Hot answers tagged ldapsearch
4
You can do most of this with powershell and LDIF - the snippet below for example will produce a file called ad.txt that has a list of user objects changed or added in the last ten minutes
$DateString = (Get-Date).AddMinutes(-10).ToString("u") -Replace "-|:|\s"
$DateString = $DateString -Replace "Z", ".0Z"
$LdapFilter = """" + "(&(|(whenChanged>=" + ...
4
There is no magic here - you can store hashed data in any text field, you just need to hash the data before it goes to the server (most LDAP servers will helpfully hash passwords for you if they appear to be plaintext - that's not done for you with other text field types).
Similarly you can store encrypted data in any text field (provided it can be ...
3
A name server will not, by design, let you search a zone or query what zones it is authoritative for. Beyond the obvious reason of reducing attack vectors (you can't make a HTTP/1.1 request to a host if you don't know its name), there is a very good reason for this: a zone can contain wildcards itself, so asking for every host in such a zone is like dividing ...
2
Your problem may be the lack of the "olcTLSCACertificateFile" directive together with olcTLSCertificateFile and olcTLSCertificateKeyFile. Point it at the same olcTLSCertificateFile, because for what I see in that doc, you are using a self signed certificate.
olcTLSCACertificateFile: /etc/pki/tls/certs/slapdcert.pem
You can also use the debug option in ...
2
Okay, I found this on TechNet:
Monitor Groups in an OU in AD for changes on Group Membership
This script runs on a scheduled task to monitor and alert for changes in Active Directory.
Any changes to group membership will cause an alert email to be created with the changes included.
The script saves the current members of the Groups in an XML ...
2
What application are you trying to configure.
There large majority of application that have some level of LDAP support as an LDAP client, simply have no support for nested groups.
Short of modifying the software, you may be out of luck.
If your LDAP server happens to be Microsoft Active Directory, then there is a non-standard search filter, that may help ...
2
This script worked for me; I'm posting it here in case it might help someone else
#!/bin/bash
# specify as first parameter the object ID as received by an LDAP query; it's base-64 encoded.
OBJECT_ID="${1}"
# we decode it, we hex-dump it and store it in an array to
# re-order it in the format expected by LDAP
BASE64_DECODED=$(echo $OBJECT_ID | base64 -d ...
2
The AD is distributed and multimaster database, in general terms you can query any of the Domain Controllers about a user and get the same answer in any of the DC (nodes).
In AD you can configure the replication of data changes between servers, so if a user change some attribute in Australia, and you query for some data against the server in NY maybe you ...
2
From what I understood, you are not able to get all entries. Looks like your are hitting admin limit exceeded.
If you want to search from a non-cn=Directory manager user. you need to add some attributes to user like below.
/usr/lib64/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com
dn: ...
2
Your terminology WRT Active Directory is not precise. There are two concerns that I can see for you:
Querying the closest replica of the AD
Understanding the behaviour of queries in a multi-domain environment
The Global Catalog maintains a subset of the contents of all domains in the forest. If your use of the term "node" refers to disperate domains, ...
1
I'm not sure what to say, mostly because its hard to see exactly what you're asking.
If your organisation creates 'duplicate' user names in different contexts/OUs, which is certainly allowable in AD, then any code you write will have to support working with usernames under different contexts.
Whether or not that's a good idea or "correct" is a question ...
1
The sAMAccountName of a user should be unique within a given domain, so you should be able to get the client to query AD based on the sAMAccountName and then use the full X.400 name you get back for authentication.
If you have more than one domain, then you need domain + userID (sAMAccountName) to authenticate anyway.
1
You're trying to use the relative distinguished name (RDN), not the CN. The relative distinguished name is unique within the OU (it's relative path) but may not be unique within the domain. You should be using the distinguished name (DN), which is unambiguous and unique within the domain.
http://technet.microsoft.com/en-us/library/cc977992.aspx
1
I found the attribute I was looking for --> userPrincipalName (UPN) . This has a unique value in Active Directory and can be supplied as the user name while attempting to authenticate. So now I need a list of UPNs and the corresponding passwords for login.
http://technet.microsoft.com/en-us/library/cc739093%28WS.10%29.aspx
1
In user Object of Active Directory, the samaccountname(logon name) and UPN (User Principal name) for logon into Active Directory domain.
