title: Generalise LDAP query for groups
body: <p>I use the following query to find the groups each user is a member of:</p>
  
  <p><code>(&amp;(objectClass=group)(|(member=cn=UID,OU=ServiceAccounts,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au)(member=cn=UID,OU=BTLY,OU=Sites,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au)))</code></p>
  
  <p>This query works and runs using the following Base DN:</p>
  
  <p><code>OU=MC,DC=ads,DC=myCompany,DC=com,DC=au</code></p>
  
  <p>I have few problems with the query:</p>
  
  <ul>
  <li>I don't like having to use the OR operator to find Service Account users and BTLY users.</li>
  <li>I don't want to hard-code the BTLY site, there are others, too.</li>
  </ul>
  
  <p>Ideally, I'd just like to have the query as:</p>
  
  <p><code>(&amp;(objectClass=group)(|(member=cn=UID,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au))</code></p>
  
  <p>This way, I don't care whether the user account is a service account nor which site the account belongs to. Unfortunately, that query doesn't work.</p>
  
  <p>Can someone please help me generalise the LDAP query? I'm a bit of a newbie, so I'm most likely missing something completely obvious!</p>
  
  <p>Thanks!</p>
  
  <hr>
  
  <p>Thanks for the reply. What you've said makes sense, but it doesn't help me, unfortunately. We're using GlassFish  (a Java app server), and have configured it to point to the local AD server. Normally, a person can tell GlassFish how to retrieve users, eg</p>
  
  <p><code>(&amp;(objectCategory=user)(CN=UID))</code></p>
  
  <p>and GlassFish will pick up all the groups (perhaps by using the <code>memberOf</code> attribute).</p>
  
  <p>This time round we're using a different AD server which hosts a different directory of users. GlassFish isn't able to retrieve the groups by itself. So, there is a field where we can give GlassFish a custom query to find groups. In this field, I've put the query I've posted which works, but is ugly and verbose.</p>
  
  <p>What I'd love to be able to do is:</p>
  
  <p><code>(&amp;(objectClass=group)(member=cn=UID))</code></p>
  
  <p>but this doesn't work.</p>
  
  <p>Is there anyway to do this? </p>
  
  <p>Thanks,
  Muel.</p>