diff --git a/analyzers/LdapQuery/LdapQuery.json b/analyzers/LdapQuery/LdapQuery.json index e2d2f911a..455f03676 100644 --- a/analyzers/LdapQuery/LdapQuery.json +++ b/analyzers/LdapQuery/LdapQuery.json @@ -48,7 +48,7 @@ "name": "uid_search_field", "description": "Specify here the field to use when searching by username. Eg: uid or sAMAccountName", "type": "string", - "multi": false, + "multi": true, "required": true }, { diff --git a/analyzers/LdapQuery/ldapQuery.py b/analyzers/LdapQuery/ldapQuery.py index dc5d217c5..cdedbcfa8 100755 --- a/analyzers/LdapQuery/ldapQuery.py +++ b/analyzers/LdapQuery/ldapQuery.py @@ -18,14 +18,9 @@ def __init__(self): username = self.get_param("config.LDAP_username", None, "username is missing") password = self.get_param("config.LDAP_password", None, "password is missing") self.base_dn = self.get_param("config.base_DN", None, "base_dn is missing") - uid_search_field = self.get_param( + self.search_field = self.get_param( "config.uid_search_field", None, "uid_search_field is missing" ) - if self.data_type == "mail": - self.search_field = "mail" - else: - self.search_field = uid_search_field - self.attributes = self.get_param( "config.attributes", None, "Missing attributes list to report" ) @@ -74,7 +69,12 @@ def run(self): try: data = self.get_param("data", None, "Data is missing") - q = "({}={})".format(self.search_field, data) + + if len(self.search_field) == 1: + q = "({}={})".format(self.search_field, data) + else: + search_fields = [f"({field}={data})" for field in self.search_field] + q = f"(|{search_fields.join('')})" self.connection.search(self.base_dn, q, SUBTREE, attributes=self.attributes) responses = self.connection.response