Ambiguous Name Resolution for LDAP in Windows 2000

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server
• Microsoft Windows 98 Second Edition

SUMMARY

Ambiguous Name Resolution (ANR) is an efficient search algorithm associated with Lightweight Directory Access Protocol (LDAP) clients that allows for objects to be bound without complex search filters. ANR is useful when you are locating objects and attributes that may or may not be known by the client. A common use for ANR, for example, is in a situation in which a building name is known by the requesting client, but not the associated number. In this case, the physicalDeliveryOfficeName attribute may have a value of "Building 40" and a client might search for "Building." ANR returns a match in this instance. It also returns other matches containing the word "Building."

MORE INFORMATION

LDAP clients can use ANR to make searching and querying easier. Rather than presenting complex filters, a search can be presented for partial matches. If a space is embedded in the search string, as in the case above, the search is divided at the space and an "or" search is also performed on the attributes. If there is only one space, the search divides only at the first space.

By default, the following attributes are set for ANR:

• GivenName
• Surname
• displayName
• LegacyExchangeDN
• msExchMailNickname
• RDN
• physicalDeliveryOfficeName
• proxyAddress
• sAMAccountName

Sample ANR Search Using the Address Book

1. The client presents an "anr=John Doe" request to Active Directory (Address Book generates an ANR search). ANR must be enabled on both the LDAP client and the LDAP server. Active Directory supports ANR by default.



2. Active Directory notices the "anr" and the embedded space.



3. Active Directory checks the schema to determine which objects have ANR and SEARCH index bits set.



4. Active Directory performs an "or" search for "John Doe*" against the default attributes listed above.



5. Active Directory then searches for: Given-Name=John* AND Surname=Doe*



6. Active Directory then searches for: Given-Name=Doe* AND Surname=John*

• Compared to: John Doe
  Search Results: Match
  Results Explanation: "John Doe*" matches displayName from step 4



• Compared to: John Does
  Search Results: Match
  Results Explanation: "John*" AND "Doe*" matches Given-Name=John* AND Surname=Smith* from step 5



• Compared to: John Buck
  Search Results: No match
  Results Explanation: "John Doe*" does not match the displayName
  "John*" AND "Doe*" does not match the Given-Name and Surname of John Buck
  "John*" AND "Doe*" does not match the Surname and Given-Name of John Buck

Additional query words:

Keywords : kbtool
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo