UnboundID LDAP SDK:获取用户的所有组 [英] UnboundID LDAP SDK: Get all groups for a user
问题描述
使用UnboundID LDAP sdk,如何获取特定用户所属的所有LDAP组? (我真的很感谢一些示例代码).
Using UnboundID LDAP sdk, how can I get all the LDAP groups a particular user belongs to? (I would really appreciate some example code).
推荐答案
我有同样的问题.但是,迈克尔的解决方案不适用于我,因为它不是递归的.
I have the same problem. However, the solution by Michael doesn't work for me, since it doesn't work recursively.
显然,有一个魔术" AD查询可以递归地获取所有组,请参见 使用C#查找递归组成员身份(Active Directory)和>如何过滤LDAP查询包含特定用户的组吗?
Apparently, there is a "magic" AD query that gets all groups recursively, see Find Recursive Group Membership (Active Directory) using C# and How do I filter an LDAP query for groups containing a specific user?
虽然我们的AD管理员已经使用ldifde从命令行获取了所有组,但是我无法使查询与UnboundID一起使用.我们的CN内有空格,UnboundID添加了一个奇怪的'5c'-但是即使(技术)用户没有空格,我也不会得到任何结果.
While our AD admin has fetched all groups from the command line using ldifde, I can't get the query to work with UnboundID. Our CN has spaces inside, and UnboundID adds a weird '5c' - but even with a (technical) user without spaces, I don't get any result.
无论如何,这是我正在工作(且效率不高)的源代码(使用Google Guava).我遗漏了一些方法和常量,我想你可以猜出常量OBJECT_CLASS
的值是:-)
Anyway, here's my working (and unefficient) source code (using Google Guava). I've left out some methods and constants, I think you can guess what the value for the constant OBJECT_CLASS
is :-)
/**
* Gets the groups for a user which is identified by the filter.
* @param filter The filter that identifies the user
* @return The groups for the user
*/
private List<String> getGroups(final Filter filter) {
LDAPConnection connection = null;
try {
connection = getConnection();
String userDN = getUserDN(connection, filter);
if (userDN == null) {
return Collections.emptyList(); // No user found
}
Multimap<String, String> groupsByDN = ArrayListMultimap.create();
getGroupsRecursively(connection, userDN, groupsByDN);
Set<String> groups = new HashSet<>(groupsByDN.values());
for (String dn : groupsByDN.keySet()) {
// The user is not a group...
if (!dn.equals(userDN)) {
DN distinguishedName = new DN(dn);
for (RDN rdn : distinguishedName.getRDNs()) {
if (rdn.hasAttribute(CN)) {
groups.add(rdn.getAttributeValues()[0]);
break;
}
}
}
}
return new ArrayList<String>(groups);
} catch (LDAPException e) {
throw new RuntimeException("Can't search roles for " + filter, e);
} finally {
if (connection != null) {
connection.close();
}
}
}
/**
* Since LDAP groups are stored as a tree, this fetches all groups for a user, starting with the user's DN and then
* fetching every group's groups and so on.
* @param connection The LDAP connection
* @param distinguishedName The distinguished name for which groups are searched
* @param groupsByDN Contains a distinguished name as key and its group name as result; keys are only searched once!
* @throws LDAPSearchException if the LDAP search fails
*/
private void getGroupsRecursively(final LDAPConnection connection, final String distinguishedName,
final Multimap<String, String> groupsByDN) throws LDAPSearchException {
if (!groupsByDN.containsKey(distinguishedName)) {
Filter groupFilter = Filter.createANDFilter(Filter.createEqualityFilter(OBJECT_CLASS, GROUP),
Filter.createEqualityFilter(MEMBER, distinguishedName));
SearchResult result = getSearchResult(connection, groupFilter, CN);
List<SearchResultEntry> searchResults = result.getSearchEntries();
for (SearchResultEntry searchResult : searchResults) {
String groupName = searchResult.getAttributeValue(CN);
groupsByDN.put(distinguishedName, groupName);
getGroupsRecursively(connection, searchResult.getDN(), groupsByDN);
}
}
}
这篇关于UnboundID LDAP SDK:获取用户的所有组的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!