LDAP filter - retrieve all users in a given group

ldap ldap-client
user2961042 picture user2961042 · Nov 6, 2013 · Viewed 13.8k times · Source

I have a problem with a filter in LDAP. I want to retrieve all the users in a specified LDAP group. The LDIF is like this one:

dn: cn=engineering,ou=Groups,dc=domain,dc=com
objectClass: groupOfNames
cn: engineering
member: uid=alex,ou=Users,dc=domain,dc=com
member: uid=amy,ou=Users,dc=domain,dc=com
...

dn: uid=alex,ou=Users,dc=domain,dc=com
objectClass: posixAccount
objectClass: inetOrgPerson
cn: Alex Ander
gidNumber: 5000
homeDirectory: /home/alex
...

I've tried

(&(objectClass=user)
  (memberof=cn=engineering,OU=Users,DC=domain,DC=com))

but it doesn't work.

Answer

Terry Gardner picture Terry Gardner · Nov 6, 2013

To retrieve all the members of the group, use the following parameters in a search request:

  • base object: cn=engineering,ou=Groups,dc=domain,dc=com
  • scope: base
  • filter: (&)
  • requested attributes: member

The response from the server (assuming the authorization state of the connection on which the search request is processed permits) will be a list of all the member attribute values in that group.

If the LDAP client requires the full entry of each of the members, then transmit a search search request for each member. The client has the DN, so only a base level scope is required, and list each attribute to be retrieved.

Alternatively:

  • base object: ou=users,dc=domain,dc=com
  • scope: one (if all objects are one level below ou=users)
  • filter: (&(objectClass=inetorgPerson)(memberOf=cn=engineering,ou=Groups,dc=domain,dc=com))
  • requested attributes, for example, cn, homeDirectory

The response from the (assuming the authorization state of the connection on which the search request is processed permits) will be a list of inetOrgPerson members that otherwise match the search parameters, such as being a member of that group.

see also

Related questions

Spring's LdapTemplate search: PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'

I add users through LDAP for a certain application, made with spring. While this works for most of the cases, in some cases, it does not work... The retrieve the users I use: public class LdapUserServiceImpl implements ILdapUserService { @Override public …

Read More
What are the differences between LDAP and Active Directory?

What are the differences between LDAP and Active Directory?

Read More
What are CN, OU, DC in an LDAP search?

I have a search query in LDAP like this. What exactly does this query mean? ("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com");

Read More