Searching for a user and associated groups on LDAP

Question

New to LDAP. The way our LDAP is arranged is People and groups. The people have user information such as name, uid, and mail. The groups have group name and multiple member field which has value like cn=First Last,cn=people,dc=comic,dc=com, listing the People that are members of the group.

Currently starting with userid and password, doing two searches: 1) Get user by searching on People base domain on uid=value. Then from the user get the first and last name. 2) Search on Groups base domain based on member=cn=First Last,cn=People,dc=comic,dc=com and iterate over the list of group objects returned to the group name field.

Am just wondering is there way to do all this in one search or are two searches necessary?

Answer 1

Unfortunately you cannot do what would like in one operation.

Also, what you are doing will not always work. Instead of retrieving the users first and last name you should retrieve their distinguished name (dn attribute) and do your group search based on that. First and last names can be modified within LDAP and can happen due to marriage / divorce / etc.

Answer 2

It is possible, provided that you implement a Reverse Group Membership Maintenance Overlay.

To determine which groups an entry is a member of without performing extra searches, the memberOf overlay is exactly what you need.

The memberof overlay updates an attribute (by default memberOf) whenever changes occur to the membership attribute (by default member) of entries of the objectclass (by default groupOfNames) configured to trigger updates. Thus, it provides maintenance of the list of groups an entry is a member of, when usual maintenance of groups is done by modifying the members on the group entry.

You may find this Server Fault post useful for a how to.

Once you have memberOf attribute ready to be used, you may have to run ldapmodify manually on each group entries, but just once, so that all members entries can be provisioned with the corresponding group dn in their respective memberOf attribute.

Finally, to perform a group membership search for a given user, you would just search for the user entry and iterate the memberOf attribute to get group dn's.