Searching

Search is the operation you'll use most. Every LDAP search is defined by four things:

1. A base DN — where in the tree to start.
2. A scope — how far to look from that base.
3. A filter — which entries match (covered in depth in LDAP filters).
4. A list of attributes to return.

Scope controls how much of the tree below the base DN gets searched:

Searching ou=Users,dc=example,dc=com with scope one would find ou=Engineering but not cn=Jane Doe, since she's two levels down. The same search with scope sub would find both ou=Engineering and cn=Jane Doe. Most application searches use sub.

Within the chosen base and scope, the filter decides which entries actually match:

(&(objectClass=user)(mail=jane.doe@example.com))

This searches for entries that are users and have that exact email address. Filters are their own topic — see LDAP filters for the full syntax.

By default, many clients return every readable attribute on a match, which is wasteful if you only need mail and memberOf. Real search calls almost always pass an explicit attribute list:

const attributes = ["cn", "mail", "memberOf"];

Returning fewer attributes reduces response size and avoids accidentally depending on data you didn't ask for. See Searching with ldapjs for a working code example.

Servers commonly enforce a maximum number of entries returned (sizeLimit) and a maximum time to spend on a search (timeLimit), both to protect themselves from expensive queries. A search that would return more entries than the limit allows returns the result code 4 (sizeLimitExceeded) along with whatever it managed to find.

Filters deserve their own deep dive — continue to LDAP filters.