Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. For example, while this is obvious

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
AND  
memberOf cn=Dept1,ou=Groups,dc=site,dc=com

I would like the flexibility to do

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com  
AND  
( memberOf cn=Dept1,ou=Groups,dc=site,dc=com
  OR
  memberOf cn=Dept2,ou=Groups,dc=site,dc=com
)

The only mechanism I've found to do this is by creating a new LDAP group that contains all the members of Dep1 and Dep2, however this also means managing additional group memberships and would exist outside of PGP itself. Is this type of functionality even available in Universal? Are there ways to reasonably simulate the behavior internal to the system?

share|improve this question
add comment

1 Answer

Examine the following filter:

(&(member=cn=PGPUsers,ou=Groups,dc=site,dc=com)(|(memberOf cn=Dept1,ou=Groups,dc=site,dc=com)(memberOf cn=Dept2,ou=Groups,dc=site,dc=com))

see also

LDAP: Search filters

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.