Linux – ldapsearch – Get all members of a CN (nisNetgroupTriple)

ldaplinuxredhat

I'm a bit new to using LDAP, especially non AD LDAP. We use RedHat Directory Server and was trying to do an LDAP query (filter specifically) that would retrieve all the users (and their attributes) from a cn that uses an nisNetgroupTriple attribute with specific user names in it. This is how we manage the "superusers" and then everyone else gets dropped into a specific cn based on their needs. So, my question is, how do you search and filter using ldapsearch to retrieve the users AND attributes (uid, sn, givenName, mail) from a cn. Here's some sample output from an ldapsearch I did as a test:

# ldapsearch -xLLL -h server-p 389 -D "cn=Directory Manager" -b "cn=linux,dc=example,dc=org" \* + -W
Enter LDAP Password:
dn: cn=linux,dc=example,dc=org
nisNetgroupTriple: (,user1,)
nisNetgroupTriple: (,user2,)
nisNetgroupTriple: (,user3,)
cn: linux
objectClass: top
objectClass: nisNetgroup
memberNisNetgroup: linux
description: Linux

What I need to do is get the attributes for each user: user1, user2, user3, such as:

# ldapsearch -xLLL -h server -p 389 -D "cn=Directory Manager" -b "dc=example,dc=org" -x '(&(objectClass=posixAccount)(uid=user1))' -W
Enter LDAP Password:
dn: uid=user1,ou=People,dc=example,dc=org
userPassword:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
givenName: User
sn: One
loginShell: /bin/false
gidNumber: 1000
uidNumber: 10054
mail: user1@localhost
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: user1
cn: User One
homeDirectory: /home/user1

Can't seem to find anything that makes sense on the internet as to how to do this (if it can be done). Additionally, I might not have a full understanding of this portion of LDAP, which could be why 1) I can't find anything and 2) I don't know how to figure it out myself.

Any help is appreciated.

Best Answer

The following command will help in searching the Username depending on the configuration.

ldapsearch -h localhost -D "cn=Directory Manager" -b "dc=example,dc=org" -W -x "(&(objectClass=nisnetgroup)(nisNetgroupTriple=\(,user1,\)))" cn | grep dn

It will display the only cn. You can do a quick grep and the output will be short and accurate. It would be more helpful to add/modify to that group.

Please try this LDAP query and let me know if you have any issues.