> > however, when I search with "cn=foo*", and entry has multiple > > "cn" values, like > > "cn=foo", > > "cn=joe", > > "cn=foobar", > > "cn=foobarX", > > "cn=bob", > > "cn=nofoobar" > > - is it possible to have "cn" returned, but only these values, > > which actually matched the filter ? > Yes. Use RFC 3876 control. E.g. > $ ldapsearch -E mv="(cn=foo*)" Very cool.