Is it possible to find all users in groups in an OU in LDAP?

Question

I have to get all users (not USER objects, but users added to groups) inside the groups of a determined OU.

Is it possible or should I first look for groups then loop them and find its users?

Answer 1

AFAIK in ActiveDirectory group membership is stored inside the user-node. Therefore it should be possible to select all users that have a group-attribute set and that are below the given OU.

In ldapsearch that should look something like this:

ldapsearch -h ldap -b "ou=known,..." (memberof=*) cn``` 

where memberof=* is the filter to ´query for all entries that have a "memberof"-attribute set. You can extend that filter to query also for a certain objecttype to only get user-nodes if that is a problem in this setup.

Sorry, I can't test it currently as I don't have an ActiveDirectory at hand.