Tag Info

Hot answers tagged

7

You can only ask a DNS-Server if it has a specific record. So, no there will be no such tool for DNS. Edit Zonetransfer is of course a possibility if it is available.


5

dsquery user -samid [username] | dsget user -memberof -expand | dsget group -samid Good Luck!


4

You can do most of this with powershell and LDIF - the snippet below for example will produce a file called ad.txt that has a list of user objects changed or added in the last ten minutes $DateString = (Get-Date).AddMinutes(-10).ToString("u") -Replace "-|:|\s" $DateString = $DateString -Replace "Z", ".0Z" $LdapFilter = """" + "(&(|(whenChanged>=" + ...


4

You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" -W -H ldap://ldap.example.com -b "ou=People,dc=example,dc=com" -s sub 'uid=test-user' Will find "test-user" by -D - Use bind user "search-user" -W - Prompt for ...


4

There is no magic here - you can store hashed data in any text field, you just need to hash the data before it goes to the server (most LDAP servers will helpfully hash passwords for you if they appear to be plaintext - that's not done for you with other text field types). Similarly you can store encrypted data in any text field (provided it can be ...


4

Unfortunately not. The common name of an LDAP object isn't globally unique; it's only unique relative to its parent OU. So, if you could ask if a user was a member of a group, based on a CN of a group, you could potentially get multiple results. It's for this reason that the memberOf attribute of a user object is a list of DNs (distinguished names, or ...


4

This is caused by "Domain Controller Stickiness" and causes the clients to prefer one domain controller over another. You can adjust this by forcing the clients to choose another controller at intervals. The GP setting is under Administrative Templates\System\Net Logon\DC Locator DNS Records\ Entry Name: Force Rediscovery Interval. This setting should ...


3

From what I understood, you are not able to get all entries. Looks like your are hitting admin limit exceeded. If you want to search from a non-cn=Directory manager user. you need to add some attributes to user like below. /usr/lib64/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: ...


3

You can get a full list of entries in a zone with a zone transfer; you'd need to allow this for authorized systems in your DNS server. Once that's done, you can run the transfer and grep the result: dig axfr localdomain.com | grep -i miller


3

A name server will not, by design, let you search a zone or query what zones it is authoritative for. Beyond the obvious reason of reducing attack vectors (you can't make a HTTP/1.1 request to a host if you don't know its name), there is a very good reason for this: a zone can contain wildcards itself, so asking for every host in such a zone is like dividing ...


2

The directory server administrator is free to impose a limit on the number of entries that can be returned in the response to a search request. The LDAP client can request a size limit, but this client-requested limit cannot override the server-imposed limit. The paging is working correctly: paging simply sends multiple search responses, each the size ...


2

ldapsearch -LLL -x -h $LDAPHOST -b"dc=whatever" -D${LDAPUSER} -w"${LDAPPASW}" objectclass=* -E pr=2147483647/noprompt The important part is at the end: -E pr=2147483647/noprompt. I implemented this today, so I know it works, at least with Active Directory's LDAP backend. For me, this was able to bypass server limits. From your example, it looks like you ...


2

Your problem may be the lack of the "olcTLSCACertificateFile" directive together with olcTLSCertificateFile and olcTLSCertificateKeyFile. Point it at the same olcTLSCertificateFile, because for what I see in that doc, you are using a self signed certificate. olcTLSCACertificateFile: /etc/pki/tls/certs/slapdcert.pem You can also use the debug option in ...


2

Use CN=Administrator,CN=Users,DC=madhurmoss,DC=com as your binddn string. That should do it.


2

Okay, I found this on TechNet: Monitor Groups in an OU in AD for changes on Group Membership This script runs on a scheduled task to monitor and alert for changes in Active Directory. Any changes to group membership will cause an alert email to be created with the changes included. The script saves the current members of the Groups in an XML ...


