Quantcast

LDAP: How get all users belongs to a group.

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

LDAP: How get all users belongs to a group.

sajuptpm
Hi,
How get all users belongs to a group using python ldap module.
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

Ken Watford-3
On Thu, Jun 23, 2011 at 9:14 AM, sajuptpm <[hidden email]> wrote:
> Hi,
> How get all users belongs to a group using python ldap module.

Depends on what you mean by "users" and "group", what information you
already have, and what information you want to get. I'll assume you
mean posix accounts and groups, and that you already know how to
connect to the LDAP server.

If you already know the distinguished name of the group, you can get a
list of the member names like so (ignoring error handling):

dn, entry = connection.search_s(group_dn, ldap.SCOPE_BASE)[0]
member_list = entry['memberUid']

That will only get you the usernames. If you need to get the user's
entry (or don't know the group_dn above), then you'll have to do a bit
more searching.

To find a user's entry given their uid:

results = connection.search_s(base_dn, ldap.SCOPE_SUBTREE, "(uid=*)")
for dn, entry in results:
     if uid in entry['uid']:
         # this is your guy. return, or break, or whatever

The "(uid=*)" filter just means to only find entries that have user id
fields. If you wanted to be more specific about it, you could limit it
to only posixAccount objects with "(objectClass=posixAccount)". This
would probably be necessary if you wanted to search for groups (via
"(objectClass=posixGroup)" ), since those don't have a special field
for their name - they usually just use the cn (common name) field for
that. A slightly more complex filter could be written to avoid the
python loop.

If your groups are not posixGroup objects but instead groupOfNames,
then the appropriate attribute is "member" rather than "memberUid",
and the values there are user DNs instead of uids. In that case, if
you need the uid you'll have to look up those users and pull it out.
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

Michael Ströder
In reply to this post by sajuptpm
sajuptpm wrote:
> How get all users belongs to a group using python ldap module.

There are several ways of storing grouping information in a LDAP server.

I assume the groups are normal group entries of object class 'groupOfNames'
which is most commonly used. Such an entry has the attribute 'member' which
contains DNs of all member entries which you would have to read yourself. This
can be quite annoying for large group entries since you would have to send a
search request for each group member.

Therefore on some servers you can search for a back-link attribute in the user
entries. Most times it's called 'memberOf' or 'isMemberOf'. But this depends
on the server's implemented features and configuration.

Which LDAP server are you using?

Ciao, Michael.
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

sajuptpm
Hi,
Thanks for reply.

dn: cn=My-Group-1, ou=Groups, o=CUST
equivalentToMe: cn=TDS7034,ou=Internal PCA,o=CUST
objectClass: groupOfNames  <------------
objectClass: top
objectClass: swarePointers
ACL: 2#entry#[Root]#member
cn: My-Group-1
member: cn=AJP2203,ou=Internal PCA,o=CUST
member: cn=AZE9632,ou=Internal PCA,o=CUST
member: cn=BTC4979,ou=Internal PCA,o=CUST


* I have group definition in LDAP server as above.
* How fetch all members from this perticular group 'My-Group-1' using
python-ldap module.
* I tried, but i don't know how do it.
* I want to get those 3 members from group 'My-Group-'



--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

sajuptpm
I am using Openldap (openldap 2.3.43-12.el5_5.2  and openldap.i386
0:2.3.43_2.2.29-12.el5_6.7)
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

sajuptpm
In reply to this post by sajuptpm
------------------------------------------- User

cn=AJP2203,ou=Internal PCA,o=CUST has group memberships
to the following Groups:
groupMembership: cn=My-Group-1,ou=Groups,o=CUST
groupMembership: cn=My-Group-2,u=Groups,o=CUST
groupMembership: cn=My-Group-3,ou=Groups,o=CUST

------------------------------------------- Group

dn: cn=My-Group-1, ou=Groups, o=CUST
equivalentToMe: cn=TDS7034,ou=Internal PCA,o=CUST
objectClass: groupOfNames  <------------
objectClass: top
objectClass: swarePointers
ACL: 2#entry#[Root]#member
cn: My-Group-1
member: cn=AJP2203,ou=Internal PCA,o=CUST
member: cn=AZE9632,ou=Internal PCA,o=CUST
member: cn=BTC4979,ou=Internal PCA,o=CUST

-----------------

* We will get groups of a member from member record, using key
'groupMembership'.
* But i want to get members belogs to a particular group Eg:'My-
Group-1'
* Have any method in python-ldap model for this ???
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

Michael Ströder
sajuptpm wrote:

