Page 1 of 1 1
Topic Options
#206456 - 2012-12-12 11:52 PM Use LDAP Custom Attribute in drive mapping
CivGeek Offline
Just in Town

Registered: 2004-07-28
Posts: 3
Hey folks,

I'm a very lightweight Kix user with no scripting background.
I've read through some of the LDAP query material in the documentation and my head is going to explode.

I'll spare you the back story on the situation. It's a mess.

I need a Kix logon script that will pull the value of the logging-on user's Active Directory user account attribute and then use it in the path of a drive mapping.

So, for example, if I use the EmployeeID attribute and I give it a value of "1234" for the user that is logging in. I need Kix to pull "1234" from the logging-in user's account and then turn around and use it in a drive mapping like USE G: \\SERVER\1234.

I should also mention that the user accounts won't all be in the same OU in Active Directory. However, all the user accounts will be in the same domain.

I'm not getting the LDAP query part. I'd appreciate any examples that are specifically for this purpose.

Thanks!

Bill

Top
#206457 - 2012-12-13 02:45 AM Re: Use LDAP Custom Attribute in drive mapping [Re: CivGeek]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
Bill

Welcome to KORG!

We have a pre-made login script that will do what you want. You can register and download a copy from our web site (see my sig).

Look at the "Value Rewrite" capabilities - it allows you to take a value, such as OU, Computer, Computer OU, Subnet, Site, etc.. and use it in a lookup table to define part or all of the resource path. Our recent release allows you to use any LDAP attribute in the authorization process, such as Employee ID, Manager, Department, etc..

The script is free for small environments, and we provide 2 free email support requests and full (paid) commercial support. Large enterprises pay a small fee for use based on environment size, but we offer additional support sessions as part of the deal. We can also analyze your requirements and do a full implementation, usually in just a few days turnaround if that sounds interesting.

You can view the entire Administration Guide in PDF without downloading anything, right from the product page. Go to Products / Universal Login Script.

If you want to go it yourself, the ADSIUserInfo UDF will be your best friend. The latest can be downloaded from the Resources micro-site on our web site. LDAPQuery() is also availble for ldap-specific queries.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#206462 - 2012-12-13 01:20 PM Re: Use LDAP Custom Attribute in drive mapping [Re: CivGeek]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
Glenn’s solution is nice and works like a charm but off course there are always multiple ways to get what you want. If you prefer to do it yourself then the code below is an option. Maybe not the nicest one but it should get you going in the right direction. The TranslateName() UDF is included and should not be modified. A full list of all available UDFs can be found in the UDF section of this board.

 Code:
;Get all users from the current domain.
$oDomain = GetObject("WinNT://" + @LDomain)
$oDomain.filter = "User", ""

For Each $user in $oDomain
	If $user.name = @USERID
		$userhome = TranslateName(3, "", 3, @LDomain + "\" + $user.name, 1)
		$userinfo = GetObject("LDAP://" + $userhome[0])
		;Get user data.
		$empID = $userinfo.EmployeeID
	EndIf
Next

