mORMot Open Source

Stemon63

Member

Registered: 2016-10-24

Posts: 50

LDAP Active Directory list users

Hi,
I have used this code for extract a list of users of an Active Directory.
Congratulations, really fast!
But it return only the first 1000 elements, while the users are 16000.
What am I doing wrong? Or is there a preset limit?

Thanks in advance!

with TLdapClient.Create do
  try
      if BindSaslKerberos then
            memo1.Lines.Add(' authenticated via Kerberos');
      //Search(WellKnownObjects.Users, false, '', []);
      tmpBaseDN := 'OU=GroupA1,DC=dmlocaltest,DC=com';
      Search(tmpBaseDN, false, '', []);
      memo1.Lines.Add(SearchResult.Dump);
  finally
      Free;
  end;

Last edited by Stemon63 (2023-09-06 15:09:29)

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

I guess you need to use paging, i.e. ask for more results with additional calls.

Stemon63

Member

Registered: 2016-10-24

Posts: 50

Re: LDAP Active Directory list users

Ok, Ab.
There is anny little example of a paging ? Thanks in advance!

(I take advantage:  in function TLdapClient.GetUserInfo(const AN, DN, UPN: RawUtf8;
  out Info: TLdapUser; const BaseDN: RawUtf8; WithMemberOf: boolean;
  const CustomAttributes: TRawUtf8DynArray): boolean;

Param UPN Declared but never  used)

Thanks a lot :-)

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

You should set SearchPageSize to a number of items per chunk.
Then call Search() again until it is eventually empty.
And don't forget to reset SearchCookie to '' for the next query. And SearchPageSize back to 0 to disable paging.

I have added the new TLdapClient.SearchBegin/SearchEnd wrapper methods, which may help.
See https://github.com/synopse/mORMot2/commit/6b496795

About the UPN, see https://github.com/synopse/mORMot2/commit/bef7b085

Stemon63

Member

Registered: 2016-10-24

Posts: 50

Re: LDAP Active Directory list users

Hi Ab.
Thanks, It works.
Although it took some time to understand that it was the cookie that should return empty :-)
However I take advantage of a small oversight: in .GetUserInfo, .userPrincipalName is always empty in out Info: LdapUser.
Thanks a lot for help :-)

vs

Member

Registered: 2019-10-21

Posts: 38

Re: LDAP Active Directory list users

Hi Ab.

The call

TLdapClient.GetGroupInfo('', vBaseDN, vLdapGroup, '', True);

Successfully returns the corresponding group (vLdapGroup) with N members.
One of the member from this group has DN returned by vLdapGroup.member[k] kind of 'CN=Super User,OU=1\+2 MEDIA,OU=Domain Users,DC=1plus2,DC=corp';

To determine sAMAccountName for this user, the next call

TLdapClient.GetUserInfo('', vLdapGroup.member[k], '', vLdapUser);

returns an error
Invalid input name: CN=Super User,OU=1\+2 MEDIA,OU=Domain Users,DC=1plus2,DC=corp

If I remove \ before +, then such a user does not exist.
The actual name of this OU is "1+2 Media" without quotes.

How to correctly call a TLdapClient.GetUserInfo with such a parameter?

In continuation of our conversation, this is not a problem of non ASCII characters, rather this is a problem of special characters for AD.

Thanks a lot.

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

The current code refuses to create such requests, IIRC.
This was made on purpose to avoid injection.

I will look into it.

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

Please try https://github.com/synopse/mORMot2/commit/5a61008e

I was not able to find an AD to reproduce your problem, but at least it should pass the right parameter, and I was able to use escaped chars in the DN value on Samba.

Which kind of AD is it using? (MS/Samba?)

vs

Member

Registered: 2019-10-21

Posts: 38

Re: LDAP Active Directory list users

It is MS.
I tried it, but unfortunately parameter passes, but TLdapClient.GetUserInfo returns false.
I.e. Search returns true but SearchResult.Count = 0.

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

Did you try both OU=1\+2 MEDIA and OU=1+2 MEDIA content?

Can you enable the application console, and define a ASNDEBUG conditional and report the output to the console during the search?

vs

Member

Registered: 2019-10-21

Posts: 38

Re: LDAP Active Directory list users

Did you try both OU=1\+2 MEDIA and OU=1+2 MEDIA content?

Yes. Same results.

Can you enable the application console, and define a ASNDEBUG conditional and report the output to the console during the search?

Sorry. I do not have permission to publish the log of communication with the corporate AD server. Can I send the log to your email address?

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

Yes, you can send it to me by email.

vs

Member

Registered: 2019-10-21

Posts: 38

Re: LDAP Active Directory list users

Hi Ab.
Was the log I sent useful?

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,662

Website

Re: LDAP Active Directory list users

Sorry for the non-response.

I remember having looked at the issue, but I don't remember if I succeeded into fixing it.
Could you try with the last version of mORMot?

vs

Member

Registered: 2019-10-21

Posts: 38

Re: LDAP Active Directory list users

For today's commit, "2.2.6617" works fine. Thank you!
But strangely, I followed https://github.com/synopse/mORMot2/commits/master every day and did not see any changes regarding this issue.
Probably I was inattentive and missed it))))
That's why I decided to bother you today.