modify the query to only get ones that would look >> like : >> >> dn: uid=tuc,ou=People,dc=example,dc=com >> objectClass: radiusprofile >> objectClass: pwmUser >> objectClass: top >> VVVVVVVVVVVVVVVVVVV >> objectClass: person >> ^^^^^^^^^^^^^^^^^^^ >> objectClass: posixAccount >> objectClass: organizationalPerson >> objectClass: inetOrgPerson > > I think there's a misunderstanding on your side: > If an entry has 'inetOrgPerson' as its structural object class it also has > object classes 'organizationalPerson' and 'person' no matter whether those > attributes values were added to attribute 'objectClass'. But you could, of course, filter on (&(objectclass=person)(!(objectclass=inetorgperson))) if you wanted.

--On May 16, 2014 at 10:02:04 AM -0700 Howard Chu <hyc(a)symas.com&gt; wrote: > But you could, of course, filter on > (&(objectclass=person)(!(objectclass=inetorgperson))) if you wanted. (&(objectclass=person)(!(objectclass=inetorgperson))(!(objectclass= organizationalPerson))) would probably be even better as far as achieving their stated objective, if what they want is object that only have "person". --Quanah

On 2014-05-16 13:42, Quanah Gibson-Mount wrote: > --On May 16, 2014 at 10:02:04 AM -0700 Howard Chu <hyc(a)symas.com&gt; wrote: > >> But you could, of course, filter on >> (&(objectclass=person)(!(objectclass=inetorgperson))) if you wanted. > > (&(objectclass=person)(!(objectclass=inetorgperson))(!(objectclass= > organizationalPerson))) > > would probably be even better as far as achieving their stated > objective, if what they want is object that only have "person". Also completely empty for basedn and ou=People.

--On May 16, 2014 at 10:02:04 AM -0700 Howard Chu <hyc(a)symas.com&gt; wrote: > But you could, of course, filter on > (&(objectclass=person)(!(objectclass=inetorgperson))) if you wanted. (&(objectclass=person)(!(objectclass=inetorgperson))(!(objectclass= organizationalPerson))) would probably be even better as far as achieving their stated objective, if what they want is object that only have "person".

On 2014-05-16 13:02, Howard Chu wrote: > Michael Ströder wrote: >> Tuc wrote: >>> Is there some way I can modify the query to only get ones that >>> would look like : >>> >>> dn: uid=tuc,ou=People,dc=example,dc=com >>> objectClass: radiusprofile >>> objectClass: pwmUser >>> objectClass: top >>> VVVVVVVVVVVVVVVVVVV >>> objectClass: person >>> ^^^^^^^^^^^^^^^^^^^ >>> objectClass: posixAccount >>> objectClass: organizationalPerson >>> objectClass: inetOrgPerson >> >> I think there's a misunderstanding on your side: >> If an entry has 'inetOrgPerson' as its structural object class it >> also has >> object classes 'organizationalPerson' and 'person' no matter whether >> those >> attributes values were added to attribute 'objectClass'. > > But you could, of course, filter on > (&(objectclass=person)(!(objectclass=inetorgperson))) if you wanted. > >> You should try to describe what you really want to finally achieve. If I do that filter on my ou=People, I get nothing. If I do it on our base DN,I actually end up with all our service accounts.