[Date Prev][Date Next]
Re: Ldap filter to get group members
dhanushka ranasinghe wrote:
Thanks for the reply ,
i tried many ldap filters according to the suggestion made by andrew..but i
unable to get it work.. any idea how write such a filter.
On 15 May 2012 03:03, Andrew Findlay <firstname.lastname@example.org
On Mon, May 14, 2012 at 08:06:41PM +0530, dhanushka ranasinghe wrote:
> i have a LDAP server and its has a group called .
> cn=internal ou=group,dc=example,dc=com
> --users of this group is :
> i need to only to authenticate the users under cn=internal ....
I assume you mean "I only want to allow users of this group to access
> This is what we are using
> seems like its not working ..
> what the LDAP search filter i need to use to get only the members of
> internal group authenticated...
I think it would be best to use several LDAP operations rather than
trying to do everything in one go. For example:
1) Search for user:
If the user exists, note the DN of the entry found.
2) Authenticate user:
Bind as the user DN using the user-supplied password
If this fails, deny access.
3) Re-bind as a system user (or anon if that has enough access)
4) Check authorisation:
Search base: CN=internal,OU=group,DC=example,DC=com
Search scope: base
Filter: (member=<user DN>)
Return attributes: cn
If this returns an entry then the user is in the authorisation
group and should be allowed to use the resource. Otherwise,
Step 4 should just be an LDAP Compare operation.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/