We Keep Coding

Query to retrieve all groups a user belongs to in LDAP

At the same time of providing authentication to the user in LDAP within Microsoft Active Directory, I'm trying to get all groups that specific user belongs to. The following code is in Java.
What I'm doing at the moment is the following:
public static List authenticate(String username, String password) throws Exception {
String LDAPURL = MY_LDAP_URL;
String userBase = MY_USERBASE; //format "dc=***,dc=com"
ArrayList<String> groups = new ArrayList<String>();
Hashtable<String, String> environment = new Hashtable<String, String>();
environment.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
environment.put(Context.PROVIDER_URL, LDAPURL);
environment.put(Context.SECURITY_AUTHENTICATION, "simple");
environment.put(Context.SECURITY_PRINCIPAL, username);
environment.put(Context.SECURITY_CREDENTIALS, password);
DirContext ctx =
new InitialDirContext(environment);
SearchControls ctls = new SearchControls();
String[] attributes = {"cn", "memberOf"};
ctls.setReturningAttributes(attributes);
ctls.setSearchScope( SearchControls.SUBTREE_SCOPE );
String searchFilters = "{sAMAccountName="+username+"}";
NamingEnumeration<?> answer = ctx.search(userBase, searchFilters, ctls);
if(answer == null || !answer.hasMore()) {
logger.info("No result found");
}
else {
SearchResult result = (SearchResult) answer.next();
Attributes attrs = result.getAttributes();
Attribute memberAttr = attrs.get("memberOf");
NamingEnumeration e = memberAttr.getAll();
while(e.hasMore()) {
String group = (String) e.next();
groups.add(group);
logger.info(group);
}
}
return groups;
}
I have tried several ways of doing my query, for example:
String searchFilters = "(&(uid="+username+"),(ou=users),(memberOf=*))"
Or
String searchFilters = "(&(objectClass=groupOfNames)(member=cn=" + username + ")(memberOf=*))"
Or
String searchFilters = "(&(userPrincipalName=" + username + ")(memberOf=*))"
In none of the cases any groups were retrieved. In some of the cases the login itself failed as well (in some cases it worked but still no groups returned).
What is the correct way to retrieve the groups?

Although you can bind with "username" and some other attributes, using ANR, ONLY when using Microsoft Active Directory, you will need to obtain the Fully Distinguished Name for the user to perform many LDAP Searches.
Assuming username is the samAccountName, which is always Unique within a AD Forrest, your Authentication should work.
After Authentication you can obtain the DN of the entry and then perform a search for Groups the user is a member.
For all groups the user is a member, including nested groups this will usually work.
(member:1.2.840.113556.1.4.1941:=(CN=UserName,CN=Users,DC=YOURDOMAIN,DC=NET))
We have several JNDI Examples in a code repository.

getting user DN with user name LDAP

I want to get user DN with the username provided.
What I think is that I want to retrieve all the user data and compare with the username.
And now, I have added objectclass in my search filter and I have no idea why is the data is not retrieving.
Here are the codes that I currently have.
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, url);
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "cn=admin,ou=sa,o=system");
env.put(Context.SECURITY_CREDENTIALS, "P#ssw0rd");
try{
DirContext context = new InitialDirContext(env);
SearchControls constraints = new SearchControls();
constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
NamingEnumeration result = context.search("", "(objectclass=Person)", constraints);
while(result.hasMore())
{
SearchResult searchResult = (SearchResult) result.next();
Attributes attrs = searchResult.getAttributes();
request.setEmail(attrs.get("mail").toString());
request.setPhoneNumber(attrs.get("personalMobile").toString());
Attribute ldapattr = attrs.get("photo");
if(ldapattr != null){
byte[] photo = (byte[])ldapattr.get();
request.setPhoto(photo);
}
}
}catch(Exception e){
System.out.println("can't initialized");
}
list.add(request);
//Specific URL of LDAP with the host and :port
return list;
}

Provide a base DN to search. e.g. ou=users below and add username to filter for faster search
Don't get all the user data as you are unnecessarily increasing network traffic and doing additional computational work on the client.
LDAP server excels at this kind of searching. CN is indexed by default but givenName may not be indexed; so you might want to add an index for this attribute.
NamingEnumeration result = context.search("ou=users",
"(&(objectClass=person)(sAMAccountName=" + userId + "))", constraints);
If you have givenName
NamingEnumeration result = context.search("ou=users",
"(&(objectClass=person)(givenName=" + givenName + "))", constraints);

Retrieve all sub users when entered a search term in LDAP

I am looking for a query, when entered a name it should check whether there are any sub employees reporting to that entered name. If there are any, then it should return all the list of child users(employees) and sub child users reporting to that employee.
I wrote a query, when entered a username, it gets all the data associated with him, but I am confused now how to get only the users & sub-users & sub-sub users names that report to that search term.
Is there a way to do it with AD or do I need to implement DFS search? If either option, then please give me some hints to do it.
try {
// Create Initial Context
LdapContext ctxGC = new InitialLdapContext(env, null);
// ctxGC.setRequestControls(null);
String searchFilter = "(&(objectClass=user)(sAMAccountName=" + searchTerm + ")(!(displayName=ADM*)))";
NamingEnumeration<?> namingEnum = ctxGC.search("OU=User,DC=emea,DC=xyz,DC=biz", searchFilter, getSearchControls());
Deque<Node> stack = new ArrayDeque<Node>(); // Do I need to implement tree here or is there any other way to get sub users info from LDAP search??
while (namingEnum.hasMoreElements()) {
SearchResult result = (SearchResult) namingEnum.next();
Attributes attrs = result.getAttributes();
if (attrs != null) {
NamingEnumeration ne = attrs.getAll();
while (ne.hasMore()) {
Attribute attr = (Attribute) ne.next();
}
}
}
namingEnum.close();
} catch (Exception e) {
e.printStackTrace();
}
}
private static SearchControls getSearchControls() {
SearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
searchCtls.setReturningAttributes(new String[]{"*"});
return searchCtls;
}

