LINQ to Active Directory

New Post: anr (ambiguous name resolution) query or other special queries

dotjoe — Fri, 21 Dec 2012 15:13:36 GMT

Are anr queries supported? What about the matching rule OIDs for bitwise comparisons? For example, I can include only Active users with this (!(userAccountControl:1.2.840.113556.1.4.803:=2)) or only security groups with (groupType:1.2.840.113556.1.4.803:=2147483648) (more examples). Are there other ways to perform these kind of filters?

Source code checked in, #81799

Project Collection Service Accounts — Mon, 01 Oct 2012 21:57:23 GMT

Upgrade: New Version of LabDefaultTemplate.xaml. To upgrade your build definitions, please visit the following link: http://go.microsoft.com/fwlink/?LinkId=254563

Source code checked in, #81798

Project Collection Service Accounts — Mon, 01 Oct 2012 21:51:05 GMT

Checked in by server upgrade

Commented Issue: Trying to get all users in a group is limited to 1500 records [6172]

jay_burling — Mon, 30 Apr 2012 14:41:38 GMT

When I do a query to get all users in a group like the one below (where "MyGroups" is AD Groups):
var res = from i in ctx.MyGroups
where i.Name == GroupName
select i.Members;
The results are limited to 1500 records. I believe there is some way to get around this limitation of the Directory Searcher using the "range":

DirectorySearcher groupMember = new DirectorySearcher
(group,"(objectClass=*)",new string[]{"member;Range=0-500"},SearchScope.Base);
(http://bcheul.tistory.com/archive/200811)

It would be nice if your LINQ provider knew when it had hit 1500, then did another query for the next 1500 and so on until it had all users, then merged the results into the one list. At the moment I am going to have to try and do this manually.
Comments: ** Comment from web user: jay_burling **

This has to do with the paging of results returned from AD. If you wrap the FindAll() call in DirectoryQuery<T>.GetResults() with a using and set a page size, it will continue until it retrieves all the results. Something like:

using ( var s = new DirectorySearcher( root, q, properties.ToArray(), _source.Scope ) )
{
s.PageSize = 1000;
...
foreach (SearchResult sr in s.FindAll())
...
}

New Post: how to use linq "Take()" statement

madhatter22 — Sat, 25 Feb 2012 14:21:51 GMT

Take isn't supported, but it's pretty easy to add it yourself. All of these changes are made to the DirectorySource class. Just create a nullable class variable that gets set in the Parse method for Take. I've highlighted the changes below:

public void Parse(Expression ex)
{
	var ce = ex as ConstantExpression;
	var mce = ex as MethodCallExpression;

	if (ce != null)
	{
		_source = ce.Value as IDirectorySource;
                originalType = _source.OriginalType;
        }
        else if (mce != null)
        {
                //
                // Should be extension methods on Queryable.
                //
                if (mce.Method.DeclaringType != typeof(Queryable))
                    throw new NotSupportedException("Detected invalid top-level method-call.");

                Parse(mce.Arguments[0]);

                //
                // First parameter to the method call represents the (unary) lambda in LINQ style.
                // E.g. (user => user.Name == "Bart") for a Where  clause
                //      (user => new { user.Name })   for a Select clause
                //
                switch (mce.Method.Name)
                {
                    //
                    // Builds the query LDAP expression.
                    //
                    case "Where":
                        BuildPredicate(((UnaryExpression)mce.Arguments[1]).Operand as LambdaExpression);
                        break;
                    //
                    // Builds the projection and filters the required properties.
                    //
                    case "Select":
                        BuildProjection(((UnaryExpression)mce.Arguments[1]).Operand as LambdaExpression);
                        break;

	            case "Take":

			_takeValue = (int)((ConstantantExpression)mce.Arguments[1]).Value;
		        break;
                    default:
                        throw new NotSupportedException("Unsupported query operator: " + mce.Method.Name);
                }
        }
	else
                throw new NotSupportedException("Invalid expression node detected.");
}

Once that's done you just need to check it and set it when you perform a search:

private IEnumerator<T> GetResults()
{
    DirectorySchemaAttribute[] attr = (DirectorySchemaAttribute[])originalType.GetCustomAttributes(typeof(DirectorySchemaAttribute), false);
    if (attr == null || attr.Length == 0)
        throw new InvalidOperationException("Missing schema mapping attribute.");

    string classQuery = String.Format("(objectClass={0})", attr[0].Schema);

