Find All AD groups recursively given SAM account in single query

user_8745755 0
Viewed 980

Is it possible to retrieve all AD groups recursively given a user's SAM Account identifier?

I've been using the following ldapsearch filter 

ldapsearch -D 'domain\john.doe' -W -h 'ldap.domain.com' -b 'DC=domain,DC=local' '(member:1.2.840.113556.1.4.1941:=CN=John Doe,OU=Users,OU=World,DC=domain,DC=local)' dn

to query our local LDAP server (based off AD) to retrieve the user's AD groups but it's a two-step process since I need to the users full DN.

Previously I used to get a user's direct groups by users the non-recursive filter:

ldapsearch -D 'domain\john.doe' -W -h 'ldap.domain.com' -b 'DC=domain,DC=local' '(|(userPrincipalName=john.doe@domain.com)(sAMAccountName=john.doe))' dn

Is it possible to achive the result of the first query (all AD groups recursively) and the single step of the second query (since I only needed to know the email address of user of the username

ldap active-directory
1 Answers

No you cannot without performing multiple queries.

If your server is based off AD, it may use memberOf attribute in which case you can get user's groups in one single query but without nested groups :

ldapsearch -D 'domain\john.doe' -W -h 'ldap.domain.com' -b 'DC=domain,DC=local' '(|(userPrincipalName=john.doe@domain.com)(sAMAccountName=john.doe))' memberOf

It would be great if we could use the extensible match as an attribute request in the query above, using memberof:1.2.840.113556.1.4.1941: instead of memberOf, but it's not a maintained attribute for which you can grab values when searching groups, it can only be used for extensible match in a filter (cf. LDAP_MATCHING_RULE_IN_CHAIN), and it's specific to AD (not implemented in OpenLDAP).

On the other side, you can search for groups using filter member:1.2.840.113556.1.4.1941: but the problem is precisely that it requires knowing user's dn in the first place.

One might come with the idea of querying groups with a filter matching memberUid with user login or sAMAccountName, but it depends whether or not this attributes is maintained in your directory, and I'm pretty sure you can't have extensible match with this one, meaning this filter cannot match nested group membership.

So, in the end you need to use your second query to grab all user dn's, and for each one of them build the query that will grab that user's group membership including nested groups.

user_25299540
Related