Use G: "\\server\" + $empid


;Below is a UDF. Do not modify the UDF, it is ready for use.
;
;FUNCTION TranslateName()
;
;AUTHOR
;			Howard A. Bullock (hbullock@tycoelectronics.com)
;
;VERSION
;			2.0
;
;ACTION
;			Translates from one name type to another. Good for converting an NT4 name
;			like domain\user into an LDAP distinguished name or the reverse.
;
;SYNTAX
;			TranslateName ($InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType)
;
;PARAMETERS
;			$InitType (Required)
;				-  Integer value
;				1 = ADS_NAME_INITTYPE_DOMAIN
;				Initializes a NameTranslate object by setting the domain that the object will bind to.
;
;				2 = ADS_NAME_INITTYPE_SERVER
;				Initializes a NameTranslate object by setting the server that the object will bind to.
;
;				3 = ADS_NAME_INITTYPE_GC
;				Initializes a NameTranslate object by locating the global catalog to which the object
;				will bind.
;
;			$BindName (Required)
;				-  String value
;				If an $InitType = 3 (ADS_NAME_INITTYPE_GC), then the $BindName = "".
;				InitTypes 1 And 2 require a name of a domain Or server to be input. 
;				Note: "" may default to the current server or domain.
;
;			$LookupNameType (Required)
;				-  Integer value
;
;			$LookupName (Required)
;				-  String value see below
;
;			$ReturnNameType (Required)
;				-  Integer value see below
;
;				Documentation of Name Types. Lookup the more info on http://MSDN.Microsoft.com
;				Not all name types work. "1", "2", and "3" have been the most useful. 
;
;				1 = ADS_NAME_TYPE_1779
;				Name format as specified in RFC 1779. For example, "CN=Jane Doe,CN=users, DC=Microsoft, DC=com".
;
;				2 = ADS_NAME_TYPE_CANONICAL
;				Canonical name format. For example, "Microsoft.com/Users/Jane Doe".
;
;				3 = ADS_NAME_TYPE_NT4
;				Account name format used in Microsoft® Windows© NT® 4.0. For example, "Microsoft\JaneDoe".
;
;				4 = ADS_NAME_TYPE_DISPLAY
;				Display name format. For example, "Jane Doe".
;
;				5 = ADS_NAME_TYPE_DOMAIN_SIMPLE
;				Simple domain name format. For example, "JaneDoe@Microsoft.com".
;
;				6 = ADS_NAME_TYPE_ENTERPRISE_SIMPLE
;				Simple enterprise name format. For example, "JaneDoe@Microsoft.com".
;
;				7 = ADS_NAME_TYPE_GUID
;				Global Unique Identifier format. For example, {95ee9fff-3436-11d1-b2b0-d15ae3ac8436}.
;
;				8 = ADS_NAME_TYPE_UNKNOWN
;				Unknown name type. The system will try to make the best guess.
;
;				9 = ADS_NAME_TYPE_USER_PRINCIPAL_NAME
;				User principal name format. For example, "JaneDoe@Fabrikam.com".
;
;				10 = ADS_NAME_TYPE_CANONICAL_EX
;				Extended canonical name format. For example, "Microsoft.com/Users Jane Doe".
;
;				11 = ADS_NAME_TYPE_SERVICE_PRINCIPAL_NAME
;				Service principal name format. For example, "www/www.microsoft.com@microsoft.com"
;
;				12 = ADS_NAME_TYPE_SID_OR_SID_HISTORY_NAME
;				A SID string, as defined in the Security Descriptor Definition Language (SDDL), for either
;				the SID of the current object or one from the object's SID history.
;				For example, "O:AOG:DAD:(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)" For more information see
;				Security Descriptor String Format under "Security" in the Microsoft Platform SDK documentation.
;
;REMARKS
;			Not name types seem to work.
;
;RETURNS
;			This function returns an ARRAY of three values:
;				Name of the type specified by $ReturnNameType (String)
;				Error number (Long Integer)
;				Error text (String).
;
;DEPENDENCIES
;			OS: Active Directory aware client
;
;EXAMPLES
;			$DN = TranslateName (3, "", 3, "@Domain\@wksta$", 1)
;			? "DN = " + $DN[0]
;			? "Error = " + $DN[1]
;			? "ErrorText = " + $DN[2]
;
;			$DN = TranslateName (3, "", 3, "@LDomain\@userid", 1)
;			? "DN = " + $DN[0]
;			? "Error = " + $DN[1]
;			? "ErrorText = " + $DN[2]
;
Function TranslateName($InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType)
		
	Dim $InitType, $BindName, $LookupNameType, $LookupName, $ReturnNameType
	Dim $NameTranslate, $ReturnName, $Error, $ErrorText
		
	$Error = 0
	$ErrorText = ""
	$ReturnName = ""
	$NameTranslate = CreateObject("NameTranslate")
	$Error = @error
	$ErrorText = @serror
	If $Error = 0
		$NameTranslate.Init($InitType, $BindName)
		$Error = @error
		$ErrorText = @serror
		If $Error = 0
			$NameTranslate.Set($LookupNameType, $LookupName)
			$Error = @error
			$ErrorText = @serror
			If $Error = 0
				$ReturnName = $NameTranslate.Get($ReturnNameType)
				$Error = @error
				$ErrorText = @serror
			EndIf
		EndIf
	EndIf
	$TranslateName = $ReturnName, $Error, $ErrorText
EndFunction
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#206464 - 2012-12-13 04:28 PM Re: Use LDAP Custom Attribute in drive mapping [Re: Mart]
CivGeek Offline
Just in Town

Registered: 2004-07-28
Posts: 3
Thanks for the quick responses guys.
Sorry if this is like teaching a dog to use an abacus.

