def groups(username, **kwargs):
 group_list = []
 bind = _bind(username, kwargs['password'], anonymous=_config('anonymous', mandatory=False))
 if bind:
  log.debug('ldap bind to determine group membership succeeded!')
  if _config('activedirectory'):
   try:
    get_user_dn_search = '(&({0}={1})(objectClass={2}))'.format(_config('accountattributename'), username, _config('persontype'))
    user_dn_results = bind.search_s(_config('basedn'), ldap.SCOPE_SUBTREE, get_user_dn_search, ['distinguishedName'])
   except Exception as e:
    log.error('Exception thrown while looking up user DN in AD: {0}'.format(e))
    return group_list
   if (not user_dn_results):
    log.error('Could not get distinguished name for user {0}'.format(username))
    return group_list
   dn = ldap.filter.escape_filter_chars(user_dn_results[0][0])
   ldap_search_string = '(&(member={0})(objectClass={1}))'.format(dn, _config('groupclass'))
   log.debug('Running LDAP group membership search: {0}'.format(ldap_search_string))
   try:
    search_results = bind.search_s(_config('basedn'), ldap.SCOPE_SUBTREE, ldap_search_string, [_config('accountattributename'), 'cn'])
   except Exception as e:
    log.error('Exception thrown while retrieving group membership in AD: {0}'.format(e))
    return group_list
   for (_, entry) in search_results:
    if ('cn' in entry):
     group_list.append(entry['cn'][0])
   log.debug('User {0} is a member of groups: {1}'.format(username, group_list))
  elif _config('freeipa'):
   escaped_username = ldap.filter.escape_filter_chars(username)
   search_base = _config('group_basedn')
   search_string = _render_template(_config('group_filter'), escaped_username)
   search_results = bind.search_s(search_base, ldap.SCOPE_SUBTREE, search_string, [_config('accountattributename'), 'cn'])
   for (entry, result) in search_results:
    for user in result[_config('accountattributename')]:
     if (username == user.split(',')[0].split('=')[(-1)]):
      group_list.append(entry.split(',')[0].split('=')[(-1)])
   log.debug('User {0} is a member of groups: {1}'.format(username, group_list))
   if (not auth(username, kwargs['password'])):
    log.error('LDAP username and password do not match')
    return []
  else:
   if _config('groupou'):
    search_base = 'ou={0},{1}'.format(_config('groupou'), _config('basedn'))
   else:
    search_base = '{0}'.format(_config('basedn'))
   search_string = '(&({0}={1})(objectClass={2}))'.format(_config('accountattributename'), username, _config('groupclass'))
   search_results = bind.search_s(search_base, ldap.SCOPE_SUBTREE, search_string, [_config('accountattributename'), 'cn'])
   for (_, entry) in search_results:
    if (username in entry[_config('accountattributename')]):
     group_list.append(entry['cn'][0])
   for (user, entry) in search_results:
    if (username == user.split(',')[0].split('=')[(-1)]):
     for group in entry[_config('groupattribute')]:
      group_list.append(group.split(',')[0].split('=')[(-1)])
   log.debug('User {0} is a member of groups: {1}'.format(username, group_list))
   if (not auth(username, kwargs['password'])):
    log.error('LDAP username and password do not match')
    return []
 else:
  log.error('ldap bind to determine group membership FAILED!')
 return group_list

def groups ( username , ** kwargs ) : group_list = [ ] bind = _bind ( username , kwargs [ 'password' ] , anonymous = _config ( 'anonymous' , mandatory = False ) ) if bind : log . debug ( 'ldap bind to determine group membership succeeded!' ) if _config ( 'activedirectory' ) : try : get_user_dn_search = '(&({0}={1})(objectClass={2}))' . format ( _config ( 'accountattributename' ) , username , _config ( 'persontype' ) ) user_dn_results = bind . search_s ( _config ( 'basedn' ) , ldap . SCOPE_SUBTREE , get_user_dn_search , [ 'distinguishedName' ] ) except Exception as e : log . error ( 'Exception thrown while looking up user DN in AD: {0}' . format ( e ) ) return group_list if ( not user_dn_results ) : log . error ( 'Could not get distinguished name for user {0}' . format ( username ) ) return group_list dn = ldap . filter . escape_filter_chars ( user_dn_results [ 0 ] [ 0 ] ) ldap_search_string = '(&(member={0})(objectClass={1}))' . format ( dn , _config ( 'groupclass' ) ) log . debug ( 'Running LDAP group membership search: {0}' . format ( ldap_search_string ) ) try : search_results = bind . search_s ( _config ( 'basedn' ) , ldap . SCOPE_SUBTREE , ldap_search_string , [ _config ( 'accountattributename' ) , 'cn' ] ) except Exception as e : log . error ( 'Exception thrown while retrieving group membership in AD: {0}' . format ( e ) ) return group_list for ( _ , entry ) in search_results : if ( 'cn' in entry ) : group_list . append ( entry [ 'cn' ] [ 0 ] ) log . debug ( 'User {0} is a member of groups: {1}' . format ( username , group_list ) ) elif _config ( 'freeipa' ) : escaped_username = ldap . filter . escape_filter_chars ( username ) search_base = _config ( 'group_basedn' ) search_string = _render_template ( _config ( 'group_filter' ) , escaped_username ) search_results = bind . search_s ( search_base , ldap . SCOPE_SUBTREE , search_string , [ _config ( 'accountattributename' ) , 'cn' ] ) for ( entry , result ) in search_results : for user in result [ _config ( 'accountattributename' ) ] : if ( username == user . split ( ',' ) [ 0 ] . split ( '=' ) [ ( - 1 ) ] ) : group_list . append ( entry . split ( ',' ) [ 0 ] . split ( '=' ) [ ( - 1 ) ] ) log . debug ( 'User {0} is a member of groups: {1}' . format ( username , group_list ) ) if ( not auth ( username , kwargs [ 'password' ] ) ) : log . error ( 'LDAP username and password do not match' ) return [ ] else : if _config ( 'groupou' ) : search_base = 'ou={0},{1}' . format ( _config ( 'groupou' ) , _config ( 'basedn' ) ) else : search_base = '{0}' . format ( _config ( 'basedn' ) ) search_string = '(&({0}={1})(objectClass={2}))' . format ( _config ( 'accountattributename' ) , username , _config ( 'groupclass' ) ) search_results = bind . search_s ( search_base , ldap . SCOPE_SUBTREE , search_string , [ _config ( 'accountattributename' ) , 'cn' ] ) for ( _ , entry ) in search_results : if ( username in entry [ _config ( 'accountattributename' ) ] ) : group_list . append ( entry [ 'cn' ] [ 0 ] ) for ( user , entry ) in search_results : if ( username == user . split ( ',' ) [ 0 ] . split ( '=' ) [ ( - 1 ) ] ) : for group in entry [ _config ( 'groupattribute' ) ] : group_list . append ( group . split ( ',' ) [ 0 ] . split ( '=' ) [ ( - 1 ) ] ) log . debug ( 'User {0} is a member of groups: {1}' . format ( username , group_list ) ) if ( not auth ( username , kwargs [ 'password' ] ) ) : log . error ( 'LDAP username and password do not match' ) return [ ] else : log . error ( 'ldap bind to determine group membership FAILED!' ) return group_list
return groups information from osquery cli example: .