Using LDAP Search to retrieve schema attributes

When I specify a search filter of (objectClasses=*) nothing is returned. If I specify (objectclass=*) ldapsearch returns the cn=schema object, why doesn't the search filter work for the objectclasses attribute?

This looks to be by design. Quoting RFC 2251:
Clients MUST only retrieve attributes from a subschema entry by requesting a base object search of the entry, where the search filter is "(objectClass=subschema)".
Although the filter objectclass=* works as well.
Regards,
Craig Epstein

Similar Messages

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird?

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird? We have a super awesome contacts server that works great for our Mac users. About 30% of our company are on PCs, and I would like to use the Mozilla Thunderbird mail client for them. I see that in Thunderbird I can set up LDAP searching, and would like to have this feature point to our contacts server. I've tried several different settings, and looked all over the web, but could not find the proper way to configure this. Does anyone know if this can be done, or if not, would have a better suggestion? Thank you for your time!!

try double clicking keychain acces should launch and ask if you want to install login, system, System roots
A dialog box will launch asking where to install the cert since your configuring a vpn I would put the certificate it in system.

Using GET_SCHEMA_VIEW_VALUES service to retrieve schema view data

Hi!
I want to create a WSDL in UCM to retrieve the values of some lists, to use in my web application.
For this, I want to use the GET_SCHEMA_VIEW_VALUES service. I know that this service has an input parameter schViewName, so I can configure that.
How do I find out what the return datatype or soap structure of this service is? I cannot find that in the documentation and I do know how to call the service directory to find out what the result looks like.
Jeroen van Veldhuizen

your XML would look something like this:
{SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"}
{SOAP-ENV:Body}
{idc:service xmlns:idc="http://www.stellent.com/IdcService/" IdcService="GET_SCHEMA_VIEW_VALUES"}
{idc:document}
{idc:field name="schViewName"}MyViewname{idc:field}
{idc:field name="schRelationName"}MyRelation{idc:field}
{idc:field name="schParentValue"}MyParentValue{idc:field}
{idc:document}
{idc:service}
{SOAP-ENV:Body}
{SOAP-ENV:Envelope}
note, schRelationName and schParentValue are optional... and I changed all the angle brackets to braces so that the HTML would come through.
Also, the above code should also work for the service "GET_SCHEMA_VIEW_FRAGMENT".

LDAP Search/Bind function

I'm trying to create an authentication function that can perform a search/bind.
The algorithm for this is as follows:
1) Bind to the LDAP server as the application (ie: admin username and password)
2) Search the LDAP directory for the sign-in username %userid%
3) Get the DN of that entry
4) Unbind as the application
5) Bind as the sign-in username %userid% with the DN from above
I'm pretty sure that this is possible with the DBMS_LDAP and DBMS_LDAP_UTL packages, but I'm not sure how to put it all together. Does anyone out there know if a function such as this already exists?
Thanks,
Logan

