Trying to Search 2 Folders for Users in LDAP

Question

#Users Accounts path
bind_dn = "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Mtp,DC=us,DC=bosch,DC=com" and "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Ca1,DC=br,DC=bosch,DC=com"
bind_pass = password

If i do "and" it will only search the second folder

#Users Accounts path
bind_dn = "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Mtp,DC=us,DC=bosch,DC=com" or "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Ca1,DC=br,DC=bosch,DC=com"
bind_pass = password

When I do "or" it only searches the first folder

This is for LDAP authentication it is going in these folders to search for usernames to make sure they exist. Is there a function i can use to have this bind_dn search both folders for users instead of just one or the other.

Function to connect LDAP

def connect_ldap(user, password):

#CHANGE TO YOUR LDAP SERVER HERE
#LDAP Server
ldap_server = "bosch.com"

#CHANGE TO YOUR BIND_DN PATH HERE
#Users Accounts path
bind_dn = "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Mtp,DC=us,DC=bosch,DC=com" and "cn="+user+",ou=" +user[0]+",OU=Useraccounts,OU=Ca1,DC=br,DC=bosch,DC=com"
bind_pass = password

#Config the server and connection
server = Server(ldap_server, port=int(636), use_ssl=bool(True))
conn = Connection(server=server, user=bind_dn, password=bind_pass)

#First make a touchbase in the LDAP Server with the credentials to authenticate
connection_status = conn.bind()
print("Status: ",connection_status)

# If the user and pass is correct it will continue the script
if connection_status == True:

    #Filter the search to Groups
    search_filter = '(objectClass=group)'
    try:
        #CHANGE TO YOUR GROUP SEARCH HERE
        #This search will return a members list of the selected group
        conn.search("CN=CI/OSR-NA Staff,OU=Recipients,OU=MAIL34,OU=DL,OU=MSX,DC=us,DC=bosch,DC=com",
        search_filter, search_scope=SUBTREE, attributes=['member'])
        members = []

        #Set the list in a variable
        for entry in conn.entries:
            members = entry.member.values

        print("\nGroup Members: \n\n", members, "\n")        
        status = "Permission Denied"        

        #Check if the user is part of the group                        
        for member in members:

            #If the user is part of the group it will return "Permission Allowed" and terminate the script. 
            if user.lower() in member.lower() or user.upper() in member.upper():
                status = "Permission Allowed" 
                return status

        #If the user is not part of the group it will return "Permission Denied" and terminate the script.        
        if status == "Permission Denied":
            return status
    except Exception as e:
        return e

# If the user and pass is incorrect it will return "False" and terminate the script.
elif connection_status == False:        
    return "Connection error"

Answer 1

bind_dn is a string, so it's converting whatever you have on the right to a single string. The reason for the difference in using and or or is because of how those keywords operate on strings.

a and b

means: If string a has a value, then use string b. In your case, because the first string is a constant string, it always has a value, so the result is always the second string.

a or b

means: If string a has a value, use that. Otherwise, use string b. In your case, because the first string is a constant string, it always has a value so that first string is always used.

This syntax is pointless with static strings, since the result will always be the same. You would usually use this syntax with variables. You can read this answer to read about cases where this is quite useful.

You will need to set that to a single string without and or or. You haven't shown the code where you use these variables, and I can't figure it out from the python-ldap documentation. But if you're using base_dn to authenticate, then what you do will depend on what your LDAP server is running. If you're using Active Directory, I know it will accept just the username - you don't need the full DN. So if you are using AD, you can just do this:

bind_dn = user