Re: large groups question

--001a1143f2ace746f40528a97e62
Content-Type: text/plain; charset=UTF-8

Your issue is that your perl logic has only one loop, over the first group.
You need to search and then start processing the groups with pop_entry.

You'll also probably need to use paging controls if your domain is large.
On Jan 6, 2016 2:55 AM, "Natxo Asenjo" <[email protected]> wrote:

> hi,
>
> following the FAQ (
> http://search.cpan.org/~marschap/perl-ldap-0.65/lib/Net/LDAP/FAQ.pod#How_do_I_search_for_all_members_of_a_large_group_in_AD
> ?)
>
> I successfully retrieve all members of a large group, nice.
>
> The example searchs only using scope 'base' and as base the group
> distinguishedname.
>
> If I change that to
>
> base = "dc=domain,dc=tld",
> scope = "sub",
>
> it finds just one group:
>
> my $mesg;
> my @members;
> my $samaccount;
> my $index = 0;
>
> while ( $index ne '*' ) {
>     $mesg = $ldapprod->search(
>         base   => $prod_base,
>         filter => "(objectclass=group)",
>         scope  => 'sub',
>         attrs  => [ ( $index > 0 ) ? "member;range=$index-*" : 'member',
> 'samaccountname', ]
>     );
>     if ( $mesg->code == LDAP_SUCCESS ) {
>         my $entry = $mesg->entry(0);
>         my $attr;
>
>         # large group:
>         if ( ($attr) = grep( /^member;range=/, $entry->attributes ) ) {
>             push( @members, $entry->get_value($attr) );
>             $samaccount = $entry->get_value('samaccountname');
>
>             if ( $attr =~ /^member;range=\d+-(.*)$/ ) {
>                 $index = $1;
>                 $index++ if ( $index ne '*' );
>             }
>         }
>
>         # small group:
>         else {
>             @members = $entry->get_value('member');
>             $samaccount = $entry->get_value('samaccountname');
>             last;
>         }
>     }
>
>     # failure
>     else {
>         last;
>     }
> }
>
> if ( $mesg->code == LDAP_SUCCESS ) {
>     for (@members) {
>         print "$_\n";
>     }
>     print "Group: $samaccount\n";
> }
>
> I'm obviously doing something wrong. Do I need to get the groups
> distinguishedname and then use the scope 'base' to look at membership of
> all groups?
>
> Thanks for your advice.
>
>
> --
> --
> Groeten,
> natxo
>

--001a1143f2ace746f40528a97e62
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">Your issue is that your perl logic has only one loop, over t=
he first group. You need to search and then start processing the groups wit=
h pop_entry.</p>
<p dir=3D"ltr">You&#39;ll also probably need to use paging controls if your=
 domain is large. </p>
<div class=3D"gmail_quote">On Jan 6, 2016 2:55 AM, &quot;Natxo Asenjo&quot;=
 &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&g=
t; wrote:<br type=3D"attribution"><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=
=3D"ltr"><div><div><div>hi,<br><br></div>following the FAQ (<a href=3D"http=
://search.cpan.org/~marschap/perl-ldap-0.65/lib/Net/LDAP/FAQ.pod#How_do_I_s=
earch_for_all_members_of_a_large_group_in_AD" target=3D"_blank">http://sear=
ch.cpan.org/~marschap/perl-ldap-0.65/lib/Net/LDAP/FAQ.pod#How_do_I_search_f=
or_all_members_of_a_large_group_in_AD</a>?)<br><br></div>I successfully ret=
rieve all members of a large group, nice.<br><br></div><div>The example sea=
rchs only using scope &#39;base&#39; and as base the group distinguishednam=
e.<br><br></div><div>If I change that to <br><br></div><div>base =3D &quot;=
dc=3Ddomain,dc=3Dtld&quot;,<br></div><div>scope =3D &quot;sub&quot;,<br><br=
></div><div>it finds just one group:<br><br>my $mesg;<br>my @members;<br>my=
 $samaccount;<br>my $index =3D 0;<br><br>while ( $index ne &#39;*&#39; ) {<=
br>=C2=A0=C2=A0=C2=A0 $mesg =3D $ldapprod-&gt;search(<br>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 base=C2=A0=C2=A0 =3D&gt; $prod_base,<br>=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 filter =3D&gt; &quot;(objectclass=3Dgroup=
)&quot;,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 scope=C2=A0 =3D&gt; =
&#39;sub&#39;,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attrs=C2=A0 =
=3D&gt; [ ( $index &gt; 0 ) ? &quot;member;range=3D$index-*&quot; : &#39;me=
mber&#39;, &#39;samaccountname&#39;, ]<br>=C2=A0=C2=A0=C2=A0 );<br>=C2=A0=
=C2=A0=C2=A0 if ( $mesg-&gt;code =3D=3D LDAP_SUCCESS ) {<br>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 my $entry =3D $mesg-&gt;entry(0);<br>=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 my $attr;<br><br>=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 # large group:<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 if ( ($attr) =3D grep( /^member;range=3D/, $entry-&gt;attributes ) )=
 {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 pu=
sh( @members, $entry-&gt;get_value($attr) );<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 $samaccount =3D $entry-&gt;get_valu=
e(&#39;samaccountname&#39;);<br><br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 if ( $attr =3D~ /^member;range=3D\d+-(.*)$/ ) {=
<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 $index =3D $1;<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 $index++ if ( $in=
dex ne &#39;*&#39; );<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }<br><br=
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 # small group:<br>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 else {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 @members =3D $entry-&gt;get_value(&#39;me=
mber&#39;);<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 $samaccount =3D $entry-&gt;get_value(&#39;samaccountname&#39;);<br>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 last;<br=
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 }<br><b=
r>=C2=A0=C2=A0=C2=A0 # failure<br>=C2=A0=C2=A0=C2=A0 else {<br>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 last;<br>=C2=A0=C2=A0=C2=A0 }<br>}<br><br>if=
 ( $mesg-&gt;code =3D=3D LDAP_SUCCESS ) {<br>=C2=A0=C2=A0=C2=A0 for (@membe=
rs) {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 print &quot;$_\n&quot;;=
<br>=C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 print &quot;Group: $samaccou=
nt\n&quot;;<br>}<br><br></div><div>I&#39;m obviously doing something wrong.=
 Do I need to get the groups distinguishedname and then use the scope &#39;=
base&#39; to look at membership of all groups?<br><br></div><div>Thanks for=
 your advice.<br clear=3D"all"></div><div><div><div><div><br><br>-- <br><di=
v>--<br>Groeten,<br>natxo</div>
</div></div></div></div></div>
</blockquote></div>

--001a1143f2ace746f40528a97e62--