Group Membership

[Spijkmans]

Hi @Yevrag35,
Your repo has been very helpful sofar, there are somethings however which I kinda miss in the API.
First one is 'GroupMembership' of (direct and nested) group-objects and the second is 'MemberOf ' in user-objects.

Do you plan in adding these endpoints?

[Yevrag35]

Glad to hear it's of some use to you!

So for the 2nd one - you can specify the "memberOf" attribute in the URL to retrieve the property back when querying:

/search/user?properties=memberOf

And for the first about group memberships, you're talking about about something like the PowerShell equivalent of "Get-ADGroupMember -Recursive"?

[Spijkmans]

I've tried the 'memberOf' properties in search/user and it does return the property however you can't filter it for a specific user. It returns the property for all user objects...
Or should I use the POST '/search/user' endpoint for this?

Just too explain a bit further: I'd like to get the memberOf for a single user or at least for a filtered set of users.
So for example if I want the check what group membership the user 'John Doe' has you would need to pass the user's name or accountname to the query. (Can I do a '/search/user?properties=memberOf&samaccountname=JDoe' ?)
Or maybe I want the memberOf property of all users where the accountname or display name starts with 'John'.
(Like wise can I do a '/search/user?properties=memberOf&givenname=John*' ?)

Maybe if you can use a LDAP query/filter, that would be nice. LDAP queries/filters are easily testable in the AD mmc.

As for the first question, yes that is what I'm talking about. When using 'search/group?properties=member' you do get the directly assigned objects and having the option to query recusively (the nested group members) would be helpful.

Again like with '/search/user' some way of LDAP filtering for which group (or selected groups) would be very nice.

[Yevrag35]

Yes, technically the POST endpoint would be used for that. But I do agree with you that giving the ability to send your own LDAP filters would be helpful. I could work on incorporating that.

I stopped working on this last year because I never could get Kerberos constrained delegation to work properly - no matter what I tried, but I can work on this.

In the meantime, to get a filtered list of users and their memberOf, you could do:

POST /search/user?properties=memberOf+default

{
  "or": [
    {
      "samAccountName": "JDoe"
    },
    {
      "cn": "John*"
    },
    {
      "displayName": "John*"
    },
    {
      "givenName": "John*"
    }
  ]
}

For the question about the recursive members, I can look into creating a dedicated endpoint for that as well. However, you can achieve that now with 2 separate queries. One to get the DN of the group in question, and then the second to find all recursive members:

POST /search/group

{
  "name": "Some Group"
}

POST /search

{
  "recurse": {
    "memberOf": "CN=Some Group,OU=Security,DC=contoso,DC=com"
  }
}