Group Membership in Active Directory Query

[kooch54]

I am trying to write a script to simply query the group members in an
active directory group. I need to use LDAP to make sure I capture any
global global group nestings that may occur. I already have a
function that uses WinNT provider to capture this info from NT4 or AD
domains and it works beautifully. It just doesn't capture global >
global nestings. I am having great difficulties in getting this to
work on AD though with ldap. I have a multiple domain tree
environment and need to be able to query groups in different domains.
I want to simply make an ldap connection, bind to it, search for the
group and get it's members.
I do the following for eDirectory and it works great but not in AD.

import ldap
l=ldap.open(1.2 .3.4,trace_leve l = 1)
l.simple_bind_s ('cn=username,o u=company','pas sword')
UserRes = UserRes + l.search_s(
o=company,
ldap.SCOPE_SUBT REE, "(|'cn=groupnam e')

If I do the same thing as above but to an AD source it doesn't work.
I run the open and it seems successful, I run the bind using DN, UPN,
or domain name and password and it seems to bind, I run the query and
it says I must complete a successfull bind operation before doing a
query.

Any help is appreciated.

[kooch54]

On Feb 7, 9:22 am, kooc...@gmail.c om wrote:

I am trying to write a script to simply query the group members in an
active directory group. I need to use LDAP to make sure I capture any
global global group nestings that may occur. I already have a
function that uses WinNT provider to capture this info from NT4 or AD
domains and it works beautifully. It just doesn't capture global >
global nestings. I am having great difficulties in getting this to
work on AD though with ldap. I have a multiple domain tree
environment and need to be able to query groups in different domains.
I want to simply make an ldap connection, bind to it, search for the
group and get it's members.
I do the following for eDirectory and it works great but not in AD.

import ldap
l=ldap.open(1.2 .3.4,trace_leve l = 1)
l.simple_bind_s ('cn=username,o u=company','pas sword')
UserRes = UserRes + l.search_s(
o=company,
ldap.SCOPE_SUBT REE, "(|'cn=groupnam e')

If I do the same thing as above but to an AD source it doesn't work.
I run the open and it seems successful, I run the bind using DN, UPN,
or domain name and password and it seems to bind, I run the query and
it says I must complete a successfull bind operation before doing a
query.

Any help is appreciated.

I found an example in the groups here and attempted it but it failed
as well. Below is the code I used and the results.

import ldap, ldapurl

proto = 'ldap'
server = 'domaincontroll er.domain.compa ny.com'
port = 389

url = ldapurl.LDAPUrl (urlscheme=prot o,
hostport="%s:%s " % (server,
str(port))).ini tializeUrl()
ldap_obj = ldap.initialize (url)

# !!!password will be on wire in plaintext!!!
ldap_obj = ldap_obj.simple _bind_s('u***** **@domain.compa ny.com',
'password')

base = 'DC=DOMAIN, DC=COMPANY, DC=COM'

scope = ldap.SCOPE_SUBT REE

query = '(objectclass=u ser)'

res_attrs = ['*']

res = ldap_obj.search _ext_s(base, scope, query, res_attrs)
print res

RESULTS FROM PYTHON SHELL
res=ldap_obj.se arch_ext_s(base , scope, query, rest_attrs)
AttributeError: 'NoneType' object has no attribute 'search_Ext_s'

[Uwe Hoffmann]

ko*****@gmail.c om schrieb:

ldap_obj = ldap_obj.simple _bind_s('u***** **@domain.compa ny.com',
'password')
AttributeError: 'NoneType' object has no attribute 'search_Ext_s'

dummy = ldap_obj.simple _bind_s('u***** **@domain.compa ny.com',
'password')
or better simply
ldap_obj.simple _bind_s('u***** **@domain.compa ny.com',
'password')

[kooch54]

On Feb 7, 11:56 am, Uwe Hoffmann <q...@tiscali.d ewrote:

kooc...@gmail.c om schrieb:

ldap_obj = ldap_obj.simple _bind_s('usern. [e-mail] ny.com',
'password')

AttributeError: 'NoneType' object has no attribute 'search_Ext_s'

dummy = ldap_obj.simple _bind_s('usern. [e-mail] ny.com',
'password')
or better simply
ldap_obj.simple _bind_s('usern. [e-mail] ny.com',
'password')

First and foremost thanks for the feedback. Although I don't
appreciate the slight dig at me.
dummy = ldap_obj.simple _bind......

