在LDAP搜索过滤器中，是否可以要求一个多值字段的第一个，第二个，第n个或最后一个值？

Question

Using a search filter, is it possible to retrieve the last value of a multi-valued field for an object eg the department field of the inetOrgPerson?

For instance, if my user cn=Alice has 2 values for department, can I somehow write a search filter that will return the last value only?

Thanks.

Answer 1

LDAPSearch filters are meant to find and filter LDAP entries. In the LDAP request, the list of attributes to retrieve is a separate parameter from the filter. An LDAP Extension (a Control) exists to specify to match and retrieve only matching values of a multi-valued attribute, specified in RFC 3876. This extension is not implemented in all LDAP directory services, nor in all LDAP clients.

Answer 2

I found a draft for ordered entries and values:

https://tools.ietf.org/html/draft-chu-ldap-xordered-00

If your LDAP server implements this schema extension you might succeed in searching for the nth value of a multi-valued attribute