Question : Active Directory Vs. LDAP

I have been learning how to programmatically read Active Directory and write it out and add filters and other assorted criteria and objects.  Ok,  not too obvious, but I can now iterate through a large population pulling a useful row of information per individual. Great stuff.

So,  now I want to iterate through an LDAP server and do similar.  The problem is all the snippets of code I seem to find mention LDAP and then start using AD.  I would really appreciate a snippet or two that I can use to build off of to query LDAP.

Also,  a site with some tutorials explaining how these queries/filters are built as they relate to a particular directory structure (LDAP and AD) would be infinitely useful.

Thanks in advance,
Howard

Answer : Active Directory Vs. LDAP


It depends which you mean.

If you're treating it as a pure LDAP directory there's little difference between AD as an LDAP directory and, for example, an OpenLDAP directory, at least in terms of talking to the directory and returning data for known attributes from it.

However, having "known attributes" is the key: Many of the attributes defined in an LDAP schema are likely to differ across different directory implementations. A few standard (RFC defined) attributes do exist, but they're pretty basic; there's no need for someone else to follow the schema MS have defined for AD.

Functions written for AD itself are may fail because they are likely to depend on both LDAP and the underlying schema. An example of that would be retrieving group membership for a user. In AD that will always be the member / memberOf pair, but no rule enforces that outside of MS AD, it could be anything.

Ultimately it's extremely difficult to write any kind of code for a system you know nothing about. AD has the advantage that it's very well documented (in part because of MS, and in part because of the enormous community surrounding it).

Most of the systems you see that integrate with multiple directories present the end-user with options to define the names of common attributes. Including the attribute that defines a username (sAMAccountName, uid, etc), group membership, etc, etc.

Chris
Random Solutions  
 
programming4us programming4us