> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/1-11-0/documentation/connectware-on-kubernetes/ldap-authentication/customizing-the-search-filter-for-ldap-authentication.md).

# Customizing the Search Filter for LDAP Authentication

## Prerequisites

* Helm version 3 is installed on your system.
* The Kubernetes command line tool kubectl is configured and has access to the target installation.
* You know the name and namespace of your Connectware installation. See [Obtaining the name, namespace, and version of your Connectware installation](/1-11-0/documentation/connectware-on-kubernetes/connectware-helm-chart.md#obtaining-the-name-namespace-and-version-of-your-connectware-installation).
* The values.yaml file is available.
* [LDAP authentication configured](/1-11-0/documentation/connectware-on-kubernetes/ldap-authentication/configuring-ldap-authentication.md).

## Customizing the Search Filter for LDAP Authentication

There are scenarios where it is useful to extend the default search filter of Connectware. For example:

* your users are not uniquely identifiable by their username, for example when there are users with the same RDN within the search base of your LDAP configuration.
* You have to give a search base that is very huge as your accounts a spread within the DIT but by filtering the search may be more efficient

The filter that will be used by Connectware is (=) whereas `userRdn` is defined as environment variable in your `values.yml` and `username` is the name the user enters during login.

Any extension will result in a filter of the current format:

{% code lineNumbers="true" %}

```yaml
(&(<userRdn>=<username>)(<your extension>)
```

{% endcode %}

Info: You could test the filter by performing request with `ldapsearch` on your terminal (may require additional packages to be installed)

**Example**

{% code lineNumbers="true" %}

```yaml
ldapsearch -L -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w admin_pass "(&(cn=User 1)(objectclass=iNetOrgPerson))"
```

{% endcode %}

**Example**

In the following example, we have two entries with an RDN `cn=a.smith`.

{% code lineNumbers="true" %}

```yaml
dc=example,dc=org
├ cn=customers
│  └ cn=a.smith
└ cn=employees
└ cn=a.smith
```

{% endcode %}

Both users are named a.smith, but they are different entries. In a case like this you will use cn=employees,`dc=ecample,dc=org` as search base and actually won’t have a problem. But lets `use dc=example,dc=org` in order to create a simple example case for the filter extension.

We want to modify the filter in order to search only for entries that have `cn=employees` in their DN.

The search command to test on the terminal will for the employee a.smith will look like this:

{% code lineNumbers="true" %}

```yaml
ldapsearch -L -b "dc=example,dc=org" -D "cn=admin,dc=example,dc=org" -w admin_pass "(&(cn=a.smith)(cn:dn:=employee))"
```

{% endcode %}

To modify Connectware, we only add the extension itself (`cn:dn:=employee`) to the configuration:

{% code lineNumbers="true" %}

```yaml
global:
    authentication:
        ldap:
            enabled: true
            existingBindSecret: my-ldap-user
            searchBase: CN=Users,DC=company,DC=tld
            searchFilter: cn:dn:=employees
            userRdn: cn
            url: ldap://my-dc.company.tld:389
```

{% endcode %}

Important: Be aware the no surrounding brackets are used for the additional expression. Brackets within your expression could be used, e.g. `&(objectClass=iNetOrgPerson)(cn:dn:=employees)`.

**Related Links**

* [Single Sign-On with LDAP](/1-11-0/documentation/user-management/single-sign-on-sso/single-sign-on-with-ldap.md).
* [Configuring Connectware to use LDAP authentication](/1-11-0/documentation/connectware-on-kubernetes/ldap-authentication/configuring-ldap-authentication.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cybus.io/1-11-0/documentation/connectware-on-kubernetes/ldap-authentication/customizing-the-search-filter-for-ldap-authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.