    DirectorySearcher s = Helpers.CloneSearcher(
        _source.Searcher,
        !string.IsNullOrEmpty(query) ? String.Format("(&{0}{1})", classQuery, query) : classQuery,
        properties.ToArray()
    );
    if (_takeValue.HasValue) s.SizeLimit = _takeValue.Value;

    //rest of method to perform search...
}

As for paging the results, LDAP doesn't really support paging the way LINQ expects it to work. Paging is kind of abstracted away and only exposed through a cookie returned from the server. You can read more about it here: http://tools.ietf.org/html/rfc2696.

You can tell the DirectorySearcher to get everything by setting a sufficiently large PageSize, but getting a subset and then going to get more is not possible from what I can tell.

You can filter by group. Just map the memberOf property as a string[] and do something like this:

context.Where(u => u.memberOf.Contains("[distinguished name of group]"))

This will find all users that are a member of that group.

New Post: Get user list but ...

anAgent — Fri, 17 Feb 2012 00:18:36 GMT

Yes. You just need to model your you DirectoryEntity for your ADUser like so:

[DirectorySchema("user", typeof(IADsUser))]
public class ADUser : DirectoryEntity
{
	[DirectoryAttribute("givenName")]
	public string FirstName { get; set; }
	
	[DirectoryAttribute("Mail")]
	public string EmailAddress { get; set; }
	
	[DirectoryAttribute("sn")]
	public string LastName { get; set; }
	
}

New Post: Get groups from OU

anAgent — Fri, 17 Feb 2012 00:16:44 GMT

I think this is basically what' you're looking for.

1) Create the Group class modeling from the example provided in this framework:

2) Create a basic Context class;

    sealed class MyContext : DirectoryContext
    {
        public MyContext(DirectoryEntry searchRoot)
            : base(searchRoot)
        {
        }
        [DirectorySearchOptions(SearchScope.Subtree)]
        public DirectorySource<ADGroup> Groups { get; set; }
    }

3) Query you data. Just sent the OU path to where you want to query.

	
MyContext ctx = new MyContext(new DirectoryEntry("LDAP://OU=Users,OU=TEST,DC=mydc,DC=com")); 

var groups = from x in ctx.Groups
		 where x.Name.StartsWith("Test")
		 select x;

foreach (var g in groups)
{
Console.WriteLine(g.Name);
}

New Post: how to use linq "Take()" statement

touhami — Tue, 14 Feb 2012 13:20:25 GMT

Hello

linq take statement is not supported in this project

any one have idea how to query first 20 (grid pagesize) from linq to ad queury?

and when page index change load next 20 results?

other limitation i cant filter by group (memberOf)

Any one has an idea how to filter by group?

tahnk you very much for your help

New Post: Get user list but ...

Kris_I — Tue, 13 Sep 2011 12:08:12 GMT

Hello,

Is there a way to get all users from AD but with email, firstname, lastname ?

Thanks,

New Post: Get groups from OU

Kris_I — Tue, 13 Sep 2011 11:22:24 GMT

Hello,

Is there a way to get all the Groups (not the users) available in the Organization Unit (OU) "Security Groups" ?

Thanks,

New Post: The project is alive ?

madhatter22 — Fri, 26 Aug 2011 03:29:48 GMT

jkinter,

Here's the extension method I use to clean filter values:

public static string CleanFilterValue(this string value)
{
    var sb = new StringBuilder();
    foreach (var curChar in value)
    {
        switch (curChar)
        {
            case '\\':
                sb.Append("\\5c");
                break;
            case '*':
                sb.Append("\\2a");
                break;
            case '(':
                sb.Append("\\28");
                break;
            case ')':
                sb.Append("\\29");
                break;
            case '\u0000':
                sb.Append("\\00");
                break;
            default:
                sb.Append(curChar);
                break;
        }
    }
    return sb.ToString();
}

You could call this on the value and pass in the result so you won't have to change your apps. It's been a while since I've looked at the LINQ to AD source so I'm not sure where you could add this in there. I hope this helps.

