Re: using groups in filters

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 11:49 AM 10/18/00 +0200, Joeri van Ruth wrote:
>Is it possible to filter on group membership?  For example,
>finding all people in a group whose name contains the string
>"joeri"?

No. This would require a "join" capability which LDAP doesn't
offer.  You have to obtain the list members and test each
member to see if their name contains the string.  In the
general non-recursive group case, this requires 1+N protocol
operations (one search to read the list membership and one
search per member to test the assertion).  However, if you
assume all the users are within the same namingContext, you
can you can do this in 2 protocol operations (one search to
read the list membership and one search to find all entries
matching the assertion).

The LDAP design assumption, of course, is that group members
many not be related in any manner other then by their group
membership.  Each member and the group could be held on a
different server... and the group might contain other groups...
and you might have referential loops, dangling references, and
other cases requiring special attention.

Kurt