Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. For example, while this is obvious

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
memberOf cn=Dept1,ou=Groups,dc=site,dc=com

I would like the flexibility to do

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
( memberOf cn=Dept1,ou=Groups,dc=site,dc=com
  memberOf cn=Dept2,ou=Groups,dc=site,dc=com

The only mechanism I've found to do this is by creating a new LDAP group that contains all the members of Dep1 and Dep2, however this also means managing additional group memberships and would exist outside of PGP itself. Is this type of functionality even available in Universal? Are there ways to reasonably simulate the behavior internal to the system?

share|improve this question

Examine the following filter:

(&(member=cn=PGPUsers,ou=Groups,dc=site,dc=com)(|(memberOf cn=Dept1,ou=Groups,dc=site,dc=com)(memberOf cn=Dept2,ou=Groups,dc=site,dc=com))

see also

LDAP: Search filters

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.