Maybe not strictly lldap, but, isn't this a valid search filter?

(&(&(uid=nas_admin)(objectclass=inetOrgPerson)(unix_uid_number=*))(memberOf=uid=nas_users,ou=groups,dc=example,dc=com))

It's built by sssd, and it reports

ldap_search_ext failed: Bad search filter

, testing with ldapsearch reports the same, until I remove the

(unix_uid_number=*)

part, but shouldn't that be valid? I don't see anything in the lldap log, it's not possible that it has rejected it, without anything in the log, right?

message has been deleted

How are you sending the message? ldapsearch?

Yeah

Then the error is from before sending the message, ldapsearch refuses it

tried quoting with both double and single quotes, and the print from ldapsearch gives me the same query back in both cases

It is

memberOf=uid=nas_users

is this valid syntax?

Good catch, that can't work

Pretty sure it is, and it works when I remove the` (unix_uid_number=*)` alone

Though it doesn't seem to be the problem

Yeah, this works:

(&(&(uid=nas_admin)(objectclass=person)(memberOf=uid=nas_users,ou=groups,dc=apc,dc=dk)))

Not a valid part of an attribute name

ahhh!

LDAP is all camel case (or dash separated)

thanks!

There should be some checks in LLDAP to prevent you from creating bad attributes

Yes, gimme a sec, will just test with a different name first 🙂

User names or groups are fine

also when just fetched

Yeah, I guess it depends who does the validation

yeah, that seems likely

Yes, but they have aliases without underscores

uid should work instead, right?

Yes

Yes, then the query works! 🎉