@Mart
I took the top portion of your code and put it into a script.
I get "expected ')'!" in line 7.

Here is the exact script:
 Code:
;Get all users from the current domain.
$oDomain = GetObject("WinNT://" + @LDomain)
$oDomain.filter = "User", ""

For Each $user in $oDomain
	If $user.name = @USERID
		$userhome = TranslateName(3, "", 3, @LDomain + "\" + $user.name, 1)
		$userinfo = GetObject("LDAP://" + $userhome[0])
		;Get user data.
		$empID = $userinfo.EmployeeID
	EndIf
Next

? "Employee ID is" $empid
? "Domain is" + @LDomain
Use H: "\\civwro990\" + $empid



Edited by CivGeek (2012-12-13 04:33 PM)

Top
#206467 - 2012-12-13 04:37 PM Re: Use LDAP Custom Attribute in drive mapping [Re: CivGeek]
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
You need to include all of the code, not just the top portion. Since the top portion is calling the TranslateName udf, it must be included. Or you will get an error message.
Top
#206471 - 2012-12-13 05:00 PM Re: Use LDAP Custom Attribute in drive mapping [Re: ShaneEP]
CivGeek Offline
Just in Town

Registered: 2004-07-28
Posts: 3
Yep, that was it.

Do you mind explaining how the top part of the script calls on the bottom part?
I see line 7 has "TranslateName" in it. Does it then look through the rest of the script for that function? I looked through the Kix document for TranslateName and didn't find anything. Is that something purely of Howard Bullock's making?

What is the overhead of this routine like? Should I expect any problems with 300 users logging in and out everyday 2 or 3 times a day?

Thanks again!

Top
#206472 - 2012-12-13 05:08 PM Re: Use LDAP Custom Attribute in drive mapping [Re: CivGeek]
Mart Moderator Offline
KiX Supporter
*****

Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
 Originally Posted By: CivGeek
Yep, that was it.

Do you mind explaining how the top part of the script calls on the bottom part?

I see line 7 has "TranslateName" in it. Does it then look through the rest of the script for that function? I looked through the Kix document for TranslateName and didn't find anything. Is that something purely of Howard Bullock's making?
...

Every function is read into memory before execution. After this it can be used just like any other build-in function. Any UDF is add-on functionality that is not natively available in kixtart. All UDFs are created by members of this board.

See: How to use a UDF FAQ

 Originally Posted By: CivGeek

....
What is the overhead of this routine like? Should I expect any problems with 300 users logging in and out everyday 2 or 3 times a day?

Thanks again!


I don’t know. Might be substantial but I do not have 300+ users to test with.
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.

Top
#206478 - 2012-12-13 07:40 PM Re: Use LDAP Custom Attribute in drive mapping [Re: Mart]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
The ULS is used in environments of 15-20,000 users without issue and, depending on the number of resources being processed, can complete in sub-second times. In real-world testing, it can process 12 resources (11 direct, 1 lookup) in 0.88 seconds, and 40 resources with six 500-record lookup tables in under 8 seconds The script has a timestamp logging option with 1-ms resolution so you can optimize performance on a per-resource basis.

The login script config file defines a set of resource data. There are two formats that will do what you need:
PATH=\\server\share\&AD:AttributeName&
This changes the lookup tag "&AD:AttributeName&" to the value read from AD for the current user. If the value is empty, this resource is ignored. This example uses a fixed server and share with a variable subfolder. The lookup can replace any part or all of the path string.

PATH=&AD:AttributeName:TableName&
This example changes the lookup tag by obtaining the value associated with the defined attribute for the current user. This value is then used to locate a match in the lookup table. If "TableName" was "AD_Lookup" and the value of the "Department" attribute was "Northeast Sales", the following table would be scanned and the path associated with Northeast Sales would be used.
[AD_Lookup]
Southeast Sales=\\server1\share\folder
Northeast Sales=\\server2\share\folder

As for coding it yourself:
The UDFs I referenced earlier use direct calls to first translate a userid to a DN string, and then use the DN string and LDAP attribute to return the value - no enumeration, so very fast. Calling the UDF with just the userid returns the DN string, so no complex external coding, either.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2312 anonymous users online.
Newest Members
fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users

Generated in 0.065 seconds in which 0.029 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org