Using LDAP authentication, is it possible to allow users to use different attributes?

[former_SQLA_member1694901]

In an Anywhere 17 database users authenticate to a LDAP server (a Windows Domain Controller).

Using the LDAP URL "ldap://mydc.mycompany.de:389/cn=Users, dc=mycompany, dc=de??sub?(sAMAccountName=*)" works fine for this.

Now I wanted to allow my users to use either their account name or their principle name (aka mail address) using the LDAP URL

ldap://mydc.mycompany.de:389/cn=Users, dc=mycompany, dc=de??sub?(|(userPrincipalName=*)(sAMAccountName=*))

without success.

Using Wireshark I found out that the database server seems to replace the first asterisk in the filter restriction with the account name to be verified, so the filter used in the search is something like "(|(userPrincipalName=someuser@mycompany.de)(sAMAccountName=*))", which obviously does not return the expected result...

Is this intended behaviour? Otherwise I'd suggest to replace all asterisks in the filter restriction, not just the first one.

N.B.: We found a workaround by creating two different LDAP servers in the database server, which is acceptable but a bit awkward.