Ldap search filter multiple groups - squid

Question

I am testing suid + AD using windows server 2008. I have the following simple structure for now:

+ Test_Users
-----internet_group
--------Matthew Vassallo (user)
-----normal_group
--------Kenneth Grech (user)

I would like to make an ldap query that contains a single common OU but with different groups. The following query worked out well for only one group and one OU:

(&(memberOf=OU=Test_Users,CN=internet_group,DC=matthew,DC=com)(sAMAccountName=%s))

How can I extend that please for more different groups? Thanks

You should fix the query, CN=... should be in the left side. — Diego Woitasen, Oct 25 '13 at 11:55

score 15 · Answer 1 · answered Oct 25 '13 at 01:39

15

Use:

(&(memberOf=CN=%s,OU=Test_Users,DC=matthew,DC=com)(sAMAccountName=%s))

Then:

external_acl_type ldap_group %LOGIN /path/to/squid_ldap_group ...
acl group1 external ldap_group internet_group
acl group2 external ldap_group normal_group
http_access allow internet_group
http_access allow normal_group

Another option is to build a complex filter:

(&(|(memberOf=CN=normal_group,OU=Test_Users,DC=matthew,DC=com)(memberOf=CN=internet_group,OU=Test_Users,DC=matthew,DC=com))(sAMAccountName=%s))

Choose the best option for you :)

answered Oct 25 '13 at 01:39

Diego Woitasen

32,892
1
18
20

1

the 2nd string is such a life-saver, Kudos! – Aqua 4 Sep 11 '20 at 05:13
Ditto Life saver for me too – BB8 Jul 30 '21 at 00:38

score 0 · Answer 2 · answered Feb 22 '22 at 10:44

Worked for me (&(objectClass=posixAccount)(|(ou:dn:=Users1)(ou:dn:=Users2)))

You need to be sure of the unique user uids!

    AuthLDAPURL ldap://localhost/dc=ldapserver?uid?sub?(&(objectClass=posixAccount)(|(ou:dn:=Users1)(ou:dn:=Users2))) NONE
    Require ldap-group cn=wsgihg,ou=WebAuth,dc=ldapserver

Ldap search filter multiple groups - squid

2 Answers2