title: LDAP: how to create search filters for nested attributes and values?
body: <p>I understand how to create ldap search filters based on simple attriburtes, e.g. </p>
  
  <pre><code>(&amp;(objectClass=universityPerson)(surname=Smith*))
  </code></pre>
  
  <p>will return a nice list of university people whose last names start with 'Smith'.  So far so good!</p>
  
  <p>In our university LDAP schema, people have a number of custom attributes or sub-objects that have a structure like</p>
  
  <pre><code>graduateStatus: {campus=CAMPUS_CODE}:{degSchool=SCHOOL_CODE}:{classYr=YYYY}
  </code></pre>
  
  <p>or</p>
  
  <pre><code>universityHR:
    {jobCategory=Staff}:
    {campus=CAMPUS_CODE}:
    {deptId=999999}:
    {deptGroup=COLLEGE_BUSINESS}:
    {deptDescription=Business Library}:
    {deptVicePresidentArea=PROVOST}:
    {jobcode=123456}:
    {jobFamily=123}:
    {emplStatus=A}:
    {regTemp=R}
  </code></pre>
  
  <p>It would be very useful to make LDAP queries to answer questions like:</p>
  
  <ul>
  <li>"Who are the people who graduated from the Business College in classYr=1995?"</li>
  <li>"Who are all the staff at the Nursing School with jobCode=456789?"</li>
  <li>"Who are the temporary staff on the main campus where jobFamily=789?"</li>
  </ul>
  
  <p>I'd like to be able to create ldap search filters referring to those sub-attributes, something like:</p>
  
  <pre><code>(&amp;(objectClass=universityPerson)(graduateStatus.campus=BUS)(graduateStatus.classYr=1995))
  </code></pre>
  
  <p>or</p>
  
  <pre><code>(&amp;(objectClass=universityPerson)(universityHR.regTemp=T)(universityHR.jobFamily=789))
  </code></pre>
  
  <p>but I can't figure out if this is possible, let alone what the syntax might be.</p>
  
  <p>I suspect that this is not a good use case for LDAP, and that I should look for answers to such questions in other enterprise systems.   Yet it would be very convenient to use the enterprise directory as something more than a glorified phone book.</p>
  
  <p>Digging through OpenLDAP.org and ldapsearch docs for various distros has not led to an answer.  Anytime I look for something about nested attributes or hierarchy, I find tons of documents about nested <em>groups</em> and membership queries, but that's not the question here.</p>
  
  <p>Many thanks for any advice.</p>