Question

I use javax.naming.directory.DirContext to create a LDAP request for Active Directory. This request returns groups of which the user with given name is member of.

hSearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
searchCtls.setCountLimit(1);
searchCtls.setReturningAttributes(new String[]{"memberOf"});
String searchFilter = MessageFormat.format("(sAMAccountName={0})", new Object[]{userName});
NamingEnumeration answer = null;
try {
    String hostDC = host.replaceAll("\\.", ",dc=");
    adSearchRequestCr = adSearchRequestCr.replace("DL3", getDomainName(host, 3));
    adSearchRequestCr = adSearchRequestCr.replace("DL2", getDomainName(host, 2));
    adSearchRequestCr = adSearchRequestCr.replace("DL1", getDomainName(host, 1));
    answer = context.search(adSearchRequestCr, searchFilter, searchCtls);
}

This works fine but now I need to change this request. Changed request should return not just group in which the user is, but also parent groups of that group and so on (tree of groups). I read about LDAP_MATCHING_RULE_IN_CHAIN, but I still didn`t manage to use it.

Please help with using LDAP_MATCHING_RULE_IN_CHAIN or smth similar to get new aim of the request.

Answer 1

Finally I created recursive by myself without using LDAP_MATCHING_RULE_IN_CHAIN. Firstly I get groups of which the user is member of. I retrieve this groups with attribute “memberOf” – this attribute contains parent groups. And then I make same operation for parent groups until my search is finished. This works fast.