Complex Consumer Matching Queries with PGP Universal

Question

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. For example, while this is obvious

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
AND  
memberOf cn=Dept1,ou=Groups,dc=site,dc=com

I would like the flexibility to do

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
AND  
( memberOf cn=Dept1,ou=Groups,dc=site,dc=com
  OR
  memberOf cn=Dept2,ou=Groups,dc=site,dc=com
)

The only mechanism I've found to do this is by creating a new LDAP group that contains all the members of Dep1 and Dep2, however this also means managing additional group memberships and would exist outside of PGP itself. Is this type of functionality even available in Universal? Are there ways to reasonably simulate the behavior internal to the system?

Answer 1

Examine the following filter:

(&(member=cn=PGPUsers,ou=Groups,dc=site,dc=com)(|(memberOf cn=Dept1,ou=Groups,dc=site,dc=com)(memberOf cn=Dept2,ou=Groups,dc=site,dc=com))

see also

LDAP: Search filters