Example of ASP LDAP query string? 14

[MikeBronner]

Could someone post an example of ASP code used to query LDAP without any proprietary components?

Thanks! Take Care,
Mike

 

[valdeloire]

zcolton

Any luck in getting a sample together for me?

 

[zcolton]

valdeloire,

Did you want something that is point-n-click or fill-in-the-blank?

 

[valdeloire]

zcolton,

I would prefer a fill-in-the-blank type form.

 

[MQuimby]

zcolton -

Your posts have been very insightful and helpful to me.

I hope you can answer a few questions for me. This is for an Intranet site.

1) I had a call into the GC working fine, now suddenly it has stopped working. I''m wondering if someone in another office made changes that might have done this - like applying an SP.

2) The code that was working was working with IIS Integrated Windows security. Now it works, but only if I hard code credentials - which I don't want to do.

3) The code that was working with integration was giving me a lot of data back in arrays - and I had to grab the 1st element. Now, when I pass credentials and get the dat - it is mostly in strings.

4) I'm wondering if I'm hittinga different DC - maybe on another site. Is there a way to find that out?

5) Is there a resource for the Properties and Methods available on the RootDSe and GC objects? (Eg., al ist of fields...)

I am trying to hit a Win2K3 DC and access AD.

Many thanks for any insight and advice.

 

[Curriculum2]

Hello - I've read this excellent thread, and am not able to get any connection to an LDAP server using any of this code. It's apparent that security is an issue but I'd appreciate some help in understanding next steps:

Situation: eDirectory LDAP server which I'd like to get information from via an IIS ASP page.

I can browse the company LDAP server using the Softerra browser which is installed onto the web server.

Swapping in "mit" for my company, Softerra's URL showing which successfully browses is:

ldap://ldap.mit.edu:389/o=mit??base?(objectClass=*)

with "o=mit" entered into the "Base" textbox in the general tab.

For most all code samples, I get an asp 500 error at the line that is :
Set objGroup=GetObject("ldap:// etc etc.

Can anyone point me to a solution? I"m thinking either:
a.) IUSR_machinename is not being accepted by the LDAP server, or
b.) I'm missing something in IIS setup that would set up this object
c.) the settings that I've seen in the sample code just aren't being matched by my company's situation.

If it's c.), then here's some additional info about the LDAP structure:
In the Softerra browser, under the main LDAP entity I've connected to, I see some ou=, and I'm interested in ou=ELEMENTARY, and within that, ou=BIGSCHOOL (among others) and within that, ou=STAFF (among others) and within that, cn=gbush (for example, among others).

Finally, I need to parse one of the many (about eight) "securityEquals" which has a string like:

cn=Teachers, ou=STAFF, ou=BIGSCHOOL, ou=ELEMENTARY, o=mit

so that I can detect the word "Teachers" for enabling access to the web page (rather than a student or secretary accessing the page).

Thanks for any direction on this.

 

[mooka]

Wow this is the master LDAP thread!

I would like to add another question / problem that the masters may help with...

The infamous error: Table Does not Exist - With a Twist

I have the following Code (VB Script) used to enumerate the trusted domains...

I can run it no problem, I have other users who are getting the table does not exist...

Here is the script:


strDomain = InputBox("Enter the name of the Domain in Domain.com notation",Title,strDomain)
If InStr(strDomain, ".") = FALSE Then
MsgBox("The Domain must be the FQDN e.g. Domain.com")
WScript.Quit
End If

aDomain = Split(strDomain, ".")
strNTDomain = aDomain(0)

strDomainUid = InputBox("Enter a User Account (Domain\UserName)",Title,strNTDomain & "\")


strDomainPwd = InputBox("Enter Password for " & strDomain,Title,strDomainPwd)



GetTrustedDomains strDomain, strDomainUid, strDomainPwd

Sub GetTrustedDomains(strDomain, strDomainUid, strDomainPwd)
On Error Resume Next


Set con = CreateObject("ADODB.Connection")
con.provider = "ADsDSOObject"
con.Properties("User ID") = strDomainUid
con.Properties("Password") = strDomainPwd
con.open "Active Directory Provider"
Set com = CreateObject("ADODB.Command")
Set com.ActiveConnection = con

If Err.Number <> 0 Then
MsgBox "Error binding to " & strDomain & ". Error is : " & Err.Description
Exit Sub
Else
MsgBox "Successfully connected to domain " & strDomain
End If

com.CommandText = "select name FROM 'GC://" & strDomain & "' where objectCategory='trustedDomain'"
Set rs = com.Execute

If Err.Number <> 0 Then
MsgBox "Error opening connection To " & strDomain & ". Error is : " & Err.Description
Exit Sub
End If

If Not rs.EOF Then
Do Until rs.EOF
wscript.echo "Trusted Domain: " & rs("name")
rs.MoveNext
Loop
MsgBox "Query is functioning properly."
Else
wscript.echo "No Trusted Domains Discovered."
End If
rs.Close
Set com = Nothing

If Err.Number <> 0 Then
MsgBox "Error opening connection To " & strDomain & ". Error is : " & Err.Description
Exit Sub
End If

End sub


For one particular client, this occurrs in their test domain, but not their production domain.

