Can retrieve users from some sub OUs and from other sub OUs cann't

Question

hi,
I am using Windows 2003 Active Directory Server and Jndi to access that in my application. I am using follwing code to retrieve all Users from a aprticular OU.
ctx = new InitialDirContext(environment);
SearchControls ctls = new SearchControls();
ctls.setSearchScope(2);
String attrs[] = {
"sn", "givenName", "userPrincipalName"
ctls.setReturningAttributes(attrs);
String filter = "(&(objectClass=*))";
String serachCriteria[] = {"User Container", "Admin Leads,OU=Administration,OU=User Container"};
for(int i = 0; i < serachCriteria.length; i++)
StringBuffer searchString = new StringBuffer("OU=");
searchString.append(serachCriteria);
searchString.append(",DC=india,DC=mycompany,DC=com");
for(NamingEnumeration answer = ctx.search(searchString.toString(), filter, ctls); answer.hasMoreElements();)
SearchResult searchResult = (SearchResult)answer.next();
....................and so on
as can be observed in the bold text above, I have to specify the path of sub OU to retrieve users under that. Whereas apart from this sub OU, it is retrieving users from others sub OUs. The problem is, the code can access users from some OUs but not from other sub OUs
Can anybody help?
regards,
Zaid

Answer 1

Active Directory has a very rich access control model.
Perhaps it may not have occurred to you, that you do not have list access rights to the child3 & child9 organizational units ?
You may have access rights to all the leaf objects contained in child3 & child9, which explains why you can retrieve all the leaf objects when you explicitly bind to them, however you may not have list access rights to child3 & child9 which explains why you can't bind to it when iterating through parent1.
What happens if you simply perform a one level search on parent1, using a filter (objectClass=organizationalUnit) ?
If it doesn't retrieve child3 & child9, then perhaps you do not have list access rights for those two ou's.