Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get all the list of all users that belong to a specific group from a Domino 8 LDAP server using ldapsearch.

I've tried pretty much every possible variant of the following filters with no success :


Note that the attribute dominoaccessgroups shows up in LDAP browser, and contains the name of the group the user belongs. For each group that the user belongs to, there is a matching dominoaccessgroups attribute for the user object

No matter what I try, it always returns an empty result set.

Any help welcome, I've been struggling with this all afternoon.


As posted below, I can get the list of all users in a group by querying the member attribute on a group. However, my original question was not clear on that point : I don't want to extract the DN's of the users, but the value of another attribute (in my case, the mail attribute). Is there anyway to do that without running two separate queries (one for the group members' DNs, and one for the mail attribute of all the DNs returned by the first) ?

share|improve this question
up vote 1 down vote accepted

Sorry, I can't quite parse what you mean by "...that belong to a specific from a Domino 8 LDAP server...".

But if you search for example for "objectClass=dominoGroup"

ldapsearch -h localhost "objectClass=dominoGroup"

You get a list of all you groups. And if you look at the return values, you will see, that each group has a list of "member" attributes, listing all the members of a group.

So with

ldapsearch -h localhost "(&(objectClass=dominoGroup)(CN=LocalDomainAdmins))" member

You would get the list of all members of the "LocalDomainAdmins" group.


share|improve this answer
I edited my post so that it is now parsable. – T. Fabre Mar 25 '12 at 8:13

The object class for groups are called groupOfNames. The following filter should do a LDAP search for a group:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.