#206456 - 2012-12-12 11:52 PM
Use LDAP Custom Attribute in drive mapping
|
CivGeek
Just in Town
Registered: 2004-07-28
Posts: 3
|
Hey folks,
I'm a very lightweight Kix user with no scripting background. I've read through some of the LDAP query material in the documentation and my head is going to explode.
I'll spare you the back story on the situation. It's a mess.
I need a Kix logon script that will pull the value of the logging-on user's Active Directory user account attribute and then use it in the path of a drive mapping.
So, for example, if I use the EmployeeID attribute and I give it a value of "1234" for the user that is logging in. I need Kix to pull "1234" from the logging-in user's account and then turn around and use it in a drive mapping like USE G: \\SERVER\1234.
I should also mention that the user accounts won't all be in the same OU in Active Directory. However, all the user accounts will be in the same domain.
I'm not getting the LDAP query part. I'd appreciate any examples that are specifically for this purpose.
Thanks!
Bill
|
|
Top
|
|
|
|
#206457 - 2012-12-13 02:45 AM
Re: Use LDAP Custom Attribute in drive mapping
[Re: CivGeek]
|
Glenn Barnas
KiX Supporter
   
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
Bill
Welcome to KORG!
We have a pre-made login script that will do what you want. You can register and download a copy from our web site (see my sig).
Look at the "Value Rewrite" capabilities - it allows you to take a value, such as OU, Computer, Computer OU, Subnet, Site, etc.. and use it in a lookup table to define part or all of the resource path. Our recent release allows you to use any LDAP attribute in the authorization process, such as Employee ID, Manager, Department, etc..
The script is free for small environments, and we provide 2 free email support requests and full (paid) commercial support. Large enterprises pay a small fee for use based on environment size, but we offer additional support sessions as part of the deal. We can also analyze your requirements and do a full implementation, usually in just a few days turnaround if that sounds interesting.
You can view the entire Administration Guide in PDF without downloading anything, right from the product page. Go to Products / Universal Login Script.
If you want to go it yourself, the ADSIUserInfo UDF will be your best friend. The latest can be downloaded from the Resources micro-site on our web site. LDAPQuery() is also availble for ldap-specific queries.
Glenn
_________________________
Actually I am a Rocket Scientist!
|
|
Top
|
|
|
|
#206462 - 2012-12-13 01:20 PM
Re: Use LDAP Custom Attribute in drive mapping
[Re: CivGeek]
|
Mart
KiX Supporter
   
Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
|
Glenn’s solution is nice and works like a charm but off course there are always multiple ways to get what you want. If you prefer to do it yourself then the code below is an option. Maybe not the nicest one but it should get you going in the right direction. The TranslateName() UDF is included and should not be modified. A full list of all available UDFs can be found in the UDF section of this board.
;Get all users from the current domain.
$oDomain = GetObject("WinNT://" + @LDomain)
$oDomain.filter = "User", ""
For Each $user in $oDomain
If $user.name = @USERID
$userhome = TranslateName(3, "", 3, @LDomain + "\" + $user.name, 1)
$userinfo = GetObject("LDAP://" + $userhome[0])
;Get user data.
$empID = $userinfo.EmployeeID
EndIf
Next
Use G: "\\server\" + $empid
;Below is a UDF. Do not modify the UDF, it is ready for use.
;
;FUNCTION TranslateName()
;
;AUTHOR
; Howard A. Bullock (hbullock@tycoelectronics.com)
;
;VERSION
; 2.0
;
;ACTION
; Translates from one name type to another. Good for converting an NT4 name
; like domain\user into an LDAP distinguished name or the reverse.
;
;SYNTAX
; TranslateName ($InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType)
;
;PARAMETERS
; $InitType (Required)
; - Integer value
; 1 = ADS_NAME_INITTYPE_DOMAIN
; Initializes a NameTranslate object by setting the domain that the object will bind to.
;
; 2 = ADS_NAME_INITTYPE_SERVER
; Initializes a NameTranslate object by setting the server that the object will bind to.
