LDAP how to retrieve user from certain department only?

[yandp]

Hello all, 

i am using LDAP to retrieve user data fronm AD to ServiceNow.

I try to add a filter with the department as below, but after i try execute now button, there is no response, no new data retrieve.

this is my filter condition, is there something wrong?

(&(objectClass=person)(sn=*)(department=MS11)(department=MS21)(department=MS30)(!(objectClass=computer)))

This is original, before adding department it is working good.

(&(objectClass=person)(sn=*)(!(objectClass=computer)))

appreciate your help, pls share with me.

Thank you very much.

[_ChrisHelming · Accepted solution]

Background:  "&" is the "And" operator, "!" is the "Not" operator, "|" is the "Or" operator, and "*" is the wildcard. Conditions can be nested in parentheses. The wildcard cannot be used in DN attributes. Allowed comparison operators are "=", ">=", and "<=" (not  ">" or "<").

Your current query is a bunch of AND conditions, one of which being a not condition:

(&
    (objectClass=person)
    (sn=*)
    (department=MS11)
    (department=MS21)
    (department=MS30)
    (!(objectClass=computer))
)

This requires a person to be in all three departments because they're all AND conditions. What you are most likely trying to achieve is for the three departments to be nested in an OR condition so that any of them will be considered a match.

Try the following:

(&(objectClass=person)(sn=*)(|(department=MS11)(department=MS21)(department=MS30))(!(objectClass=computer)))

[yandp]

@Chris Helming 

Chris, Thank you so much for your explanation.

It really help me lots. 

Regards.