The domain is a Windows 2003 domain. From this thread it seems like the user permissions and MDAC are likely causes.

I know this script works, so I'm trying to troubleshoot why it works for some and not others. I've verified it against both Windows 2000 and Windows 2003 domains.

This is actually for a website, but I put it in VBS for ease of use.

The web service is using Integrated Authentication only, but doesnt really matter since I'm passing my own account information over. The problem seems to occcur for any level of domain permissions (Domain Admins and regular users.)

So if you guys can try this in your own domains to see if it works or not, or any ideas why it would work in some domains and not others, then you will have saved a mans business and will have good fortune for all of your lives.

Any help would be MUCH appreciated.

/John

 

[zcolton]

Everyone pleae hold tight... answers are soon to follow...

 

[MQuimby]

Awesome...

THanks..

Upon working on this all day yesterday, I have discovered the follwoing...

If I code to get the Default naming context, it pulls up something like this: DC=AB, DC=company - making my sleect statements:
"SELECT a, b FROM GC:\\DC=AB, DC=company" - which works in another site, but not here. It will work at mt site, but only if I hard code credentials - which I don't want to do.

If I hard code in the GC name like this:
"SELECT a, b FROM GC:\\ServerName" - everytihng works fine.

Obviously I don't want to do the latter....

I think this is indicating a DNS issue in my location - but I'm not a DNS expert, and I don't know where to look. I think I read I need to have SRV records added - does that make sense.

I think in the first case, the code is doing a double-hop to get to the GC and thus not passing credentials - this is validated by the fact that if I trust my ID and the server to delegate, the first example works without credentials...

I did an NSLOOKUP - and if I read it correctly, it supports my theory.

 

[Rikkimaru]

Hello...I just wanted to ressurect this post to ask you all (or anyone else) who has gotten this code working what version of MDAC they use.

The MDAC version can be found here: C:\Program Files\Common Files\System\ADO\MDACReadMe.htm
(this location and file may vary slightly)

Code of this nature works fine on windows XP but gives me errors on Windows 2k Server when I try to display the result-set.

Here are my errors:
Response object error 'ASP 0106 : 80020005'

Type Mismatch

/phonebook/includes/test.asp, line 0

An unhandled data type was encountered




I have a theory that the code will not work unless MDAC is at version 2.7 or above.

So hopefully you all will reply and we will see whether I am right.

Thanks,
Rikki

 

[Curriculum2]

Regarding MDAC version, my IIS server (the machine making the LDAP requests) is running 2.6 on a win2K server, and I'm one of the posts who can't get the code to work. I'll try 2.7.

 

[Curriculum2]

Rikkimaru,
You, my friend, have solved my connection problem. I'm still at the infancy point of getting the data I need from a very hierarchical tree structure, but I'm getting gobs of data back now, so it should just be a matter of setting the query right.

Solution for me: Upgrade a Win2K server running IIS, to MDAC 2.8 (and the readme shows 2.7). It was at 2.6.

 

[Curriculum2]

OK, I'll refine my question now that I'm seeing data:
My query is taking 30 seconds due to the size of the directory and the vagueness of my query.

I'm sending:
[and I've substituted "big" for my organization and some other states for actual values]

SQLStmt = "SELECT cn " & _
"FROM'LDAP://ldap.big.edu:389/o=big/ou=State' " & _
"WHERE objectClass='*'

and the LDAP structure is:
o=big
then about 10 ou's including:
ou=Ohio
then about 100 ou's including:
ou=Cleveland
then about 10 ou's including:
ou=STAFF
then about 300 cn's including:
cn=GBush
and within that container, tehre are five strings of
securityEquals, and one of them is of interest, which reads:
cn=Teachers,ou=STAFF,ou=Cleveland,ou=Ohio,o=big

and the fact that the entry has "Teachers" rather than something else is what I'm searching for.

I'll come into the search knowing the value for the cn (GBush) but I won't know that GBush is in Cleveland, let alone Ohio. I'm hoping that there is an obvious way to find GBush without what appears to be a grab of many megabytes of data by the IIS machine rather than the work being done by the LDAP server. Any ideas how to get what I need and get it quicker ?

tnx !

 

[zcolton]

valdeloire,

fill-in-the-blank phonebook

http://www.burltwpsch.org/users/zcolton/tools/pbfitb.zip

For all of the latest posts/questions. I will hopefully have time tonight to sit down and respond to them. I've been quite busy in the office. Sorry for the delay.

 

[MQuimby]

Thanks zcolton - I underatand this is not your number one priority.

More info....

I have found there are differences in W2K and W2K3.

In W2K some of the values come over as arrays and I need to access as elements. In W2K3, those same values need to be strings.

Also, W2K3 (possibly due to SP1) is requiring authentication where W2K is not - may have to do with double hop and Kerberos.

