Some question regarding filters

[Klaus Steinberger <Klaus.Steinberger@Physik.Uni-Muenchen.DE>]

Hello,

I try to write a script, which figures out any user for which the 
shadowExpire attribute has expired. But using <= for the filter does not 
work. A filter using equality "=" works.

(shadowExpire<=12052)  returns no results
(shadowExpire=12052)   returns any user expiring on 31.12.2002


I've lurked through the maillinglist, and found out that this behavior 
is because the schema for shadowAccount is defined the following way:

attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )


So my questions:

1. Why for heaven's sake is no ordering defined for shadowExpire?

2. How could I work around this?
   I could sort it out in the perlscript of course, but it would be
   better to have the server do the work, that would make the script
   much simpler.

   I tried extensible filter, and was able to request
   integerOrderingmatch the following way:

   (shadowExpire:2.5.13.15:=12052)

   but I didn't figure out how to write a filter with less-equal in this
   syntax?

Sincerly,
Klaus

--
Klaus Steinberger         Maier-Leibnitz Labor
Phone: (+49 89)289 14287  Am Coulombwall 6, D-85748 Garching, Germany
FAX:   (+49 89)289 14280  EMail: Klaus.Steinberger@Physik.Uni-Muenchen.DE
URL: http://www.physik.uni-muenchen.de/~k2/