LDAP filter - retrieve all users in a given group

StackOverflow https://stackoverflow.com/questions/19815879

  •  04-07-2022
  •  | 
  •  

Pergunta

I have a problem with a filter in LDAP. I want to retrieve all the users in a specified LDAP group. The LDIF is like this one:

dn: cn=engineering,ou=Groups,dc=domain,dc=com
objectClass: groupOfNames
cn: engineering
member: uid=alex,ou=Users,dc=domain,dc=com
member: uid=amy,ou=Users,dc=domain,dc=com
...

dn: uid=alex,ou=Users,dc=domain,dc=com
objectClass: posixAccount
objectClass: inetOrgPerson
cn: Alex Ander
gidNumber: 5000
homeDirectory: /home/alex
...

I've tried

(&(objectClass=user)
  (memberof=cn=engineering,OU=Users,DC=domain,DC=com))

but it doesn't work.

Foi útil?

Solução

To retrieve all the members of the group, use the following parameters in a search request:

  • base object: cn=engineering,ou=Groups,dc=domain,dc=com
  • scope: base
  • filter: (&)
  • requested attributes: member

The response from the server (assuming the authorization state of the connection on which the search request is processed permits) will be a list of all the member attribute values in that group.

If the LDAP client requires the full entry of each of the members, then transmit a search search request for each member. The client has the DN, so only a base level scope is required, and list each attribute to be retrieved.

Alternatively:

  • base object: ou=users,dc=domain,dc=com
  • scope: one (if all objects are one level below ou=users)
  • filter: (&(objectClass=inetorgPerson)(memberOf=cn=engineering,ou=Groups,dc=domain,dc=com))
  • requested attributes, for example, cn, homeDirectory

The response from the (assuming the authorization state of the connection on which the search request is processed permits) will be a list of inetOrgPerson members that otherwise match the search parameters, such as being a member of that group.

see also

Licenciado em: CC-BY-SA com atribuição
Não afiliado a StackOverflow
scroll top