ldapsearch filter memberOf group returning no results

Question

I have ran into problem using memberOf filter in my ldapsearch query. The customer is using `OpenLDAP.

I have a group of users with 3 members

When I query for users using ldapsearch:

ldapsearch -h hostname -p 393 -x -z 3 -b "o=XY,dc=group,dc=com,dc=xyz,dc=cz" "(&(objectClass=person))" 1.1

I get results containing also user XYZ.

# extended LDIF
#
# LDAPv3
# base <o=XYZ,dc=group,dc=com,dc=xyz,dc=cz> with scope subtree
# filter: (&(objectClass=person))
# requesting: 1.1 
#

# XYZ, People, XY, xyz.com
dn: cn=XYZ,ou=People,o=XY,dc=group,dc=com,dc=xyz,dc=cz

...

# search result
search: 2
result: 4 Size limit exceeded

# numResponses: 4
# numEntries: 3

But when I use the filter:

ldapsearch -h hostname -p 393 -x -z 3 -b "o=XY,dc=group,dc=com,dc=xyz,dc=cz" "(&(objectClass=person)(memberOf=cn=X,ou=BusinessRoles,ou=AccessControl,o=XYZ,dc=group,dc=com,dc=xyz,dc=cz))"

I get no results.

Did I make any mistake in the query? Is the memberOf syntax OK?

@BertoldKolics - thanks for reply. When I look at user 'xyz' witch is one of members of group X in result set, there is no 'memberOf' field. — shimon001
I should have asked you to replace 1.1 from the end of your first search query with memberOf. If you still do not get a memberOf value, then you are likely using a built-in group. — Bertold Kolics
Hi, there is no memberOf value in results, even if I replace the 1.1 with memberOf in search query. — shimon001
The thing is, I am not aware of the way the grouping is done, I do just read the data from AD (the users are assigned to groups in another application). — shimon001

Bertold Kolics Bertold Kolics · Accepted Answer · 2016-05-25T01:34:32

Check with your admin to make sure that memberOf is enabled on the OpenLDAP server
Check with your admin that anonymous access is allowed to this attribute

ldapsearch filter memberOf group returning no results

1 Answers