Rafael Pfister

LDAP / Active Directory

Finn brukere, test bind, Root DSE og LDAPS.

Finn en bruker

Finner en bruker via sAMAccountName og viser de viktigste attributtene (navn, e-post, DN, grupper).

Active Directory

Brukernavn (sAMAccountName)
jdoe Endre i generatoren →

PowerShell (Windows)

DirectorySearcher (.NET) Innebygd 

$s = New-Object DirectoryServices.DirectorySearcher
$s.SearchRoot = "LDAP://dc01.example.com/DC=example,DC=com"
$s.Filter = "(sAMAccountName=jdoe)"
"displayName", "mail", "distinguishedName", "memberOf" | ForEach-Object { [void]$s.PropertiesToLoad.Add($_) }
$r = $s.FindOne()
if ($r) { $r.Properties } else { "not found" }

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -b "DC=example,DC=com" "(sAMAccountName=jdoe)" displayName mail distinguishedName memberOf

Unix-skall (bash)

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -b "DC=example,DC=com" "(sAMAccountName=jdoe)" displayName mail distinguishedName memberOf

curl Tilleggsverktøy 

curl -s "ldap://dc01.example.com/DC=example,DC=com?displayName,mail?sub?(sAMAccountName=jdoe)"

Uten bind-opplysninger kjører søket som den påloggede Windows-brukeren (integrert autentisering). Linux har ingen innebygd LDAP-klient: bruk ldapsearch (openldap-clients / ldap-utils) eller curl med LDAP-støtte; for ldapsearch legger du ved behov til -D <bind DN> -W.

Test bind / pålogging

Kontrollerer om en konto kan gjøre bind (autentisere seg) mot katalogen.

PowerShell (Windows)

DirectoryEntry (.NET) Innebygd 

$de = New-Object DirectoryServices.DirectoryEntry("LDAP://dc01.example.com", "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com", "P@ssw0rd")
try { $null = $de.NativeObject; "bind ok: $($de.distinguishedName)" }
catch { "bind failed: $($_.Exception.Message)" }

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -D "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com" -W -b "" -s base "(objectClass=*)" 1.1

Unix-skall (bash)

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -D "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com" -W -b "" -s base "(objectClass=*)" 1.1

curl Tilleggsverktøy 

curl -s -u "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com:P@ssw0rd" "ldap://dc01.example.com/"

Erstatt P@ssw0rd med det ekte passordet. -W i ldapsearch spør etter passordet interaktivt.

Eget filter

Kjører et LDAP-søk med et fritt filter og lister de treffende DN-ene.

PowerShell (Windows)

DirectorySearcher (.NET) Innebygd 

$root = New-Object DirectoryServices.DirectoryEntry("LDAP://dc01.example.com/DC=example,DC=com", "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com", "P@ssw0rd")
$s = New-Object DirectoryServices.DirectorySearcher($root, "(&(objectClass=user)(sAMAccountName=jdoe))")
$s.PageSize = 200
$s.FindAll() | ForEach-Object { $_.Properties["distinguishedname"] }

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -D "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com" -W -b "DC=example,DC=com" "(&(objectClass=user)(sAMAccountName=jdoe))" dn

Unix-skall (bash)

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -D "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com" -W -b "DC=example,DC=com" "(&(objectClass=user)(sAMAccountName=jdoe))" dn

curl Tilleggsverktøy 

curl -s -u "CN=svc-ldap,OU=Service Accounts,DC=example,DC=com:P@ssw0rd" "ldap://dc01.example.com/DC=example,DC=com?dn?sub?(&(objectClass=user)(sAMAccountName=jdoe))"

Erstatt P@ssw0rd med det ekte passordet. For et anonymt søk, fjern bind-delen.

Root DSE

Leser Root DSE: navnekontekster, vertsnavn og støttet LDAP-versjon, uten autentisering.

PowerShell (Windows)

[ADSI] RootDSE Innebygd 

$r = [ADSI]"LDAP://dc01.example.com/RootDSE"
$r.defaultNamingContext; $r.dnsHostName; $r.supportedLDAPVersion; $r.rootDomainNamingContext

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -s base -b "" "(objectClass=*)" +

Unix-skall (bash)

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldap://dc01.example.com -s base -b "" "(objectClass=*)" +

curl Tilleggsverktøy 

curl -s "ldap://dc01.example.com/?+?base?(objectClass=*)"

LDAPS (636)

Kontrollerer den krypterte LDAP-tilkoblingen og viser sertifikatet.

LDAPS (636)

PowerShell (Windows)

SslStream (.NET) Innebygd 

$h = "dc01.example.com"; $p = 636
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotAfter
$ssl.Dispose(); $c.Close()

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldaps://dc01.example.com:636 -s base -b "" "(objectClass=*)" 1.1

Unix-skall (bash)

openssl Innebygd 

openssl s_client -connect dc01.example.com:636 </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

ldapsearch Tilleggsverktøy 

LDAPTLS_REQCERT=allow ldapsearch -x -H ldaps://dc01.example.com:636 -s base -b "" "(objectClass=*)" 1.1

Globaler Katalog (3269)

PowerShell (Windows)

SslStream (.NET) Innebygd 

$h = "dc01.example.com"; $p = 3269
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotAfter
$ssl.Dispose(); $c.Close()

ldapsearch Tilleggsverktøy 

ldapsearch -x -H ldaps://dc01.example.com:3269 -s base -b "" "(objectClass=*)" 1.1

Unix-skall (bash)

openssl Innebygd 

openssl s_client -connect dc01.example.com:3269 </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

ldapsearch Tilleggsverktøy 

LDAPTLS_REQCERT=allow ldapsearch -x -H ldaps://dc01.example.com:3269 -s base -b "" "(objectClass=*)" 1.1

LDAPTLS_REQCERT=allow godtar også et ikke-klarert sertifikat, slik at testtilkoblingen lykkes.

Andre områder