Active Directory

From the command line, use the ldapsearch utility (OpenLDAP client) to retrieve LDAP entry attributes.

Command to retrieve user entries

ldapsearch -H ldap://10.11.12.7 -b "cn=Users,dc=shturval,dc=lab" -D "cn=Administrator,cn=Users,dc=shturval,dc=lab" -w "password123"

Example response

# Users, shturval.lab
dn: CN=Users,DC=shturval,DC=lab
objectClass: top
objectClass: container
cn: Users
description: Default container for upgraded user accounts
distinguishedName: CN=Users,DC=shturval,DC=lab
instanceType: 4
whenCreated: 20220926131156.0Z
whenChanged: 20220926131156.0Z
uSNCreated: 5660
uSNChanged: 5660
showInAdvancedViewOnly: FALSE
name: Users
objectGUID:: UPW8kPVYR0K/vWQM8yxQMA==
systemFlags: -1946157056
objectCategory: CN=Container,CN=Schema,CN=Configuration,DC=shturval,DC=lab
isCriticalSystemObject: TRUE
dSCorePropagationData: 20220928141115.0Z
dSCorePropagationData: 20220926131239.0Z
dSCorePropagationData: 16010101000416.0Z

# Maksim Maksimov, Users, shturval.lab
dn: CN=Maksim Maksimov,CN=Users,DC=shturval,DC=lab
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Maksim Maksimov
sn: Maksimov
givenName: Maksim
distinguishedName: CN=Maksim Maksimov,CN=Users,DC=shturval,DC=lab
instanceType: 4
whenCreated: 20240306093015.0Z
whenChanged: 20241031085511.0Z
displayName: Maksim Maksimov
uSNCreated: 732
memberOf: CN=cluster-admin-restricted,OU=Groups,DC=shturval,DC=lab
uSNChanged: 986
name: Maksim Maksimov
objectGUID:: 1SzqRfN6b0GKCPYA==
userAccountControl: 660
badPwdCount: 1
codePage: 0
countryCode: 0
badPasswordTime: 1336256934
lastLogoff: 0
lastLogon: 13356799236
pwdLastSet: 1335077
primaryGroupID: 513
objectSid:: AQUAAAAAAA//PXEFSXmgQAAA==
accountExpires: 92275807
logonCount: 0
sAMAccountName: m.maksimov
sAMAccountType: 800668
userPrincipalName: m.maksimov@shturval.lab
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=shturval,DC=lab
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 133748385110655368

In the response, the attributes are:

displayName — full user name;
sAMAccountName — unique user name;
userPrincipalName — user email address with UPN suffix and @;
UPN suffix for the user email address. You can specify an email suffix instead of the full email address. In this example, the suffix is shturval.lab.

Command to retrieve group entries

ldapsearch -H ldap://10.11.11.7 -b "OU=Groups,dc=shturval,dc=lab" -D "cn=Administrator,cn=Users,dc=shturval,dc=lab" -w "password123"

Example response

# extended LDIF
#
# LDAPv3
# base <OU=Groups,dc=shturval,dc=lab> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# Groups, shturval.lab
dn: OU=Groups,DC=shturval,DC=lab
objectClass: top
objectClass: organizationalUnit
ou: Groups
distinguishedName: OU=Groups,DC=shturval,DC=lab
instanceType: 4
whenCreated: 20220928141115.0Z
whenChanged: 20220928141115.0Z
uSNCreated: 13006
uSNChanged: 13007
name: Groups
objectGUID:: uxe0CpQ7EBw==
objectCategory: CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=shturval,
DC=lab
dSCorePropagationData: 20220928141115.0Z
dSCorePropagationData: 20220928141115.0Z
dSCorePropagationData: 16010101000000.0Z

# cluster-admin, Groups, shturval.lab
dn: CN=cluster-admin,OU=Groups,DC=shturval,DC=lab
objectClass: top
objectClass: group
cn: cluster-admin
member: CN=Maksim Maksimov,CN=Users,DC=shturval,DC=lab
distinguishedName: CN=cluster-admin,OU=Groups,DC=shturval,DC=lab
instanceType: 4
whenCreated: 20240306092755.0Z
whenChanged: 20240306093217.0Z
uSNCreated: 73240
uSNChanged: 73251
name: cluster-admin
objectGUID:: G2n1dg==
objectSid:: AQUAAAAAA//PXEFSXUlmQQAAA==
sAMAccountName: cluster-admin
sAMAccountType: 268456
groupType: -2147646
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=shturval,DC=lab
dSCorePropagationData: 16010101000000.0Z

In the response, the cn attribute contains the common (short) group name.
Use the attribute names you found to configure LDAP search:

Connection settings

Connection DN: cn=Administrator,cn=Users,dc=shturval,dc=lab (example DN for a service user account)
Connection password: password123
LDAP server address: 10.11.11.7 (example LDAP server IP address)

Group search

Group search base DN: OU=Groups,dc=shturval,dc=lab (example group search base DN)
Group name attribute: cn (example attribute for the short group name in the directory)

User search

User search base DN: cn=Users,dc=shturval,dc=lab (example user organizational unit base DN)

Example mapping of entry attributes to UI fields

UI field	Attribute description	Search attribute	Attribute value
Email attribute	user email address with UPN suffix and @	userPrincipalName	m.maksimov@shturval.lab
Name attribute	full user name	displayName	Maksim Maksimov
UserName attribute	unique user name	sAMAccountName	m.maksimov
Email suffix	UPN suffix for the user email address	-	shturval.lab

Изменено 2026-02-12 at 00:00

Active Directory

Active Directory #

Active Directory