C++ LDAP Checking if a user is a member of a specific group

Question

Been trying this for a while so far with no success, so hoping someone can help out (and that I'm not far off.). I just want to return whether a user is a member of a specific group through LDAP; So far I have the below code;

int authMethod = LDAP_AUTH_SIMPLE;
LDAP* pLdapConnection = NULL;
ULONG version = LDAP_VERSION3;
ULONG getOptSuccess = 0;
ULONG connectSuccess = 0;
INT returnCode = 0;
int retSearch = 0;
LDAPMessage *res;
int num_entries = 0, num_refs = 0;

pLdapConnection = ldap_init((char*)m_Hostname.GetString(), LDAP_PORT);

returnCode = ldap_set_option(pLdapConnection,
    LDAP_OPT_PROTOCOL_VERSION,
    (void*)&version);


// Connect to the server.
connectSuccess = ldap_connect(pLdapConnection, NULL);

// Bind
returnCode = ldap_bind_s(pLdapConnection, (char*)m_Username.GetString(), (char*)m_Password.GetString(), authMethod);

// Attempt to search for user
retSearch = ldap_search_s(pLdapConnection, "dc=as,dc=local", LDAP_SCOPE_SUBTREE, "(&(sAMAccountName = examplename))", NULL, NULL, &res);

All of this works so far, up until the searching part, for example - I want to search for a user "username" in group "Technical". I've tried things like the below;

retSearch = ldap_search_s(pLdapConnection, "dc=as,dc=local", LDAP_SCOPE_SUBTREE, "(&(sAMAccountName=username)(memberof=CN=Technical))",
    nullptr, 0, &pSearchResult);

That does not return anything, so I've tried searching more and the only thing similar I've found is - LDAP Finding Members of a group PHP but it's in PHP and I cannot seem to transfer that over to C++ so far.

Any help in the right direction would be helpful as I cannot work it out. :-)

Answer 1

Your filter should be something like:

(&(objectClass=user)(sAMAccountName=yourUserName)
  (memberOf=CN=YourGroup,OU=Users,DC=YourDomain,DC=com))

To include membership due to group nesting:

(&(objectClass=user)(sAMAccountName=yourUserName)
  (memberOf:1.2.840.113556.1.4.1941:=cn=YourGroup,ou=Users,dc=YourDomain,dc=com))

The numbers 1.2.840.113556.1.4.1941 are an extended match.