2

What application are you trying to configure. There large majority of application that have some level of LDAP support as an LDAP client, simply have no support for nested groups. Short of modifying the software, you may be out of luck. If your LDAP server happens to be Microsoft Active Directory, then there is a non-standard search filter, that may help ...


2

This script worked for me; I'm posting it here in case it might help someone else #!/bin/bash # specify as first parameter the object ID as received by an LDAP query; it's base-64 encoded. OBJECT_ID="${1}" # we decode it, we hex-dump it and store it in an array to # re-order it in the format expected by LDAP BASE64_DECODED=$(echo $OBJECT_ID | base64 -d ...


2

The AD is distributed and multimaster database, in general terms you can query any of the Domain Controllers about a user and get the same answer in any of the DC (nodes). In AD you can configure the replication of data changes between servers, so if a user change some attribute in Australia, and you query for some data against the server in NY maybe you ...


2

Your terminology WRT Active Directory is not precise. There are two concerns that I can see for you: Querying the closest replica of the AD Understanding the behaviour of queries in a multi-domain environment The Global Catalog maintains a subset of the contents of all domains in the forest. If your use of the term "node" refers to disperate domains, ...


2

This is probably a hidden permissions issue, since AD can stash accounts in odd places, and permissions can be taken away if you're not careful. The first troubleshooting step I'd do is see if there is any correlations in location in the accounts that are getting missed. That may point to a location where the rights are subtly different. If they don't ...


2

S615 is the so called "Soundex" - Value of the name you enter see this link at IBM to learn more about soundex. Normally Soundex is only checked, if no direct match for a name could be found. I did a short research, but could not find a hint about prohibit Soundex- search. Regarding this link it might have something to do with the "Address Lookup" settings ...


2

-o ldif-wrap=no will take care of the 80 character wrap limit. Piping your output into sed -r -e 's/^(.*:): (.*)$/echo -n "\1 "; echo \2 | base64 -d/e' will decode all base64 encoded results. If you're holding EFS certificates you'll want to modify it to touch just the attributes you want. Only using sed: sed -e 'N; s/\n //; P; D' | sed -r -e 's/^(.*:): ...


1

The main problem is that objectGUID is a binary field, and certain ldapsearch builds don't have an ability to directly query that kind of field. As the output of searching for objectGUID shows, it's presuming the data is base64 and that's what you're seeing when searching for objectGUID. The actual data on one object in my tree is 32 bytes long, but linux ...


1

ldapsearch will say "Can't contact LDAP server" if it can't verify the TLS certificate. Add -d1 to your ldapsearch command, and check the output lines that begin with "TLS:" to get more information about whether the TLS connection is failing and why.


1

ldapsearch -d 9 od ldapsearch -d 999 man ldapsearch ... -d debuglevel Set the LDAP debugging level to debuglevel. ldapsearch must be compiled with LDAP_DEBUG defined for this option to have any effect. ...


1

VLV searches where introduced to help creating applications that need to show a scrollable list of the results of a search with features such as paging, smooth scrolling, without having to bring the entire result-set on the client. See: http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-04 However, this required to create a separate index for almost ...


1

You're looking for the subschemaSubentry. RFC 2252 Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions 5.1.5. subschemaSubentry The value of this attribute is the name of a subschema entry (or subentry if the server is based on X.500(93)) in which the server makes available attributes specifying the schema. ( ...


1

Either you have problems with the permissions (you did not show us your slapd.conf), or you have made some modifications to indexing and have not yet run slapindex.


1

I'm not sure what to say, mostly because its hard to see exactly what you're asking. If your organisation creates 'duplicate' user names in different contexts/OUs, which is certainly allowable in AD, then any code you write will have to support working with usernames under different contexts. Whether or not that's a good idea or "correct" is a question ...


1

The sAMAccountName of a user should be unique within a given domain, so you should be able to get the client to query AD based on the sAMAccountName and then use the full X.400 name you get back for authentication. If you have more than one domain, then you need domain + userID (sAMAccountName) to authenticate anyway.



Only top voted, non community-wiki answers of a minimum length are eligible