Net::LDAP and AD

mce has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Net::LDAP and AD by shmem (Chancellor) on Jun 27, 2006 at 13:32 UTC
Now, we just found a problem that in Windows AD, users are a member of a group, without being an actual member attribute. You mean, the primary group is not visible in an LDAP query via the memberOf attribute of the user record? or is there no DN entry for the corresponding group? Or do the members not show up querying the group? oh, wait... (reading) ... Um, that should be straight forward. Get a list of the users, query their PrimaryGroupID, store that somewhere (in a hash? :-), see what's in memberOf, get the groupIds of the returned groups and determine the users primary group by comparing their PrimaryGroupId with the groupIds found. Windows AD should be querable (? queryable?) through port 3268 (or 3269 with TLS), I found the service behind the standard port 389 at times unreliable. There could be a maxRows limitation of an LDAP query to AD. --shmem _($_=" "x(1<<5)."?\n".q·/)Oo. G°\ / /\_¯/(q / ---------------------------- \__(m.====·.(_("always off the crowd"))."· ");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}	[reply]
Re^2: Net::LDAP and AD by g0n (Priest) on Jun 27, 2006 at 16:41 UTC
Um, that should be straight forward. Get a list of the users, query their PrimaryGroupID, store that somewhere (in a hash? :-), see what's in memberOf, get the groupIds of the returned groups and determine the users primary group by comparing their PrimaryGroupId with the groupIds found. That approach definitely works - I solved the same problem in javascript that way (although I don't have the code anymore). There could be a maxRows limitation of an LDAP query to AD. AD defaults to a page size of 1000 objects. You need to use the Net::LDAP::Control::Paged control to handle anything bigger than that. I have code returning tens of thousands of entries from AD on port 389 without a problem that way. -------------------------------------------------------------- "If there is such a phenomenon as absolute evil, it consists in treating another human being as a thing." John Brunner, "The Shockwave Rider". Can you spare 2 minutes to help with my research? If so, please click here	[reply]
Re: Net::LDAP and AD by marto (Cardinal) on Jun 27, 2006 at 13:42 UTC
Hi mce, "What I want is a routine that can be called to search the AD directory, and return a mapping for all users with their groups (or vise versa)." This is not a Net::LDAP solution, however you may wish to have a look at the source code from the Active Directory Cookbook. If you use it, you could buy a copy and do the author a favor :) Hope this helps. Martin	[reply]
Re: Net::LDAP and AD by strat (Canon) on Jun 28, 2006 at 09:11 UTC
The first time I tried to push data into AD with Net:LDAP I found out that it has a hardlimit of 1000 returned entries and needs paging, e.g. with Net::LDAP::Control::Paged (I also guess that might be your problem) doesn't use utf8 for saving data (or at least the admintools can't work with utf8), and Net::LDAP v3 automatically uses utf8 with gives problems with non-ascii-chars (e.g. german umlauts). I could solve this problem with using Net::LDAP with LDAPv2. I found no way to query the Global Catalog with Net::LDAP (well, I didn't search too hard) So I turned over to ADSI with pure Win32::OLE which is also easier because there exists more documentation with good examples. Disadvantage: it only runs under Win32. Useful links for ADSI: http://rallenhome.com/books/adcookbook/code.html http://www.perl.com/pub/a/2001/12/19/xmlrpc.html http://isg.ee.ethz.ch/tools/realmen/det/adsi.en.html Perlmonks -> ActiveDirectory Perlmonks -> ADSI Best regards, perl -e "s>>F>e=>y)\martinF)stronat)=>print,print v8.8.8.32.11.32"	[reply]


Just another Perl shrine
	PerlMonks