Question

We got a special multivalue attribute. Let’s call it ourOwnManagedBy which can contain users or groups (their DN) that manages the current group.

How can I retrieve a list of all groups that a specific user manages (with the help of managedBy and ourOwnManagedBy)?

For instance. Let’s say that the user is member of the group GlobalAdministrators and that the group ApplicationAdministrators has GlobalAdministrations as a member. And finally the group MyApplication which has ApplicationAdministrators in the ourOwnManagedBy attribute.

• User is member of GlobalAdministrators
• GlobalAdministrators is member of ApplicationAdministrators
• MyApplication got ApplicationAdministrators in ourOwnManagedBy

How do I use that information to find all groups that a specific user manages? Is it possible to do some kind of recursive check in custom attributes (that contains DNs of users and groups)?

Update

I’ve tried to use a directory search filter like this:

string.Format("(ourOwnManagedBy:1.2.840.113556.1.4.1941:={0})", dn);

but I might have missunderstood what 1.2.840.113556.1.4.1941 does? (MSDN page)

Answer 1

This is, I’m afraid, not possible to accomplish with only one LDAP query. You will have to split it into subqueries and run the each separately, which in turn will choke the domain controller if there’s a lot to iterate over.

I tried to do it the way I described, and the performance was horrible, at least doing it using the available modules for .NET.