Well, I figured it out.
create or replace FUNCTION F_Authenticate (p_username in varchar2, p_password in varchar2)
      RETURN BOOLEAN
   IS
      CURSOR ldap_param_cur
      IS
         SELECT *
           FROM ldap_parameters;
      ldap_param_rec   ldap_param_cur%ROWTYPE;
      l_session        DBMS_LDAP.SESSION;
      l_srch_attr      DBMS_LDAP.STRING_COLLECTION;
      l_attr_values    DBMS_LDAP.STRING_COLLECTION;
      l_result         DBMS_LDAP.MESSAGE;
      l_entry          DBMS_LDAP.MESSAGE;
      l_dn             VARCHAR2 (200);
      l_retval         PLS_INTEGER;
      multiple_uid     EXCEPTION;
      no_ldap_entry    EXCEPTION;
   BEGIN
      -- get parameters from uvic_ldap_parameters table
      OPEN ldap_param_cur;
      FETCH ldap_param_cur
       INTO ldap_param_rec;
      -- if the cursor returns no records display error message and exit
      IF ldap_param_cur%NOTFOUND
      THEN
         DBMS_OUTPUT.PUT_LINE
             ( 'LDAP Parameters not configured in UVIC_LDAP_PARAMETERS table'
         CLOSE ldap_param_cur;
         RETURN FALSE;
      END IF;
      CLOSE ldap_param_cur;
      DBMS_LDAP.use_exception := TRUE;
      BEGIN
         -- open session to ldap server
         l_session :=
            DBMS_LDAP.init (ldap_param_rec.ldap_host,
                            ldap_param_rec.ldap_port
         -- bind with credentials from cursor
         l_retval :=
            DBMS_LDAP.simple_bind_s (l_session,
                                     ldap_param_rec.search_credential,
                                     ldap_param_rec.search_passwd
         -- run ldap search
         l_retval :=
            DBMS_LDAP.search_s (l_session,
                                ldap_param_rec.search_base,
                                DBMS_LDAP.SCOPE_SUBTREE,
                                ldap_param_rec.search_filter || p_username,
                                l_srch_attr,
                                0,
                                l_result
         -- count the search result records
         l_retval := DBMS_LDAP.count_entries (l_session, l_result);
         -- if multiple search result records raise exception
         -- the userid should be unique and only return 1 search record
         IF l_retval > 1
         THEN
            RAISE multiple_uid;
         ELSIF NVL (l_retval, 0) = 0
         THEN
            RAISE no_ldap_entry;
         END IF;
         -- select first entry from ldap search record
         l_entry := DBMS_LDAP.first_entry (l_session, l_result);
         -- get the distinguished name from the ldap record
         l_dn := DBMS_LDAP.get_dn (l_session, l_entry);
         -- close ldap session used to retrieve search results
         l_retval := DBMS_LDAP.unbind_s (l_session);
         -- open session to ldap server
         l_session :=
            DBMS_LDAP.init (ldap_param_rec.ldap_host,
                            ldap_param_rec.ldap_port);
         -- bind using ldap search results distinguished name and password
         -- if the bind is successful the user can login
         l_retval := DBMS_LDAP.simple_bind_s (l_session, l_dn, p_password);
         -- close ldap session
         l_retval := DBMS_LDAP.unbind_s (l_session);
         RETURN TRUE;
      EXCEPTION
         WHEN multiple_uid
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE('Multiple LDAP entries found.'
            RETURN FALSE;
         WHEN no_ldap_entry
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE ('No LDAP records found.'
            RETURN FALSE;
         WHEN OTHERS
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE ('LDAP Error. Unknown type.');
            RETURN FALSE;
      END;
   EXCEPTION
      WHEN OTHERS
      THEN
         l_retval := DBMS_LDAP.unbind_s (l_session);
         DBMS_OUTPUT.PUT_LINE ('LDAP Error. Unknown type.');
         RETURN FALSE;
   END F_Authenticate;

Error in LDAP Search QPAC

Hi..
i am trying to use LDAP search qpac.I have the provider url and i gave the username as admin and password as password.when i drag the ldap search qpac into my workflow and refreshing for the baseDN, it is giving an error saying that "cannot instantiate class com.sun.jndi.ldap.LdapCtxFactory"
wht do the DC,CN mean?
plzz help me if there are any demos for understandin the ldap search qpac more.. have already read the topic given by marc szulc regarding ldap search qpac.
thanks..
Raghava Kumar V.S.S.

I started getting this error when I mistakenly changed a search filter from (&(uid=james)(objectclass=Staff)) to (uid=james)(objectclass=Staff)). It is complaining about the unbalanced parenthesis.

