Ldap nested group membership filter

Question

I tried using the LDAP mapping rule, but I cannot find the search entries and the LDAP matching rule filter.

This is how I send the filter: filter (&(objectclass=*)(memberof:1.2.840.113556.1.4.1941:=)(cn=gasaxena))

I reset the filter in pcap received on the ldap server, and here is what it looks like: filter: (&(&(objectclass=*)(memberof:1.2.840.113556.1.4.1941:=[NULL]))(cn=gasaxena))

Can someone point out if I missed something? AD server

Answer 1

You should search for a group similar to:

(member:1.2.840.113556.1.4.1941:=CN=John Smith,DC=MyDomain,DC=NET)

Not owned by the user.

-Jeet

Answer 2

To understand Active Directory filters, just look at the search filter syntax .

To find all groups in which "user1" is a member:

DN ; , DN (dc = dom, dc = fr)

: (member:1.2.840.113556.1.4.1941:=cn=user1,cn=users,DC=x)

LDIFDE.EXE( AD ):

ldifde -f t.txt -d "DC=dom,DC=fr" -r "(member:1.2.840.113556.1.4.1941:=CN=jblanc,OU=MonOu,DC=dom,DC=fr)"

jpblanc .

Answer 3

: (&(objectclass=*)(memberof:1.2.840.113556.1.4.1941:=)(cn=gasaxena)).

, :

(&(objectclass=*)(memberOf:1.2.840.113556.1.4.1941:=cn=gasaxena,<superior-portion-of-distinguished-name-here>))

Answer 4

memberOf: 1.2.840.113556.1.4.1941: = CN = MyGroup, OU = , OU = , OU = Security, DC = domain, DC = com -

(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,OU=User,OU=Groups,OU=Security,DC=domain,DC=com))

, (& (objectclass= group) (name = MyGroup))

    Imports System.DirectoryServices

    Module Module1

        Sub Main()
            Dim run As Boolean = True
            Dim Filter As String
            While run
                Console.WriteLine("Enter Filter:")
                Filter = Console.ReadLine()
                If Filter = "exit" Then
                    run = False
                Else
                    checkFilter(Filter)
                End If
            End While
        End Sub

        Function checkFilter(Filter As String) As Boolean
            Dim search As New DirectorySearcher("LDAP://dc=Domain,dc=com")
            Try
                search.Filter = Filter
                search.PropertiesToLoad.Add("name")
                search.PropertiesToLoad.Add("distinguishedName")
                search.SearchScope = SearchScope.Subtree
                Dim results As SearchResultCollection = search.FindAll()
                If results Is Nothing Then
                    Console.WriteLine("Nothing")
                    Return False
                Else
                    If results.Count() = 0 Then
                        Console.WriteLine("non found")
                    End If
                    Dim result As SearchResult
                    For Each result In results
                        Console.WriteLine(result.Properties("name")(0).ToString())
                        Console.WriteLine(result.Properties("distinguishedName")(0).ToString())
                        'For Each prop In result.Properties("members")
                        '    Console.WriteLine(prop.ToString())
                        'Next
                    Next
                    Console.WriteLine(String.Format("{0} Users Found", results.Count()))
                End If
            Catch ex As Exception
                Console.WriteLine(ex.Message)
            End Try
            Return True
        End Function
    End Module