LDAP Filters

[jvirot]

Hello,
I would like to make a filter on my ldap discovery... it's OK for cn=my-server.
but i would like to filter on distinguishedname but i have an error with this.

what is the correct syntax for distinguishedname ?

i try this :
` discovery:
base_dn: "*"
filters:

• '(|(dn=OU=Servers,OU=Harden_T0,DC=stella,DC=group))'
  `

[zmb3]

If you only want to search in a single DN then you don't even need an LDAP filter - you should just change the base DN.

discovery:
  base_dn: OU=servers,OU=Harden_T0,DC=stella,DC=group

[jvirot]

Yes Indeed.
But it's because i need to search in two différents ou

[jvirot]

I think the problem is not really what i try as filter but the field "filters" himself.
Because when i put the same code like the Docs teleport won't start with errors :

line 94: field filters not found in type config.WindowsDesktopService line 99: field label_attributes not found in type config.WindowsDesktopService

        AXpSZ0JPwyDmn0S7XV9C
        -----END CERTIFICATE-----

  discovery:
    base_dn: "*"
  filters:
  - '(location=Oakland)'
  - '(!(primaryGroupID=516))' # exclude domain controllers
    # (optional) LDAP attributes to convert into Teleport labels.
    # The key of the label will be "ldap/" + the value of the attribute.
  label_attributes:
  - location

[jvirot]

Ok finaly i find the solution.
The problem was identation of filters and label atrributes.
we must ident those fields like base_dn and not like discovery
like this:

        -----END CERTIFICATE-----

  discovery:
    base_dn: "*"
    filters:
      ##- '(!(primaryGroupID=516))' # exclude domain controllers
    # (optional) LDAP attributes to convert into Teleport labels.
    # The key of the label will be "ldap/" + the value of the attribute.
    - '(&(objectClass=organizationalUnit)(|(ou:dn:=Harden_T0)(ou:dn:=Domain Controllers)))'
    label_attributes:
    - location
    - operatingSystem

on the docs online is

windows_desktop_service:
  enabled: yes
  discovery:
    base_dn: '*'
  filters:
  - '(location=Oakland)'
  - '(!(primaryGroupID=516))'

[webvictim]

Thanks for the report. I filed a PR to fix the docs: #52181

[jvirot]

Ok.
Because on docs the label_attributes have thé correct indentation but not filtres.