title: How is the processing order on a LDAP filter
body: <p>I have two kinds of user in our Active Directory: technical user and user user.</p>
  
  <p>With LDAP filter <code>(&amp;(objectclass=person)(uid=%v))</code> I get for both some results.</p>
  
  <p>But for my application I need a more detailed filter or else there will be no results (checkPassword method of com.ibm.websphere.security.UserRegistry). So I thought of this filter: </p>
  
  <p><code>(&amp;(|(objectcategory=person)(objectclass=person))(uid=%v))</code></p>
  
  <p>This works fine for technical users, but for the other I get <code>EntryNotFoundException: CWIML4001E:</code></p>
  
  <p>Why is that? Shouldn't it at least give me the result of the simple filter? Is it not processing the filter combinations because of the OR?:</p>
  
  <ul> 1. uid=%v AND objectclass=person </ul>
  
  <ul> 2. uid=%v AND objectcategory=person</ul>
  
  <p>I also tried the following filter to be on the save side: </p>
  
  <p><code>(|(&amp;(objectclass=person)(uid=%v))(&amp;(objectcategory=person)(uid=%v)))</code></p>
  
  <p>But the result is the same.</p>
  
  <p>Some background:</p>
  
  <p>I use Liberty and run the following simple servlet on it for testing:</p>
  
  <pre><code>protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
  try {
      if (WSSecurityHelper.isServerSecurityEnabled()) {
          String testuser = "myuser";
          String password = "mypassword";
  
          UserRegistry registry = RegistryHelper.getUserRegistry("LdapRegistry");
          response.getWriter().append("&lt;p&gt;Output: " + registry.getUserSecurityName(testuser) +"&lt;/p&gt;");
          response.getWriter().append("&lt;p&gt;Output: " + registry.isValidUser(testuser) +"&lt;/p&gt;");
          response.getWriter().append("&lt;p&gt;Output: " + registry.isValidUser(registry.getUserSecurityName(testuser)) +"&lt;/p&gt;");
  
      }else{
          response.getWriter().append("&lt;p&gt;Output: No Sec Enabled&lt;/p&gt;");
      }
  } catch (Exception e) {
  
      response.getWriter().print("&lt;p&gt;Exception caught: " + e + " &lt;/p&gt;");
  
  }
  }
  </code></pre>
  
  <p>The application fails at <code>getUserSecurityName(testuser)</code> when testuser is not a technical user.  </p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>LDIF techuser:</p>
  
  <pre><code>&gt;&gt; Dn: uid=techuser,ou=technical,ou=people,o=appsdir
  1&gt; someWorkingOrgAlias:  
  1&gt; someHomeOrgAlias:  
  1&gt; someWorkingOrg:  
  1&gt; someUserSuspended:  
  1&gt; mail:  
  1&gt; givenName:  
  1&gt; cn:  
  1&gt; c:  
  1&gt; someIsUserEnabledIntra:  
  1&gt; someSupervisor:  
  1&gt; someSourceProcess:  
  1&gt; someAppResp:  
  2&gt; someAncestors:  
  1&gt; someHomeOrg:  
  1&gt; someOrgs: 
  1&gt; someAuthMode:  
  1&gt; uid: techuser; 
  7&gt; objectClass: someTechPerson; somePerson; sPerson; inetOrgPerson; organizationalPerson; person; top; 
  1&gt; someUserEnabled:  
  1&gt; sn: 
  </code></pre>
  
  <p>LDIF user user:</p>
  
  <pre><code>&gt;&gt; Dn: uid=useruser,ou=employees,ou=people,o=appsdir
  2&gt; appsOrgs:  
  1&gt; departmentNumber:  
  1&gt; someLocationCode:  
  1&gt; somePlant2:  
  1&gt; ou:  
  1&gt; someCompanyID:  
  1&gt; somePlant1:  
  1&gt; someHomeOrg:  
  6&gt; someEntGrps:  
  4&gt; someAuthGrps:  
  3&gt; someScopedEntitlements:  
  1&gt; telephoneNumber:  
  1&gt; mail:  
  2&gt; someAncestors:  
  1&gt; c:  
  1&gt; sn:  
  1&gt; someCostCenter:  
  1&gt; uid: useruser; 
  1&gt; givenName:  
  1&gt; cn: 
  8&gt; objectClass: organizationalPerson; person; sEmployeePerson; sInternalEmployee; sPerson; inetOrgPerson; somePerson; top; 
  </code></pre>
  
  <p>Thats all I can see with LDP.exe. My search base is <code>o=appsdir</code>.
  I try to describe my problem further:</p>
  
  <p>Currently using filter:</p>
  
  <p><code>(|(&amp;(objectclass=person)(uid=%v))(&amp;(objectcategory=person)(uid=%v)))</code></p>
  
  <p>Works fine with my code and <code>techusers</code>.</p>
  
  <p>When using <code>user users</code> I get <code>The useruser entity was not found. Specify the correct entity or create the missing entity.</code>
  from the method <code>registry.getUserSecurityName("useruser")</code>.</p>
  
  <p>Removing <code>objectcategory</code> part from my filter: <code>(|(&amp;(objectclass=person)(uid=%v))(&amp;(uid=%v)))</code> or by just using <code>(uid=%v)</code> gives me results, but then fails at the method <code>registry.isValidUser(registry.getUserSecurityName("useruser"))</code> (returns false although it's a valid user). And this also fails for <code>techusers</code> although with the <code>objectgategory</code> part in the filter it returned true.
  I also tried the following filter:</p>
  
  <p><code>(|(uid=%v)(&amp;(objectclass=person)(uid=%v))(&amp;(objectcategory=person)(uid=%v)))</code> 
  with the same result as without the added <code>(uid=%v)</code> part.</p>