Oops sorry, accidently took everyone else off if anyone else was interested.
-- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm -----Original Message----- From: joe [mailto:[EMAIL PROTECTED] Sent: Saturday, October 21, 2006 8:12 PM To: 'Michael B Allen' Subject: RE: [ActiveDir] List Attribute Syntaxes? I haven't tested SBS specifically but would be entirely shocked if you didn't have an aggregate object in your schema... I can't see any point for MSFT to yank that out just for SBS. The DN for the object would be CN=Aggregate,CN=Schema,CN=Configuration,<Root Domain DN>. It has existed in AD since it was released. You can pull it with AdFind in any environment with a generic command adfind -schema -rb cn=aggregate -s base extendedAttributeInfo Or even just query for it adfind -schema -f name=aggregate extendedAttributeInfo I still am not completely sure why you think you need that definition, you can query the entire schema and its settings really easily, I do this with several of my tools now to make decisions on how to display/handle things. I recommend hard coding as little as possible or else you will always be playing catch-up. Get as much from reading the schema as you can and then have overrides in place. So for instance you read the schema and find out that description is multivalued, then you have some config capability that allows the user to indicate that for classes x, y, z description is NOT multivalued and supply any special cases you have encountered. I would make it generic so you can override any of the schema object properties for classes or attributes. joe -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm -----Original Message----- From: Michael B Allen [mailto:[EMAIL PROTECTED] Sent: Saturday, October 21, 2006 6:31 PM To: ActiveDir@mail.activedir.org Cc: [EMAIL PROTECTED] Subject: Re: [ActiveDir] List Attribute Syntaxes? Apparently I don't have CN=Aggregate,CN=Schema,DC=X. I'm using W2K 2003 but maybe it's because it's SBS? I think it's clear that this is a problem that requires work on several fronts. These are: 1) Build a local table of attributes. The table would not be read from the schema on startup but be directly included in the code. This will handle 90% of attributes seen in scripts and tools. Anything not defined is just assumed to be multi-valued and uninterpreted (e.g. not converted to string). As for attribute definitions that may have additional constraints not represented in the schema, I suppose I can either compensate for specific cases within the code or allow the programmer to utilize method 3) below. 2) Allow new attribute definitions to be registered at runtime either by providing an LDIF path on startup, calling a registration function, etc. This should, in theory, handle the remaining cases. 3) As a convenience (and as a way to compensate for things like the issue you mentioned), the programmer may supply one of several predefined "attribute modifiers" to assist with or override attribute typing. For example, a script using my script binding might look like: $attrs = array("single-value(description)", "guid(someGUIDAttribute)"); $acct = account_get(NULL, "[EMAIL PROTECTED]", $attrs); echo "description: " . $acct['description'] . "\n"; $someGUIDAttribute = guid_from_binary($acct['someGUIDAttribute']); echo "someGUIDAttribute: " . guid_tostr($someGUIDAttribute) . "\n"; Thanks for the pointers. I'll check them out. Mike On Sat, 21 Oct 2006 12:59:56 -0400 "joe" <[EMAIL PROTECTED]> wrote: > Are you maybe looking for the extendedAttributeInfo of the Aggregate object > from the schema? That is the closest thing to that format in AD that I am > aware of. > > AD's schema is entirely within the LDAP directory and is readable directly > with LDAP, there is no need to go to extra files etc. The downside is that > the schema doesn't tell the whole story unfortunately. For instance, the > description attribute is multivalued, but on certain SAM type objects the > SAM enforces that attribute to be single valued. Try it, add values to > description on say an OU and then on a user. One allows it, one throws an > error. Another issue is there there is no easy way to determine what > attributes are say GUIDS. I have come up with a mechanism in AdFind to do > that programmatically but that is far from 100%, I sometimes treat things as > GUIDs that aren't. But it is far better than having to maintain a list in my > eyes which I initially did, then I started getting quite a few emails from > folks who wanted me to add their custom GUID attributes to the decoding. > There are other items such as rangeupper saying one thing in the schema and > being something else due to SAM, etc. > > > The attributeSyntaxes combined with the oMSyntax is what you want to mostly > look at for handling attributes. See > > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/ad > schema/syntaxes.asp > > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/choos > ing_a_syntax.asp > > > And actually overall reading everything under the following link will > probably be helpful > > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/ad > schema/active_directory_schema.asp > > > There isn't a lot of programmer talk on this list but the list has some > extremely high powered programming resources available here both from inside > and outside of Microsoft and in "native" and NET topics. There are also > quite a few non-programmer resources (or maybe they programmed in the past > but don't any longer) that can lend great insight into the products overall > and their experiences with folks who do write code and where they may want > to reconsider. > > > My overall posting recommendation would be to try and keep questions focused > to very tight specific scopes, the bigger the scope andm question, the more > likely people are not going to respond