0

Is it possible, using LDAP filter syntax, to retrieve all users a user is subordinate to, based on the 'manager' attribute? For example,

  • Bob is John's manager
  • Alice is Bob's manager
  • Dave is Alice's manager
  • Mary is Dave's manager

When I give John's user account, I get Bob, Alice, Dave and Mary.

I know this can be done the other way around using LDAP_MATCHING_RULE_IN_CHAIN, e.g.

(manager:1.2.840.113556.1.4.1941:=cn=mary,ou=bosses,dc=domain,dc=local)

...would return Dave, Alice, Bob and John's user accounts (per this article):

My question is - in the absence of a corresponding linked attribute (such as in the case of member and memberof), can this be achieved using filter syntax? I know this can be achieved programmatically but I'm trying to avoid that if possible.

1

The opposite of the manager attribute is directReports.

So you can use the chain rule to match this to get all managers above: (directreports:1.2.840.113556.1.4.1941:=JOHNS-DN-HERE)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.