Ldap filter to get group members

List overview All Threads
Download

newer

older

Controlled LDAP Proxy/Relay

Reject requests on non-secure...

dhanushka ranasinghe

14 May 2012 14 May '12

6:36 p.m.

Hi... guys

i have a LDAP server and its has a group called .

cn=internal ou=group,dc=example,dc=com

--users of this group is :

uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com

i need to only to authenticate the users under cn=internal ....

LDAP search for the cn=internal group as follows ,

dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user2,ou=user,dc=example,dc=com

member: uid=user3,ou=user,dc=example,dc=com

member: uid=user4,ou=user,dc=example,dc=com

by the way All the users are stored at base OU=user,DC=example,DC=com

This is what we are using

(&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com))

seems like its not working ..

what the LDAP search filter i need to use to get only the members of the cn=internal group authenticated...

Thanks

Attachments:

attachment.htm (text/html — 1.1 KB)

Show replies by date

Andrew Findlay

15 May 15 May

1:33 a.m.

On Mon, May 14, 2012 at 08:06:41PM +0530, dhanushka ranasinghe wrote:

...

i have a LDAP server and its has a group called .

cn=internal ou=group,dc=example,dc=com

--users of this group is :

uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com

...

i need to only to authenticate the users under cn=internal ....

I assume you mean "I only want to allow users of this group to access some resource"

...

This is what we are using

(&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com))

seems like its not working ..

what the LDAP search filter i need to use to get only the members of the cn= internal group authenticated...

I think it would be best to use several LDAP operations rather than trying to do everything in one go. For example:

1) Search for user: base: ou=user,dc=example,dc=com filter: (&(objectclass=account)(uid=<username>)) If the user exists, note the DN of the entry found.

2) Authenticate user: Bind as the user DN using the user-supplied password If this fails, deny access.

3) Re-bind as a system user (or anon if that has enough access)

4) Check authorisation: Search base: CN=internal,OU=group,DC=example,DC=com Search scope: base Filter: (member=<user DN>) Return attributes: cn If this returns an entry then the user is in the authorisation group and should be allowed to use the resource. Otherwise, deny access.

Andrew

-- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

dhanushka ranasinghe

25 Jun 25 Jun

7:47 a.m.

Hi guys...

Thanks for the reply ,

i tried many ldap filters according to the suggestion made by andrew..but i unable to get it work.. any idea how write such a filter.

Thank You

On 15 May 2012 03:03, Andrew Findlay andrew.findlay@skills-1st.co.ukwrote:

...

On Mon, May 14, 2012 at 08:06:41PM +0530, dhanushka ranasinghe wrote:

...
i have a LDAP server and its has a group called .

cn=internal ou=group,dc=example,dc=com

--users of this group is :

uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com

...
i need to only to authenticate the users under cn=internal ....

I assume you mean "I only want to allow users of this group to access some resource"

...
This is what we are using

(&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com))

...
seems like its not working ..

what the LDAP search filter i need to use to get only the members of the

cn=

...
internal group authenticated...

I think it would be best to use several LDAP operations rather than trying to do everything in one go. For example:
 Search for user:
        base: ou=user,dc=example,dc=com
        filter: (&(objectclass=account)(uid=<username>))
If the user exists, note the DN of the entry found.
 Authenticate user:
        Bind as the user DN using the user-supplied password
If this fails, deny access.
 Re-bind as a system user (or anon if that has enough access)
 Check authorisation:
        Search base: CN=internal,OU=group,DC=example,DC=com
        Search scope: base
        Filter: (member=<user DN>)
        Return attributes: cn
If this returns an entry then the user is in the authorisation
group and should be allowed to use the resource. Otherwise,
deny access.
Andrew

| From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 |

Howard Chu

5:13 p.m.

dhanushka ranasinghe wrote:

...

Hi guys...

Thanks for the reply ,

i tried many ldap filters according to the suggestion made by andrew..but i unable to get it work.. any idea how write such a filter.

Thank You

On 15 May 2012 03:03, Andrew Findlay <andrew.findlay@skills-1st.co.uk mailto:andrew.findlay@skills-1st.co.uk> wrote:

On Mon, May 14, 2012 at 08:06:41PM +0530, dhanushka ranasinghe wrote:

 > i have a LDAP server and its has a group called .
 >
 > cn=internal ou=group,dc=example,dc=com
 >
 > --users of this group is :
 >
 > uid=user1,ou=user,dc=example,dc=com
 > uid=user2,ou=user,dc=example,dc=com

 > i need to only to authenticate the users under cn=internal ....

I assume you mean "I only want to allow users of this group to access
some resource"

 > This is what we are using
 >
 >
(&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com))
 >
 > seems like its not working ..
 >
 > what the LDAP search filter i need to use to get only the members of
the cn=
 > internal group  authenticated...

I think it would be best to use several LDAP operations rather than
trying to do everything in one go. For example:

1)      Search for user:
                base: ou=user,dc=example,dc=com
                filter: (&(objectclass=account)(uid=<username>))
        If the user exists, note the DN of the entry found.

2)      Authenticate user:
                Bind as the user DN using the user-supplied password
        If this fails, deny access.

3)      Re-bind as a system user (or anon if that has enough access)

4)      Check authorisation:
                Search base: CN=internal,OU=group,DC=example,DC=com
                Search scope: base
                Filter: (member=<user DN>)
                Return attributes: cn
        If this returns an entry then the user is in the authorisation
        group and should be allowed to use the resource. Otherwise,
        deny access.

Step 4 should just be an LDAP Compare operation.

-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

Andrew Findlay

5:43 p.m.

On Mon, Jun 25, 2012 at 09:17:28AM +0530, dhanushka ranasinghe wrote:

...

i tried many ldap filters according to the suggestion made by andrew..but i unable to get it work.. any idea how write such a filter.

You will have to post more detail and ask clearer questions if you want to get help from a mailing list like this.

To start with, I suggest you post an LDIF file containing all the entries involved in your tests. You should then describe what you want to do, and post some example searches showing what you have tried so far.

Andrew

4819

Age (days ago)

4861

Last active (days ago)

openldap-technical@openldap.org

4 comments

3 participants

tags (0)

participants (3)

Andrew Findlay
dhanushka ranasinghe
Howard Chu