I tried your second recommendation of using
ldap_obj.simple _bind_s('usern. [e-mail] ny.com','passwo rd')

Now I get the following error even after the bind operation seems to
complete successfully.
result = func(*args,**kw args)
OPERATIONS_ERRO R: {'info': '00000000: LdapErr: DSID-0C0905FF, comment:
In order to perform this operation a successful bind must be completed
on the connection., data 0, vece', 'desc': 'Operations error'}

Thanks again...

[alex23]

On Feb 8, 4:27 am, kooc...@gmail.c om wrote:

First and foremost thanks for the feedback. Although I don't
appreciate the slight dig at me.
dummy = ldap_obj.simple _bind......

I _really_ don't think Uwe was intending any slight, 'dummy' generally
means 'dummy variable' ie it's just there to catch the value but it's
never used after that :)

If you're doing a lot of AD work, I highly recommend Tim Golden's
active_director y module: http://timgolden.me.uk/python/
active_director y.html

His WMI module has also been a godsend on a number of occasions.

- alex23

[Kooch54]

On Feb 7, 7:52 pm, "alex23" <wuwe...@gmail. comwrote:

On Feb 8, 4:27 am, kooc...@gmail.c om wrote:

First and foremost thanks for the feedback. Although I don't
appreciate the slight dig at me.
dummy = ldap_obj.simple _bind......

I _really_ don't think Uwe was intending any slight, 'dummy' generally
means 'dummy variable' ie it's just there to catch the value but it's
never used after that :)

If you're doing a lot of AD work, I highly recommend Tim Golden's
active_director y module:http://timgolden.me.uk/python/
active_director y.html

His WMI module has also been a godsend on a number of occasions.

- alex23

Alex-
Thanks for your response and Uwe I apologize if I misunderstood
and misinterpreted your comments. I am sorry.
I have tried Tim's module called active_director y and it works really
well. But I can't figure out how to connect to a specific group is I
know the common name for it but not the DN and then return it's
members. Example.... I know the group name is domain1\shareda ccess.
How do I bind to that group and get the members. The domain isn't
necessarily the defaultnamingco ntext. It could be another domain in
the forest. I need to be able to connect to any domain group and get
it's members. Thanks again.

[Kooch54]

On Feb 8, 8:44 am, "Kooch54" <kooc...@gmail. comwrote:

On Feb 7, 7:52 pm, "alex23" <wuwe...@gmail. comwrote:

On Feb 8, 4:27 am, kooc...@gmail.c om wrote:

First and foremost thanks for the feedback. Although I don't
appreciate the slight dig at me.
dummy = ldap_obj.simple _bind......

I _really_ don't think Uwe was intending any slight, 'dummy' generally
means 'dummy variable' ie it's just there to catch the value but it's
never used after that :)

If you're doing a lot of AD work, I highly recommend Tim Golden's
active_director y module:http://timgolden.me.uk/python/
active_director y.html

His WMI module has also been a godsend on a number of occasions.

- alex23

Alex-
Thanks for your response and Uwe I apologize if I misunderstood
and misinterpreted your comments. I am sorry.
I have tried Tim's module called active_director y and it works really
well. But I can't figure out how to connect to a specific group is I
know the common name for it but not the DN and then return it's
members. Example.... I know the group name is domain1\shareda ccess.
How do I bind to that group and get the members. The domain isn't
necessarily the defaultnamingco ntext. It could be another domain in
the forest. I need to be able to connect to any domain group and get
it's members. Thanks again.

Bump

[Tim Golden]

Kooch54 wrote:

> Thanks for your response and Uwe I apologize if I misunderstood
and misinterpreted your comments. I am sorry.
I have tried Tim's module called active_director y and it works really
well. But I can't figure out how to connect to a specific group is I
know the common name for it but not the DN and then return it's
members.

For the simple "group in my domain" situation, as
far as I can see you can do something like this:

<code>
import active_director y
for group in active_director y.search (
"sAMAccountName ='sharedaccess' ",
"objectClass='g roup'"
):
print group
for member in group.members:
print member

</code>

(I'm not on an AD-connected machine just now, but I
think that'll do it).

As to finding it another domain, I'm not sure. I suspect
that if you simply issue the above query, you'll get
the groups back from all domains in the forest. But I'm
not sure about that. In essence this isn't a Python question
as such. If you can find out from any source how to formulate
the query in an AD way, I'm quite sure we can translate that
easily into Python.

I'm afraid that my AD module is a very lightweight wrapper
over the LDAP:// object system and offers very little support
(and gets very little attention from me). Hopefully I can
have a boost of energy & time and give it some help.

TJG