PingDirectory

About managing JSON attribute values

The PingDirectory server supports a JSON object attribute syntax that can be used for attribute types whose values are JSON objects. The syntax requires that each value of this type is a valid JSON object.

The following is an example schema definition.

dn: cn=schema
objectClass: top
objectClass: ldapSubentry
objectClass: subschema
cn: schema
attributeTypes: ( jsonAttr1-OID NAME 'jsonAttr1' DESC 'test json attribute support' EQUALITY jsonObjectExactMatch SYNTAX 1.3.6.1.4.1.30221.2.3.4 USAGE userApplications )
objectClasses: ( jsonObjectClass-OID NAME 'jsonObjectClass' AUXILIARY MAY jsonAttr1 )

You should always specify the EQUALITY matching rule as jsonObjectExactMatch in the schema definition. Using the jsonObjectFilterExtensibleMatch isn’t valid in this case.

The jsonObjectExactMatch and jsonObjectFilterExtensibleMatch matching rules are provided to filter equality matching rule JSON object syntax. The following three additional matching rules are used in conjunction with jsonObjectExactMatch and provide support for customizing the way that the server treats case sensitivity in JSON field names and in string values:

  • jsonObjectCaseSensitiveNamesCaseSensitiveValues

  • jsonObjectCaseInsensitiveNamesCaseInsensitiveValues

  • jsonObjectCaseInsensitiveNamesCaseSensitiveValues

The jsonObjectExactMatch equality matching rule is used in evaluating equality filters in search operations, and for matching performed against JSON object attributes for add, compare, and modify operations. It determines whether two values are logically-equivalent JSON objects. The field names used in both objects must match exactly, although fields can appear in different orders. The values of each field must have the same data types. The order of elements in arrays is considered significant. Substring or approximate matching isn’t supported.

The jsonObjectFilterExtensibleMatch matching rule can perform more powerful matching against JSON objects. The assertion values for these extensible matching filters should be JSON objects that express the constraints for the matching. These JSON object filters are described in detail in the Javadoc documentation for the LDAP SDK for Java. Although the LDAP SDK can facilitate searches with this matching rule, these searches can be issued through any LDAP client API that supports extensible matching.

The following are example searches using the jsonObjectFilterExtensibleMatch rule with available filter types:

"equals" filter type
$ bin/ldapsearch -p 1389 -b dc=example,dc=com  -D "cn=Directory Manager" -w password '(jsonAttr1:jsonObjectFilterExtensibleMatch:={ "filterType" : "equals", "field" : ["stuff", "onetype", "name"], "value" : "John Doe" })'
"containsField" filter type
$ bin/ldapsearch -p 1389 -b dc=example,dc=com  -D "cn=Directory Manager" -w password '(jsonAttr1:jsonObjectFilterExtensibleMatch:={ "filterType" : "containsField", "field" : "age", "expectedType" : "number" })'
"greaterThan" filter type
$ bin/ldapsearch -p 1389 -b dc=example,dc=com  -D "cn=Directory Manager" -w password '(jsonAttr1:jsonObjectFilterExtensibleMatch:={ "filterType" : "greaterThan", "field" : "age", "value" : 26, "allowEquals" : true})'