Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After asking this question, I had an LDAP query that looked like this:

(&(cn=*)(networkAddress=*)(objectClass=user))

However, if a user has multiple cn's, they are returned multiple times. Is there a way to stop this happening?

share|improve this question
    
it's quite a hack, but can you use a ! to omit the rows you don't want? –  resonator Jul 22 '09 at 5:54
    
do you mean if an user has cn=joe and cn=joe2 attributes at the same time you receive the same DN two times as the result? –  asdmin Jul 22 '09 at 8:36
    
Yes, sort of. I'm using python so if I have a user with {'cn': ['joe', 'joe2']}, I'll get that user twice. Both results have the full CN list. –  Harley Jul 22 '09 at 21:36
add comment

3 Answers

up vote 2 down vote accepted

Because CN in many schema implementations is multi valued, and not guarenteed to be unqiue the general rule is to use an attribute that is single valued and supposed to be unique, like uid.

In Active Directory, for a single domain you could rely on sAMAccountName, but not if there is more than one domain in the tree/forest. You might be able to rely on userPrincipalName, which is usually structured as sAMAccountName@domain.Name but unlike sAMAccountName, there is no validation that this is actually a unique value.

Experimentally I have noticed (ok, I made some typos) that UPN can be just about any value and there is no enforcement.

share|improve this answer
add comment

That sounds like the correct result to me...

What happens if you use a tool like ldapsearch?

share|improve this answer
add comment

I don't know anything about python data types, but couldn't you just catch the output in object and then check whether it is an array or just string. if its array just take first record if its a string take it directly.

I mean that's how I handle group membership related queries for users in vbscript.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.