LDAP Filter for directReports whithout using manager attribute

user_973828 0
Viewed 457

I need to get 2 separate results from Active Directory using LDAP filters.

Everyone who directly reports to a manager:

(&(manager=CN=XXXX,OU=IT,OU=STAFF,OU=XYZ,DC=ad,DC=xxxcom))

And another list that is recursive directReports for the same manager:

(&(manager:1.2.840.113556.1.4.1941:=CN=XXXX,OU=IT,OU=STAFF,OU=XYZ,DC=ad,DC=xxxcom))

These both return exactly what we need. BUT, it would be great if I could avoid using a specific person in the filter and base the filter on another attribute instead, such as:

(&(department="IT")(jobDesc="Senior Director"))

We are currently accomplishing this using PHP, but we need to switch to using an application that only takes filters. This application does not allow $result= then putting $result in the filter instead of the manager's CN.

Thanks.

ldap active-directory
1 Answers

That's not possible to do. You can't use the results from one query in another query and do all that in one query.

If you're looking for everyone in the IT department, can you not just look for (department=IT)?

By the way, you really should include at least one indexed attribute in your searches. The department and manager attributes are not indexed, so AD has to look at all objects to find matches, and you could get matches you don't want. For example, computer objects have a department attribute too. This query:

(&(objectClass=user)(objectCategory=person)(department=IT))

Limits your results to just user accounts. If you want to include contact objects, you can omit (objectclass=user).

user_12028070
Related