And This Properties of user object must be unique in Active Directory
as your question...
CN=jack,CN=Users,DC=xyz,DC=com
CN=jack,OU=abc,DC=xyz,DC=com
you create two user object as above.
the above syntax is DN's.
...
1
If your self-signed certificate is signed by your owned authority, you can check if the certificate provided is correct by check the server cert. To do this, add in your ldap.conf the line 'TLS_CACERT /etc/ssl/certs/ca.pem' with ca.pem is the file with public key of your authority. With 'TLS_REQCERT hard', it will check your connection, and refuse to speak ...
1
PHP code should not have called ldapsearch.
instead: http://php.net/manual/en/book.ldap.php
.net code should not call dsquery.
instead: use native tools (not as easy to find online docs)
useful(?): http://www.youcanlearnseries.com/Programming%20Tips/CSharp/LDAPReader.aspx
1
The directory server administrator is free to impose a limit on the number of entries that can be returned in the response to a search request. The LDAP client can request a size limit, but this client-requested limit cannot override the server-imposed limit. The paging is working correctly: paging simply sends multiple search responses, each the size ...
1
This sounds like it would be a simple request, but it quickly becomes boiling the ocean.
While there are commercial products that do this (and the reasons will become apparent), basically you need to run your query (all users where date modified is < 10 minutes ago). Unfortunately, this won't tell you what has changed. I don't think it will tell you ...
1
File should look like this:
abc123
lmn456
xyz789
and command like this:
ldapsearch -v -h somehost.com -D "CN=valid_user,DC=valid_everything" -q -b "OU=valid_ou,DC=valid_dc" -s sub -f myqueries.txt "(cn=%s)" -L objectGUID
File given after -f can only holds parameters of query, not the query.
1
Sorry, I can't quite parse what you mean by "...that belong to a specific from a Domino 8 LDAP server...".
But if you search for example for "objectClass=dominoGroup"
ldapsearch -h localhost "objectClass=dominoGroup"
You get a list of all you groups. And if you look at the return values, you will see, that each group has a list of "member" attributes, ...
1
What is not clear here is what you mean with the term "node".
A single Active Directory domain with multiple domain controllers geographically distributed?
A single domain with OUs containing users and computers for each geographical location?
Multiple domains representing various company regional offices?
As long as you're querying domain controllers of ...
1
OpenLDAP have two configuration modes:
add to slapd.conf (static mode):
sizelimit unlimited
add '/path-to/cn=config/olcDatabase={-1}frontend.ldif' (dynamic mode):
olcSizeLimit: unlimited
selective limits can be done by 'limits' option for slapd.conf.
If this not help, you should't tag question with 'openldap'.
1
I usually use Apache Directory Studio to graphically browse to what is needed and then I right click and Copy DN from there. Makes things a ton easier. Not that LDAP formatting is tricky but it has saved me on typos, switching CN for OU, etc.
Give a go with that and see how it works. Plus, it'll let you know if it is a permissions issue you are having.
1
The string sAMAccountName=Administrator,DC=madhurmoss,DC=com isn't a valid X.500 definition. The attribute sAMAccountName is a valid attribute for all Security Principals, but it's not a valid X.500 node type (DC, OU or CN are). I'd be looking at your LDAP bind definition. What LDAP implementation are you using?
1
You have olcDbCacheSize: 200000 (and a 512MB cache) indicating you may have a high number of directory entries.
You have size.unchecked=100000 which places limits on queries for attributes with no
indexes.
There are no olcDbIndex attributes in your config [extract], so there are may be no indexes for searching.
If you have more than 100,000 entries, ...
1
The main problem is that objectGUID is a binary field, and certain ldapsearch builds don't have an ability to directly query that kind of field. As the output of searching for objectGUID shows, it's presuming the data is base64 and that's what you're seeing when searching for objectGUID. The actual data on one object in my tree is 32 bytes long, but linux ...
Only top voted, non community-wiki answers of a minimum length are eligible
