I try to build a ldap query to MS Active Directory. I found that there is a LDAP_MATCHING_RULE_IN_CHAIN type to do so. Which results in the follow syntax:
The query* enumerate online the first nested group.
In my example the Group1 has the follow member groups:
- Domain Administrators
- Domain Members
- Domain Computers
And Benna is in Group Domain Members, but the query dont give me a result*.
When I change the filter to
I can see, that the query enumerates only members of the Group "Domain Administrators"*.
So thats the reason that it not matches my query above.
Any reason why this happens?
*Tested with adsiedit.msc
ok - it seams that this is the reason
but is it possible to build a query to the nested group also for the primaryGroupID attribute? Or is there any way to have a single ldap query, where you can use to find if a user is member of a group (which can also have nested groups)?