- 9 minutes to read

Group Management with the Nodinite LDAP Web API

Comprehensive group management operations for LDAP directories using the Nodinite LDAP Web API. This page covers all 9 group-specific operations with detailed XML examples.

✅ CRUD Operations: Select, Create, Update, Delete groups
✅ Organization: Rename and Move groups between OUs
✅ Membership Management: Add, Remove, and Select members
✅ Batch Support: Process multiple groups in single operations
✅ Flexible Queries: Use searchFilter for precise group targeting

Understanding Group Operations

Group operations are available in the Operations section of the Group record within the request message. Every operation uses the With record to define search criteria and scope; the LDAP Web API first finds the matching groups, then runs each operation on them.

flowchart LR Client["fa:fa-code Client"] -->|"Execute request (XML or JSON)"| API["fa:fa-cloud LDAP Web API"] API -->|"With: CN, OU, DC, searchScope, searchFilter"| Dir["fa:fa-address-book LDAP directory"] Dir -->|"Matching groups"| API API -->|"Operations on each matched group"| Dir API -->|"SearchResult and OperationResult"| Client

Diagram: the LDAP Web API resolves the With query against the directory, then runs the group operations on every group found and returns both results.

Both XML and JSON formats are supported. See the Request Schema for message structure details.

Operations Summary

Operation Description Multiple Records
Select Retrieve group records from LDAP ✅ Yes
Create Create new group with properties ❌ No
Update Update existing group properties ✅ Yes
Delete Delete group records ✅ Yes
Rename Rename group (CN part) ❌ No
MoveTo Move groups to different OU ✅ Yes
Add Add member(s) to group(s) ✅ Yes
Remove Remove member(s) from group(s) ✅ Yes
SelectMembers Retrieve group membership details ✅ Yes

Select

The Select operation retrieves group objects from the LDAP catalog using the search criteria provided in the With record.

Example: Select All Groups in an OU 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">      
        <Group>
          <With OU="Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description" />
          <Operations>
            <Select/>
          </Operations>
        </Group>
    </Batch>    
  </Batches>
</ns0:LDAP>

Tip

Use additional filters via the searchFilter attribute (see Request Schema) to refine your query.

Create

The Create operation creates a new group within an OU found using the With record search criteria.

Attributes

Attribute Required Description
name ✅ Yes The common name (CN part) of the group to create
allowUpdateIfExists ❌ No Updates the existing group with the properties collection content if the group already exists. When false (default), the operation fails if the group already exists

Properties Element

The name-value pair collection with attributes for the group object to be set by the operation.

Example: Create a New Group with Description 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">      
        <Group>
          <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Base"/>
          <Operations>
            <Create name="LDAP Adapter Users">
              <Properties>
                <Property name="description" value="Mighty People."/>
              </Properties>
            </Create>
          </Operations>
        </Group>
    </Batch>    
  </Batches>
</ns0:LDAP>

The response shows the OU found and the group created within this OU.

Update

The Update operation modifies existing group properties for one or multiple groups returned by the query.

Properties Element

The attributes to be updated are provided in the name-value properties collection.

Example: Update Group Description 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">      
        <Group>
          <With CN="CN=LDAP Adapter Users" OU="OU=Old hackers" DC="DC=ibiz,DC=local" 
searchScope="Base" expectedMatchCount="1"/>
          <Operations>
            <Update>
              <Properties>
                <Property name="description" value="Secret society."/>
              </Properties>
            </Update>
          </Operations>
        </Group>
    </Batch>    
  </Batches>
</ns0:LDAP>

Note

The response shows data before and after the operation.

Delete

The Delete operation removes group(s) returned by the With query part.

Warning

DANGEROUS OPERATION

The Delete operation can permanently remove groups from Active Directory. The LDAP Web API automatically removes child objects (group members) in the correct order.

ALWAYS use expectedMatchCount attribute to specify the exact number of records you intend to delete. This safety check prevents accidental mass deletions. Follow these safety recommendations:

  • Use expectedMatchCount - Set to the exact number of objects you expect (e.g., expectedMatchCount="1")
  • Test with Select first - Run identical With criteria using Select operation to verify what will be deleted
  • Test in non-production - Always test Delete operations in development/test environments first
  • Use specific filters - Combine CN attribute with searchScope="Base" for single group deletions
  • Backup before bulk deletes - Ensure Active Directory backups are current before large deletion operations

See Request Schema - expectedMatchCount for detailed attribute documentation.

