Re: search right and attribute existence

[Michael Ströder <michael@stroeder.com>]

On 2016-08-11 14:13, Emmanuel Dreyfus wrote:
> I would like to test if an attribute is set without disclosing it.
> Using an ACL that grants the search right does it: I can do
> ldapsearch -b dn attr=*' dn
> and see if I get a result.
>
> Problem: it is still possible to brute force the atribute value,
> by searching x* with x being the first lette,r, then xy* and so on.
>
> Is there a way to address this?

I don't know your schema, attribute values and requirements.
If it's a custom attribute type disabled the SUBSTR matching rule is the 
only solution
in case of DirectoryString or IA5String syntax.

And same issue if attribute type declaration in the schema allows 
ORDERING searches...

Ciao, Michael.