How to create a ad/ldap filter to work in this senario.

Chris Bowen

I am attempting to create an AD/LDAP filter for confluence. We currently have our own AD services, however are about to start to have to use the primary organizations AD and we do not want to pull in all the users, 170k, and want to restrict it to just our staff. we have a group setup  lets say it is as follows:

 

CN=Confluence-Users,OU=Security,OU=Groups,OU=depatment,OU=organization,DC=tech,DC=ad,DC=example,DC=com)

we then have 3 groups assigned to it

DN: CN=fulltime,OU=Managed Groups,OU=organization,DC=tech,DC=ad,DC=example,DC=com

DN: CN=contract,OU=Managed Groups,OU=organization,DC=tech,DC=ad,DC=example,DC=com

DN: CN=parttime,OU=Managed Groups,OU=organization,DC=tech,DC=ad,DC=example,DC=com

One of these groups are assigned to each of our staff memebers.

I have attempted to create the search filter as such:

 

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=Confluence-Users,OU=Security,OU=Groups,OU=depatment,OU=organization,DC=tech,DC=ad,DC=example,DC=com))

 

But it is not finding my users.

Any help on this would be appreciated. 

Edit

Additional information I probably should have included. I have the option to include nested groups checked.

For base DN I have used both OU=Security,OU=Groups,OU=depatment,OU=organization,DC=tech,DC=ad,DC=example,DC=com as well as path to the 170k users.

image2016-3-23 12:24:29.png

Davin Studer

There is an option in the ldap setup for nested groups. It is under Advanced Settings. It does say that performance can be degraded and I did find that with one of our plugins the nested groups was seriously degrading performance. Once we flattened it out again everything went back to normal. The performance degradation didn't come right away. It started off working just dandy and I would love to have left it that way. It was after we had been using the system for a while and got more and more users into it that things started to slow down. So, do some testing and realize that your current testing may not stay that way going forward.

image2015-4-7 8:37:8.png

Also, you should not need the (sAMAccountName=*).

image2015-4-7 8:37:8.png