Checking PasswordsChapter 5 Front-End API Functions 69Converting a String to a FilterA search filter can be represented by either the datatype Slapi_Filter or as astring. In a parameter block for a search operation, SLAPI_SEARCH_FILTER is a filterof the datatype Slapi_Filter and SLAPI_SEARCH_STRFILTER is the stringrepresentation of that filter. In general, it is easier to specify a filter as a string thanit is to construct a filter from the type Slapi_Filter.To convert the string representation of a filter into a filter of the datatypeSlapi_Filter, call the slapi_str2filter() function.When you are done working with the filter, you should free it by calling theslapi_filter_free() function.Creating Complex Filters by Combining FiltersYou can use AND, OR and NOT to combine different filters to create a complexfilter. To do this, call the slapi_filter_join() function.The slapi_filter_join() function returns the complex filter you’ve created.When you are done using the complex filter, you should free it by callingslapi_filter_free().Filters of the type LDAP_FILTER_NOT can have only one component. If the filter type(ftype) is LDAP_FILTER_NOT, you must pass a NULL value for the second filterwhen calling slapi_filter_join().Checking PasswordsWhen Directory Server 4.x stores the password for an entry in the userpasswordattribute, it encodes the password using the scheme specified in the passwdhashdirective of the configuration file. The scheme can be crypt or sha or “ “ (forcleartext).By default, Directory Server 6.x uses the userpassword attribute to store thecredentials for an entry. The server encodes the password using the schemespecified in the nsslapd-rootpwstoragescheme or passwordStorageSchemeattributes of the cn=config entry contained in the dse.ldif file. The scheme canbe any of the following:• CLEAR (means no encryption and can be defined using theclear-password-storage-scheme plug-in)
