CODEWITHSUNDEEP
active-directoryldapldap-query
user21258641
user21258641

Reputation: 3

LDAP Query - Include/Exclude Groups

Trying to amend a rule to exclude certain group from my existing functioning query... When i add the extra section to exclude, groupC, it picks up no users.

(&
    (objectclass=user)
    (&
        (|
            (memberOf=groupA)
            (memberOf=groupB)
        )
        (!
            (memberOf=CN=GroupC)
        )
    )
)

Have tried tweaking syntax, adding extra parenthesis, and extra &, with no change.

Upvotes: 0

Views: 875

Answers (1)

Gabriel Luci
Gabriel Luci

Reputation: 40988

Active Directory requires the full distinguished name in queries when you're matching an attribute that takes a DN, like memberOf. So just CN=Group3 isn't enough, and getting no results is exactly what would happen. Besides that, your syntax is correct.

It should look more like this:

(&
    (objectclass=user)
    (&
        (|
            (memberOf=CN=groupA,OU=Groups,DC=example,DC=com)
            (memberOf=CN=groupB,OU=Groups,DC=example,DC=com)
        )
        (!
            (memberOf=CN=GroupC,OU=Groups,DC=example,DC=com)
        )
    )
)

Upvotes: 2

Related Questions