To get the list of users reporting to a manager, I just need to change the search filter query and retrieve the manager credentials, then it returns the list of all users that are reporting to that person. If there are no users reporting to him, then it returns nothing.
So, the searchFilter need to be changed like the following.
String searchFilter = "(&(objectClass=user)(manager=CN=Its\\\\, Zaif,OU=xx,OU=xx,OU=StandardUser,OU=xx,DC=emea,DC=xyz,DC=biz) (!(displayName=ADM*)))";

connect Java to Active Directory

I try to connect to Active Directory with my Java code, but I get this error message :
Début du test Active Directory
Search error: javax.naming.AuthenticationException: [LDAP: error code 49 - 8009030C:
LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1
I use JNDI,the DIGEST-MD5 authentication method and no encryption method
this is my code:
public class TestAD {
static DirContext ldapContext;
public static void main (String[] args) throws NamingException
{
try
{
System.out.println("Début du test Active Directory");
Hashtable<String, String> ldapEnv = new Hashtable<String, String>(11);
ldapEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
ldapEnv.put(Context.PROVIDER_URL, "ldap://societe.fr:389");
ldapEnv.put(Context.SECURITY_AUTHENTICATION, "DIGEST-MD5");
ldapEnv.put("java.naming.security.sasl.realm","myRealm");
ldapEnv.put("javax.security.sasl.qop", "auth");
ldapEnv.put("javax.security.sasl.strength","high");
ldapEnv.put(Context.SECURITY_PRINCIPAL, "dn:cn=administrateur,ou=users,o=societe.fr");
ldapEnv.put(Context.SECURITY_CREDENTIALS,"myPassword");
ldapContext = new InitialDirContext(ldapEnv);
// Create the search controls
SearchControls searchCtls = new SearchControls();
// Specify the attributes to return
String returnedAtts[]={"sn","givenName", "samAccountName"};
searchCtls.setReturningAttributes(returnedAtts);
// Specify the search scope
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
// specify the LDAP search filter
String searchFilter = "(&(objectClass=user))";
// Specify the Base for the search
String searchBase = "dc=societe,dc=fr";
// initialize counter to total the results
int totalResults = 0;
// Search for objects using the filter
NamingEnumeration<SearchResult> answer = ldapContext.search(searchBase, searchFilter, searchCtls);
// Loop through the search results
while (answer.hasMoreElements())
{
SearchResult sr = (SearchResult)answer.next();
totalResults++;
System.out.println(">>>" + sr.getName());
Attributes attrs = sr.getAttributes();
System.out.println(">>>>>>" + attrs.get("samAccountName"));
}
System.out.println("Total results: " + totalResults);
ldapContext.close();
}
catch (Exception e)
{
System.out.println(" Search error: " + e);
e.printStackTrace();
System.exit(-1);
}
}
}
P.S.:I can connect to my Active Directory with the same parameter with Apache Directory Studio

Find user with specific value in employeeID attribute

I'm trying to find the CN of a username by searching for the employeeID attribute (which is unique for each employee). I already got it to return a string with all attributes, but I want it to return only the CN of a user (ex: 'John Doe' or 'cn=John Doe'; both are fine)
public void getEmployeeId(String id) {
// TODO stuff
String groupName = "ou=Accounts,DC=PORTAL,DC=COMPANY,DC=BE";
try {
System.out.println("Creating initial directory context...");
LdapContext ctx = new InitialLdapContext(env, null);
// Create default search controls
SearchControls ctls = new SearchControls();
// Search for user with 'id' as value for employeeID attribute
String filter = "(&(employeeID=" +id + "))";
// Search for objects using filter
NamingEnumeration answer = ctx.search(groupName, filter, ctls);
// Print the answer
// Search.printSearchEnumeration(answer);
System.out.println("-----------------");
System.out.println(answer.next());
System.out.println("-----------------");
// Close the context when we're done
ctx.close();
} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
note: I know you can just cut parts from a string, but I want it to return only the value I need.

The search request should contain a list of attributes. Some APIs will return all attributes from matching entries. Specify cn in the list of attributes to return, and be prepared to handle a multi-valued cn attribute.
see also
LDAP: Mastering Search Filters
LDAP: Search best practices
LDAP: Programming practices

For example:
DirContext ctx = new InitialDirContext(env);
/***/
NamingEnumeration<?> namingEnum = ctx.search(
"dc=stackoverflow,dc=com, "employeeID=" +id,
ctls);
while (namingEnum.hasMoreElements()) {
SearchResult result = (SearchResult) namingEnum.next();
Attributes attrs = result.getAttributes();
System.out.println(attrs.get("cn"));
System.out.println(attrs.get("name"));
System.out.println(attrs.get("userPrincipalName"));
}
/***/
the result:
CN: Andres Montejo
NAME: Andres Montejo
userPrincipalName: andresmontejo#stackoverflow.com