Actually IDM query API is bit limited as it's not possible to dynamically define attributes, which will be compared by <= or >= .

Currently there are just 2 hardcoded statements for CREATED_AFTER and CREATED_BEFORE attributes in LDAPIdentityStore: https://github.com/picketlink/picketlink/blob/master/modules/idm/impl/src/main/java/org/picketlink/idm/ldap/internal/LDAPIdentityStore.java#L465 . But if I want to create filter with some completely different attribute, for example:

(&((whenChanged>=20140622134652.0Z)(objectClass=person)))

it seems that I don't have possibility to do it.