groupsof

#!/bin/bash

#####################################################################################
#
# The MIT License (MIT)
#
# Copyright (c) 2015-2017 Jules Kerssemakers / Deutsches Krebsforschungszentrum Heidelberg (DKFZ)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
# of the Software, and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
# OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
#####################################################################################


# This scripts checks AD/LDAP for ALL groups a given username is part of,
# INCLUDING groups of which they are only an indirect member.
# It does this by querying the AD-server using the special LDAP_MATCHING_RULE_IN_CHAIN
# filter criterion, which instructs it to resolve groups recursively
# (groups themselves can be a member of other groups, meaning their members are
#  indirect members of the supergroup)


# Username in which we are interested
USER="$1"

# Load the secrets such as password and hostname from somewhere not-in-git
source "${XDG_CONFIG_HOME:-"$HOME"/.config}/ldap-summary.conf"

# The recursive group search only works with a full DN, acquire full DN of this user
USER_DN=$(
  ldapsearch -u -LLL \
    -h "$JK_LDAPHOST" -w "$JK_LDAPPASSWORD" \
    -D "$JK_BINDDN" -b "$JK_SEARCHBASE" \
    -x \
    cn="$USER" \
    dn \
  | sed -zr -e "s/\r?\n //g"  -e "s/\r?\n# refldap:.+\r?\n//g" \
  | awk --posix '/^dn:/ {print $2}')

# The magic ldap-filter: _recursively_ finds all groups that have our DN as a 'member'
# The magic number is the OID of microsoft-AD specific extension LDAP_MATCHING_RULE_IN_CHAIN
# https://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx
# https://ldapwiki.com/wiki/1.2.840.113556.1.4.1941
FILTER="member:1.2.840.113556.1.4.1941:=$USER_DN";

# query with our filter,
# remove spurious 80column linebreaks with sed and
# pretty-print with AWK
  ldapsearch -u -LLL \
    -h "$JK_LDAPHOST" -w "$JK_LDAPPASSWORD" \
    -D "$JK_BINDDN" -b "$JK_SEARCHBASE" \
    -x \
    "$FILTER" \
    dn \
  | sed -zr -e "s/\r?\n //g"  -e "s/\r?\n# refldap:.+\r?\n//g" \
  | awk --posix -F'( {2,}|,|:)' '/^dn:/ { printf("%-28s %-18s %s\n", $2, $3, $0); next };'