LDAP query help

[JForce]

Need help with an LDAP query.

Scenario is a system will query at login to see if a user is a member of various groups that match an internal config to give various access rights.

So, am trying to get a query that will return all the groups a specified user is a member of, within a specified OU. The OU has 100 or so groups, but each user should only be a member of a few.

Will the following query work?

(&(objectcategory=group)(member=cn=XXX,ou=groups,o u=stores,ou=something else,ou=businessunits,dc=XXX,dc=net))

Don't have access to test/run it to see what it would return unfortunately :/

[Liare]

do yourself a favor and capitalize the object type.

also, this part looks strange. "member=cn=XXX" is member a variable you are stuffing something into ?
your query is wrong anyway, since LDAP does not have support for spaces, depending on what specific LDAP implementation you are talking to it may or may not support it with "" around it, but that is entirely dependent on the implementation itself, see below for the "correct" syntax that at least most of Microsoft's products will accept.

CN=xxx,OU=groups,OU=stores,OU="something else",OU=BuisnessUnits,DC=xxx,DC=net

a virtualized DC takes 30 minutes to configure, you should have access to MSDN licences if you do any serious work on Microsoft products, do yourself a favor and set one up, its incredibly useful.

[Lana Torrin]

Just posting to say I have to look up LDAP queries every fucking time I have to use them.. I can never remember how to do them.. Google however, is awesome at shit like this.

[Daneel Trevize]

FWIW this forum has a shit bug/feature with long unbroken strings. The space in "...groups,o u=stores..." probably isn't really there in the query.

[Liare]

Just posting to say I have to look up LDAP queries every fucking time I have to use them.. I can never remember how to do them.. Google however, is awesome at shit like this.

LDAP is pretty shit in the first place to be honest.

what's amazing is that nobody has done anything that's even marginally better, there's gotta be a better way to represent information than a digitalized telephone book.

[IceBlock]

What are you using? Any scripting or programming language or ADUC?

[Hel OWeen]

FWIW this forum has a shit bug/feature with long unbroken strings. The space in "...groups,o u=stores..." probably isn't really there in the query.

... which can be circumvented using [ code ] tags:

Pellentesquepulvinarloremacfelisimperdietindapibusduiinterdum.Curabiturlaoreetnislinnullaornaresollicitudin.Duisfringillacommodometus,quislaciniaodioconsequatquis!Nunceuismod,lectusetviverratincidunt,tellusfelisbibendumelit,eulobortisnislarcuegetdui.Duistellusdui,bibendum

[Daneel Trevize]

LDAP is pretty shit in the first place to be honest.

what's amazing is that nobody has done anything that's even marginally better, there's gotta be a better way to represent information than a digitalized telephone book.

Yeah, real shame databases (e.g. SQL-based ones) don't exist.

[Liare]

LDAP is pretty shit in the first place to be honest.

what's amazing is that nobody has done anything that's even marginally better, there's gotta be a better way to represent information than a digitalized telephone book.

Yeah, real shame databases (e.g. SQL-based ones) don't exist.

ironically a structured database is not really the answer to everything either.

LDAP assumes everything can be broken down into containers and stuffed together like that, a structured database (say a SQL one) assumes everything can be broken down into tables and interconnected like that.

neither really provides the best solution for the problem, the reason LDAP is so hilariously popular is because it's so fucking vague that you can build a inventory management system on it.

[Hel OWeen]

Yeah, real shame databases (e.g. SQL-based ones) don't exist.

But you can use ADO to "speak in" SQL to LDAP, see for example http://www.rlmueller.net/SQLSyntax.htm

[JForce]

Thanks for the responses. Yes, there's no spaces in the actual query.

There's no language as such, it's a direct LDAP query that this external system uses, so it's not a scripted thing (unfortunately).

I think we're going to end up with a query that returns ALL groups a user is a member of, but unfortunately our AD structure has users segmented by departments, and I don't think I can just query the top level and have it locate the user in the sub-ou structure - meaning I have to run a different query for each possible OU the user's account is in.

[IceBlock]

Direct LDAP query is a complete brainfuck and a messed up term that brings up a shitload of other irrelevant shit when searching for it. :\

[Liare]

LDAP is like PBX's, it makes perfect sense if you have worked with it the last 40 years, otherwise you are fucked.

honestly, the only way to get it working is to experiment with it, unless you know the brainfuck nature of the syntax by heart.