Ldapsearch query

Question

I have around 10 users who have been given access to one specific application which uses AD authentication.

ldapsearch -p xxx -LLL -x -w test -h abc.com -D abc -b dc=abc,dc=com sAMAccountName=xyz | grep displayName

Can sAMAccountName be made to refer to my entire list of users (which is a seperate text file) at once? If not, Can we just put this command into a script and let the user enter their sAMAccountName and check if they exist in AD?

Any thoughts on this...

Answer 1

I might not understand this clearly but if you wanted to put it in a script you could write a bash script like below to prompt for an account name.

#!/bin/bash
echo -n "Please enter username to lookup: "
read USERNAME
DISPLAYNAME=`ldapsearch -p xxx -LLL -x -w test -h abc.com -D abc -b dc=abc,dc=com sAMAccountName=$USERNAME | grep displayName`

if [ -z "$DISPLAYNAME" ]; then
  echo "No entry found for $USERNAME"
else 
  echo "Entry found for $USERNAME"
fi

Answer 2

Your script will have to create a proper LDAP filter with all the usernames:

(|(sAMAccountName=foo)(sAMAccountName=bar)(sAMAccountName=baz))

For example:

filter="(|"
while read -r name; do
    filter+="(sAMAccountName=${name})"
done
filter+=")"

(| ... ) is OR in LDAP. The AND operator is (& ... ).