Directory Searcher Filter is returning no results-CodePudding

Definitely not experienced enough to know why this is returning no results. I cannot use the PricipalContext library and must use the Directory Searcher option in place. Groups exist like this "MB-X-Approvers", "MB-Y-Approvers", "MB-Z-Approvers", etc.

        public IEnumerable<Mailbox> GetAprMailboxes()
        {
            IEnumerable<Mailbox> mailBoxes = new List<Mailbox>();
            try
            {
                DirectorySearcher directorySearch = GetDirectorySearcher();
                
                var who = @"CN=lastName\, Firstname,OU=USERS,OU=HOUSTON,DC=mydomain,DC=net"


                var strFilter = "(&(objectCategory=group)(member="   who   ")(cn=MB-*-Approvers))";

                directorySearch.Filter = strFilter;

                var searchResults = directorySearch.FindAll();

        //Do stuff with results and add to mailbox list

            return mailBoxes;

            }
            catch (Exception ex)
            {
                LogHelper.LogException(ex);
            }
        }
        
        public DirectorySearcher GetDirectorySearcher()
        {
            DirectorySearcher directorySearch = null;
            try
            {
                var baseEntry = new DirectoryEntry
                {
                    Path = "LDAP://ldapquery.mydomain.net/DC=mydomain,DC=net",
                    Username = "ADUserName",
                    Password = "ADPassword",
                    AuthenticationType = AuthenticationTypes.Secure
                };
                
                directorySearch = new DirectorySearcher(baseEntry);
                directorySearch.SearchScope = SearchScope.Subtree;
                directorySearch.SizeLimit = 5000;
                directorySearch.PageSize = 1000;
            }
            catch (Exception ex)
            {
                
            }

            return directorySearch;
        }

CodePudding user response：

Generally, DNs like "cn=MB-*-Approvers" will not work for substring searches.

When using the DN syntax, therefore, the client must use the fully Qualified DN

Might want to try something like:

(&
    (member=*)
    (|(MB-X-Approvers,cn=groups,DC=mydomain,DC=net, ,cn=groups,DC=mydomain,DC=net, ,cn=groups,DC=mydomain,DC=net))
)

-jim