Removing a member from an AD group using net-ldap

active-directory, ldap, ruby, ruby-on-rails, ruby-on-rails-3

Solution

I know this is over a year old, but I am posting for posterity's sake since this shows up when searching for removing users from a group in Active Directory using Ruby net-ldap.

@ldap.open do |ldap|
  ldap.modify :dn => "CN=your group,OU=something,DC=domain,DC=org", :operations => [[:delete, :member, "CN=Johnny Doe,OU=something,DC=domain,DC=org"]]
end

There are two "gotchas". First with Active Directory you cannot manage a user's groups, you can only manage a group's membership. Second, the ":operations" must be an array of operation tuples.

Problem

What is the proper methodology (the steps) to remove an user from an AD group? In this context, I'm doing it from within a Rails project, using net-ldap gem. Originally, I was going to modify the "memberof" value for the user (remove that particular group from the array of grouop DN's in the "memberof" field), but I learned that "memberof" is read-only. I'm kind of new to the concept of LDAP, so I'm not sure what the standard practices are. Thanks in advance!

Original source