Using LDAP to search attribute bit flags using attribute OID values

Hello everyone,
My question stems from trying to understand the OID and syntax behind this classic LDAP search to find disabled users:
"(useraccountcontrol:1.2.840.113556.1.4.803:=2)"
What I am interested in is the value 1.2.840.113556.1.4.803, specifically how it differentiates from the value 1.2.840.113556.1.4.8, which is the OID of the useraccountcontrol attribute:
http://msdn.microsoft.com/en-us/library/ms680832(v=vs.85).aspx
Now, this website below says that the 03 and 04 are designators of the AND and OR operations, respectively, and are added on to the end of the OID:
https://www.appliedtrust.com/blog/2011/04/keeping-your-active-directory-pantry-order
However, using this logic, I can't get these 03 and 04 operators to work with other attribute OID's that use flags as values, such as the "searchflags" attribute, e.g. a LDAP search of "(searchflags:=1.2.840.113556.1.2.33404:=0)
returns nothing, using the OR (04) operation at the end of the "searchflags" OID of 1.2.840.113556.1.2.334.
So back to my original question, for the useraccountcontrol OID of 1.2.840.113556.1.4.8, is this OID at all related to the bitwise AND extensible match of 1.2.840.113556.1.4.803 (like just adding a 03 to designate an AND operation), or is this
extensible match
value of 1.2.840.113556.1.4.803 completely separate from the useraccountcontrol OID of 1.2.840.113556.1.4.8?
If I have my terms mixed up, please feel free to correct me on what the proper terms are.
Thanks!

Hmm yeah I posted that link above in my OP as well, and I was hoping that the OID values of these bitwise filters were somehow related to the shorter OID of the "useraccountcontrol" attribute, but it looks like it's just a coincidence.
So I wonder if the "useraccountcontrol" section of
this article from my OP is a little misleading when it says:
To make a comparison, we either need to use the LDAP_MATCHING_RULE_BIT_AND rule (1.2.840.113556.1.4.803), or the LDAP_MATCHING_RULE_BIT_OR rule (1.2.840.113556.1.4.804) for our attribute OID (the AND rule adds a 03 suffix to denote the AND operation,
and the OR rule adds a 04 suffix).
Following this logic, I should be able to use the "03" and "04" in other bitwise operations with different OID's to search "AND" or "OR", but as I pointed out in my OP above, I can't seem to make this work with adding the
"03" and "04" onto the end of other OID's. So I will go with Christoffer that these bitwise OID's (1.2.840.113556.1.4.803 and 1.2.840.113556.1.4.804) are unique in themselves, and the fact that they are 2 characters away from the OID of the "useraccountcontrol"
attribute (1.2.840.113556.1.4.8) is just coincidence.
This does seem strange however, and it seems like there should be some correlation here....
If anyone has any more info, I would love to hear it!

Retrieve all attributes for a specific objectClass using ldapsearch

Hi everybody,
Question : is it possible to retrieve all attributes for a specific objectClass (by example person) using ldapsearch tool ?
I tried something like that, but it doesn't work :
ldapsearch -v -h XXX -p XXX -b "cn=schema" -s base "objectclass=person" attributetypes
Thanks a lot,
Franck

Ok, Thanks for you help,
But my question is : For a specific objectClass, by example, I would like to have all attributes for the objectClass called "inetOrgPerson"
something like that :
ldapsearch -D "cn=Directory Manager" -w pwd -h host ...objectClass="inetOrgPerson"
and the response could be :
audio || businessCategory || departmentNumber || displayName || givenName || initials || jpegPhoto || labeledUri || manager || mobile || pager || photo || preferredLanguage || mail || o || roomNumber || secretary || userPKCS12
I dont't know how to do ????
Thanks
Franck

JAZN-LDAP : retrieve inetOrgPerson attributes from principal object

Hello.
I 've extended callerInfo demo (in OC4J distrib :j2ee/home/jazn/demo) :
1. use of JAZN-LDAP
2. now the servlet prints the "HttpServletRequest.getUserPrincipal()" object attributes (class implementation : oracle.security.jazn.oc4j.JAZNUserAdaptor) : the servlet prints LDAP attributes like user DN, subscriber name, groups member, ....
Is it possible to retrieve other attributes of the LDAP object user (like description, businessCategory) by the java.security.Principal interface ?
Thanks.

