-
Notifications
You must be signed in to change notification settings - Fork 91
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GetGroupsOfUser() for Active Directory database #13
Comments
Using this in a project I'm working on with AD and this took me a bit to find out. "(&(member=%s)(objectClass=group))" where "%s" is the user distinguished name -- I just grabbed the user dn from the attributes once they were authenticated. Hope this helps. |
I'm trying to use AD for authorization only.. I bind as a read-only user to query the list of groups a user is in, and I'm having a heck of a time getting the GroupFilter written properly to get anything but an empty set of groups. If you have a code example of how you're making this work, I would be very grateful, @arpachuilo! |
@eklein I've changed jobs since then, so I don't have access to the codebase to share a snippet -- nor do I remember what I did. I hazily remember using Not much, but hope this helps. |
I thought I had cracked this with Time to create a quick helper function to grab the DN I guess |
@eklein My // GetGroupsOfUser returns the group for a user.
func (lc *LDAPClient) GetGroupsOfUser(username string) ([]string, error) {
err := lc.Connect()
if err != nil {
return nil, err
}
defer lc.Close()
// First Bind with read only user
if lc.BindDN != "" && lc.BindPassword != "" {
err = lc.Conn.Bind(lc.BindDN, lc.BindPassword)
if err != nil {
return nil, err
}
}
// Get the users DN
// Search for the given username
searchRequest := ldap.NewSearchRequest(
lc.Base,
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
fmt.Sprintf(lc.UserFilter, username),
[]string{"dn"},
nil,
)
sr, err := lc.Conn.Search(searchRequest)
if err != nil {
return nil, err
}
if len(sr.Entries) != 1 {
return nil, errors.New("User does not exist")
}
userdn := sr.Entries[0].DN
searchRequest = ldap.NewSearchRequest(
lc.Base,
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
fmt.Sprintf(lc.GroupFilter, userdn),
[]string{"cn"}, // can it be something else than "cn"?
nil,
)
sr, err = lc.Conn.Search(searchRequest)
if err != nil {
return nil, err
}
groups := []string{}
for _, entry := range sr.Entries {
groups = append(groups, entry.GetAttributeValue("cn"))
}
return groups, nil
} |
Wish I would have seen this about 10 minutes ago 😂. I just sat down and wrote a helper function to do the same. This indeed did work for me, though I wonder if this breaks things when using openldap. Need to look into that since I have a need to authenticate against both. Thank you both very much for your help! @arpachuilo @Joffcom |
To follow-up, it does indeed break when trying to authenticate against openldap. I'll need to rewrite things to support both based on whether it's openldap or AD. |
Hi |
Good question @abolinhas, I have not really played with this for a couple of years now but I would have expected it to work with the primary group as well as the user would still be a member 🤔 I don't have an AD server to test against anymore either. |
What would be the GroupFilter in that case? User filter is "(sAMAccountName=%s)", BTW
The text was updated successfully, but these errors were encountered: