使用 LDAP 在 Active Directory 中查找用户 - 没有用户？

Posted 2023-02-16

技术标签:

【中文标题】使用 LDAP 在 Active Directory 中查找用户 - 没有用户？【英文标题】：Using LDAP to find Users in Active Directory - no Users? 【发布时间】：2015-04-02 10:41:50 【问题描述】：

使用 (python-ldap 2.4.17.0) 我正在尝试从 AD (Active Directory) 获取我们所有用户 (用户名) 的列表。当我执行下面的代码时，它只给出域信息、DNS 服务器、有关 Exchange 服务器的内容的列表——我似乎找不到与 AD 用户有关的任何内容——即使当我转到服务器并查看 Active 时基本/根节点下的目录 - 有一个 CN=Users，下面有我需要的所有好东西！！！但这并没有反映在代码中。有人知道为什么我无法通过代码看到用户吗？

import ldap

def main():

    con=ldap.initialize('ldap://192.168.16.12:389')
    try:
        res =con.search_s("DC=mycompany,DC=local", ldap.SCOPE_SUBTREE)
        for dn, entry in res:
        print dn
except Exception, error:
    print error

结果

DC=mycompany,DC=local
DC=ForestDnsZones,DC=mycompany,DC=local
DC=DomainDnsZones,DC=mycompany,DC=local
CN=Configuration,DC=mycompany,DC=local
CN=EXCH-FOOPLACE,CN=Public Folder Database 2,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Mycompany,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=local
CN=EXCHANGE01,CN=Barplace-RegularMailBoxes,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Mycompany,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=local
CN=EXCHANGE01,CN=Barplace-LargeMailBoxes,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Mycompany,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=local
CN=EXCHANGE01,CN=Public Database,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Mycompany,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=local
CN=EXCH-FOOPLACE,CN=Houston-Exchange02,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Mycompany,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=local
CN=Schema,CN=Configuration,DC=mycompany,DC=local

【问题讨论】：

您的用户位于何处。（通常是："OU=Users,"DC=mycompany,DC=local"）将 "DC=mycompany,DC=local" 更改为 "OU=Users,"DC=mycompany,DC=local" 【参考方案1】：

发现在查询 LDAP 以获得完整的实体列表之前，您实际上必须提供某种授权用户凭据，例如：

con=ldap.initialize('ldap://192.168.16.12:38')

user_dn = r"Administrator@foo.com"
password = "bar"

criteria = "(&(objectClass=user)(sAMAccountName=username))"
attributes = ['displayName', 'company']

try:
    con.simple_bind_s(user_dn, password)
    res =con.search_s("CN=Users,DC=foo,DC=com", ldap.SCOPE_SUBTREE,'(objectClass=User)')
    for dn, entry in res:
        print dn
except Exception, error:
    print error

【讨论】：

您是否打算在 search_s 方法调用中使用条件和属性？【参考方案2】：

答案与@Vidar 类似，但略有扩展：

import ldap

l = ldap.initialize("ldap://ldap.example.com")
try:
    l.protocol_version = ldap.VERSION3
    l.set_option(ldap.OPT_REFERRALS, 0)

    bind = l.simple_bind_s("me@example.com", "password")

    base = "dc=example, dc=com"
    criteria = "(&(objectClass=user)(sAMAccountName=username))"
    attributes = ['displayName', 'company']
    result = l.search_s(base, ldap.SCOPE_SUBTREE, criteria, attributes)

    results = [entry for dn, entry in result if isinstance(entry, dict)]
    print results

finally:
    l.unbind()