Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

294 lines (203 sloc) 6.639 kb
#!/usr/local/bin/perl
#printMembers.pl
#given the name of a group (assume object class is groupOfUniqueNames) will
#display the members of the group including members of any groups that may be a member
#of the original group
#*Now Handles Netscape Dynamic Groups*
#
#By default it will display the DN of the member entries, you can specify a particular
#attribute you wish to display instead (e.g. mail attribute)
#example: printMembers.pl -n "Accounting Managers"
#optionally you can also specify the host, port, binded search and search base.
#Mark Wilcox mark@mjwilcox.com
#
#first version: August 8, 1999
#second version: August 15, 1999
use strict;
use Carp;
use Net::LDAP;
use URI;
use vars qw($opt_h $opt_p $opt_D $opt_w $opt_b $opt_n $opt_a );
use Getopt::Std;
my $usage = "usage: $0 [-hpDwba] -n group_name";
die $usage unless @ARGV;
getopts('h:p:D:w:b:n:a:');
die $usage unless ($opt_n);
my $DEBUG = 0; #DEBUG 1 if you want debugging info
#get configuration setup
$opt_h = "airwolf" unless $opt_h;
$opt_p = 389 unless $opt_p;
$opt_b = "o=airius.com" unless $opt_b;
my $isGroup = 0; #checks for group or not
my $ldap = new Net::LDAP ($opt_h, port=> $opt_p);
#will bind as specific user if specified else will be binded anonymously
$ldap->bind($opt_D, password=> $opt_p) || die "failed to bind as $opt_D";
#get the group DN
my @attrs = ['dn'];
eval
{
my $mesg = $ldap->search(
base => $opt_b,
filter => "(&(cn=$opt_n)(objectclass=groupOfUniqueNames))",
attrs => @attrs
);
die $mesg->error if $mesg->code;
my $entry = $mesg->pop_entry();
my $groupDN = $entry->dn();
&printMembers($groupDN,$opt_a);
$isGroup = 1;
};
print "$opt_n is not a group" unless ($isGroup);
$ldap->unbind();
sub printMembers
{
my ($dn,$attr) = @_;
my @attrs = ["uniquemember","memberurl"];
my $mesg = $ldap->search(
base => $dn,
scope => 'base',
filter => "objectclass=*",
attrs => @attrs
);
die $mesg->error if $mesg->code;
#eval protects us if nothing is returned in the search
eval
{
#should only be 1 entry
my $entry = $mesg->pop_entry();
print "\nMembers of group: $dn\n";
#returns an array reference
my $values = $entry->get_value("uniquemember", asref => 1);
foreach my $val (@{$values})
{
my $isGroup = 0; #lets us know if the entry is also a group, default no
#change val variable to attribute
#now get entry of each member
#is a bit more efficient since we use the DN of the member
#as our search base, greatly reducing the number of entries we
#must search through for a match to 1 :)
my @entryAttrs = ["objectclass","memberurl",$attr];
$mesg = $ldap->search(
base => $val,
scope => 'base',
filter => "objectclass=*",
attrs => @entryAttrs
);
die $mesg->error if $mesg->code;
eval
{
my $entry = $mesg->pop_entry();
if ($attr)
{
my $values = $entry->get_value($attr, asref => 1);
foreach my $vals (@{$values})
{
print $vals,"\n";
}
}
else
{
print "$val\n";
}
my $values = $entry->get_value("objectclass", asref => 1);
# This value is also a group, print the members of it as well
&printMembers($entry->dn(),$attr) if (grep /groupOfUniqueNames/i, @{$values});
};
}
my $urls = $entry->get_value("memberurl", asref => 1);
&printDynamicMembers($entry->dn(),$urls,$attr) if ($urls);
};
return 0;
}
#prints out a search results
#for members of dynamic group (as supported by the Netscape Directory Server)
#*Note this may or may not return all of the resulting members and their attribute values
#depending on how the LDAP connection is binded. Normally users who are not binded as the Directory Manager
#are restricted to 2000 or less total search results.
#In theory a dynamic group could have a million or more entries
sub printDynamicMembers
{
my ($entryDN,$urls,$attr) = @_;
print "\nMembers of dynamic group: $entryDN\n";
foreach my $url (@{$urls})
{
print "url is $url\n" if $DEBUG;
my $uri;
eval
{
$uri = URI->new($url);
} ;
print "ref ",ref($uri),"\n" if $DEBUG;
my $base = $uri->dn();
print "base is $base\n" if $DEBUG;
my $scope = $uri->scope();
my $filter = $uri->filter();
my @attrs = [$attr];
my $mesg = $ldap->search(
base => $base,
scope => $scope,
filter => $filter,
attrs => @attrs
);
#print results
my $entry;
while ($entry = $mesg->pop_entry())
{
if ($attr)
{
my $values = $entry->get_value($attr, asref => 1);
foreach my $vals (@{$values})
{
print $vals,"\n";
}
}
else
{
print $entry->dn(),"\n";
}
}
}
return 0;
}
=head1 NAME
printMembers.pl
=head1 DESCRIPTION
Prints out the members of a given group, including members of groups that are also members of the given group.
Defaults to printing out members by DN, but you can specify other attributes for display
=head1 USAGE
perl printMembers.pl -n "Accounting Managers"
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
uid=scarter, ou=People, o=airius.com
uid=tmorris, ou=People, o=airius.com
cn=HR Managers,ou=groups,o=airius.com
Members of group: cn=HR Managers,ou=groups,o=airius.com
uid=kvaughan, ou=People, o=airius.com
uid=cschmith, ou=People, o=airius.com
cn=PD Managers,ou=groups,o=airius.com
Members of group: cn=PD Managers,ou=groups,o=airius.com
uid=kwinters, ou=People, o=airius.com
uid=trigden, ou=People, o=airius.com
Here's an example of the same group but instead print the cn attribute
of each entry:
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
Sam Carter
Ted Morris
HR Managers
Members of group: cn=HR Managers,ou=groups,o=airius.com
Kirsten Vaughan
Chris Schmith
PD Managers
Members of group: cn=PD Managers,ou=groups,o=airius.com
Kelly Winters
Torrey Rigden
And same group but with the mail attribute:
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
scarter@airius.com
tmorris@airius.com
Members of group: cn=HR Managers,ou=groups,o=airius.com
kvaughan@airius.com
cschmith@airius.com
Members of group: cn=PD Managers,ou=groups,o=airius.com
kwinters@airius.com
trigden@airius.com
=cut
Jump to Line
Something went wrong with that request. Please try again.