Re: Add Windows User to ADAM Role using LDIFDE.exe

Note you can use admod to do this right at the command line without the encoding.

admod -h server:port -b group_dn "member:+:<SID=Blah>"


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Jeremy Wiebe wrote:
Hi Lee,

Thanks for the response. I missed the part that you have to encode the
"<SID=XYZ>". I gave that a quick try and that works!

As to the existing foreignSecurityPrincipal collision, I don't think
that should ever be an issue because I'm always importing into a brand
new application partition.

Thanks for the help!

Jeremy Wiebe

On Jan 19, 3:20 pm, "Lee Flight" <l...@xxxxxxxxxxxxxxx> wrote:
Hi

unfortunately <SID=....> syntax only works with base64 encoding
the #member line in Dmitri's post indicates a comment. More here:

http://groups.google.com/group/microsoft.public.windows.server.active...

Note that if you having been testing this by against your ADAM instance and
already imported the Windows user the foreignSecurityPrincipal will have
already been
created in your ADAM instance and that will cause a violation when you try
the ldf
import even using the correct encoding. For a clean test delete any matching
FSP, the ldf import will create it for you as you say.

Lee Flight

"Jeremy Wiebe" <jeremy.wi...@xxxxxxxxx> wrote in messagenews:1169228507.640926.157200@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

I'm trying to add a Windows user to an ADAM role by creating an LDIF
file and importing it into ADAM using ldifde.exe. I found this post
which seems to be exactly what I need, but I can't get it to work
(http://groups.google.ca/group/microsoft.public.windows.server.active_...).
Here's my LDIF file:
dn: CN=Readers,CN=Roles,CN=MyApp,DC=MyCompany,DC=COM
changetype: modify
add: member
# member: <SID=S-1-5-21-1644491937-113007714-1957994488-1007>
-
I got the SID by manually adding a windows user to a role using
ADAM-AdsiEdit and then exporting that role using ldifde.exe
The error I'm getting is:
===
There is a syntax error in the input file
Failed on line 5. The last token starts with 'm'.
An error has occurred in the program
===
In the post I mentioned above Dmitri's (last poster) LDIF specifies the
SID using both the <SID=XYZ> and base64 encoded method. Is that
required? (If it is, I couldn't get that working either).
So, am I missing something obvious here or does LDIFDE.exe actually not
support this?
Also, I'm under the impression that LDIFDE.exe (or probably ADAM) will
automatically create a ForeignSecurityPrincipal for me, if needed, when
I add the user to the role.

.

Relevant Pages

  • Re: Tk 8.4.11 / Windows XP / Encoding problem
    ... Some of our clients are experiencing a weird problem on their Windows XP PCs. ... suddenly they start showing other characters instead of the correct utf-8 ... I also checked to see if the encoding in our ...
    (comp.lang.tcl)
  • Re: Tk 8.4.11 / Windows XP / Encoding problem
    ... Some of our clients are experiencing a weird problem on their Windows XP PCs. ... I also checked to see if the encoding in our ... but it reported "utf-8" as it should. ... Tcl usually does proper detection of the system encoding. ...
    (comp.lang.tcl)
  • Re: length of char in bits differs on Win/Linux and Mac
    ... You were just lucky on Windows with your algorithm, and you used the wrong encoding for reading on the Mac. ... because Java uses Unicode for all characters. ...
    (comp.lang.java.programmer)
  • Re: IE 6 sp2 - encoding problem
    ... Encoding setting Unicode that I normally use to the Western ... I have Windows XP Pro. ... it just hangs....I go up and manually select Western European ... Resolving problems with the IE toolbars being out of sync ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: IE 6 sp2 - encoding problem
    ... Encoding setting Unicode that I normally use to the Western ... I have Windows XP Pro. ... European and I manually put it on Western European ... Resolving problems with the IE toolbars being out of sync ...
    (microsoft.public.windows.inetexplorer.ie6.browser)