AMS7 & Active Directory

[Derek]

Is this possible?
Anybody got any ideas on how I can retrieve information from AD based on user logon? [Name, email etc]

[longedge]

I use a batch file to display a personalised welcome message in my network apps. It uses the dos 'net user' command the output of which I pipe to a text file and then parse to get the "Full Name".

You don't get email address details so it might not be what you want.

I have also used-

lan = System.GetLANInfo();
user=lan.User

just to get the network username but this isn't really meaningful on our network as payroll numbers are used to logon to the network.

Hope someone comes up with something more useful.

[mwreyf1]

I have noticed from time to time some people have asked, as in the thread how to do Active Directory queries (LDAP) lookups.

I had the same issue and here is what I have come up with using LDAP and the AMSWscript plugin (thanks for the GREAT plugin).

Maybe someone else will get some use out of it.

sUsr = "Joe Blow"

code = [[
	sDomainDNSW2Kx = "DomainNameGoesHere.net"
	Dim sPath, sUsr, title, phone, allInfo
	ssAMAccountName = "]]..sUsr..[["
	Set oShell = CreateObject( "WScript.Shell" )
	Set oConnection = CreateObject("ADODB.Connection")
	Set oCommand = CreateObject("ADODB.Command")
	oConnection.Provider = "ADsDSOObject"
	oConnection.Open "ADs Provider"
	Set oCommand.ActiveConnection = oConnection
	sQuery = "SELECT DistinguishedName FROM 'LDAP://" & sDomainDNSW2Kx & "' WHERE displayName = '" & ssAMAccountName & "'"
	oCommand.CommandText = sQuery
	Set oResults = oCommand.Execute
	sObjDN = oResults.Fields("DistinguishedName")
	sObjDN = "LDAP://" & sObjDN
	Set objUser = GetObject(sObjDN) 
	
	title = (objUser.title)
	phone = (objUser.telephoneNumber)
	
	strInfo = title &"|"& phone
]]

Script.AddCode(code, Script_InternalCode);
result = Script.GetResultAsString("strInfo");

Dialog.Message("Notice", result, MB_OK, MB_ICONINFORMATION, MB_DEFBUTTON1);

In the above example, the title and phone number are being queried.

Just add and remove to get whatever it is you are going after.

[mwreyf1]

Thought I would also include a function to get a list of ALL users assigned to an AD group.

This one uses luacom and LDAP lookup.

grpName = "GROUP-NAME-GOES-HERE"

objGroup = luacom.GetObject("LDAP://cn="..grpName..",ou=OU-NAME-GOES-HERE,dc=DOMAIN-NAME-GOES-HERE,dc=COM")
for e, strUser in objGroup:Member() do
	result = String.Left(String.Mid(strUser, 4, -1), String.Find(String.Mid(strUser, 4, -1),",",1,false) - 1);
	ListBox.AddItem("ListBox1", result);
end

[mwreyf1]

Ok here is the last one...unless someone needs something having to do with LDAP lookups.

This will get ALL GROUPS A USER IS A MEMBER OF.

This one also uses AMSWscript and LDAP (ADO) for doing the query.

sUsr = "Joe Blow"

code = [[
	Option Explicit 
	Const E_ADS_PROPERTY_NOT_FOUND = &h8000500D
	
	Dim adoCommand, adoConnection, strBase, strFilter, strAttributes 
	Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strNTName, varName
	Dim objUser, strDN, arrMemberOf, Group
	Dim oFilesys, oFiletxt, sPath, sFilename
	Dim result
	
	varName = "]]..sUsr..[["
	
	strNTName = varName
	
	Set adoCommand = CreateObject("ADODB.Command") 
	Set adoConnection = CreateObject("ADODB.Connection") 
	adoConnection.Provider = "ADsDSOObject" 
	adoConnection.Open "Active Directory Provider" 
	adoCommand.ActiveConnection = adoConnection 
	
	Set objRootDSE = GetObject("LDAP://RootDSE") 
	
	strDNSDomain = objRootDSE.Get("defaultNamingContext") 
	strBase = "<LDAP://" & strDNSDomain & ">" 
	
	strFilter = "(&(objectCategory=person)(objectClass=user)" & "(displayName=" & strNTName & "))" 
	
	strAttributes = "distinguishedName" 
	
	strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree" 
	adoCommand.CommandText = strQuery 
	adoCommand.Properties("Page Size") = 100 
	adoCommand.Properties("Timeout") = 30 
	adoCommand.Properties("Cache Results") = False 
	
	Set adoRecordset = adoCommand.Execute 
	
	Do Until adoRecordset.EOF 
		strDN = adoRecordset.Fields("distinguishedName").Value 
		Set objUser = GetObject("LDAP://" & strDN) 
		arrMemberOf = objUser.GetEx("memberOf")
		If Err.Number <> E_ADS_PROPERTY_NOT_FOUND Then
			For Each Group in arrMemberOf
				result = result + Group
			Next
		Else
			WScript.Echo vbTab & "memberOf attribute is not set"
			Err.Clear
		End If
	    adoRecordset.MoveNext 
	Loop 
	
	
	adoRecordset.Close 
	adoConnection.Close

]]

Script.AddCode(code, Script_InternalCode);
stringvalue = Script.GetResultAsString("result");

tblUsrGroups = DelimitedStringToTable(stringvalue, "CN=")
for each, record in tblUsrGroups do
	ListBox.AddItem("ListBox1", record, "");
end

[markstaylor]

How can you use this to authenticate a user in AD to start an application?
Or better yet Radius support.

[mwreyf1]

The way I handle that is to create an AD group and add all the users you want to have access to that app to the group and then check what groups the logged on user is a member of when the app is started.

Or have the user enter a username and then check that.

For multiple apps just repeat the above process.

All the code you need to perform this is already in this thread.

Hope that helps.