Tag Info

Hot answers tagged

8

You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" \ -W -H ldap://ldap.example.com -b "ou=People,dc=example,dc=com" \ -s sub 'uid=test-user' Will find "test-user" by -D - Use bind user ...


7

You can only ask a DNS-Server if it has a specific record. So, no there will be no such tool for DNS. Edit Zonetransfer is of course a possibility if it is available.


5

dsquery user -samid [username] | dsget user -memberof -expand | dsget group -samid Good Luck!


4

You can do most of this with powershell and LDIF - the snippet below for example will produce a file called ad.txt that has a list of user objects changed or added in the last ten minutes $DateString = (Get-Date).AddMinutes(-10).ToString("u") -Replace "-|:|\s" $DateString = $DateString -Replace "Z", ".0Z" $LdapFilter = """" + "(&(|(whenChanged>=" + ...


4

There is no magic here - you can store hashed data in any text field, you just need to hash the data before it goes to the server (most LDAP servers will helpfully hash passwords for you if they appear to be plaintext - that's not done for you with other text field types). Similarly you can store encrypted data in any text field (provided it can be ...


4

You can get a full list of entries in a zone with a zone transfer; you'd need to allow this for authorized systems in your DNS server. Once that's done, you can run the transfer and grep the result: dig axfr localdomain.com | grep -i miller


4

Unfortunately not. The common name of an LDAP object isn't globally unique; it's only unique relative to its parent OU. So, if you could ask if a user was a member of a group, based on a CN of a group, you could potentially get multiple results. It's for this reason that the memberOf attribute of a user object is a list of DNs (distinguished names, or ...


4

This is caused by "Domain Controller Stickiness" and causes the clients to prefer one domain controller over another. You can adjust this by forcing the clients to choose another controller at intervals. The GP setting is under Administrative Templates\System\Net Logon\DC Locator DNS Records\ Entry Name: Force Rediscovery Interval. This setting should ...


3

From what I understood, you are not able to get all entries. Looks like your are hitting admin limit exceeded. If you want to search from a non-cn=Directory manager user. you need to add some attributes to user like below. /usr/lib64/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: ...


3

Okay, I found this on TechNet: Monitor Groups in an OU in AD for changes on Group Membership This script runs on a scheduled task to monitor and alert for changes in Active Directory. Any changes to group membership will cause an alert email to be created with the changes included. The script saves the current members of the Groups in an XML ...


3

A name server will not, by design, let you search a zone or query what zones it is authoritative for. Beyond the obvious reason of reducing attack vectors (you can't make a HTTP/1.1 request to a host if you don't know its name), there is a very good reason for this: a zone can contain wildcards itself, so asking for every host in such a zone is like dividing ...


3

-o ldif-wrap=no will take care of the 80 character wrap limit. Piping your output into sed -r -e 's/^(.*:): (.*)$/echo -n "\1 "; echo \2 | base64 -d/e' will decode all base64 encoded results. If you're holding EFS certificates you'll want to modify it to touch just the attributes you want. Only using sed: sed -e 'N; s/\n //; P; D' | sed -r -e 's/^(.*:): ...


3

On Active Directory domain controllers, LDAPS support is optional, and needs a proper certificate to be enabled; otherwise, only LDAP services are provided. A quick way to check if your server supports LDAPS is to try a connection to its TCP port 636 (or run netstat on the server itself): if it's closed, LDAPS is not enabled and you should either enable it ...


2

This script worked for me; I'm posting it here in case it might help someone else #!/bin/bash # specify as first parameter the object ID as received by an LDAP query; it's base-64 encoded. OBJECT_ID="${1}" # we decode it, we hex-dump it and store it in an array to # re-order it in the format expected by LDAP BASE64_DECODED=$(echo $OBJECT_ID | base64 -d ...


2

The AD is distributed and multimaster database, in general terms you can query any of the Domain Controllers about a user and get the same answer in any of the DC (nodes). In AD you can configure the replication of data changes between servers, so if a user change some attribute in Australia, and you query for some data against the server in NY maybe you ...


2

ldapsearch -LLL -x -h $LDAPHOST -b"dc=whatever" -D${LDAPUSER} -w"${LDAPPASW}" objectclass=* -E pr=2147483647/noprompt The important part is at the end: -E pr=2147483647/noprompt. I implemented this today, so I know it works, at least with Active Directory's LDAP backend. For me, this was able to bypass server limits. From your example, it looks like you ...


