Ambiguous Name Resolution for LDAP in Windows 2000 (243299)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 98 Second Edition
This article was previously published under Q243299

SUMMARY

Ambiguous Name Resolution (ANR) is an efficient search algorithm associated with Lightweight Directory Access Protocol (LDAP) clients that allows for objects to be bound without complex search filters. ANR is useful when you are locating objects and attributes that may or may not be known by the client. A common use for ANR, for example, is in a situation in which a building name is known by the requesting client, but not the associated number. In this case, the physicalDeliveryOfficeName attribute may have a value of "Building 40" and a client might search for "Building." ANR returns a match in this instance. It also returns other matches containing the word "Building."

MORE INFORMATION

LDAP clients can use ANR to make searching and querying easier. Rather than presenting complex filters, a search can be presented for partial matches. If a space is embedded in the search string, as in the case above, the search is divided at the space and an "or" search is also performed on the attributes. If there is more than one space, the search divides only at the first space.

By default, the following attributes are set for ANR:
  • GivenName
  • Surname
  • displayName
  • LegacyExchangeDN
  • msExchMailNickname
  • RDN
  • physicalDeliveryOfficeName
  • proxyAddress
  • sAMAccountName

Sample ANR Search Using the Address Book

Assume that there are three users named John Doe, John Does, and John Buck, and a search for "John Doe" is performed. The following actions result:
  1. The client presents an "anr=John Doe" request to Active Directory (Address Book generates an ANR search). ANR must be enabled on the LDAP server. Active Directory supports ANR by default. ANR is a filter rewrite on the server.
  2. Active Directory notices the "anr" and the embedded space.
  3. Active Directory checks the schema to determine which objects have ANR and SEARCH index bits set.
  4. Active Directory performs an "or" search for "John Doe*" against the default attributes listed above.
  5. Active Directory then searches for: Given-Name=John* AND Surname=Doe*
  6. Active Directory then searches for: Given-Name=Doe* AND Surname=John*
The search results are returned to the client with matches for John Doe:
  • Compared to: John Doe
    Search Results: Match
    Results Explanation: "John Doe*" matches displayName from step 4
  • Compared to: John Does
    Search Results: Match
    Results Explanation: "John*" AND "Doe*" matches Given-Name=John* AND Surname=Smith* from step 5
  • Compared to: John Buck
    Search Results: No match
    Results Explanation: "John Doe*" does not match the displayName
    "John*" AND "Doe*" does not match the Given-Name and Surname of John Buck
    "John*" AND "Doe*" does not match the Surname and Given-Name of John Buck
Modification Type:MinorLast Reviewed:9/6/2006
Keywords:kbinfo KB243299
©2004 Microsoft Corporation. All rights reserved.