Example: Delete a Specific Group 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">    
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <Group>
        <With CN="CN=LDAP Adapter Users" OU="OU=Old hackers" DC="DC=ibiz,DC=local" 
searchScope="Base" expectedMatchCount="1"/>
        <Operations>
          <Delete/>
        </Operations>
      </Group>
    </Batch>
  </Batches>
</ns0:LDAP>

The response SearchResult displays the group found for deletion, and the operation result confirms deletion.

Rename

The Rename operation changes the name (CN part) of a group. This operation requires exactly one group in the search results.

Attributes

Attribute Required Description
name ✅ Yes The new name for the group object

Warning

The operation throws an exception when the search finds more than one group. Limit your search query to exactly 1 group, for example with expectedMatchCount="1".

Example: Rename a Group 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <Group>
        <With CN="CN=LDAP Adapter Users" OU="OU=Old hackers" DC="DC=ibiz,DC=local" 
searchScope="Base" expectedMatchCount="1" returnProperties="name,description,whenChanged"/>
        <Operations>
          <Rename name="Users of the LDAP Adapter"/>
        </Operations>
      </Group>
    </Batch>
  </Batches>
</ns0:LDAP>

MoveTo

The MoveTo operation moves groups found by the With search criteria to the destination OU specified in the operation arguments.

Attributes

Attribute Required Description
DC ✅ Yes Domain Component for the destination
OU ✅ Yes Organizational Unit path for the destination
CN ❌ No Common Name for the destination

Note

Multiple records are supported in a single request.

Example: Move a Group to Another OU 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <Group>
        <With CN="CN=LDAP Adapter Users" OU="OU=Old hackers" DC="DC=ibiz,DC=local" 
searchScope="Subtree"/>
        <Operations>
          <MoveTo OU="OU=3l1t hackers,OU=Old hackers" DC="DC=ibiz,DC=local"/>
        </Operations>
      </Group>
    </Batch>
  </Batches>
</ns0:LDAP>

Add

The Add operation adds member(s) to group(s). If the member already belongs to the group, the operation is skipped.

Member Element

You must specify which member(s) to add using the Member record.

Attribute Required Description
CN ❌ No Common name of the member to add
OU ❌ No OU part of the member to add
DC ✅ Yes Domain component part

Example: Add a User to Groups 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">      
        <Group>
          <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
expectedMatchCount="*" searchFilter="(name=LDAP*)"/>
          <Operations>
            <Add>
              <Member CN="CN=Jane Doe" OU="OU=Old hackers" DC="DC=ibiz,DC=local" />
            </Add>
          </Operations>
        </Group>
    </Batch>    
  </Batches>
</ns0:LDAP>

Remove

The Remove operation removes member(s) from group(s). If the member is not part of the group, the operation is skipped.

Member Element

You must specify which member(s) to remove using the Member record.

Attribute Required Description
CN ❌ No Common name of the member to remove
OU ❌ No OU part of the member to remove
DC ✅ Yes Domain component part

Example: Remove a User from Groups 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <Group>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
expectedMatchCount="*" searchFilter="(name=LDAP*)"/>
        <Operations>
          <Remove>
            <Member CN="CN=Jane Doe10" OU="OU=Old hackers" DC="DC=ibiz,DC=local" />
          </Remove>
        </Operations>
      </Group>
    </Batch>
  </Batches>
</ns0:LDAP>

SelectMembers

The SelectMembers operation retrieves information about members in groups found by the query.

Example: Get Members of Groups 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">      
        <Group>
          <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name, description" />
          <Operations>
            <SelectMembers/>
          </Operations>
        </Group>
    </Batch>    
  </Batches>
</ns0:LDAP>

Tip

Use the searchFilter attribute (see Request Schema) to customize your query.

Note

Members, if any, are listed per group in the SearchResult record. Groups can contain both users and other groups as members.

Next Steps