[Samba] Group members via LDAP

[Rowland Penny]

On 08/02/2023 15:35, Troels Arvin via samba wrote:
> Hello,
> 
> On a network, I'm using Samba as domain controller.
> 
> I've created a group "mygroup" which has three members. Those members 
> have "mygroup" as primary group:
> 
> ===================================================
> # samba-tool group listmembers mygroup
> user1
> user2
> user3
> ===================================================
> 
> 
> However, when I query Samba via LDAP, the group members don't appear:
> ===================================================
> $ ldapsearch samaccountname=mygroup member
> SASL/GSS-SPNEGO authentication started
> SASL username: troels at MYDOM.ORG
> SASL SSF: 256
> SASL data security layer installed.
> # extended LDIF
> #
> # LDAPv3
> # base <dc=MYDOM,dc=ORG> (default) with scope subtree
> # filter: samaccountname=mygroup
> # requesting: member
> #
> 
> # mygroup, Users, mydom.org
> dn: CN=mygroup,CN=Users,DC=mydom,DC=org
> 
> # search reference
> # ...
> ===================================================
> 
> 
> I had expected the result to also have some "member:" lines such as:
> ===================================================
> dn: CN=mygroup,CN=Users,DC=mydom,DC=org
> member: CN=User1 Surname1,CN=users,DC=mydom,DC=org
> member: CN=User2 Surname2,CN=users,DC=mydom,DC=org
> member: CN=User3 Surname3,CN=users,DC=mydom,DC=org
> ===================================================
> 
> How can I run ldapsearch in a way where all members of the group are 
> shown, including users who have the group as the primary group?


I don't use ldapsearch much (I use ldbsearch etc, easier to use with 
kerberos), but don't you have to use a searchbase ?

i.e, -b 'dc=mydom,dc=org'

Rowland