LDAP Query for User Group Membership Verification

Introduction

In directory services using LDAP (Lightweight Directory Access Protocol), managing and querying user-group relationships is a common task. Often, it’s necessary to verify if a specific user is part of a particular group or any groups at all. This tutorial provides an overview on constructing effective LDAP queries for these checks, including handling membership within nested groups.

Understanding LDAP Structure

LDAP directories store information in entries (similar to records) and attributes (like fields). Commonly used for authentication and authorization processes, LDAP is pivotal in managing user credentials and access permissions efficiently.

Key Components:

• DN (Distinguished Name): A unique identifier for an entry. For example, cn=jdoe,dc=example,dc=com.
• Attributes: Properties of entries, such as sAMAccountName or memberOf.

Writing an LDAP Query to Check User Group Membership

Single-Level Group Membership

To check if a user is a member of a specific group, you can craft an LDAP query that combines the user’s sAMAccountName with the target group’s distinguished name. Here’s how:

(&(objectClass=user)(sAMAccountName=yourUserName)(memberOf=CN=YourGroup,OU=Users,DC=YourDomain,DC=com))

This query checks for a user entry that is of objectClass=user, has an sAMAccountName matching "yourUserName", and belongs to the specified group.

Implementing with C# System.DirectoryServices

Below is a practical example using C#:

using System;
using System.DirectoryServices;

class Program
{
    static void Main()
    {
        DirectoryEntry rootEntry = new DirectoryEntry("LDAP://dc=yourcompany,dc=com");
        DirectorySearcher srch = new DirectorySearcher(rootEntry)
        {
            SearchScope = SearchScope.Subtree,
            Filter = "(&(objectClass=user)(sAMAccountName=yourusername)(memberOf=CN=yourgroup,OU=yourOU,DC=yourcompany,DC=com))"
        };

        SearchResultCollection res = srch.FindAll();

        if (res == null || res.Count <= 0)
        {
            Console.WriteLine("This user is *NOT* a member of that group");
        }
        else
        {
            Console.WriteLine("This user is INDEED a member of that group");
        }
    }
}

Considerations

• Immediate Group Memberships: This method checks direct memberships. It won’t account for nested group memberships unless the memberOf attribute includes all levels (typically managed by LDAP extensions like OpenLDAP’s memberof overlay).
• Primary Group Membership: Direct membership in a user’s primary group may not be captured.

Handling Nested Group Membership with LDAP Extensions

In environments like OpenLDAP, you can leverage overlays such as memberof to manage nested memberships. However:

1. Enable the memberOf overlay:
   • This allows using (memberOf=...) filters directly.
2. Apply changes to groups after enabling the overlay:
   • Existing entries might need re-entry for the overlay to process them.

Querying All Groups a User is Part Of

To list all groups a user belongs to, set your search filter and base DN as follows:

ldapsearch -x -D "your_ldap_user" -w "your_password" -b "cn=jdoe,dc=example,dc=local" -h ldap_host "(memberOf=*)" memberof

This command lists all groups the user is a direct or indirect member of by requesting only the memberof attribute.

Conclusion

LDAP queries are powerful tools for managing and verifying group memberships in directory services. Whether you’re checking single-level memberships or handling complex nested structures, understanding how to formulate these queries correctly ensures effective directory management. Remember that extending capabilities with overlays can further enhance your LDAP server’s functionality, especially when dealing with multi-tiered organizational units.