LDAP_MATCHING_RULE_DN_WITH_DATA

  • 311 Views
  • Last Post 22 March 2016
  • Topic Is Solved
Dima Razbornov posted this 17 March 2016

Hello, AD guys! Can someone tell me an example of the syntax filter LDAP_MATCHING_RULE_DN_WITH_DATA?

Maybe Crisse ;)
I've found this answer and I understand how another OID (LDAP_MATCHING_RULE_TRANSITIVE_EVAL)  is used on this example:

(member:1.2.840.113556.1.4.1941:=(cn=user1,cn=users,DC=x))

LDAP_MATCHING_RULE_TRANSITIVE_EVAL

1.2.840.113556.1.4.1941

So, cool, how I could use LDAP_MATCHING_RULE_DN_WITH_DATA?

I have tried, but my filter doesnt work, and didn't seen detailed description over google-foo skills.

 

Order By: Standard | Newest | Votes
chriss3 posted this 21 March 2016

Hi1.       This requires to be target against a Windows Server 2012 R2 or later DSA2.       This only works for linked attributes, for example the “wellKnownObjects” attribute is DN-Binary but isn’t linked. So this bit is used to search linked-attributes with a syntax of either DN-Binary or DN-String. The query has the following format: (A:1.2.840.113556.1.4.2253:=V) A = the linked attributeV = depends on the syntax of A·         If A is of type “DN-Binary”, V is = https://msdn.microsoft.com/en-us/library/cc223180.aspx
B:charcount:binaryvalue:objectDN·         If A is of type “DN-String”, V is = https://msdn.microsoft.com/en-us/library/cc223178.aspx
S:byte
count:stringvalue:objectDN So you wanted an example. For that we need to find a linked attribute with one of the above syntaxes that existing in AD by default.. Let’s pick “msDS-HasInstantiatedNCs” (Note: This assumes you have at least one Windows Server 2003 DSA, but will you need to have anyway for this bit to work as stated above). OK. So “msDS-HasInstantiatedNCs” is of type DN-Binary where the data (binary) portion contains the instanceType of each NC a DSA hosts, the link itself points to the DN of that NC.This can be represented as “B:8:<InstanceTypeOfNCInHex>:<DNOfNC>” For example “B:8:0000000D:CN=Schema,CN=Configuration,DC=corp,DC=chrisse,DC=com” So running a query against the config partition with a filter of:
(msDS-HasInstantiatedNCs:1.2.840.113556.1.4.2253:=B:8:0000000D:CN=Schema,CN=Configuration,DC=corp,DC=chrisse,DC=com) Will give you a list of all DSAs hosting the schema NC.. something is wired if you don’t get a count back that is equal to the numbers of WIN2K3+ DSAs in your forest… Enfo ZipperChristoffer Andersson – Principal Advisor

show

chriss3 posted this 21 March 2016

Note for the actual example: If you have RODCs those will of course not host the schema NC as writable and missing out of that bit. This I guess is the whole purpose for “LDAPMATCHINGRULEDNWITHDATA” so you can be able to filter on the data portion and distinct objects who only would differ by the data. InstanceType bits: https://msdn.microsoft.com/en-us/library/cc219986.aspx  Enfo ZipperChristoffer Andersson – Principal Advisor

show

  • Liked by
  • Dima Razbornov
Dima Razbornov posted this 22 March 2016

Thaks for your reply, Christoffer ! :)

I didnt have RODC in my lab, but searcher didnt find anything with your query:

chriss3 posted this 22 March 2016

The search base must be the configuration nc and being a subtree search. You can’t do this in ADUC. This is how it’s done with ldp.exe
   Enfo ZipperChristoffer Andersson – Principal Advisor

show

  • Liked by
  • Dima Razbornov
Dima Razbornov posted this 22 March 2016

Thanks, my fault! Totally forgot LDP syntax. However, If you dont mind, I was looking for solution with aduc/scripts searches, and intersting that  LDAP RULE.  can I use this filter for such purposes, what do you think?

chriss3 posted this 22 March 2016

So what is the purpose and/or the need of using DAPMATCHINGRULEDNWITHDATA, what do you want to achieve?  Enfo ZipperChristoffer Andersson – Principal Advisor

show

Dima Razbornov posted this 22 March 2016

Something like a usual searcher, but without part of piece of query. I just try to do my best and thinking, how i can use it with lack of information on using this.My initial interest was in whether or not I can specify only part of DN with this weird RULE.

Close