LDAP: Retrieve entries from multiple OUs in one query

Question

try to retrieve entries of objectClass 'groupOfNames' from multiple OUs from LDAP. My scheme looks like this:

ou=gp,ou=gruppen,dc=some,dc=my-company,dc=at
|
|-ou=99 (objectClass=organizaionalUnit)
   |-cn=admins (objectClass=groupOfNames)
   |-cn=managers (objectClass=groupOfNames)
|-ou=103 (objectClass=organizaionalUnit)
   |-cn=admins (objectClass=groupOfNames)
   |-cn=managers (objectClass=groupOfNames)
|-many more OUs
...

Now i try to create a query with which i can retrieve the admins/managers of the different OUs with one query. Within the CN the admins and managers groups contain the names of users that belong to theses groups. One filter i came up with was:

(cn=admins)

This Results in giving me back all the CNs of all OUs:

The search scope is set to complete subtree. How can I change this filter to get only the entries from specific OUs, e.g. ou=212917 and ou=211208, but not from the other OUs? The groups i want to extract in the end look like this:

Or is there another possibility to realise this? I'm fairly new to LDAP.

Ludovic Poitou Ludovic Poitou · Accepted Answer · 2018-10-20T11:56:55

It's possible to use a very specific filter to search for only the groups with cn=admins in specific OUs.

(&(cn=admins)(|(ou:dn:=212917)(ou:dn:=211208)))

The notation means search for ou=212917 in the entry or part of the DN. Not all servers support this though, even it's part of LDAPv3 standard specifications.

LDAP: Retrieve entries from multiple OUs in one query

1 Answers