New Post: The project is alive ?

jkinter — Thu, 18 Aug 2011 21:29:22 GMT

bdesmet wrote:

In fact a brand new version of LINQ to AD will appear fairly soon. I've been busy doing quite an extensive rewrite of the query translator as part of my day-to-day job. Check out http://blogs.bartdesmet.net/bart for some hints as to what I'm up to nowadays. While I can't give a firm timeframe just yet, I'd encourage you to keep an eye on the website.

Cheers,
-Bart

Hi Bart,

We're using this project in several of our internal solutions and I've recently come up against the "special characters" issue and was wondering how soon is "fairly soon"? This post was quite some time ago and I'd really rather not have to assume the technical debt of pulling out your solution and replacing it with the LinqToLDAP solution. Please advise.

Thanks.

New Post: Mapping to System.DirectoryServices instead of ActiveDs

tgreaves — Fri, 01 Jul 2011 14:43:07 GMT

The description says that it supports both but how do you map to one instead of the other? The reason I ask is because my project that is going to use this is compiled for "Any cpu" and when running on x64, I get the usual COM exception.. Compiling under x86 makes it work correctly but I dont want to do that..

New Post: DateTime issues with 4.0 Framework

azeltroth — Wed, 29 Jun 2011 22:25:44 GMT

Just wondering if anyone has tried to upgrade this project and use it with the 4.0 framework?

I am using this project to wrap my AD, and calling it using a WCF service. It works beautifully in the 4.0 framework, except it seems to have issues bringing back values that are DateTime data types. All other data types seem to work without issues.

My code is simple:

    Dim ROOT As New System.DirectoryServices.DirectoryEntry("LDAP://xxxxx", "xxxxx", "xxxxx")
    Dim users As New DirectorySource(Of ADLinq.User)(ROOT, SearchScope.Subtree)
    Dim res = From usr In users Where usr.Name.StartsWith(searchcriteria)
    Dim dt As DataTable = HelperFunctions.GetBlankTable(GetType(ADLinq.User))
    Dim dr As DataRow
    For Each u In res
       dr = dt.NewRow()
       HelperFunctions.AddRow(dr, u)
       dt.Rows.Add(dr)
    Next
    Dim ds As New DataSet()
    ds.Tables.Add(dt)
    Return ds

The issue occurs in the class DirectorySource.cs, in the function AssignResultProperty. For a data type of DateTime (In my case PasswordLastChanged) when it attempts to get the PropertyInfo from the helper object, the variable 'p' is null, and it crashes on a nullreferenceexception.

The line it crashes on is line 496 of DirectorySource.cs. p is null so there for it crashes.

All other datatypes, it works perfectly, except for DateTime.

Interestingly enough, when I create an Identical service using the 3.5 framework, these issues do not seem to occur. Which tends to lean me towards one of the two references that have changed being the culprit. System.DirectoryServices, or System.Data, however I am not sure.

Was just wondering if anyone has also discovered this issue, or am I totally alone on this one? And if you have figured it out, how did you do so?

Thanks in Advance,

Jason Schatz

New Post: The project is alive ?

madhatter22 — Sat, 14 May 2011 16:44:02 GMT

Jetski5822,

You're welcome to use http://linqtoldap.codeplex.com/. However, I use System.DirectoryServices.Protocols to get broader LDAP server support so if you're use to just System.DirectoryServices there's a slight learning curve (if you want to dig into the internals). If LINQ to AD gets updated I'll delete this post, but right now like this project looks dead.

New Post: The project is alive ?

Jetski5822 — Thu, 24 Feb 2011 21:24:18 GMT

Im going to implement it in http://orchardopenauth.codeplex.com/ Could you tell us when your going to release a new version?

Reviewed: LINQ to Active Directory RTW (Jan 25, 2011)

omarqa — Tue, 25 Jan 2011 11:40:08 GMT

Rated 4 Stars (out of 5) - wonderful work! needed better documentation.

New Post: The project is alive ?

MadHatter22 — Mon, 10 Jan 2011 05:32:27 GMT

Any news, Bart?

Commented Issue: Really Big Problem: Doesn't Filter Distinguished Name properly. Doesn't Handle Escape Characters Correctly Upon WHERE Comparison [3693]

mingsai — Thu, 23 Dec 2010 18:21:42 GMT

Tell me I am not the only one to run into this...