Try this
public String getCompanyByUserDN(String userDN) throws Exception
String result = null;
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://<<LDAP HOST>>:<<LDAP PORT>>");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, <<User DN>>);
env.put(Context.SECURITY_CREDENTIALS, <<User Password>>);
DirContext dirCtx = new InitialDirContext(env);
DirContext userCtx = (DirContext)dirCtx.lookup(userDN);
Attributes attrs = userCtx.getAttributes("", new String[] {"o"});
result = (String)attrs.get("o").get();
return result;
}

Adding Another LDAP Search Attribute

Hi,
Can you please point me to any document for adding another ldap search attribute apart from uid.
Regards,
Edited by: IDM1312 on Jun 9, 2008 4:28 PM

Yes, here is what happens when your user tries to login:
They enter some username & password. The username can be any attribute you wish it to be (email, UID, cn, etc). The actual authentication is not done using the value the user enters. This is because you need to authenticate with the user's DN. To get the DN, access manager does a lookup on the directory server to see if what the user entered exists in any of the attributes in the search alias list. If the search is successful, it returns the user's DN. Access Manager then uses the DN and password to authenticate the user.
So, if you expect your users to enter their email address, you will want your email attribute in this list. You can have multiple values in the list, if for example you want to allow users to enter uid OR email address. I would be careful about allowing this flexibility if you are in a large organization because this will bring increased overhead to both AM & DS.
Also, be sure that whatever attribute you use is indexed!!
I hope this helps,
Eric

Use wildcard in LDAP search with filter and filter args fails

Hi,
I'm writing a function that receives the search filter and the filter arguments and returns the attributes of the found entries but I'm having problems when I pass the wildcard '*' as argument. For example I'm looking for cn=* but instead it looks for cn=\2a (searches for cn containing *).
I'm using the InitialLdapContext function:
public NamingEnumeration<SearchResult> search(String name,
String filterExpr,
Object[] filterArgs,
SearchControls cons)
throws NamingException
The problem occurs in the class com.sun.jndi.toolkit.dir.SearchFilter format method where it replaces the filter place holders with the filter arguments. There it calls getEncodedStringRep to the arguments and that function returns the wildcard '*' escaped.
Is it supposed to behave like that? I don't have problems using the search function search(String name, String filterExpr,Object[] filterArgs, SearchControls cons) but I'd like to be able to separate the filter and the filter arguments.

That's a forum artefact, as the boldface should make obvious.
My point is that you should specify the wildcard in the filter string, not as an argument. See http://download.oracle.com/javase/6/docs/api/javax/naming/directory/DirContext.html#search(javax.naming.Name,%20java.lang.String, java.lang.Object[],%20javax.naming.directory.SearchControls). (The forum will break that link too.) The argument asterisk is being escaped in accordance with what it says there. Or maybe you can escape it yourself as an argument as \0x2a.

DAP using LDAP and Cisco Attributes

I would like to be able to set up a Dynamic Access Policy with the criteria that if all of the following:
cisco.grouppolicy=Sales
ldap.memberOf=Remote_Access
can have specific set of access. My Connection profile is using a Radius server to authenticate and assign the Group Policy.
Is it possible to accomplish this? since it doesn't seem to work for me.

Hi Luis,
if you want to use LDAP attributes in your DAP policy, then you have to use LDAP for authentication or authorization in your tunnel-group.
So you will either have to replace radius with ldap for authentication, OR keep radius for authentication and add ldap for authorization on top.
hth
Herbert

WCAP - Calendar search using LDAP ?

