Skip to content

Instantly share code, notes, and snippets.

@mortymacs

mortymacs/openldap-get-changed-users.md

Created November 11, 2017 12:28
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mortymacs/376e559e5f8dad6020579f6926ac1ff3 to your computer and use it in GitHub Desktop.
Save mortymacs/376e559e5f8dad6020579f6926ac1ff3 to your computer and use it in GitHub Desktop.
Download ZIP
How to get OpenLdap user changed attributes instead of all user attributes
Raw
openldap-get-changed-users.md

To handle this issue, you need to get openldap internal fields by adding a + sign at the end of search query like so:

    $ ldapsearch -h localhost -w 'admin' -x -D "cn=admin,dc=example,dc=org" -b "DC=example,DC=org" +

And in python code it would like this:

    r = l.search_ext("dc=example,dc=org", ldap.SCOPE_SUBTREE, "objectClass=*", ["+",], 0)

Then it returns internal fields which are important like modifyTimestamp.

Or if you want to get all internal fields and user attributes in one request, just add '*' '+' like this:

     r = l.search_ext("dc=example,dc=org", ldap.SCOPE_SUBTREE, "objectClass=*", ["*", "+"], 0)

If you want to get last changed user after a specific date, try to add modifyTimestamp on query like this:

    ldapsearch -h localhost -w 'admin' -x -D "cn=admin,dc=example,dc=org" -b "DC=example,DC=org" "modifyTimestamp>=20171012152507Z

To get more info about history, try to enable overlay accesslog in your ldap and use it:

    $ ldapsearch -x -b cn=accesslog

Resources:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment