Search functionality is limited.

[dbaarda]

Currently the search implementation supports enough functionality for pam_ldap and nss_ldap to work. This includes arbitrary combinations of the following supported search operations;
and, or, not, equalityMatch, and present. The unsupported search operations are; substrings, greaterOrEqual, lessOrEqual, approxMatch, extensibleMatch.

substrings match can be implemented by turning the subInitial, subAny, subFinal substrings into a regex to match against.

greaterOrEqual and lessOrEqual probably require rudimentary schema support to map attribute types to integer or string (or caseless string?) comparisions.

approxMatch is not clearly defined in the standard and usually avoided for that reason. However, it would probably be nice if this was implemented as an extended regex match.

I haven't even considered extensibleMatch yet, and maybe we will never support it.