> ------------------------------------------- User
>
> cn=AJP2203,ou=Internal PCA,o=CUST has group memberships
> to the following Groups:
> groupMembership: cn=My-Group-1,ou=Groups,o=CUST
> groupMembership: cn=My-Group-2,u=Groups,o=CUST
> groupMembership: cn=My-Group-3,ou=Groups,o=CUST
>
> ------------------------------------------- Group
>
> dn: cn=My-Group-1, ou=Groups, o=CUST
> equivalentToMe: cn=TDS7034,ou=Internal PCA,o=CUST
> objectClass: groupOfNames  <------------
> objectClass: top
> objectClass: swarePointers
> ACL: 2#entry#[Root]#member
> cn: My-Group-1
> member: cn=AJP2203,ou=Internal PCA,o=CUST
> member: cn=AZE9632,ou=Internal PCA,o=CUST
> member: cn=BTC4979,ou=Internal PCA,o=CUST
>
> -----------------
>
> * We will get groups of a member from member record, using key
> 'groupMembership'.
> * But i want to get members belogs to a particular group Eg:'My-
> Group-1'

If this is the server's data the LDAP server seems to be Novell eDirectory not
OpenLDAP.

I'd try member search with this filter:

  (groupMembership=cn=My-Group-1,ou=Groups,o=CUST)

Ciao, Michael.
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

John Gordon-2
In reply to this post by sajuptpm
In <[hidden email]> sajuptpm <[hidden email]> writes:

> dn: cn=My-Group-1,ou=Groups,o=CUST
> member: cn=AJP2203,ou=Internal PCA,o=CUST
> member: cn=AZE9632,ou=Internal PCA,o=CUST
> member: cn=BTC4979,ou=Internal PCA,o=CUST

> * I have group definition in LDAP server as above.
> * How fetch all members from this perticular group 'My-Group-1' using
> python-ldap module.
> * I tried, but i don't know how do it.
> * I want to get those 3 members from group 'My-Group-'

This code should work, although I haven't tested it:

import ldap

uri = "my hostname and port"
user = "my username"
password = "my password"

ldapClient = ldap.initialize(uri)
ldapClient.set_option(ldap.OPT_REFERRALS, 0)

ldapClient.bind(user, password)

results = ldapClient.search_s("cn=My-Group-1,ou=Groups,o=CUST", ldap.SCOPE_BASE)

for result in results:
  result_dn = result[0]
  result_attrs = result[1]

  if "member" in result_attrs:
    for member in result_attrs["member"]:
      print member

ldapClient.unbind_s()

--
John Gordon                   A is for Amy, who fell down the stairs
[hidden email]              B is for Basil, assaulted by bears
                                -- Edward Gorey, "The Gashlycrumb Tinies"

--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

sajuptpm
results = ldapClient.search_s("cn=My-Group-1,ou=Groups,o=CUST",
ldap.SCOPE_BASE)

Is this method work for all types of groups (groupOfNames,
posixGroup) ???

have to implement user search/fetch separately for each groups ???
--
http://mail.python.org/mailman/listinfo/python-list
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: LDAP: How get all users belongs to a group.

Michael Ströder
sajuptpm wrote:
> results = ldapClient.search_s("cn=My-Group-1,ou=Groups,o=CUST",
> ldap.SCOPE_BASE)
>
> Is this method work for all types of groups (groupOfNames,
> posixGroup) ???

Yes, but the member attribute differs.

'member' in entries of object class 'groupOfNames' contains the DN of the
member's entry.

'memberUID' in entries of object class 'posixGroup' contains the 'uid' of the
member's entry if the original RFC 2307 is used. If the LDAP server uses a
draft-howard-rfc2307bis it behaves like groupOfNames.

Also there's object class 'groupOfUniqueNames' used most times on Sun DS which
contains the DN of the member's entry in attribute 'uniqueMember'.

Additionally organizationalRole -> roleOccupant contains DN of the member's
entry...

The default config of my web2ldap contains even more:

--------------------------------- snip ---------------------------------

    # The definitions for group entry administration
    groupadm_defs={
      'groupOfNames':       ('member',None),
      'groupOfUniqueNames': ('uniqueMember',None),
      'organizationalRole': ('roleOccupant',None),
      'rfc822MailGroup':    ('mail','mail'),
      'nisMailAlias':       ('rfc822MailMember','mail'),
      'mailGroup':          ('mgrprfc822mailmember','mail'),
      # Found on IBM SecureWay Directory
      'accessGroup':        ('member',None),
      # RFC2370
      'posixGroup':         ('memberUid','uid'),
      'nisNetgroup':        ('memberNisNetgroup','uid'),
      # Samba 3.0
      'sambaGroupMapping':  ('sambaSIDList','sambaSID'),
      # Active Directory
      'group':              ('member',None),
      # draft-findlay-ldap-groupofentries
      'groupOfEntries':     ('member',None),
      # Apple MAC OS X
      'apple-group':        ('apple-group-memberguid','apple-generateduid'),
    },

--------------------------------- snip ---------------------------------

Ciao, Michael.
--
http://mail.python.org/mailman/listinfo/python-list
Loading...