Re: Matching Rules used in Inequality Filters

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

ariel writes:
> attributeType ( 1.3.6.1.4.1.9012.1.1.1.153 NAME 'lastLogin'
>         ORDERING caseIgnoreOrderingMatch
>         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)

You should probably have an EQUALITY matching rule too.
Otherwise you can't search for an exact value, compare with a value, add
or remove one value at a time, or use the attribute in a DN.  Provided
the server follows the X.500 model properly.

Personally, I always include EQUALITY matching rules unless there is
some specific reason not to.

> /usr/local/openldap-2.1.25/bin/ldapsearch (...)
>  "(&(objectclass=*)(lastLogin>=10279010355563))" lastLogin
> 
> but the comparation is by string and it is not what I ment, I need
> numeric comparation

Then you need SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 (Integer),
EQUALITY integerMatch, ORDERING integerOrderingMatch.

Note that Integer does not allow extra zeroes in front of the number.
(Of course, your server might not check that restriction, if so don't
depend on that - a later version of it could become more restrictive.)

> so I changed my attribute to numeric string:

Numeric string is not a number, but a string of digits and spaces.
They are not matched as numbers, but as strings - ignoring spaces.
E.g. "52" matches "5 2", but not "052", and is less than "7".

-- 
Hallvard