4.4. Query groupOfNames

RFC 4519 defines object classes groupOfNames and groupOfUniqueNames that describe entries for representing lists of DNs (a group).

The command below displays all attributes for each entry where the compound filter is true, matching on attributes objectClass and cn (common name). Filters like these would be expected to work in many common LDAP server products. Object classes groupOfNames and groupOfUniqueNames are defined for Microsoft Active Directory, but they may not be used. Active Directory has a group object class that is used to represent groups of users.

ldapsearch \
    '( &
        ( |
            (objectClass=groupOfUniqueNames)
            (objectClass=groupOfNames)
        )
        (cn=SOME_GROUP_NAME)
    )' \
    '*' +

The command below displays the member and uniqueMember attributes for each entry where the compound filter is true, matching on attributes objectClass and cn (common name).

ldapsearch \
    '( &
        ( |
            (objectClass=groupOfUniqueNames)
            (objectClass=groupOfNames)
        )
        (cn=SOME_GROUP_NAME)
    )' \
    member uniqueMember

The command below is based on the command above, but it isolates the uid for each member or uniqueMember.

ldapsearch \
    '( &
        ( |
            (objectClass=groupOfUniqueNames)
            (objectClass=groupOfNames)
        )
        (cn=SOME_GROUP_NAME)
    )' \
    member uniqueMember |
awk '
    /^(member|uniqueMember):/ {
        match($0,/uid=([^,]*),/,a);
        if (length(a[1]) > 0)
            print a[1];
        else
            print "pattern not found in " $0
    } 
    '

The command below displays the distinguished name of any groups of class groupOfNames or groupOfUniqueNames where the given distinguished name for some user (e.g., uid=jxd1234,ou=someOrgUnit,o=example.com,c=us) is a member or a uniqueMember.

ldapsearch \
    '( |
        ( &
            (objectClass=groupOfNames)
            (member=uid=jxd1234,ou=someOrgUnit,o=example.com,c=us)
        )
        ( &
            (objectClass=groupOfUniqueNames)
            (uniqueMember=uid=jxd1234,ou=someOrgUnit,o=example.com,c=us)
        )
    )' \
    dn