Is it possible, using LDAP filter syntax, to retrieve all users a user is subordinate to, based on the 'manager' attribute? For example,
- Bob is John's manager
- Alice is Bob's manager
- Dave is Alice's manager
- Mary is Dave's manager
When I give John's user account, I get Bob, Alice, Dave and Mary.
I know this can be done the other way around using LDAP_MATCHING_RULE_IN_CHAIN, e.g.
(manager:1.2.840.113556.1.4.1941:=cn=mary,ou=bosses,dc=domain,dc=local)
...would return Dave, Alice, Bob and John's user accounts (per this article):
My question is - in the absence of a corresponding linked attribute (such as in the case of member and memberof), can this be achieved using filter syntax? I know this can be achieved programmatically but I'm trying to avoid that if possible.
The opposite of the manager attribute is directReports.
So you can use the chain rule to match this to get all managers above:
(directreports:1.2.840.113556.1.4.1941:=JOHNS-DN-HERE)