How should I escape commas in Active Directory filters?
<p>I'm using python-ldap to query Active Directory</p>

<p>I have this DN </p>

<pre><code>CN=Whalen\, Sean,OU=Users,OU=Users and Groups,DC=example,DC=net
</code></pre>

<p>That works fine as a base in a query, but if I try to use it in a search filter like this</p>

<pre><code>(&amp;(objectClass=group)(memberof:1.2.840.113556.1.4.1941:=CN=Whalen\, Sean,OU=Users,OU=Users and Groups,DC=example,DC=net))
</code></pre>

<p>I get a <code>Bad search filter</code> error. From my testing, the comma in the CN seems to be the culprit, even though I escaped it with a backslash (<code>\</code>). But, comma isn't  listed in the <a href="http://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx#LDAP_Filters" rel="nofollow">Microsoft documentation</a> as a character that needs escaped in filters.</p>

<p>What am I missing? </p>

<p>The LDAP filter specification assigns special meaning to the following characters <code>* ( ) \ NUL</code> that should be escaped with the backslash escape character followed by the two character ASCII hexadecimal representation of the character (<a href="https://tools.ietf.org/search/rfc2254#page-5" rel="nofollow">rfc2254</a>) :</p>

<pre><code>*   \2A
(   \28
)   \29
\   \5C
Nul \00
</code></pre>

<p>So in your case, any backslash used for escaping DN' special characters must be represented by <code>\5c</code> when used in a search filter :</p>

<pre><code>(&amp;(objectClass=group)(memberof:1.2.840.113556.1.4.1941:=CN=Whalen\5c, Sean,OU=Users,OU=Users and Groups,DC=example,DC=net))
</code></pre>

python active-directory ldap ldap-query python-ldap