2

Basically, I'm writing a script that determines an acceptable default for a base DN when pointed at a particular hostname. I'm wrapping it around ldapsearch output.

  • I can do Active Directory by looking directly at the root DSE and pulling defaultNamingContext
  • I can do Domino by starting a one-level search directly underneath DSE filtering for the dominoOrganization objectClass and just taking the first one (it's a default so if it's not correct they can be expected to just change it).
  • I can do OpenLDAP by looking directly at root DSE and extracting the first value of namingContexts

But I'd also like for this to support eDirectory just in case. Problem is that I don't have any eDirectory installs to look at and it's not free software so I can't install an test version of it to see how it's set up.

Looking at Novell's site it looks like they don't really do the same defaultNamingContext thing AD does, and they're definitely not going to do a dominoOrganization objectClass. Most example DN's I've seen for eDirectory look like they also use o=OrganizationName like exists in Domino but I've also seen o=OrganizationName,C=US so if the country abbreviation could or could not be in the base DN, I would have to do more than just one_level.

What makes things worse is if the directory server is partitioned (like some AD configurations) or is like Domino where there are many built-in default organizations that don't reflect where you'd find the important LDAP information. For example there's a O=RSA Data Security\, Inc.,C=US organization in the Domino LDAP instance I'm looking at now.

Is there a particular objectClass I can filter for if I start a search at root DSE? I realize this is an expensive search (esp when if I have to go full sub on the scope) but this should be a once-in-a-while type thing.

Long story short: What identifying attributes does the base of a company's organization have in eDirectory and how do I locate it if I set my search base to root DSE?

I'd prefer examples since I won't be able to validate your code works until I run into the off-chance of needing to run this script on an eDirectory server (we're higher education so this is definitely possible).

  • 1
    Not exactly an answer, but there are trial downloads available: netiq.com/products/edirectory. Oh and does this help? novell.com/communities/node/11426/rootdse-search-edirectory – Drav Sloan Jul 29 '13 at 23:25
  • Yeah that last link gets us almost the complete way there. It gives the tree name, so I'm just unsure how to translate that into a base DN. – Bratchley Jul 30 '13 at 10:39
  • @JoelDavis - I'm surprised this hasn't gotten a single answer. I tried but don't have much experience with LDAP. Maybe migrate it to ServerFault? – slm Aug 3 '13 at 14:58
  • I'm thinking I might be able to post my own answer once I install the trial version of eDirectory. I'm thinking that if I pull directoryTreeName from the Root DSE and locate that via search, that'll give me an acceptable default base DN. I just have to test it first. After that I'll rephrase/retag the original question and write and answer for all the major directory servers (AD, Domino, eDirectory, 389 and OpenLDAP) so that people looking the same thing can figure it out whichever DS they're on. I may do Apache DS too (though that doesn't really have a large install base). – Bratchley Aug 3 '13 at 19:01
  • So Drav seems to have pushed me into the correct direction. – Bratchley Aug 3 '13 at 19:02
3

It appears namingContext is pretty ubiquitous for the root DSE object on most directories. So a reasonable default is usually just taking the first one (unless the DSA specific sets one as the default, as with AD). If they have a an exotic configuration where there's multiple partitions/DIT's on the same non-AD DSA then those same admins are probably also going to be sw00ft enough know what an appropriate base DN is, if the first namingContext isn't the one we should be looking for users/groups under.

Pseudo-code for how to run auto-detection for base DN defaults for various DSA's:

  # Active Directory Test
  # rootDSE lists acceptable default base DN for us
If "1.2.840.113556.1.4.800" in rootDSE["supportedCapabilities"]:
    defaultBase = rootDSE["defaultNamingContext"]

  # IBM Domino LDAP Test
  # Take the dn of the first dominoOrganization Object we find
If "IBM Lotus Software" == rootDSE["vendorname"]
    ldapsearch -LLL "objectClass=dominoOrganization" dn | head -1

  # eDirectory Test
  # Take the first Partition Object we find
If "Novell Inc." == rootDSE["vendorName"]
    ldapsearch -LLL "objectClass=Partition" dn | head -1

  # OpenLDAP Tests
  # This is the same as the default action so not technically required but it shows 
  # how you identify OpenLDAP DSA's. It's possible to nest some additional checks/searches
  # here for the various types of top level containers (For example to prefer domain 
  # container-style entries to org-style, etc).
If "OpenLDAProotDSE" in rootDSE["objectClass"]
    ldapsearch -LLL -b '' -s base namingContext | head -1

  # Apache DS Tests
  # Same as above, not technically required but it shows how you identify Apache DS
If "Apache Software Foundation" in rootDSE["vendorName"]
    ldapsearch -LLL -b '' -s base namingContext | head -1

  # Default to taking the first namingContext attribute if present but no tests works
If $(ldapsearch -LLL -b '' -s base namingContexts | head -1 | cut -d: -f2 | wc -c ) > 1
   ldapsearch -LLL -b '' -s base namingContext | head -1

  # I'm out of ideas on how to find a base DN so ultimately default to something explicit

return "(null)"

Determining a good base DN from an OpenLDAP DSA:

[root@policyServer ~]# ldapsearch -x -LLL -H ldap://localhost -b '' -s base + | egrep "^namingContexts:" | head -1 | cut -d: -f2
 dc=trunkator,dc=com
[root@policyServer ~]#

For reference, this is that same DSA's full root DSE (I ensured there were multiple DIT's listed for a full illustration):

[root@policyServer ~]# ldapsearch -x -LLL -H ldap://localhost -b '' -s base +
dn:
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
monitorContext: cn=Monitor
namingContexts: dc=trunkator,dc=com
namingContexts: dc=localhost
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.3344810.2.3
supportedControl: 1.3.6.1.1.13.2
supportedControl: 1.3.6.1.1.13.1
supportedControl: 1.3.6.1.1.12
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedExtension: 1.3.6.1.1.8
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: GSSAPI
entryDN:
subschemaSubentry: cn=Subschema

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.