Cloudera Docs

Complex matching logic for group queries using LDAPGroupQuery()

You can use LDAP to restrict user access to Data Vizualization resources by using multiple require groups.

To use a complex group query, implement the LDAP authorization requirement group, as we demonstrate in the following code snippet: 

AUTH_LDAP_REQUIRE_GROUP = (
(LDAPGroupQuery("cn=enabled,ou=groups,dc=example,dc=com") |
LDAPGroupQuery("cn=also_enabled,ou=groups,dc=example,dc=com")) &
~LDAPGroupQuery("cn=disabled,ou=groups,dc=example,dc=com")
)

For more information, see the django-auth-ldap reference documentation.