Hi,
Calendar 6.3 (WCAP) allows to search/subscribe other users calendars.
There is this configuration setting in the ics.conf
! Calendar searches are done using LDAP or UserPreferene plugin
service.calendarsearch.ldap = "yes"
When i set this to yes, i have the following behaviour :
- lightning : the service sometimes returns entries 3 times
- Convergence : i can't search for secondary calendars.
I made a simple test page to run "search_calprops.wcap" tests, and the server is really returning entries 3 times (it's not a lightning bug).
For Convergence, there is an exception in the Error console, due to Convergence trying to create an object this an id that already exists (this can easily be fixed).
When i comment the configuration setting, everything works fine.
The question is :
Is it harmful not to rely on the LDAP for calendar subscription ? Will it decrease the server's performance ?
Thank you.
For the Convergence "this can easily be fixed", here is an example of customization :
Class:
iwc.widget.calendar.Subscribe
Method : showCals
Body :
Replace
this.currentCalIds.push(calid);
this._makeRow({id:calid, n:cal[c.NAME], p:perm}, cnt);
With
// BEGIN PATCH
//this.currentCalIds.push(calid);
//this._makeRow({id:calid, n:cal[c.NAME], p:perm}, cnt);
// No, the calendar may (and DOES) return duplicates, so check if the calid has
// already been added
var exists = false;
dojo.forEach(this.currentCalIds, function(nm){
if(calid == nm){ exists = true; }
if(!exists){
this.currentCalIds.push(calid);
this._makeRow({id:calid, n:cal[c.NAME], p:perm}, cnt);
// END PATCH
Edited by: diesmo on 29 mars 2012 08:47

Well, Either :
- i enable this, and my front-end server runs searches on the LDAP server, meaning that my back-end server is less loaded
- i disable this, and my front-end server relies on the back-end server (using DWP) for calendar searches, which may (or may not) result in slower responses and/or heavier load on both my front-end and back-end server
Anyway, we'll try to disable it, and monitor the service during some time to see what happen.

Using Content search web part to retrieve items from another site collection

I have a web application that contains two site collections(team site + enterprise wiki), with the following URLs:-
-http://applicationname/teamsite
-http://applicationname/enterprisewiki
Now I need to display the latest 10 wiki pages from the enterprise wiki site collection(according to the modified date) inside the team site. So I read that using Content search web part allow for cross-site content query. Currently I added a new content
search web part , inside my team site, and I click on “change query” button. But I am not sure how I can reference the enterprise wiki site collection's wiki page library and to specify that I need to get the latest 10 wiki pages , inside the following dialog:-
Basically this setting partially worked for me, I provide the following settings inside the “Build Your Query” dialog:-
From the “Select a Query” I defined the following:- “items matching content type(system).”
Restrict by app : “Do not restrict results by app”
Restrict by content type “Enterprise Wiki Page”.
This showed all the sites, lists and even pages are based on the “Enterprise Wiki Page” content type. But I am facing these three problems:-
1. The above setting showed only the sites,lists and pages matching the “Enterprise Wiki Page” content type, that exists on another web application, and not that exists inside the current web application.
2. To test the web part , I got the following results, But I was not able to add additional info for the items such as created by, modified by ,etc.
3. Also there is no way to sort the wiki pages by the modified date, as in the Sorting tab inside the “Build Your query” dialog I cannot find the “modified” inside the Soft by list
So can anyone advice how to fix these three problems

Hi,
1. In "Build Your Query" dialog, we can select "Specify a URL" in
Restrict by app and enter another site URL.
2. If you want to add more information for the items, we need customize the display template, the following link for your reference:
http://blogs.technet.com/b/sharepoint_quick_reads/archive/2013/08/01/sharepoint-2013-customize-display-template-for-content-by-search-web-part-cswp-part-1.aspx
3. In the Sorting tab, we can use "LastModifiedTime" to instead of "Modified".
Best Regards
Dennis Guo
TechNet Community Support

Retrieving the value using formatted search

Hi everyone. I have a question regarding on how I can get the value of the user-defined field in the title of a marketing document. I would like to get the value using formatted search and sql query.
Here's the format I am currently using.
$[$ <Item>.<Pane>.<Variable>]
Is my format correct? Thanks.
Regards,
Omann

Hi Omann,
You can refer to fields in an entry screen using the syntax
$[Table name.Field name]
The table name is the name of the table belonging to the entry screen, for example, OINV for the A/R invoice entry screen.
You can also use the fieldu2019s item number and fieldu2019s column number to refer to a field on the entry screen. By doing this, the query applies to all document entry screens. The syntax is then
$[$Fieldu2019s item number.Fieldu2019s column number.NUMBER/CURRENCY/DATE/0]
The system is able to uniquely identify each field of a document using the fieldu2019s index number and fieldu2019s column number. If you have activated the debug information under View  Debug Information, the system displays the fieldu2019s item number and the fieldu2019s column number in the status bar.
You use the NUMBER parameter if the field concerned contains an amount and a currency key, and you want to extract the amount only.
You use the CURRENCY parameter if the field concerned contains an amount and a currency key, and you want to extract only the currency key.
You use the DATE parameter if the field concerned is a date field and you want to use it for calculations.
Regards, Yatsea

JMX endpoint LDAP search (discovery) and connection

In the "JMX Remote API 1.0.1_03 Reference Implementation" examples\Lookup\ldap\README file, reference is made to Service URLs of the type:
service:jmx:rmi:///jndi/${jndildap}/cn=x,dc=Test
Here's what I expect to be able to do with this type of URL:
* Firstly, I can start a server process and have it register a node of type jmxConnector (as described in the jmx-schema.txt file). It registers a jmxServiceURL attribute that looks like:
service:jmx:rmi://myserver/stub/rO0ABXNyAC5qYXZheC5tYW5hZ2VtZW50LnJlbW90ZS5ybWkuUk1JU2Vydm...* Then I can start JConsole and put in the URL:
* service:jmx:rmi:///jndi/ldap://myldapserver:389/cn=myJMXConnector,dc=Test
* JConsole should (transparently):
* Contact LDAP and retrieve the specified node.
* Use a DirObjectFactory to read the attributes on the node, recognise that it represents a JMX endpoint and create a JMXConnector object.
* Connect to the endpoint.
For me, this LDAP node to endpoint indirection is the whole point of the directory server. I don't want to look up the endpoint URL registered in jmxServiceURL within the LDAP node then connect to it directly. I need the discovery and connection mechanism to do that for me. Then, when the endpoint dies and restarts using a different RMI port (dynamically allocated at startup), JConsole can reconnect to the same LDAP URL which will direct it transparently to the new endpoint.
Is the aim of the LDAP service URL format to support this functionality? If so, I can't get it to work; there's no object factory to do the required work. If not, I'll create my own DirObjectFactory to make it work the way I need it to work. However, I'd like to know what the point of the LDAP-style service URL is?
The example in the Reference Implementation is inadequate. The README defines all sorts of URL formats then the example Java just connects to LDAP, reads the value of the jmxServiceURL attribute and makes a direct connection. This isn't real JNDI-style discovery.
Many thanks in advance (I've been struggling with this for a while, so help appreciated!!)
Dave
p.s. You may be able to get more of a context for what I'm asking by seeing what I'm trying to put together at http://code.google.com/p/jconsole-ldap/ . This is a user interface which shows what's available in LDAP (by doing a simple search) and then tries to connect using the indirect LDAP-style URL.

I guess that this part of the JMX specification is basically saying that if you want a client to connect based on a jmxServiceURL string in LDAP then you have to build your own ObjectFactory. It's a bit of a shame that at ObjectFactory isn't made available for this as part of the reference implementation. The LDAP schema is standardised so why not provide an ObjectFactory to read the standardised schema and make the relevant connection?
From section 17.2.1 JMXServiceURL Versus JMXConnector Stubs
■ JNDI API/LDAP: register the URL string representation of the JMX Service URL
(JMXServiceURL.toString()). The JNDI API can be configured on the client
side (via StateFactories and ObjectFactories - see [JNDI - Java Objects ])
to create and return a new JMXConnector automatically from the DirContext
containing the JMX Service URL, or simply return the DirContext from which
that JMX Service URL can be extracted. See Section 17.5 Using the Java Naming
and Directory Interface (LDAP Backend) on page 264.
An alternative way to use JNDI/LDAP is to store a JMXConnector stub directly,
as described for Jini. This specification does not define a standard way to do that.

Using LDAP Search to retrieve schema attributes

Similar Messages

Maybe you are looking for