title: LDAP Syntax/Semantics: Filter vs. Base DN?
body: <p>This is probably pretty stupid, but I'm still green to LDAP. So I hope someone can lend me a hand.</p>
  
  <p>I am using Apache Directory Studio to do my searches and I am confused about when I should be using a filter or when I should be breaking up my filter into two, using one part as the filter and the other as my search base. </p>
  
  <p>Here's an example where I'm trying filter out a group.</p>
  
  <pre><code>Filter: CN=JohnTestGroup,OU=TECH,DC=lab,DC=ing
  Base:   DC=lab,DC=ing
  </code></pre>
  
  <p>This yielded zero results. I realized that perhaps I am being redundant as part of the base is in the filter, so I got rid of that part in the filter.</p>
  
  <pre><code>Filter: CN=JohnTestGroup,OU=TECH
  Base:   DC=lab,DC=ing
  </code></pre>
  
  <p>This still did not yield anything. So I tried this:</p>
  
  <pre><code>Filter: CN=JohnTestGroup
  Base:   OU=TECH,DC=lab,DC=ing
  </code></pre>
  
  <p>I moved the <code>OU</code> parameter into the <code>Base</code>. This worked, but I don't understand why the first or second attempts didn't. Someone care to drop some knowledge on me?</p>
  
  <p>This is probably a matter of syntax/semantics, so if anyone could point me to a resource, I'd be more than willing to read more about it.</p>