Using LDAP to query user accounts and determine their group membership

HCL Domino Domino Forum
1

Hi, we have some software that allows the importing of user and group data from an LDAP repository. I am working with a customer that uses Domino and wishes to import a selection of people to our system.

Typically we create a group, then add the required accounts to this group. Our software then filters based on this group membership, for instance the LDAP filter would be;

(&(objectClass=user)(memberOf=CN=IRM Users,ou=CA,ou=US,DC=Global,DC=CompanyName))

In the past, with things like Active Directory and iPlanet the user account object has a property which reflects their group membership and therefore it is easy to filter users based on these properties.

However when we looked at the Domino schema, this property didn’t exist. We could add/use an existing atttribute to indicate their requirement in our system but this would be quite labour intensive and also difficult to permission. With group membership we can allow certain managers to add users to the group and therefore be imported into our server.

So my question is;

Does anyone know of a way to design a filter/LDAP query which would allow us to return only those accounts which are members of a particular group.

One of the answers to this could be, ‘why not programatically query the group and use this list of users to drive the import?’ but due to the design of this part of our software I cannot do it, I wish I could!

2

Subject: Using LDAP to query user accounts and determine their group membership

“(&(objectclass=dominoGroup)(CN=yourgroupname))” member

should give you a list of all members of a Domino group

3

Subject: Using LDAP to query user accounts and determine their group membership

(&(objectClass=user)(memberOf=CN=IRM Users,ou=CA,ou=US,DC=Global,DC=CompanyName))

A few words on this thread and in particular the query above …

This is an Active Directory query, where memberOf, per Group Objects - Win32 apps | Microsoft Learn, only returns direct membership. Nested members are NOT returned by this query.

Erik is correct that

ldapsearch -h yourhost “(&(objectclass=dominoGroup)(CN=yourgroupname))” member

returns the equivalent Domino Person objects. Again, note that only direct members are returned.

Most Domino group DNs are “flat”. Therefore leave the search base blank to search the root.

The direct member search above can be improved performance-wise by both AD and Domino LDAP servers by simply retrieving the DN-named object and asking for its member attribute values like so:

ldapsearch -h yourhost -s base -b “CN=IRM Users,ou=CA,ou=US,DC=Global,DC=CompanyName” “(objectclass=*)” member

It sounds like your comment “One of the answers to this could be, ‘why not programatically query the group and use this list of users to drive the import?’ but due to the design of this part of our software I cannot do it, I wish I could!” suggests that the search results must be the N objects, rather than simply the names of the N objects satisfying the query. Therefore this approach is not useful to you.

If you need to find both direct and nested members, this cannot be done via a simple query for AD or Domino. Instead, your LDAP application will need to implement code similar to that described in the “Collaborative Cuisine” article referenced in “Domino Directory FAQ” (google it)