2

The directory server administrator is free to impose a limit on the number of entries that can be returned in the response to a search request. The LDAP client can request a size limit, but this client-requested limit cannot override the server-imposed limit. The paging is working correctly: paging simply sends multiple search responses, each the size ...


2

Your terminology WRT Active Directory is not precise. There are two concerns that I can see for you: Querying the closest replica of the AD Understanding the behaviour of queries in a multi-domain environment The Global Catalog maintains a subset of the contents of all domains in the forest. If your use of the term "node" refers to disperate domains, ...


2

What application are you trying to configure. There large majority of application that have some level of LDAP support as an LDAP client, simply have no support for nested groups. Short of modifying the software, you may be out of luck. If your LDAP server happens to be Microsoft Active Directory, then there is a non-standard search filter, that may help ...


2

Either append the ldapentrycount option to the end: ldapsearch -LLL -H ldaps://example.com -b "ou=people,dc=example,dc=com" "sn=Smith" ldapentrycount or parse the numEntries value from the results: ldapsearch -LLL -H ldaps://example.com -b "ou=people,dc=example,dc=com" "sn=Smith" ldapentrycount | awk '/numEntries: / { print $3 }' Is this what you're ...


2

Use CN=Administrator,CN=Users,DC=madhurmoss,DC=com as your binddn string. That should do it.


2

Your problem may be the lack of the "olcTLSCACertificateFile" directive together with olcTLSCertificateFile and olcTLSCertificateKeyFile. Point it at the same olcTLSCertificateFile, because for what I see in that doc, you are using a self signed certificate. olcTLSCACertificateFile: /etc/pki/tls/certs/slapdcert.pem You can also use the debug option in ...


2

This is probably a hidden permissions issue, since AD can stash accounts in odd places, and permissions can be taken away if you're not careful. The first troubleshooting step I'd do is see if there is any correlations in location in the accounts that are getting missed. That may point to a location where the rights are subtly different. If they don't ...


2

S615 is the so called "Soundex" - Value of the name you enter see this link at IBM to learn more about soundex. Normally Soundex is only checked, if no direct match for a name could be found. I did a short research, but could not find a hint about prohibit Soundex- search. Regarding this link it might have something to do with the "Address Lookup" settings ...


2

You're looking for the subschemaSubentry. RFC 2252 Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions 5.1.5. subschemaSubentry The value of this attribute is the name of a subschema entry (or subentry if the server is based on X.500(93)) in which the server makes available attributes specifying the schema. ( ...


1

I usually use Apache Directory Studio to graphically browse to what is needed and then I right click and Copy DN from there. Makes things a ton easier. Not that LDAP formatting is tricky but it has saved me on typos, switching CN for OU, etc. Give a go with that and see how it works. Plus, it'll let you know if it is a permissions issue you are having.


1

Sorry, I can't quite parse what you mean by "...that belong to a specific from a Domino 8 LDAP server...". But if you search for example for "objectClass=dominoGroup" ldapsearch -h localhost "objectClass=dominoGroup" You get a list of all you groups. And if you look at the return values, you will see, that each group has a list of "member" attributes, ...


1

File should look like this: abc123 lmn456 xyz789 and command like this: ldapsearch -v -h somehost.com -D "CN=valid_user,DC=valid_everything" -q -b "OU=valid_ou,DC=valid_dc" -s sub -f myqueries.txt "(cn=%s)" -L objectGUID File given after -f can only holds parameters of query, not the query.


1

OpenLDAP have two configuration modes: add to slapd.conf (static mode): sizelimit unlimited add '/path-to/cn=config/olcDatabase={-1}frontend.ldif' (dynamic mode): olcSizeLimit: unlimited selective limits can be done by 'limits' option for slapd.conf. If this not help, you should't tag question with 'openldap'.


1

This sounds like it would be a simple request, but it quickly becomes boiling the ocean. While there are commercial products that do this (and the reasons will become apparent), basically you need to run your query (all users where date modified is < 10 minutes ago). Unfortunately, this won't tell you what has changed. I don't think it will tell you ...



Only top voted, non community-wiki answers of a minimum length are eligible