;
; 3 = ADS_NAME_INITTYPE_GC
; Initializes a NameTranslate object by locating the global catalog to which the object
; will bind.
;
; $BindName (Required)
; - String value
; If an $InitType = 3 (ADS_NAME_INITTYPE_GC), then the $BindName = "".
; InitTypes 1 And 2 require a name of a domain Or server to be input.
; Note: "" may default to the current server or domain.
;
; $LookupNameType (Required)
; - Integer value
;
; $LookupName (Required)
; - String value see below
;
; $ReturnNameType (Required)
; - Integer value see below
;
; Documentation of Name Types. Lookup the more info on http://MSDN.Microsoft.com
; Not all name types work. "1", "2", and "3" have been the most useful.
;
; 1 = ADS_NAME_TYPE_1779
; Name format as specified in RFC 1779. For example, "CN=Jane Doe,CN=users, DC=Microsoft, DC=com".
;
; 2 = ADS_NAME_TYPE_CANONICAL
; Canonical name format. For example, "Microsoft.com/Users/Jane Doe".
;
; 3 = ADS_NAME_TYPE_NT4
; Account name format used in Microsoft® Windows© NT® 4.0. For example, "Microsoft\JaneDoe".
;
; 4 = ADS_NAME_TYPE_DISPLAY
; Display name format. For example, "Jane Doe".
;
; 5 = ADS_NAME_TYPE_DOMAIN_SIMPLE
; Simple domain name format. For example, "JaneDoe@Microsoft.com".
;
; 6 = ADS_NAME_TYPE_ENTERPRISE_SIMPLE
; Simple enterprise name format. For example, "JaneDoe@Microsoft.com".
;
; 7 = ADS_NAME_TYPE_GUID
; Global Unique Identifier format. For example, {95ee9fff-3436-11d1-b2b0-d15ae3ac8436}.
;
; 8 = ADS_NAME_TYPE_UNKNOWN
; Unknown name type. The system will try to make the best guess.
;
; 9 = ADS_NAME_TYPE_USER_PRINCIPAL_NAME
; User principal name format. For example, "JaneDoe@Fabrikam.com".
;
; 10 = ADS_NAME_TYPE_CANONICAL_EX
; Extended canonical name format. For example, "Microsoft.com/Users Jane Doe".
;
; 11 = ADS_NAME_TYPE_SERVICE_PRINCIPAL_NAME
; Service principal name format. For example, "www/www.microsoft.com@microsoft.com"
;
; 12 = ADS_NAME_TYPE_SID_OR_SID_HISTORY_NAME
; A SID string, as defined in the Security Descriptor Definition Language (SDDL), for either
; the SID of the current object or one from the object's SID history.
; For example, "O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)" For more information see
; Security Descriptor String Format under "Security" in the Microsoft Platform SDK documentation.
;
;REMARKS
; Not name types seem to work.
;
;RETURNS
; This function returns an ARRAY of three values:
; Name of the type specified by $ReturnNameType (String)
; Error number (Long Integer)
; Error text (String).
;
;DEPENDENCIES
; OS: Active Directory aware client
;
;EXAMPLES
; $DN = TranslateName (3, "", 3, "@Domain\@wksta$", 1)
; ? "DN = " + $DN[0]
; ? "Error = " + $DN[1]
; ? "ErrorText = " + $DN[2]
;
; $DN = TranslateName (3, "", 3, "@LDomain\@userid", 1)
; ? "DN = " + $DN[0]
; ? "Error = " + $DN[1]
; ? "ErrorText = " + $DN[2]
;
Function TranslateName($InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType)
Dim $InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType
Dim $NameTranslate, $ReturnName, $Error, $ErrorText
$Error = 0
$ErrorText = ""
$ReturnName = ""
$NameTranslate = CreateObject("NameTranslate")
$Error = @error
$ErrorText = @serror
If $Error = 0
$NameTranslate.Init($InitType, $BindName)
$Error = @error
$ErrorText = @serror
If $Error = 0
$NameTranslate.Set($LookupNameType, $LookupName)
$Error = @error
$ErrorText = @serror
If $Error = 0
$ReturnName = $NameTranslate.Get($ReturnNameType)
$Error = @error
$ErrorText = @serror
EndIf
EndIf
EndIf
$TranslateName = $ReturnName, $Error, $ErrorText
EndFunction
_________________________
Mart
- Chuck Norris once sold ebay to ebay on ebay.
