LDAP Configuration:

MemberOf Overlay is enabled
  • Users are part of an organizationalUnit called People.
  • Each user is a "memberOf" a role. For example, a user in their role at a company is a "SeniorDeveloper" or a "Director" or a "QAAnalyst". These roles are of objectClass "groupOfNames".
  • Each role is a "memberOf" a functional group. For example, there is a "groupOfNames" called "productionServers" and it has other "groupOfNames" as members. The groups "SeniorDeveloper" and "QAAnalyst" are part of the "productionServers" group.

I need a query that says, get all the users that are part of the "productionServers" group.

This filter returns the groups that are members of "productionServers":


enter image description here

  • If you think I'm going about this the wrong way, please tell me what you think the correct way would be. – jnrcorp Jan 14 '16 at 18:01

There is no single LDAP query that can do what you want.

You could:

  • implement recursive the logic yourself via multiple calls
    Postfix does this. See: ldap_table(5) special_result_attribute
  • run a cron job on a system that keeps flatter groups in order
    Active Directory does something similar with adminCount

At this time I don't recall if sssd will work with hereditary groups. You'll want to set ldap_schema = rfc2307bis to test, along with making your groupOfNames a posixGroup.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.