And, I think W2K3 does not resolve DNS entires for GC's - may also be due to authentication issues...

Look forward to your advice.

 

[CityWebGuy]

Hello,

When I return the information from my LDAP query I notice that there is an whenCreated field.

My question is, Can someone provide an example if it is possible so that I can query to retrive a list of users that were create withing a a given time frame. Such as BeginDate - EndDate which would be paramater that I pass into the page

Thanks for any help.

 

[valdeloire]

zcolton,

Thanks for taking the time to help me with this. I have the files and put them on the web server.

I am getting the following error when I try to pull up the page.

HTTP 500.100 - Internal Server Error - ASP error
Internet Information Services

Error Type:
Provider (0x80040E37)
Table does not exist.
/phonebook/Default.asp, line 42


Is there some other configuration that I need to do before trying to use this?

 

[valdeloire]

zcolton,

Disregard that last post. I was able to get the web page to work correctly.

One question for you though. It appears that all of my users need to be in a single OU to make this work correctly. I have different OUs set up for different divisions (nested). When I tried to change the OU in the asp pages to include the domain or an OU that has other OU's defined in it I do not get anything returned.

Am I correct in this? If that is the case, I can move all of my users into a single ou.

 

[zcolton]

valdeloire,

In the pages I provided, in the code, there is a variable objRootOU. That variuable defines the starting OU for the queries. The queries will then look in that OU and any other OU nested in it.

To all of the various security questions:
2k or not 2k : The examples I have shown, and the advice I have given apply to Win2k only. Though some info may hold true for Win2k3, I do not have a 2k3 domain do test for functionality. MS has made changes to the security of LDAP and GC when the made 2k3. You may need to refer to MSKB or MSDN for info on the differences.
IIS : Successful LDAP queries seem to reply on two things (other than proper programming) MDAC and user credentials. Step 1 - update the IIS server to latest version of MDAC. I believe 2.8 is the latest. It just may fix some of your issues. Step 2 - verify the user credentials that are being used to query LDAP. Under normal circumstances the IUSR_machine account can NOT query ldap. If anonymous pages are to be used with that account, the username and password for a domain account with atleast read access MUST be hardcoded in the ASP. What you can do (this is what I have done) is to create a very low-privledged domain account for the sole purpose of submitting queries. Change IIS settings to use that account instead of the IUSR account. You would only need to make thius change on the folder which contains the ASP pages. If you do this, verify the NTFS permissions on those files to be sure that the account has read access. For non-anonymous access, you can use Integrated Windows or Basic authentication. To use Integraded a few conditions MUST be true: anonymous access MUST be disabled, the client browser MUST support it and be enabled, and the client is logged in using a domain account. If all of this is true, Integrated works well. If the client end is not true, the security access reverts back to Basic. To verify the user credentials use:

Response.Write "AUTH_USER = " & Request.ServerVariables("AUTH_USER")

to display the username. If it comes up blank, you are using the IUSR_machine account.
There is a wya to configure Active Directory to allow anonymous queries (MSKB article ID 320528) but I have not tested it, nore would I want to. Changing permissions on Active Directory can be a VERY BAD thing if done incorrectly. I seriously DO NOT RECOMMEND it.
A few other notes when you do your queries:
Querying a GC is faster than LDAP, however, the Global Catalog may not contain all of the fields you are looking for. But that can be easily modified. (MSKB article ID 229662)

I don't know when I will have the time to answer specific questions. I've been extremely busy. I will what I can as time permits.
I hope this clears up most questions out there.

 

[usctrojan]

Hi All,
I want to retieve the mail-quata,mail-usage,warning,username and email address of perticular user in MS Exchange server. Uptil now I am able to retrieve only the email address of perticular user. Now I wants to retrieve user's mail quata,mail usage and warning(warning means if perticular user has warning= -10 and mail-quata=60 then when user reaches to mail-usage=50 i want to shoot the warning ...bcz 60-10=50..) I hope you understand my needs of program.
Here is my code:
/*---------------------------------------------------------*/
Option Explicit
Dim strUsername,strUsernamea,strpassword,con,rs,Com,objADsPath,objDomain

Set objDomain = GetObject ("GC://rootDSE")
objADsPath = objDomain.Get("defaultNamingContext")
Set objDomain = Nothing
Set con = CreateObject("ADODB.Connection")
con.provider ="ADsDSOObject"
'con.Properties("User ID") = "BURLINGTON\"+strUsername
'con.Properties("Password") = strpassword
con.open "Active Directory Provider"
Set Com = CreateObject("ADODB.Command")
Set Com.ActiveConnection = con
Com.CommandText ="select mail FROM 'GC://"+objADsPath+"' where sAMAccountName='vsavalia'"
Set rs = Com.Execute

msgbox rs("mail")
rs.Close
con.Close
Set rs = Nothing
Set con = Nothing
/*-----------------------------------------------------------*/

 

[usctrojan]

dfdsfdsf