#1
  1. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Mar 2004
    Posts
    24
    Rep Power
    0

    Accessing LDAP help


    Hi All,

    I would need some help understanding the DN string to access LDAP info.
    I've been able to get a list of the top objects, but now I don't know how to view the sub objects.
    For example, this is the output of my PHP script, but how can I look into 'Everyone'? I guess the users are there...

    cn:Everyone
    instancetype:4
    distinguishedname:CN=Everyone,CN=WellKnown Security Principals,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectcategory:CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectclass:top
    objectguid:QLxڜ
    objectsid:
    name:Everyone
    showinadvancedviewonly:TRUE
    usnchanged:1295
    usncreated:1295
    whenchanged:20020613081629.0Z
    whencreated:20020613081629.0Z

    cn:Creator Owner
    instancetype:4
    distinguishedname:CN=Creator Owner,CN=WellKnown Security Principals,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectcategory:CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectclass:top
    objectguid:g-IkeN
    objectsid:
    name:Creator Owner
    showinadvancedviewonly:TRUE
    usnchanged:1296
    usncreated:1296
    whenchanged:20020613081629.0Z
    whencreated:20020613081629.0Z


    Thanks,
    Stefano
  2. #2
  3. Chris Larivee
    Devshed Newbie (0 - 499 posts)

    Join Date
    Sep 2003
    Location
    Littleton, CO
    Posts
    72
    Rep Power
    11
    It looks like the users aren't there - for those groups at least. If they were you would see the following in your results from the query:

    cn:Everyone
    instancetype:4
    distinguishedname:CN=Everyone,CN=WellKnown Security Principals,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectcategory:CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,DC=AISEDEMILANO,DC=LOCALE
    objectclass:top
    objectguid:QLxڜ
    objectsid:
    member: dnofuser
    member: dnofuser
    member: dnofuser

    name:Everyone
    showinadvancedviewonly:TRUE
    usnchanged:1295
    usncreated:1295
    whenchanged:20020613081629.0Z
    whencreated:20020613081629.0Z

    Again - this information would have been retrieved in the query you ran - which was probably at the base level.

    You may want to consider running a subtree level search to reach deeper into the DIT structure.

    HTH
  4. #3
  5. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Mar 2004
    Posts
    24
    Rep Power
    0
    I tried using a LDAP browser (Softerra 2.5) to get deeper into subtree levels, but it seems no sublevels are available.
    Exchange works fine even without a DN base string, so I don't know where to look for it (our SysAdmins are very busy... ) in fact I just need to authenticate users within our Intranet using Apache/LDAP or PHP.

    Attached you may find an export of a global search using LDAP browser, hope it may be useful.

    Thanks
    Stefano
    Attached Files
  6. #4
  7. Chris Larivee
    Devshed Newbie (0 - 499 posts)

    Join Date
    Sep 2003
    Location
    Littleton, CO
    Posts
    72
    Rep Power
    11
    You may have a permissions issue. To be clear - can you see anything other than what is in the file you posted? Not only subtree entries - but the attributes associated with the entries you are able to see?
  8. #5
  9. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Mar 2004
    Posts
    24
    Rep Power
    0
    I post a complete (I guess) ldif export with all the attributes I can see. I'm able to log as 'admin', but I don't notice any difference against anonimous bind.
    I've given a look at the ActiveDirectory conf window, where I can see all the users inside the 'Users' folder, but no way to find it through ldap browser

    Thanks,
    Stefano


    Originally Posted by ldap4u
    You may have a permissions issue. To be clear - can you see anything other than what is in the file you posted? Not only subtree entries - but the attributes associated with the entries you are able to see?
  10. #6
  11. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Mar 2004
    Posts
    24
    Rep Power
    0
    Attached the complete ldif export
    Attached Files
    Last edited by Providence77; March 12th, 2004 at 03:31 AM. Reason: attachment
  12. #7
  13. Chris Larivee
    Devshed Newbie (0 - 499 posts)

    Join Date
    Sep 2003
    Location
    Littleton, CO
    Posts
    72
    Rep Power
    11
    I want to back up for a minute to clarify your original post and my responses. I just realized you were querying a security principle for users - which won't (I don't think) ever expose the users that have that principle applied to them (unlike group membership - which is where I was going with my original response).

    That having been said - I still think you have a permissions issue - as you should be able to drill down into the subtree CN=users just like you were able through the admin console.

    Were you binding as the same user in the ldap browser that you used when you logged in to Windows and viewed cn=users through the admin console?

IMN logo majestic logo threadwatch logo seochat tools logo