Search code examples
ldapopenldapldap-query

How do I query using ldapsearch what LDAP groups are members of other groups?

I'm working with an LDAP installation whose structure is not well documented. I think the tools that are normally used to add entries into it can create nested groups that a reused for assigning multiple permissions to users. By this, I mean:

User1 (o=users) -- is member of --> Group1 (o=groups) -- is member of --> Group2 (o=groups)

To confirm that this is indeed the way the system works, is there a way of querying using ldapsearch what groups are members of other groups?

Solution

  • Not easily. You will have to get the DNs of all the groups and their member attributes, whatever you're using for that, and then search for group DNs in the membership attributes.