07-09-2015
LDAP Group query
I need to write LDAP group query where I need to find if a particular user is a member of a 2 specific Groups. This is LDAP Novell edirectory implementation.
Below are the details -
================
LDIF entry for OndotAPI group
dn: cn=OndotAPI,ou=Groups,o=CNS
changetype: add
objectClass: top
objectClass: groupOfNames
objectClass: CCGroupApplication
cn: OndotAPI
# OndotAPI, Groups, CNS
dn: cn=OndotAPI,ou=Groups,o=CNS
member: cn=OndotUsr,ou=WebServices,o=fiserveft
member: uid=test1113,ou=People,o=CNS
member: uid=rtest901,ou=People,o=CNS
member: cn=OndotUsr2,ou=WebServices,o=fiserveft
AND
LDIF entry for CREATE_SESSION role. Notice the user OndotUsr is also a member of that role.
dn: cn=CREATE_SESSION,ou=Groups,o=CNS
changetype: add
objectClass: top
objectClass: groupOfNames
objectClass: CCGroupRole
cn: CREATE_SESSION
# CREATE_SESSION, Groups, CNS
dn: cn=CREATE_SESSION,ou=Groups,o=CNS
member: cn=OndotUsr,ou=WebServices,o=fiserveft
member: uid=test1113,ou=People,o=CNS
member: uid=rtest901,ou=People,o=CNS
member: cn=OndotUsr2,ou=WebServices,o=fiserveft
So I need to verify using LDAP query that OndotUsr is a member of both the group - OndotAPI and CREATE_SESSION.
If this sounds difficult, then i need to write two queries one after the another in my program.
1) 1st query to see if OndotUsr is member of OndotAPI
2) if Yes, then only it'll run second query.
2n query to find if the OndotUsr is member of CREATE_SESSION group.
Need your help in writing this query.
Thank you.
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hi
I'm not a programmer but am muddling through as best I can. I am trying to set up a PostSearchHook for Radiator (RADIUS server), that carries out an LDAP lookup, and, based on the
string returned ("staff" or "student") in the "businessCategory" attribute, will set the $role to be either 40... (3 Replies)
Discussion started by: mikie
3 Replies
2. UNIX for Dummies Questions & Answers
I would like to do an ldap search which looks for entries which do not actually have a certain attribute. Not that the attribute is Null, but where the attribute does not exist.
Is this possible using ldapsearch? (3 Replies)
Discussion started by: dopple
3 Replies
3. Red Hat
I can't seem to make sense of this.
$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.2 Beta (Tikanga)
$
$ mount
/dev/sda2 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on... (6 Replies)
Discussion started by: dfinn
6 Replies
4. Emergency UNIX and Linux Support
Hi all
We have squid-2.5.STABLE11-3.FC4 running in our environment.
LDAP authentication works fine. Active Directory 2003 Users are prompted to enter credentials every time they access the net. The system works perfectly, but I need to configure Squid to block users in a specific AD group.... (1 Reply)
Discussion started by: wbdevilliers
1 Replies
5. Shell Programming and Scripting
Hi All,
I have a existing Ldap query which take a HOME as variable and gives the result where i grep for a particular line.
ldapsearch -h server_domain_name -p 389 -D "uid=user,ou=appadm,o=ent" -w PaB -b "ou=roles,o=ent" "cidx=$HOME" | grep -w "ent: xyz"
Now i have 330K Homes in a... (1 Reply)
Discussion started by: posner
1 Replies
6. Solaris
I have a test environment which is running RedHat 6.5 Identity management. On the lab network are two Solaris 10 (U11) machines. I can successfully log into the S10 machines using the ldap username/passwords. However, I have a problem with groups and although I found through an internet search one... (3 Replies)
Discussion started by: cjhilinski
3 Replies
7. Emergency UNIX and Linux Support
Hi Friends,
I have below scenarios .
dom1.test.com - LDAP
dom2.test.com - AD
Requirement is establish a trust relation between LDAP and AD server in such a way that if any user login on LDAP managed authentication server with
dom1\username -> get authenticated by LDAP host
... (2 Replies)
Discussion started by: Shirishlnx
2 Replies
8. Web Development
trying to implement authz to a webpage using require ldap-group. It works, except I need to do apachectl restart before the server will observe an add or a delete to the group.
Seems like apache is acquiring the group membership at startup & caching it.
It's a static group.
I have apache... (0 Replies)
Discussion started by: maraixadm
0 Replies
9. UNIX for Advanced & Expert Users
Has anyone attempted to define GPO / HBAC policies in Windows Server 2012 that could be respected by Kerberos/LDAP on AIX?
I'm looking to associate servers to groups so that when a user part of a group tries to login to a host not associated with that group, it would be denied. This would allow... (3 Replies)
Discussion started by: Devyn
3 Replies
10. UNIX for Advanced & Expert Users
I have an in interesting dilemna that I am trying to address. I have some ldap queries that I use to retrieve user information to perform access validations on a quarterly/annual basis. I can successfully pull the local users, and I can use ldapsearch to pull back all the users from the DN as well.... (7 Replies)
Discussion started by: dagamier
7 Replies
LEARN ABOUT SUSE
afp_ldap.conf
AFP_LDAP.CONF(5) Netatalk 2.2 AFP_LDAP.CONF(5)
NAME
afp_ldap.conf - Configuration file used by afpd(8) to configure a LDAP connection to an LDAP server. That is needed for ACL support in
order to be able to query LDAP for UUIDs.
DESCRIPTION
/etc/netatalk/afp_ldap.conf is the configuration file used by afpd to set up an LDAP connection to an LDAP server.
Any line not prefixed with # is interpreted.
Note
You can use afpldaptest(1) to syntactically check your config
The required parameters and their meanings are:
PARAMETER
ldap_server
Name or IP address of your LDAP Server
ldap_auth_method
Authentication method: none | simple | sasl
none
anonymous LDAP bind
simple
simple LDAP bind
sasl
SASL. Not yet supported !
ldap_auth_dn
Distinguished Name of the user for simple bind.
ldap_auth_pw
Distinguished Name of the user for simple bind.
ldap_userbase
DN of the user container in LDAP.
ldap_userscope
Search scope for user search: base | one | sub
ldap_groupbase
DN of the group container in LDAP.
ldap_groupscope
Search scope for user search: base | one | sub
ldap_uuuid_attr
Name of the LDAP attribute with the UUIDs.
Note: this is used both for users and groups.
ldap_name_attr
Name of the LDAP attribute with the users short name.
ldap_group_attr
Name of the LDAP attribute with the groups short name.
EXAMPLES
Example. afp_ldap.conf setup with simple bind
ldap_server = localhost
ldap_auth_method = simple
ldap_auth_dn = cn=admin,dc=domain,dc=org
ldap_auth_pw = notthisone
ldap_userbase = ou=users,dc=domain,dc=org
ldap_userscope = one
ldap_groupbase = ou=groups,dc=domain,dc=org
ldap_groupscope = one
ldap_uuid_attr = some_attribute
ldap_name_attr = cn
ldap_group_attr = cn
SEE ALSO
afpd(8), AppleVolumes.default(5), afpldaptest(1)
Netatalk 2.2 30 Mar 2011 AFP_LDAP.CONF(5)