how to get groups of a user in ldap by members with attribute value

Question

My question is very similar to how to get groups of a user in ldap but I want to be able to search a group whose member has attribute foo with value bar

ie, from the previous question instead of doing (&(objectClass=groupOfNames)(member=cn=root,ou=django,dc=openldap))

I want to do something like (&(objectClass=groupOfNames)(member=sn=bar)) but it seems only the full DN can be used for such query. Is there another way to find groups for user matching a pattern?

Does your server have [`memberOf` enabled for users](https://www.adimian.com/blog/2014/10/how-to-enable-memberof-using-openldap/)? — Gabriel Luci, Aug 21 '19 at 13:19

Gabriel Luci · Accepted Answer · 2019-08-28T14:43:20.273

0

Since memberOf is available to you, you can search for the users instead of the groups:

(&(objectClass=person)(sn=bar))

(You might have to change the objectClass depending on what it is for users. I'm used to Active Directory, not OpenLDAP.)

Then you can read the memberOf attribute of the users you find.

Update: If you just want to find members of that group with that attribute then you can do it in one query by using memberOf in the query, and looking for the DN of the group:

(&(objectClass=person)(sn=bar)(memberOf=CN=MyGroup,DC=whatever))

edited Aug 28 '19 at 14:43

answered Aug 22 '19 at 15:38

Gabriel Luci

38,328
4
55
84

But can that be made in a single query? I'm using a library that I pass it the query for what I want and does operations based on RBAC. So I can't do multiple queries – Demian Tinkiel Aug 28 '19 at 11:33
I see. I updated my answer with something that should work. – Gabriel Luci Aug 28 '19 at 14:43
Thanks for that @GabrielLuci but that would imply I know the group. The objective is to get the group of someone of whom I only have partial information (i.e not full DN) – Demian Tinkiel Sep 04 '19 at 13:56
Sounds like you will have to do it in two steps then. – Gabriel Luci Sep 04 '19 at 13:59
yep, I thought so. Thanks for confirming it! – Demian Tinkiel Sep 12 '19 at 14:28

how to get groups of a user in ldap by members with attribute value

1 Answers1