<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Drop By! &#187; ldap</title>
	<atom:link href="http://www.rekk.de/bloggy/category/ldap/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.rekk.de/bloggy</link>
	<description>Dropping Brain Crumbs ...</description>
	<lastBuildDate>Wed, 09 Jun 2010 16:59:11 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.4</generator>
		<item>
		<title>LDAP Query to Find Groups for a Member</title>
		<link>http://www.rekk.de/bloggy/2009/ldap-query-to-find-groups-for-a-member/</link>
		<comments>http://www.rekk.de/bloggy/2009/ldap-query-to-find-groups-for-a-member/#comments</comments>
		<pubDate>Thu, 24 Dec 2009 13:16:43 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[ldap]]></category>

		<guid isPermaLink="false">http://www.rekk.de/bloggy/?p=158</guid>
		<description><![CDATA[Situation: You have a lot of groups as groupOfNames in you ldap directory. How to find all such groups a known member belongs to? The goupOfNames object might look similiar to this: dn: cn=TestGroup, o=TestOne, dc=rekk, dc=de objectClass: dcObject objectClass: groupOfNames cn: cn=TestGroup dc: dc=TestGroup description: Some test group member: uid=00001 member: uid=00011 member: uid=schwarz,dc=Test [...]]]></description>
			<content:encoded><![CDATA[<p>Situation: You have a lot of groups as groupOfNames in you ldap directory. How to find all such groups a known member belongs to?</p>
<p>The goupOfNames object might look similiar to this:<br />
<pre><code>dn: cn=TestGroup, o=TestOne, dc=rekk, dc=de
objectClass: dcObject
objectClass: groupOfNames
cn: cn=TestGroup
dc: dc=TestGroup
description: Some test group
member: uid=00001
member: uid=00011
member: uid=schwarz,dc=Test DC,dc=rekk,dc=de</code></pre></p>
<p>The query would be for uid=schwarz:<br />
<code>(member=uid=schwarz,dc=Test DC,dc=rekk,dc=de)</code></p>
<p>or more specific:<br />
<code>(&amp;amp;(objectclass=groupofnames)(member=uid=schwarz,dc=Test DC,dc=rekk,dc=de)</code></p>
<p>Also see <a href="http://www.rekk.de/bloggy/2007/ldap-query-adventures/">LDAP Query Adventures</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.rekk.de/bloggy/2009/ldap-query-to-find-groups-for-a-member/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>LDAP Query Adventures</title>
		<link>http://www.rekk.de/bloggy/2007/ldap-query-adventures/</link>
		<comments>http://www.rekk.de/bloggy/2007/ldap-query-adventures/#comments</comments>
		<pubDate>Sun, 27 May 2007 16:23:01 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[ldap]]></category>
		<category><![CDATA[programming]]></category>
		<category><![CDATA[software]]></category>

		<guid isPermaLink="false">http://www.rekk.de/bloggy/?p=16</guid>
		<description><![CDATA[Today I worked on a Jelly script to import users to Jira. Such a script you can create automatically using a scripting language of your choice, in my case I try Python. The primary source for the users and groups data would be an organically grown LDAP of a public organization. I had to find [...]]]></description>
			<content:encoded><![CDATA[<p>Today I worked on a <a HREF="http://jakarta.apache.org/commons/jelly/">Jelly</a> script to import users to <a HREF="http://www.atlassian.com/software/jira/">Jira</a>. Such a script you can create automatically using a scripting language of your choice, in my case I try Python. The primary source for the users and groups data would be an organically grown LDAP of a public organization.</p>
<p>I had to find out that there is more about LDAP (Version 3) queries or filters (described in <a HREF="http://www.rfc-editor.org/rfc/rfc4515.txt">RFC 4515</a> ) then just the straight forward examples like:<br />
<code>(objectclass=inetorgperson)</code><br />
- finds all entries with objectClass equal to inteOrgPerson<br />
<code>(cn=*Inter*)</code><br />
- finds all entries with &#8220;Inter&#8221; appearing somewhere within the cn (common name) attribute<br />
<code>(!(cn=*Inter*))</code><br />
- finds all entries without &#8220;Inter&#8221; appearing somewhere within the cn (common name) attribute<br />
<code>(&amp;amp;(ou=universit*)(l=Berlin))</code><br />
- finds all entries with ou starting with &#8220;universit&#8221; AND l equal to Berlin (trying to find universities located in Berlin)<br />
<code>(&amp;amp;(|(ou=universit*)(ou=hochschule*))(l=Berlin))</code><br />
- now we added an OR ( | ) to the query to find entries with &#8220;universit&#8221; or &#8220;hochschule&#8221; in ou (organizational unit), cause &#8220;hochschule&#8221; means literally &#8220;high school&#8221; in german, i.e. &#8220;almost&#8221; a university</p>
<p>I find useful to know:<br />
<code>(&amp;amp;(objectClass=inetorgperson)(mail=*))</code><br />
- finds inetOrgPersons with nonempty mail attribute<br />
<code>(&amp;amp;(objectClass=inetorgperson)(!(mail=*)))</code><br />
- finds the same but with an empty mail attribute</p>
<p>More complex queries (extensible match search):<br />
<code>(ou:dn:=bibliotheken)</code><br />
-  matches part of a dn (or better: treat attributes used within dn&#8217;s string  as if they would be regular attributes of the entry)  in that case entries like that: dn=&#8230;,ou=bibliotheken,dc=mydomain,dc=de<br />
<code>(ou:dn:=bibliotheken*)</code><br />
- does not work!</p>
<p>General matching rules can be used (see <a HREF="http://www.rfc-editor.org/rfc/rfc4517.txt">RFC 4517</a>) within the extensible match search. Match rules are identified by OIDs or names. So:<br />
<code>(uid:2.5.13.5:=John)</code><br />
is the same as<br />
<code>(uid:caseExactMatch:=John)</code><br />
And<br />
<code>(uid=John)</code><br />
the same as<br />
<code>(uid:caseIgnoreMatch:=john)</code><br />
or<br />
<code>(uid:2.5.13.2:=john)</code></p>
<p>To <strong>escape</strong> characters which have a special meaning use<br />
&#8216;*&#8217; &#8211; \2a, &#8216;(&#8216; &#8211; \28, &#8216;)&#8217; &#8211; \29, &#8216;\&#8217;  &#8211; \5c, &#8216;NUL&#8217;- \00, &#8216;/&#8217; &#8211; \2f .<br />
<code>(cn=*\2a*)</code><br />
- finds entries with  &#8220;cn&#8221; attribute containing a value with the character &#8220;*&#8221; anywhere in it.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.rekk.de/bloggy/2007/ldap-query-adventures/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>

