LDAP/AD filter - "objectclass not equal to" is not working

php active-directory ldap ldap-query
shadyyx picture shadyyx · Mar 10, 2011 · Viewed 46.3k times · Source

I am working with LDAP Active Directory and trying to list all users. I have this filter which works perfect:

(&(objectclass=user)(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))

Unfortunately, we have also a computer units and other devices present in AD with objectclass "user" so with previous filter I got all users, computers, devices, rooms, etc.

These computer and devices have also an objectclass "computer" so I need to extend the filter with objectclass!="computer" in order to list only real users. So far I'd tried these filters, none of them working (no data returned!):

(&(objectclass=user)(!objectclass=computer)(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))
(&(objectclass=user)(!(objectclass=computer))(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))
(!(objectclass=computer))(&(objectclass=user)(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))
(!objectclass=computer)(&(objectclass=user)(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))

(real users do not have the objectclass "computer").

I am working with PHP ldap implementation so using an ldap_search() method.

The "not equal to" syntax was found e.g. here: http://technet.microsoft.com/en-us/library/aa996205%28EXCHG.65%29.aspx or here: http://msdn.microsoft.com/en-us/library/aa746475%28v=vs.85%29.aspx

Maybe I could try to filter users where (!CN=Computers) in DN, but first I'd like to filter (!objectclass=computer) as it is more logical for me.

What is the correct syntax for objectclass != "computer" expression?

Answer

user207421 picture user207421 · Mar 11, 2011

Contrary to the first link you provided, (!objectclass=computer) is not a valid filter expression. It should be (!(objectclass=computer)). See RFC 2254:

filter ::= "(" filtercomp ")"

not ::= "!" filter

So your filter should be

(&(!(objectclass=computer))(objectclass=user)(|(memberOf=...)(memberOf=...)...)(|(userprincipalname=...)(displayname=...)))

Related questions

LDAP Filter - Find all users of specific OU

I am having trouble with an LDAP Search Filter. What I am needing to retrieve is all the users of a specific LDAP group that is OU=Staff,OU=Users,OU=Accounts,DC=test,DC=local My search is: (&(…

Read More
Authenticating in PHP using LDAP through Active Directory

I'm looking for a way to authenticate users through LDAP with PHP (with Active Directory being the provider). Ideally, it should be able to run on IIS 7 (adLDAP does it on Apache). Anyone had done anything similar, with success? Edit: …

Read More
Using active directory to authenticate users on intranet site

I have an 'intranet' site that I have built, which has a login system of its own (users register as new users, and use the username/password thereon to login to the site). However, now I want to extend it, …

Read More