Search code examples
ldapldap-client

LDAP filter - retrieve all users in a given group

I have a problem with a filter in LDAP. I want to retrieve all the users in a specified LDAP group. The LDIF is like this one:

dn: cn=engineering,ou=Groups,dc=domain,dc=com
objectClass: groupOfNames
cn: engineering
member: uid=alex,ou=Users,dc=domain,dc=com
member: uid=amy,ou=Users,dc=domain,dc=com
...

dn: uid=alex,ou=Users,dc=domain,dc=com
objectClass: posixAccount
objectClass: inetOrgPerson
cn: Alex Ander
gidNumber: 5000
homeDirectory: /home/alex
...

I've tried

(&(objectClass=user)
  (memberof=cn=engineering,OU=Users,DC=domain,DC=com))

but it doesn't work.

Solution

  • To retrieve all the members of the group, use the following parameters in a search request:

    • base object: cn=engineering,ou=Groups,dc=domain,dc=com
    • scope: base
    • filter: (&)
    • requested attributes: member

    The response from the server (assuming the authorization state of the connection on which the search request is processed permits) will be a list of all the member attribute values in that group.

    If the LDAP client requires the full entry of each of the members, then transmit a search search request for each member. The client has the DN, so only a base level scope is required, and list each attribute to be retrieved.

    Alternatively:

    • base object: ou=users,dc=domain,dc=com
    • scope: one (if all objects are one level below ou=users)
    • filter: (&(objectClass=inetorgPerson)(memberOf=cn=engineering,ou=Groups,dc=domain,dc=com))
    • requested attributes, for example, cn, homeDirectory

    The response from the (assuming the authorization state of the connection on which the search request is processed permits) will be a list of inetOrgPerson members that otherwise match the search parameters, such as being a member of that group.

    see also