Mon 11 Feb 2008
Using OpenLDAP to query Active Directory
Posted by Steve under Active Directory , Technology[2] Comments
Jay R. Wren has a great post on how to do this:
querying-active-directory-with-unix-ldap-tools
What Jay did not mention is how to search the Global Catalog (GC). The global catalog contains a partial replica of all objects in the forest. To find Domain Controllers that are serving as Global Catalogs you simply need to query DNS SRV Records. Global Catalog SRV Records take the following form: _ldap._tcp.gc._msdcs.MYINETDOMAIN.com
host -av _ldap._tcp.gc._msdcs.MYINETDOMAIN.com
The key to being able to query active directory from linux machines is DNS. The Host command can be used to look at DNS for AD SRV and A records. These records contain names and IPs of Active Directory Domain Controllers.
The only other information you need is the Global Catalog port: 3268
Putting this all together, you should have:
ldapsearch -xLLL -h IPofGC -p 3268 -b dc=MYINETDOMAIN,dc=com -D ME@MYINETDOMAIN.com -w passwd [filter] [attribute list]
Finally, I have created a shell script called GC.sh that behaves like “ldapsearch”
HOST=`host -av _ldap._tcp.gc._msdcs.MYINETDOMAIN |tail -3 |head -1 |awk '{print $5}'`
echo "using $HOST"
ldapsearch \-xLLL \-h $HOST \-p 3268 \-b dc\=MYINETDOMAIN,dc\=COM \-D "ME@MYINETDOMAIN.com" \-w xxxxxxxx $1 $2 $3 $4 $5 $6
$1 is the filter.
$2-6 are attributes that you wish returned
Leave $2-6 blank if you wish to return all attributes.
Ex: ./GC.sh cn=jrwren hascsharpskills hasmathskills
dn: cn=jrwren,ou=users,dc=myinetdomain,dc=com
hascsharpskills: 1
hasmathskills: 0