Querying AD Group Membership Status With ldapsearch

Here’s a way to query Active Directory for group membership status with the ldapsearch utility. In my case, this was used to check if a user is authorized before attempting to mount an SMB share at login on OS X clients. The -Q option causes ldapsearch to use SASL quiet mode and not prompt for a password, which works if a Kerberos ticket is present.


console_user="$(/usr/bin/stat -f%Su /dev/console)"
group="Some Group"
is_member_of_group=`/usr/bin/ldapsearch -LLL -Q -H "$ldap_uri" -b "$search_base" "sAMAccountName=$console_user" sAMAccountName | $grep "OU=$group"` # -Q prevents the authentication prompt, works if kerberos ticket exists

if [[ "${#is_member_of_group}" -ne "0" ]]; then
    echo "$console_user is a member of $group."
    # Do something about it
    echo "$console_user is NOT a member of $group."
    # Do something else

exit $?
comments powered by Disqus