because they either don't want to > tackle something so large in scope or their response needs to be so big it > isn't worth their time or maybe something is so big they just don't have > time to read it. It could be that there is concern that if a problem can't > be summed up in a short space, the poster may not actually have an > understanding of the problem and is fishing and hope someone reads through > all of the chafe to come out with the actual problem. That does happen and > the answers do come out, but I think the number of respondents and sometimes > the quality can be impacted. > > > I know when I walk through the newsgroups and this list looking for posts to > respond to, if someone has more than one or two small paragraphs unless they > completely hook me with the subject or the first paragraph I won't read it > and just move on to something else. Subject is #1 thing I look at and that > tells me which messages to even open, then it is "how long is it". I usually > do newsgroups and listservs in short bursts of time between other things, so > anything that can be read, understood, and responded to quickly is what I > tend to go after. My responses are often long but that is simply because I > type rather quickly. If I was slower at it, I would respond a lot less. > There are others that even though they can type fast, if they can't answer > the question in a sentence or two they don't want to respond at all unless > something else sucked them into the problem like some kind of issue they > haven't ever seen before or a "pet" problem (aka something that they have > worked on and are still gathering info). :) > > > joe > > -- > O'Reilly Active Directory Third Edition - > http://www.joeware.net/win/ad3e.htm > > > -----Original Message----- > From: Michael B Allen [mailto:[EMAIL PROTECTED] > Sent: Saturday, October 21, 2006 2:39 AM > To: ActiveDir@mail.activedir.org > Cc: [EMAIL PROTECTED] > Subject: Re: [ActiveDir] List Attribute Syntaxes? > > Hi Joe, > > Actually I think my terminology is a little off. From snooping around > a bit I think I want the attributeSchema information under > CN=Schema,CN=Configuration,DC=example,DC=com. What I was thinking of > originally are the "attribute syntax" definitions like: > > ( 2.5.18.3 NAME 'creatorsName' EQUALITY distinguishedNameMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 > SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) > > But it's clear now that AD doesn't really use these textual definitions > (at least not anywhere I can see). > > Anyway, the overall objective here is to do is to give my custom LDAP > client API intellegence (see previous post about scripting language > binding) about attributeSchema information so that the API can properly > type attribute values. In particular I need to create a table of at least > lDAPDisplayName, isSingleValued, and attributeSyntax. This table > will be consulted by the API to determine how to compare and present > values whether they be binary, multivalued, strings, etc. > > To make it efficient I will need an index which will be just a hashmap > where the lDAPDisplayName is the key and the attributeSchema entry > is the datum. Additionally the attributeSyntax value should be one > of several predefined OID constants (e.g. ADSTYPE_CASE_IGNORE_STRING) > so that attributeSyntaxes can be comared logically. > > Does any of this make sense? I suppose you don't get a little programmer > double talk here :-) > > Mike > > On Fri, 20 Oct 2006 23:50:03 -0400 > "joe" <[EMAIL PROTECTED]> wrote: > > > First off... anything you do with LDIF will be an LDAP query... It speaks > > pure LDAP. > > > > Next off, if I understand what you are asking, yes, you query the schema > and > > you can find all attribute syntaxes assigned, it won't tell you what they > > are, but you will know all in use. Multivalue status has nothing to do > with > > attribute syntax, that is separate. Whether something is binary or text > > depends on what you ask for and how you ask for it. You can ask for > anything > > to come back in a binary format with the standard LDAP binary modifier. > What > > that exactly means though depends on the attribute, asking, for instance > for > > a unicode text field in binary really isn't going to look all that > different > > to you either way. But asking for say one of the replication attributes > will > > result in dramatically different results being returned. > > > > > > joe > > > > > > -- > > O'Reilly Active Directory Third Edition - > > http://www.joeware.net/win/ad3e.htm > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Michael B Allen > > Sent: Friday, October 20, 2006 8:49 PM > > To: ActiveDir@mail.activedir.org > > Subject: [ActiveDir] List Attribute Syntaxes? > > > > How can I get a list of attribute syntaxes? For each attribute used by > > a system I would like to know if it is a multivalue attribute and if it > > is binary or text. > > > > Can I get such a list using an LDAP query? > > > > If not can I use ldifde? > > > > Thanks, > > Mike > > > > -- > > Michael B Allen > > PHP Active Directory SSO > > http://www.ioplex.com/ > > List info : http://www.activedir.org/List.aspx > > List FAQ : http://www.activedir.org/ListFAQ.aspx > > List archive: http://www.mail-archive.com/activedir@mail.activedir.org/ > > > > List info : http://www.activedir.org/List.aspx > > List FAQ : http://www.activedir.org/ListFAQ.aspx > > List archive: http://www.mail-archive.com/activedir@mail.activedir.org/ > > > > > -- > Michael B Allen > PHP Active Directory SSO > http://www.ioplex.com/ > > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: http://www.mail-archive.com/activedir@mail.activedir.org/ > -- Michael B Allen PHP Active Directory SSO http://www.ioplex.com/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir@mail.activedir.org/
