Skip to content

System.DirectoryServices.Protocols.SearchRequest Filter does not allow unnecessary space-escapes unlike on Windows #127175

Description

@Pxtl

Description

When writing an ldap filter with a space in it, a leading backslash is needed if the space is at the beginning or end of the entry. For simplicity, it's common practice to backslash-escape any space in an LDAP query. This is not permitted on Linux, but is on Windows.

Invoking through powershell:

$conn.SendRequest([System.DirectoryServices.Protocols.SearchRequest]::new(
    "DC=samdom,DC=example,DC=com",
    "(&(objectClass=organizationalUnit)(distinguishedName=OU=Domain\ Controllers,DC=samdom,DC=example,DC=com))",
    "subtree",
    "*"
))

is permitted on Windows but fails on Linux.

Note that I have not tested space-at-the-beginning-and-end behaviour, only internal spaces because that's what comes up more frequently.

Reproduction Steps

using the following docker-compose.yml to create an LDAP server on localhost:

services:
  smblds:
    environment:
    - INSECURE_LDAP=true
    image: 'smblds/smblds:latest'
    ports:
      - 389:389
      - 636:636

Invoke the following (using pwsh to demonstrate).

Add-Type -path $assemblyPath

# default credentials for `smblds` for testing purposes.
$credential = [Management.Automation.PSCredential]::new('SAMDOM\Administrator', (ConvertTo-SecureString 'Passw0rd' -AsPlainText -Force))
$identifier = [System.DirectoryServices.Protocols.LdapDirectoryIdentifier]::new('localhost', 389)
$conn = [System.DirectoryServices.Protocols.LDAPConnection]::new($identifier, $credential, 'Basic')
$result = $null
$conn.SendRequest([System.DirectoryServices.Protocols.SearchRequest]::new(
    "DC=samdom,DC=example,DC=com",
    "(&(objectClass=organizationalUnit)(distinguishedName=OU=Domain\ Controllers,DC=samdom,DC=example,DC=com))",
    "subtree",
    "*"
))

Works fine in pwsh (which uses netcore) and PS5.1 (which uses framework) but fails on linux.

Expected behavior

Return OrganizationalUnit searchresponse.

Actual behavior

MethodInvocationException: Exception calling "SendRequest" with "1" argument(s): "The search filter is invalid."

Regression?

No response

Known Workarounds

No response

Configuration

Ubuntu 22.04, .NET 8.0, x64

Other information

No response

Activity

  1. dotnet-policy-service commented on Apr 20, 2026

    @dotnet-policy-service
    Contributor

    Tagging subscribers to this area: @dotnet/area-system-directoryservices
    See info in area-owners.md if you want to be subscribed.

  2. added
    help wanted[up-for-grabs] Good issue for external contributors
    and removed
    untriagedNew issue has not been triaged by the area owner
    on Aug 17, 2026
  3. added this to the Future milestone on Aug 17, 2026
  4. jeffhandley commented on Aug 17, 2026

    @jeffhandley
    Member

    Consider fixing #127168 at the same time

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions