d-ross.org
more LDAP : Active Directory nested groups
Long story short, a client wants to be able to use the nested groups in their Active Directory (AD from now on) in integrating with my favorite CMS, Farcry. Nested groups are a feature available in some directory servers, including newer versions of AD, that allow administrators to place groups as members of groups, allowing dynamic and complex group membership heirarchies
Farcry has "out-of-the-box" ability to do AD integration, and it does this using 2 external components:
ntadmin.dll
- enumerates a domain's groups
- gets a group's description
- gets a user's description
jrun.security.ntauth package
- authenticates users
- gets user's group membership
Well, the documentation on jrun.security.ntauth is light, and from all my testing, there is no way to get it to return a user's nested groups. To me, this sounds like a job for LDAP. My approach was the following:
- get user's group membership
- loop through returned groups
- get their group membership
- lather, rinse, repeat (the last 2 steps)
I feel more comfortable using recursion to do the job, however I'm sure this can be done using some clever iterative construct. Additionally, I thought this would be a good time to compare CFLDAP and JLDAP (see previous entry). From my tests, using JLDAP is 2-5 times faster than CFLDAP, and I'm positive that this factor will only increase with the number of groups/levels of nesting (as each CFLDAP call must connect to the server, bind, and then perform the read operation, whereas JLDAP only has to connect and bind once).
One caveat to using JLDAP in this situation is that it must be fed a fully qualified distinguished name (DN), but CFLDAP can be satisfied by <ntdomain name>\<user name>. So, with my CFC, if you setProvider("JLDAP"), you must pass in a full DN.
Click Here To Download ldaputil.cfc (in .txt format)
Here's an example comparing the two providers:
<cfset lc = createObject("component", "ldaputil").init()/>
<cfset lc.setHostName("myLdapServerAddress")/>
<cfset lc.setHostPort(389)/>
<cfset lc.setTimeout(2000)/>
<cfset lc.setProvider("CFLDAP")/>
<cfset t1 = getTickCount()/>
<cfset lc.getUserGroups("CN=myTestUser,OU=Users,DC=myDomain,DC=COM", "testUser'sPassword")/>
<cfdump var="#(getTickCount()-t1)#" label="CFLDAP execution time (ms)"/>
<cfset lc.setProvider("JLDAP")/>
<cfset t2 = getTickCount()/>
<cfset lc.getUserGroups("CN=myTestUser,OU=Users,DC=myDomain,DC=COM", "testUser'sPassword")/>
<cfdump var="#(getTickCount()-t2)#" label="JLDAP execution time (ms)"/>
| ||
| ||
| ||
| ||
| ||
|
| ||
| ||
| ||
| ||
| ||