The Distinguished Name of an object in the Active Directoy requires that certain characters are escaped. Please refer to http://www.rlmueller.net/CharactersEscaped.htm.

I have an Active Directory group named "MyActiveDirectoryGroupName" which contains objects that have the following Distinguished Name's:

"CN=John Doe,OU=Location A,OU=Company Objects,DC=mycompany,DC=com"
"CN=Jane Doe,OU=Location A,OU=Company Objects,DC=mycompany,DC=com"
"CN=Krugar, Freddy,OU=Location A,OU=Company Objects,DC=mycompany,DC=com"

Notice the , in the "CN=". As far as Active Directory is concerned this translates to:
"CN=Krugar\, Freddy,OU=Location A,OU=Company Objects,DC=mycompany,DC=com" because the , has to be escaped using a \ in front of it.

But guess what...when I run the following query:

------------------------------------
DirectoryEntry ROOT = new DirectoryEntry(ConfigurationSettings.AppSettings["ActiveDirectory"]);
MyCompanyName.LINQ.ActiveDirectory.ADsContext ctx = new MyCompanyName.LINQ.ActiveDirectory.ADsContext(ROOT);

var results = from item in ctx.Groups
where item.Name == "MyActiveDirectoryGroupName" // Note: Name is the [DirectoryAttribute("name")] for the Group object.
select item;

foreach (var item in results)
{
rptrGroupMember.DataSource = item.Members;
rptrGroupMember.DataBind();
}
---------------------------------
Above Members is a string[] array of the Distinguished Name's of the members in the group I just query'd. LOL! Yay this is what I want....oh but wait...

Now I need to take the value in the Members[x] (which is the string Distinguished Name) and go lookup the User information since the Distinguished Name is the unique value I should be using to lookup a user fromt he Active Directory right, or any other object for that matter? ....ok lets do that...

So I created the following additional query:

------------------------------------
public string GetGroupMemberSAMAccountName(object data)
{
DirectoryEntry ROOT = new DirectoryEntry(ConfigurationSettings.AppSettings["ActiveDirectory"]);
MyCompanyName.LINQ.ActiveDirectory.ADsContext ctx = new MyCompanyName.LINQ.ActiveDirectory.ADsContext(ROOT);

var results = from item in ctx.Users
where item.Dn == Convert.ToString(data) // Note: Dn is the [DirectoryAttribute("distinguishedName")] for the User object.
select item;

string itemValue= string.Empty;

foreach (var item in results)
{
itemValue= item.SAMAccountName;
}

return itemValue;
}
--------------------------------
Ya this should work! And guess what it does except for one thing which is a deal breaker. The only result(s) I get back is the John Doe and the Jane Doe. What? Why? Well after spending a lot of time trying to pin point it, a pattern started to emerge...crap...the Distinguished Name's that have Last Name first and First Name last doesn't match correctly when the LINQ builds the query to use against the LDAP search for the Active Directory. I thought, well maybe I am passing the value wrong to it. If you look at the Convert.ToString(data) value during debugging you see the following:

"CN=Krugar\\, Freddy,OU=Location A,OU=Company Objects,DC=mycompany,DC=com"

Hmmm...wonder what I have to do in order to get this LINQtoAD component to realize that this should match. When I looked further into the debuggin I noticed that the \ gets translated later on int he LINQtoAD project as the 0x5c value which of course is the ANSII value for \. Don't know if that has anything to do with it. Anyone have any ideas or resolutions? I can't seriously be the only one who has run into this. And this is the only LINQtoAD component out there that I am aware of. Couldn't we make it work a little better by having the component realize that matching on Distinguished Name is crutial since Active Directory uses this as the object fully qualified name? It kinda like I want to search on a unique ID of a object but LINQtoAD won't let me. Bummer... Any ideas?
Comments: ** Comment from web user: mingsai **

I believe the search operations work bi-directionally and this may be why you are seeing inconsistent results. See the following for additional information. http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

New Post: The project is alive ?

jerrynixon — Mon, 08 Nov 2010 21:47:40 GMT

Which calendar year is "quite soon" in?