ldap3 python 搜索组成员并检索他们的 sAMAcountName (Active Directory)

2022-01-17 00:00:00 python python-3.x ldap

问题描述

我正在尝试将 ldap3 与 python 一起使用来检索组的成员并检索他们的 sAMAccountName，因为我们混合了 DN(一些带有 NTID，其他带有名字/姓氏).

I'm trying to use ldap3 with python to retrieve members of a group and also retrieve their sAMAccountName as we have mixed DN's (some with NTID and others with first/last name).

我一直在尝试这个没有 0 运气，任何帮助将不胜感激:

I've been trying this with no 0 luck, any help would be appreciated:

from ldap3 import Server, Connection, AUTO_BIND_NO_TLS, SUBTREE, BASE,
      ALL_ATTRIBUTES, ObjectDef, AttrDef, Reader, Entry, Attribute,
      OperationalAttribute import ldap3

conn = Connection(Server('adserver.com', port=389, use_ssl=False),
                  auto_bind=AUTO_BIND_NO_TLS, user='DOMAIN\NTID',
                  password='somepassword')

conn.search(search_base='CN=GROUPNAME,OU=Groups,OU=Resources,OU=Global,DC=adserver.com',
            search_filter='(objectCategory=person)', search_scope=SUBTREE,
            attributes = ['sAMAAccountName'], size_limit=0) 

print(conn.response_to_json())

解决方案

在搜索成员之前，您必须先从组本身中下拉成员列表.

Before you can search the members you must first pull down the list of members from the group itself. 

conn.search(
    search_base='CN=GROUPNAME,OU=Groups,OU=Resources,OU=Global,DC=adserver.com',
    search_filter='(objectClass=group)',
    search_scope='SUBTREE',
    attributes = ['member']
)

for entry in conn.entries:
    print(entry.member.values)

这将打印出成员列表作为专有名称.

This will print out a list of members as distinguished names.

然后您需要执行一个新的搜索，遍历每个成员并返回每个成员的 sAMAccountName.

You will then need to perform a new search that iterates through each of the members and returns the sAMAccountName for each member.

下面是完整代码的样子(可能需要调整):

Here is what the full code might look like (may need to be tweaked):

conn.search(
    search_base='CN=GROUPNAME,OU=Groups,OU=Resources,OU=Global,DC=adserver.com',
    search_filter='(objectClass=group)',
    search_scope='SUBTREE',
    attributes = ['member']
)

for entry in conn.entries:
    for member in entry.member.values:
        conn.search(
            search_base='OU=Global,DC=adserver.com',
            search_filter=f'(distinguishedName={member})',
            attributes=[
                'sAMAccountName'
            ]
        )

        user_sAMAccountName = conn.entries[0].sAMAccountName.values

        print(user_sAMAccountName)

相关文章