|
|
Top
|
|
|
|
#206464 - 2012-12-13 04:28 PM
Re: Use LDAP Custom Attribute in drive mapping
[Re: Mart]
|
CivGeek
Just in Town
Registered: 2004-07-28
Posts: 3
|
Thanks for the quick responses guys. Sorry if this is like teaching a dog to use an abacus.
@Mart I took the top portion of your code and put it into a script. I get "expected ')'!" in line 7.
Here is the exact script:
;Get all users from the current domain.
$oDomain = GetObject("WinNT://" + @LDomain)
$oDomain.filter = "User", ""
For Each $user in $oDomain
If $user.name = @USERID
$userhome = TranslateName(3, "", 3, @LDomain + "\" + $user.name, 1)
$userinfo = GetObject("LDAP://" + $userhome[0])
;Get user data.
$empID = $userinfo.EmployeeID
EndIf
Next
? "Employee ID is" $empid
? "Domain is" + @LDomain
Use H: "\\civwro990\" + $empid
Edited by CivGeek (2012-12-13 04:33 PM)
|
|
Top
|
|
|
|
#206471 - 2012-12-13 05:00 PM
Re: Use LDAP Custom Attribute in drive mapping
[Re: ShaneEP]
|
CivGeek
Just in Town
Registered: 2004-07-28
Posts: 3
|
Yep, that was it.
Do you mind explaining how the top part of the script calls on the bottom part? I see line 7 has "TranslateName" in it. Does it then look through the rest of the script for that function? I looked through the Kix document for TranslateName and didn't find anything. Is that something purely of Howard Bullock's making?
What is the overhead of this routine like? Should I expect any problems with 300 users logging in and out everyday 2 or 3 times a day?
Thanks again!
|
|
Top
|
|
|
|
#206478 - 2012-12-13 07:40 PM
Re: Use LDAP Custom Attribute in drive mapping
[Re: Mart]
|
Glenn Barnas
KiX Supporter
   
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
The ULS is used in environments of 15-20,000 users without issue and, depending on the number of resources being processed, can complete in sub-second times. In real-world testing, it can process 12 resources (11 direct, 1 lookup) in 0.88 seconds, and 40 resources with six 500-record lookup tables in under 8 seconds The script has a timestamp logging option with 1-ms resolution so you can optimize performance on a per-resource basis.
The login script config file defines a set of resource data. There are two formats that will do what you need: PATH=\\server\share\&AD:AttributeName& This changes the lookup tag "&AD:AttributeName&" to the value read from AD for the current user. If the value is empty, this resource is ignored. This example uses a fixed server and share with a variable subfolder. The lookup can replace any part or all of the path string.
PATH=&AD:AttributeName:TableName& This example changes the lookup tag by obtaining the value associated with the defined attribute for the current user. This value is then used to locate a match in the lookup table. If "TableName" was "AD_Lookup" and the value of the "Department" attribute was "Northeast Sales", the following table would be scanned and the path associated with Northeast Sales would be used. [AD_Lookup] Southeast Sales=\\server1\share\folder Northeast Sales=\\server2\share\folder
As for coding it yourself: The UDFs I referenced earlier use direct calls to first translate a userid to a DN string, and then use the DN string and LDAP attribute to return the value - no enumeration, so very fast. Calling the UDF with just the userid returns the DN string, so no complex external coding, either.
Glenn
_________________________
Actually I am a Rocket Scientist!
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 2312 anonymous users online.
|
|
|