blocks|key|377252|text|有几个选项可以显示用户的完整组成员资格，包括所有嵌套组。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|377253|最简单的方法是查询用户对象的TokenGroups属性。这是一个构造的属性，它将返回当用户身份验证时将添加到用户访问令牌的组中的所有SID。构造属性的唯一条件是，搜索范围必须是返回属性的基本作用域。|377254|LDAP_MATCHING_RULE_IN_CHAIN+(1.2.840.113556.1.4.1941)匹配规则的功能受到限制，它只返回用户的DN已添加到组的成员属性的组，因此一些嵌套组将不包含在查询中。|377255|另一种选择是使用第三方工具通过横向组成员返回嵌套组，以查看组成员资格。例如，NetTools用户的成员资格选项https://nettools.net/users-membership和NetTools+AD+Properties对话框，其中包括TokenGroups选项卡，该选项卡将显示小岛屿发展中国家解析的TokenGroups属性。|offset|length|377256|entityMap|0|LINK|mutability|MUTABLE|url|https://nettools.net/users-membership^0|0|0|0|1J|11|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@$H|V|I|W|1|X]]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

There are a couple of options to display the complete group membership of a user, including all nested groups.
The simplest method is to query the TokenGroups attribute of the user object. This is a constructed attribute, that will return all the SIDs of the groups that will be added to the user's access token when the user authenticates. The only condition for the constructed attribute, the search scope must be Base scope for the attribute to be returned.
The LDAP_MATCHING_RULE_IN_CHAIN (1.2.840.113556.1.4.1941) matching rule is limited in its functionality, it will only return the groups that the user's DN has been added to the member attribute of the group, so some nested groups will not be included in the query.
The other option is to use a 3rd party tool to return the nested groups by transverse the groups membership to see the group membership. Such as NetTools User's membership option <a href="https://nettools.net/users-membership" rel="nofollow noreferrer">https://nettools.net/users-membership</a> and the NetTools AD Properties dialog which includes the TokenGroups tab which will display the TokenGroups attribute with the SIDs resolved.

blocks|key|747124|text|您可以通过sAMAccountName搜索用户并请求msds-memberOfTransitive属性，该属性包含用户所属组的可分辨名称的递归列表。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|747125|还有msds-tokenGroupNames属性，它包含小岛屿发展中国家出现在tokenGroups属性中的所有组的可分辨名称。|747126|区别在于tokenGroups只包括安全组，而memberOf也包括通讯组。只能使用安全组来分配权限。|747127|这两个属性都是构造的属性，因此必须将其具体地放在属性列表中才能在搜索中返回。|747128|entityMap|0|LINK|mutability|MUTABLE|url|https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/c5c7d019-8d88-4bfa-b84d-4413bbf189b5|1|https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1d810083-9741-4b0a-999b-30d9f2bc1f95^0|5|E|Q|N|Q|N|0|0|2|K|13|B|2|K|1|0|4|B|N|8|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@$9|W|A|X|B|C]|$9|Y|A|Z|B|C]]|D|@$9|10|A|11|1|12]]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]|$9|16|A|17|B|C]]|D|@$9|18|A|19|1|1A]]|E|$]]|$1|H|3|I|5|6|7|1B|8|@$9|1C|A|1D|B|C]|$9|1E|A|1F|B|C]]|D|@]|E|$]]|$1|J|3|K|5|6|7|1G|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|1H|8|@]|D|@]|E|$]]]|M|$N|$5|O|P|Q|E|$R|S]]|T|$5|O|P|Q|E|$R|U]]]]

You can search for the user by the <code>sAMAccountName</code> and ask for the <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/c5c7d019-8d88-4bfa-b84d-4413bbf189b5" rel="nofollow noreferrer"><code>msds-memberOfTransitive</code></a> attribute, which contains a recursive list of the distinguished names of the groups the user is a member of.
There is also the <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1d810083-9741-4b0a-999b-30d9f2bc1f95" rel="nofollow noreferrer"><code>msds-tokenGroupNames</code></a> attribute, which contains the distinguished names of all the groups whose SIDs appear in the <code>tokenGroups</code> attribute.
The difference is that <code>tokenGroups</code> only includes security groups, whereas <code>memberOf</code> includes distribution lists as well. Only security groups can be used to assign permissions.
Both are constructed attributes, so you have to specifically put it in the list of attributes to return in the search.

blocks|key|760589|text|对不起，无法添加注释|type|unstyled|depth|inlineStyleRanges|entityRanges|data|760590|要小心msd成员传递属性，它有一些奇怪的逻辑，它不遵循正常的值范围规则，并且可能返回不完整的结果，请参阅https://blog.joeware.net/2021/04/19/6068/。|offset|length|760591|entityMap|0|LINK|mutability|MUTABLE|url|https://blog.joeware.net/2021/04/19/6068/^0|0|1G|15|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

Sorry unable to add comments
Be careful of the msds-memberoftransitive attribute, it has some funky logic which doesn't follow the normal value ranging rules and can return incomplete results, see <a href="https://blog.joeware.net/2021/04/19/6068/" rel="nofollow noreferrer">https://blog.joeware.net/2021/04/19/6068/</a>

I'm trying to make a query that outputs all the groups (and nested groups) that a user is part off, queried for by sAMAccountName value.
For example, the following query works and gives the expected output but uses the displayname instead.
<pre><code>(&amp;(objectCategory=group)(member:1.2.840.113556.1.4.1941:=cn=Tester,ou=people,dc=Windomain,dc=local))
</code></pre>
Simply changing &quot;cn&quot; to &quot;sAMAccountName&quot; doesn't work (<a href="https://i.stack.imgur.com/hVlwJ.png" rel="nofollow noreferrer">I did verify that the sAMAccountName value is correct</a>)
Is it possible to do this with LDAP queries?

AD Ldap query for user nested groups by sAMAccountName

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在尝试进行一个查询，该查询输出用户被分离的所有组(和嵌套组)，并通过sAMAccountName值进行查询。例如，下面的查询工作并给出了预期的输出，但是使用了displayname。(&(objectCategory=group)(member:1.2.840.113556.1.4.1941:=cn=Tester,...

问用sAMAccountName对用户嵌套组进行AD查询
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问用sAMAccountName对用户嵌套组进行AD查询EN