How does ldapsearch sortorder work?

Question

With OpenDJ 2.6.0 using the ldapsearch wanted to get sorted data. I made several attempts, but the result was always sorted so the same

Simple sort asc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '+cn' -s sub "objectclass=*" cn
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Simple sort desc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '-cn' -s sub "objectclass=*" cn
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Sort with OID asc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '+cn:2.5.13.15' -s sub "objectclass=*"
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Sort with OID desc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '-cn:2.5.13.15' -s sub "objectclass=*"
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Sort with name asc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '+cn:integerOrderingMatch' -s sub "objectclass=*"  cn
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Sort with name desc

./ldapsearch -b 'ou=people,dc=example,dc=com' -S '-cn:integerOrderingMatch' -s sub "objectclass=*"  cn
dn: ou=people,dc=example,dc=com

dn: cn=1000000,ou=people,dc=example,dc=com
cn: 1000000

dn: cn=1000000000001,ou=people,dc=example,dc=com
cn: 1000000000001

Am I doing something wrong or is this error ldapsearch / openDJ? Thank you in advance.

Answer 1

When using the -S option, the control is not marked as critical. If the server considers that the use is not allowed or not appropriate, it will ignore the control and proceed with the search (as stated in the LDAP RFC). I'm guessing that this is what you are experimenting. There can be at least 2 reasons for ignoring the control. The user doesn't have permission to use the control. In OpenDJ, the Server Side Control is only usable by authenticated users, not anonymous. There are too many entries to sort (default I think is set to 4000).

-S 'cn' and -S '-cn' worked as expected on my test OpenDJ server with 200 entries, authenticated as a user or as Directory Manager.