How to add a ldap group-filter for more than one OU?

Andre Lehmann

Hi there,

in our ActiveDirectory we have many many OUs with groups we need four our Confluence.

So we have to search the whole Base-DN and have to create a group-search-filter...

I have tried many querys but I didn't get any result :-(

I found: https://confluence.atlassian.com/x/1YUCand tried

(&(objectClass=group)(|(ou:dn:=Chicago)(ou:dn:=Miami)))

but it didn't work.

I tried

(&(objectCategory=Group)(|(distinguishedName=OU=myorgunit1,OU=suborgunit,DC=mydc,DC=de)(distinguishedName=OU=myorgunit2,DC=mydc,DC=de)))

but it didn't work either.

Any idea what is missing?

Kind regards

André

Tiago Comasseto

Hi André,

As for your question about limiting the group search by DN, it would be possible in most LDAP distributions (see Matching Components of Distinguished Names in this documentation). This filter is supported as LDAP-compliant servers support an extensible-match filter which provides the necessary filtering capability to this search (see RFC4511).

However, on Microsoft Active Directory is impossible to do this, it's because AD is not fully LDAP compatible and does not support the extensible-match (see this documentation).

Another option can be use Nested Groups in your LDAP and set a filter in Group Object Filter field as this example:

(&(objectClass=group)(memberOf=CN=Group_A,OU=Groups,DC=Examples,DC=com))

In this example Group_A is the parent group and it wouldn't be pulled to JIRA, this filter would only return its child groups.

I hope it helps.

Cheers