61

Is it possible to create an LDAP query which will return (or check for) users in a nested group? e.g. UserA is a member of GroupA, and GroupA is a member of GroupB. I want a query on GroupB to return that UserA is a member. LDAP only. The server is Active Directory.

1

3 Answers 3

107

Yes, using the LDAP_MATCHING_RULE_IN_CHAIN matching rule (OID 1.2.840.113556.1.4.1941). For example:

(memberOf:1.2.840.113556.1.4.1941:=cn=group,cn=users,DC=x)

see http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx

10
  • 15
    Can you explain that a little bit for those of us who aren't very good at LDAPese?
    – docwhat
    Oct 25, 2011 at 16:12
  • 3
    Is this rule a Microsoft extension? Sep 26, 2012 at 10:55
  • 5
    If I could, I would bake you a cake and mail it to you as a thank you.
    – Shawn D.
    Mar 7, 2013 at 22:13
  • 3
    It sounds like the question is looking for something that takes a group argument and lists all members (including members from nested groups). All of these solutions appear to take a user argument -or- a user and a group argument both.
    – Martin
    Apr 11, 2013 at 20:54
  • 2
    I'm an LDAP newb, What the heck is 1.2.840.113556.1.4.1941? I see it on the link you posted, any idea why it's a long string of numbers like that?
    – Sean256
    Dec 20, 2016 at 1:50
13

You must use the full distinguished name of your group when using memberOf:1.2.840.113556.1.4.1941:= in my case CN=MyGroup,OU=User,OU=Groups,OU=Security,DC=domain,DC=com was the whole distinguished name

(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,OU=User,OU=Groups,OU=Security,DC=domain,DC=com))

you can get the distinguished name of you group by running the following code and putting in this filter (&(objectClass=group)(name=MyGroup))

Imports System.DirectoryServices

Module Module1

Sub Main()
    Dim run As Boolean = True
    Dim Filter As String
    While run
        Console.WriteLine("Enter Filter:")
        Filter = Console.ReadLine()
        If Filter = "exit" Then
            run = False
        Else
            checkFilter(Filter)
        End If
    End While
End Sub

Function checkFilter(Filter As String) As Boolean
    Dim search As New DirectorySearcher("LDAP://dc=Domain,dc=com")
    Try
        search.Filter = Filter
        search.PropertiesToLoad.Add("name")
        search.PropertiesToLoad.Add("distinguishedName")
        search.SearchScope = SearchScope.Subtree
        Dim results As SearchResultCollection = search.FindAll()
        If results Is Nothing Then
            Console.WriteLine("Nothing")
            Return False
        Else
            If results.Count() = 0 Then
                Console.WriteLine("non found")
            End If
            Dim result As SearchResult
            For Each result In results
                Console.WriteLine(result.Properties("name")(0).ToString())
                Console.WriteLine(result.Properties("distinguishedName")(0).ToString())
                'For Each prop In result.Properties("members")
                '    Console.WriteLine(prop.ToString())
                'Next
            Next
            Console.WriteLine(String.Format("{0} Users Found", results.Count()))
        End If
    Catch ex As Exception
        Console.WriteLine(ex.Message)
    End Try
    Return True
End Function

End Module
5

Per your question, the query should be

(&(memberOf:1.2.840.113556.1.4.1941:={0})(objectCategory=person)(objectClass=user)(sAMAccountName={1}))

{0} is the nested group, it should be a Distinguished name

{1} is the user sAMAccountName you want (you could use any other user property than sAMAccountName within (sAMAccountName={1}))

Then you will get the user detail for response if the user is the member of nested group

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.