Filter Syntax – FortiAuthenticator 4.0

Filter Syntax

This chapter outlines some basic filter syntax that is used to select users and groups in LDAP User Import, Dynamic LDAP Groups, and Remote User Sync Rules.

Filters are constructed using logical operators:

= Equal to
~= Approximately equal to
<= Lexicographically less than or equal to
>= Lexicographically greater than or equal to
| OR

Filters can consist of multiple elements, such as (&(filter1)(filter2)). More information about the query syntax of AD filters, see the following web sites:


The following examples are for a Windows 2008 AD server with the domain, default domain administrators and users, and an additional group called FW_Admins:

l Users (CN) = atano, pjfry, tleela, tbother l FW_Admins (Security Group) = atano, tbother

An unfiltered browse will return all results from the query, including system and computer accounts. To prevent this and only return user accounts, apply the filter (objectClass=person) or (objectCategory=user).

Even if unfiltered, only user accounts will be imported, so this is only required to clean up the results that are displayed in the GUI.

To filter and return only members of the security group: (&(objectCategory=user)(memberOf=CN=FW_ Admin,DC=corp,DC=example,DC=com)).

It is not possible to use the filter to limit results to CNs or OUs. To achieve this, you must change the Base DN in the LDAP Server configuration. For example, to return only users from the CompanyA OU, create an LDAP Server entry with the following Base DN: OU=CompanyA,DC=corp,DC=example,DC=com.

Filter Syntax


Users do not always have a memberOf property for their primary group, this means that querying system groups, such as Domain Users, may return zero results. This can be confusing as these are often the first queries to be tried, and can lead the user to think the filter syntax is incorrect.

For example: (memberOf=CN=Domain Users,CN=Domain

Admins,DC=corp,DC=example,DC=com) will return no valid results.

To return all users in such a group, the filter can be made against the ID value of the Primary Group. So, for Domain Users (Group ID = 513), the filter would be: (primaryGroupId=513). 163

This entry was posted in Administration Guides, FortiAuthenticator and tagged , on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.