The LDAP_MATCHING_RULE_IN_CHAIN also known as LDAP_MATCHING_RULE_TRANSITIVE_EVAL is an Extensible Match matching rule with an OID of 1.2.840.113556.1.4.1941 used to provide a method to look up the ancestry of an object and is is limited to filters that apply to the DN.[1]

Many applications using AD and AD LDS usually work with hierarchical data, which is ordered by parent-child relationships. Not using the LDAP_MATCHING_RULE_IN_CHAIN requires applications to perform transitive group expansion to figure out group membership which:

  • used too much network bandwidth
  • required applications needed to make multiple roundtrips to figure out if an object fell "in the chain" or a link is traversed through to the end.

LDAP_MATCHING_RULE_IN_CHAIN is a special Extensible Match operator that walks the chain of ancestry in objects all the way to the root until it finds a match.

Not all LDAP server vendors provide complete matching rules. The OID's shown here are Microsoft Active Directory specific and will probably not work on other server implementations.

We wish some of the other LDAP server vendors would add support for this Extensible Match Rules.

More Information#

There might be more information for this subject on one of the following:
[#1] - We obtained some of this information from http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx

Add new attachment

Only authorized users are allowed to upload new attachments.
« This page (revision-10) was last changed on 04-Sep-2014 12:41 by jim