Question

我目前编写了一个c＃脚本来检索属于三个独立用户组的用户 - 它看起来像这样......

string DomainPath = "LDAP://DC=<dc>,DC=<dc>,DC=org";
DirectoryEntry searchRoot = new DirectoryEntry(DomainPath); 
DirectorySearcher search = new DirectorySearcher(searchRoot);
search.Filter = "(&(objectClass=user)(objectCategory=person)(|(memberof=CN=group1,OU=Groups,OU=<ou>,DC=dc,DC=<dc>,DC=org)(memberof=CN=group2,OU=Groups,OU=<ou>,DC=<dc>,DC=<dc>,DC=org)(memberof=CN=group3,OU=Groups,OU=<ou>,DC=<dc>,DC=<dc>,DC=org)))";
search.PropertiesToLoad.Add("samaccountname");
search.PropertiesToLoad.Add("mail");
search.PropertiesToLoad.Add("usergroup");
search.PropertiesToLoad.Add("displayname");
search.PropertiesToLoad.Add("manager");
SearchResult result;
SearchResultCollection resultCol = search.FindAll();

使用此代码，我可以检索为此用户公开的任何属性，包括“manager”记录。经理记录在此级别公开为DN：

Manager = "CN=MTK93,OU=Users,OU=<ou>,DC=<dc>,DC=<dc>,DC=org"

真正需要的是能够递归获取现有查询返回的每个管理员的所有用户属性 - 然后将它们组合成一个数据集......

例如，请考虑以下层次结构....

Lisa (manager's manager)
   | 
   | -- Tim (Manager)
   |    mail = tim@a.com, usergroup = groupA, manager = Lisa
   |     | 
   |     |-- Mike
   |     |    mail = mike@a.com, usergroup = group1, manager = Tim
   |     |-- Lori
   |     |    mail = lori@a.com, usergroup = group2, manager = Tim
   | -- Katie (another manager)
         |    mail = katie@a.com, usergroup = groupB, manager = Lisa
         |
         |-- John
         |    mail = john@a.com, usergroup = group3, manager = Katie
         |-- Larry
              mail = larry@a.com, usergroup = group4, manager = Katie

我的查询是返回mike，lori，katie和john，因为它们存在于我要查询的组中（group1，group2，group3） - 但我也需要Tim和Katie的用户记录（因为他们是某人的经理属于那些群体）

理想的输出看起来像这样...

Name       Mail        Group        Manager
------------------------------------------------
Mike     mike@a.com   group1        Tim's DN
Lori     lori@a.com   group2        Tim's DN
John     john@a.com   group3        Katie's DN
Katie    katie@a.com  groupB        Lisa's DN
Tim      time@a.com   groupA        Lisa's DN

注意：我不希望Lisa（她下面没有人属于group1，group2或group3）或Larry（不属于group1，group2或group3）

这个LDAP查询的递归性质很难弄明白。

Answer 1

通过采用以下方法，我能够获得所需的结果：

使用组
使用自定义功能
使用Linq从第1,2和3组中的结果用户列表中获取不同的管理器列表
使用管理员的专有名称
将经理记录加载到另一个列表中并与原始用户列表结合使用

删除所有重复项

// class variable
List<ActiveDirectoryUser> recordsToInsert;

// build the query appender
string queryAppender = "";
foreach (string activeDirectoryGroup in activeDirectoryGroups)
{
    queryAppender += "(memberof=CN=" + activeDirectoryGroup + ",OU=Groups,OU=<<ou>>,DC=<<dc>>,DC=<<dc>>,DC=<org>>)";
}

// create the ldap query string
var ldapQueryForUsersInDtGroups = "(&(objectClass=user)(objectCategory=person)(|" + queryAppender + "))";

// first get the users that belong to the active directory groups...
recordsToInsert = getEmployeeRecordsFromLdapQuery(ldapQueryForUsersInDtGroups);

// then, query again to make sure we are including the managers for the people returned from the first query
var distinctManagers = (from record in recordsToInsert select record.manager).Distinct();

// build an ldap query to get only the records for the managers we need
// example query string with 2 managers: 
// (&(objectClass=user)(objectCategory=person)

queryAppender = "";
foreach (var manager in distinctManagers)
{
    queryAppender += "(distinguishedName=" + manager + ")";
}

// ldap query filter for the managers
var ldapQueryForManagers = "(&(objectClass=user)(objectCategory=person)(|" + queryAppender + "))";

// combine the result set with the managers result set
recordsToInsert.AddRange(getEmployeeRecordsFromLdapQuery(ldapQueryForManagers));

// filter off any duplicates.
uniqueRecordsToInsert = recordsToInsert.GroupBy(x => x.employeeId).Select(x => x.First()).ToList<ActiveDirectoryUser>();

C＃LDAP查询以获取特定组中用户的管理员

1 个答案: